Five hundred years ago, assayers faced a problem every engineering leader knows today: how do you know what something is actually worth? Their answer was a small, unglamorous vessel called a cupel. Place an alloy in it, apply heat, and the base metals burn away — leaving only what's genuinely precious, measurable to the grain. The cupel didn't guess. It didn't estimate. It separated what could be certified from what could not — and the certificate it produced was trusted across every market in Europe.
Cupel does the same thing for your TypeScript.
01 — THE PROBLEM NOBODY WANTS TO SAY OUT LOUD
Nobody fully trusts a rewrite
Your Node application works. It's in production, it's earning revenue, and it embodies years of accumulated business logic. Every migration story ends the same way: the demo looks great, then the subtle differences surface — a rounding edge case, an iteration-order assumption, a null that used to be undefined. The new system is fast, but it isn't your system, and you find that out one production incident at a time.
AI writes code that type-checks perfectly — and is confidently wrong
A second wave is arriving: AI now writes a growing share of your code. It's fluent, it's fast, and the industry's answer so far has been "review it harder." That doesn't scale, and everyone knows it.
Both problems are the same problem: we've been asked to trust code on the basis of testimony — "we tested it," "the model is good," "the team was careful" — when what we need is evidence.
02 — WHAT CUPEL DOES
Your production behavior is the gold standard. Cupel certifies against it.
Cupel is a certification and compilation system for ordinary TypeScript. Not a new language, not a dialect, not a framework with opinions about your architecture. It treats your actual production deployment — the exact bundled JavaScript, on the exact pinned Node runtime — as the definition of correct behavior. Then, region by region, it attempts to promote your code to native Go, and every promotion must survive a machine-checked proof of equivalence: same arithmetic edge cases, same string semantics, same iteration order, same exceptions.
If the proof holds, you get readable, human-shaped Go and a cryptographically signed certificate saying exactly what was proven, against exactly which runtime, with exactly which toolchain fingerprints. If it doesn't hold, nothing breaks — that region stays in the exact Node capsule, your original code running your original way, behind a stable interface. No region is ever forced into an unverified rewrite.
FIG. 1 — THE PIPELINE: GROUND → DECIDE → EMIT
03 — UNDER THE HOOD: THE DEPLOYMENT
Generators are untrusted. Only the proof kernel decides what ships.
Language models are magnificent proposal engines and unreliable narrators. Cupel's architecture assumes exactly that: proposers — human or machine — are untrusted, and the only trusted piece is a small, auditable validator that replays the formal argument. AI writes the code; mathematics signs for it. That is what "AI governance" should have meant all along.
FIG. 2 — THE SYSTEM MAP: SOURCE OF TRUTH → COMPILATION & PROOF → EXECUTION
04 — HONESTY AS A FEATURE
The rules forbid rounding up
Assurance classes are ranked by evidence. Code that is proven equivalent is reported as certified. Code that is tested is reported as tested — never as certified. Code under runtime guards says so. Code still in the capsule says so. Every report is a precise ledger: this much proven, this much tested, this much unchanged — with the signed artifacts to back it.
Verify without our permission
Your auditors can verify certificates independently with the Cupel verifier. No one needs our permission to check our work. That's deliberate. A certificate you can't independently verify is just a press release.
ADMITTED AS-IS: OPTIONAL CHAINING · NULLISH COALESCING · EXCEPTIONS · ASYNC · DESTRUCTURING · ARRAYS & MAPS — EXCLUDED FROM PROMOTION: ONLY class AND any
05 — THE PAYOFF
Come for the performance. Stay for the certificates.
Teams adopt Cupel for the performance and cost story — a predictable-latency native tier, smaller footprints, no JIT warmup, honest benchmarks in place of hand-waving. They stay for something more valuable: a compounding asset of certified code. Every certificate is durable evidence — for your compliance team, your acquirers, your regulators, your customers — that your system does what you say it does.
MIGRATION, REFRAMED
—A leap of faith
—Measured, region by region
—Reversible at every step
—Assayed against production behavior
CUPEL · EARLY ACCESSSPEC v1.3.2 · SEPTEMBER 2026
Trust isn't declared. It's separated out, weighed, and certified.
The assayers had it right — and once certified, it travels. Your code has been asking for the same standard. Now it has one.
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.