Baller Knowledge UK · Koachie
Generated code, verified before it ships. One plain-English sentence becomes a complete feature — database schema, server function, authentication, front end — and every piece is gated by checks that cannot hallucinate, because they are rules rather than a model. The generator is open-source Qwen2.5-Coder-7B; the checks around it are ours.
A real recorded build
This is a genuine run, captured event by event on a single desktop GPU. Nothing here is mocked — the code, the checks and the repair below are exactly what the pipeline produced.
Why it is different
Every AI writes code. The difference is what happens next. Four independent gates stand between the model and you, and each exists because of a failure we measured rather than imagined.
Scores how well the library actually matched before generating. When nothing relevant was found it says so, instead of answering from memory behind invented citations.
Splits the request into separate artifacts and builds them one at a time, so fixing one cannot break another.
Deterministic rules inspect the generated code and block it on violation — password columns, SQL injection, exposed admin keys, tables with no access control. Each rule cites its source.
Some fixes are mechanical, with exactly one correct form. Those are repaired automatically and always reported — never silently.
What it catches
| Problem | Why it matters | Action |
|---|---|---|
| Password column in an app table | Duplicates a secret the auth system already protects properly | block |
| Table without row-level security | Every table is reachable by API — without it, anyone reads everything | repair |
| SQL built by string concatenation | The most exploited web vulnerability there is | block |
| Admin key in browser code | Bypasses every access control at once | block |
| Policy clause inside a table definition | Invalid SQL — the schema will not even run | block |
| Deprecated authentication method | Removed from the current API; fails against a live project | warn |
| Request input used unvalidated | How bad data and injection get in | warn |
What is ours, and what is not
The code above was written by Qwen2.5-Coder-7B, an open-source model released under Apache 2.0, running locally on one desktop graphics card. We did not train it and we do not claim to have.
Qwen2.5-Coder-7B-Instruct, Apache-2.0, ~4.7GB in memory. Swappable: the pipeline holds no opinion about which model writes the code, and a better one can be dropped in tomorrow.
The retrieval and its refusal gate, the decomposition, the security rules, the automatic repair, and the requirement checking. None of it is a model, so none of it can hallucinate.
Model quality is a race between companies spending billions. Nobody wins it from a bedroom. But every model released makes our generator better and leaves our checks exactly as necessary.
Honest limits