A Rust CLI Release Pipeline That Proves "Secrets Don't Leak" in Lean and Turns It Into a CI Gate

Mon, 15 Jun 2026 12:00:00 +0900

Why “Tests Are Green” Wasn’t Enough

I’m building a CLI tool that runs agents without ever handing them a real API key. The property I want to protect is simple: the child process must never receive the real key. If that breaks, there’s no point in using the tool at all.

But passing tests alone didn’t feel like enough assurance. All a test can say is “this input is fine,” not “any input is fine.” When you’re handling keys, that gap isn’t something you can ignore.

Formal-Verification on 万屋猫Labs

A Rust CLI Release Pipeline That Proves "Secrets Don't Leak" in Lean and Turns It Into a CI Gate

Why “Tests Are Green” Wasn’t Enough