How it works

Governed velocity, stage by stage.

Observe, Learn, Yield, Deploy, Iterate: each stage is a real step with a real gate. The deterministic floor always beats the model's verdict, so your fix is trustworthy before it's fast.

Observe, Learn, Yield, Deploy, Iterate. The loop closes with a post-merge rescan.

Observe and Learn

OLYDI maps your routes, packages, owners, and reachability. It learns what's actually exposed and used in your codebase, so your prioritization is grounded in reality, not guessed from a rule list.

Yield

Your findings are exploit-gated and priced by exposure. Reachability plus EPSS and KEV signals plus taint proof decide what surfaces to you. No-Exploit, No-Report.

Deploy and Iterate

Your fix passes the gate set and your CI, opens a PR, and emits signed evidence. After you merge, a rescan confirms closure and the loop returns to Observe.

Precedence

final = min(deterministic_floor, llm_verdict)

The model can never override a deterministic check. If your static analysis, your test suite, or a gate says no, the change doesn't pass — no matter how confident the model is. Governed means the floor binds every fix you get.

  • Deterministic floor is binding
  • Model verdict can only lower, never raise
  • Gates run before review, not after
  • A failed gate blocks the PR

The gate wall

Every change clears the same gates.

Every candidate fix passes ~125 gates (manifest-counted) — 91 security and 35 QA gate families — plus your authoritative CI before we show it to you as ready. A failure shows as a failure, never dressed up as green.

  • 91 security + 35 QA gate families
  • Your authoritative CI must pass
  • Signed, control-mapped evidence
  • Post-merge rescan confirms closure

The wedge

A verified fix beats a suggested one.

Raw-velocity generators and scanner quick-fixes hand you a diff you still have to review, validate, and land yourself. OLYDI ships you a mergeable change that already passed your CI and the gate wall, with signed evidence attached. Governed velocity is the difference.

  • Mergeable, not just plausible
  • CI-validated before review
  • Gate-verified, not gate-skipped
  • Evidence travels with the change