Sloppoke — the AI slop code tool. Pre-commit slop detector for LLM-generated code.

See the Receipts section above for the top incidents (LiteLLM / OpenCode / rsync / Faker.js + the industry signal). One extra entry that fits less neatly into a card:

• C23 / glibc compile-fix wave (early 2026) — LLM "shortest semantic path" patches across legacy C utilities to clear glibc 2.43 errors. Aggressive const-casts + macro masking → modern GCC/Clang optimise unreachable branches → segfaults, silent memory leaks, buffer holes in decade-stable code. (Generic-git scan support inbound: sourceware.org/git/glibc.git and other non-GitHub hosts.)

What sloppoke measures:

• Slop density per repo over time (gate merges on a target).
• Hits blocked × 1 hr 56 min × your eng rate = hours/dollars saved.
• Determinism — same diff → same finding, audit-ready.
• Per-category TP / FP, tracked each catalog release.
• Verdict p95 <10 ms (elapsed_ms in every response).

No. Different tool category. Runtime perf → profilers (perf, flamegraphs) + load tests (k6, wrk, Locust). Correctness → types, tests, formal verification. Density of LLM residue in source is what sloppoke measures — a statistical correlation with the failure modes the FAQ above documents, not a proof of correctness or speed.

Adjacent failure mode it does catch indirectly: "shortest semantic path" compile-fix patches (see the C23 / glibc bullet above) leave the code compiling but push GCC/Clang into UB. The markers fire because the patches drop language-level guarantees, not because we instrument the runtime.

Yes — landing, copy, pixel widgets, all agent-sketched. The catalog is not: deterministic ML + ruleset from 15+ yrs regulated engineering. Vibe the visible layer; stay deterministic where it counts.

Three flavours: wordy nothing (comments restating code, vacant names), defensive theatre (guards for impossible cases, empty catches), unfinished work shipped (placeholders, untested branches, AI trailers in commits). Catalog isn't published and isn't static — every slop learn tunes yours.

PR bots fire after the slop is in git history. slop poke runs on the staged diff before commit. No force-push cleanup. CI still covered: slop poke --range $BASE..$HEAD drops into any pipeline as a one-liner, exits non-zero on SLOP. No GitHub-App scope on your repo.

Reuse what already works. Requests signed by ssh-keygen -Y sign; fingerprint = account. Nothing to provision, no email breach target, no marketing list. Same key in CI: drop in a secret, done.

Unified diff. Nothing else. No origin URL, no SHA, no OAuth token, no clone. Server processes the patch in memory, returns verdict + apply-patch, persists only learning weights. Diff bytes do contain your literal lines — treat sending them like any code-review tool.

Surface detection on every language. Deep analysis lights up first for Rust, TS/JS, Python, Go. More land continuously server-side — no CLI reinstall.

slop learn "false positive on … because …". Quiets next scan for your account + project. We keep the calibration weights, not the raw text.

Yes, Enterprise. Server runs in AMD SEV-SNP confidential VM; we can't read your diffs even with root on the host. Remote attestation proves the running binary matches our published hash; session key sealed to that measurement. EU residency default; Intel TDX / AWS Nitro on request. Trust the math.

Enterprise. Private-corpus calibration, SSO, SLA, audit trail, server image inside your perimeter. engineering@peeramid.xyz.

Today: no. Thin client → catalog match runs server-side. On-prem / TEE available under Enterprise. Patches kept 24 h for the learning loop on our own model fleet (no third-party LLM APIs); only anonymised patterns survive after. EU residency, per- account purge on request.