Beta Three open-source C → Rust migrations underway

From legacy code to verified Rust.

We migrate legacy codebases — C/C++, Python, COBOL — to fast, memory-safe Rust, with automated proof that behavior is preserved.

We show the proof, not the pitch — on a live C repo.

Equivalence run ubase · checksum.c · #2847
C — originalsrc/checksum.c
/* legacy — 2004, no tests, author retired */
uint32_t checksum(const uint8_t *buf, size_t len)
{
    uint32_t sum = 0;
    for (size_t i = 0; i < len; i++)
        sum = (sum << 3) ^ buf[i];
    return sum;
}
Rust — generatedsrc/checksum.rs
// spec §4.2 · wrapping shift preserved
pub fn checksum(buf: &[u8]) -> u32 {
    buf.iter().fold(0u32, |sum, &b| {
        (sum << 3) ^ b as u32
    })
}
// no unsafe · no allocation
487 differential cases 12 property checks PRD §4.2 conformance 0 unsafe blocks EQUIVALENT
~70%
of severe CVEs are memory-safety bugs
Microsoft · Chromium
13–22%
one-shot success translating real C to safe Rust
CRUST-Bench
25–55%
of translated code is ever proven equivalent
Published benchmarks
Jan 1, 2026
CISA memory-safety roadmap deadline — now passed
CISA · FBI
The problem

AI translation alone can't be trusted.

Compiling is easy. Correctness is not. Every team migrating off C/C++ hits the same wall — the code builds, the tests pass, and nobody can prove the behavior survived.

500 / 600

Passing tests still shipped regressions

Ubuntu's Rust coreutils passed roughly 500 of 600 GNU tests and still broke production — date -r and cp were reverted. Test parity is not proof.

84% vs 46%

Developers use AI, and distrust it

84% of developers use AI tools; 46% actively distrust the output. Veracode found 45% of AI-generated code contains security flaws.

€15M / 2.5%

The deadlines now carry penalties

EU Cyber Resilience Act reporting starts September 11, 2026, with full obligations in December 2027. Fines reach €15M or 2.5% of global turnover.

1–3%

Conversion is the cheap part

Tooling is 1–3% of program cost. Testing and validation is all the rest — exactly the part we automate, and the only part we charge for.

Sources: CISA · MSRC · Chromium · CRUST-Bench · Stack Overflow 2025 · Veracode · Phoronix · EU 2024/2847

How it works

Three stages. One artifact you can audit at every step.

We don't hand you a pile of Rust and wish you luck. Each stage produces something a human can read, and the last one produces evidence.

1.0  Ingest

Everything, not just code

Source is the smallest part of what a system knows. We read the record around it and build an organizational knowledge base.

  • +Source code across C/C++, Python and COBOL
  • +PRDs, commits, tickets, chats, logs, decisions
  • =The context the retired engineer took with them
source412 KLOC
commits18,204
tickets3,067
docs221
2.0  Compiled documents

What the system must do

Before a line is rewritten, the behavior is written down — and the ambiguities get settled by a human, not guessed by a model.

  • +Comprehensive PRD — the behavioral spec
  • +Wiki for human support
  • +Migration documents and verification plan
Comprehensive PRD
§4.2 wrapping shift · §4.7 record layouts · 312 requirements
Verification plan
differential I/O pairs · property checks · parity gates
Wiki
module map · ownership · known landmines
3.0  Rust rewrite

An AI loop with a harness, not a chat window

The agent works against the spec and the compiler, and every candidate is run against the original before it counts. Generate, verify, repeat until the behavior matches.

  • +Differential tests: legacy output vs Rust output
  • +PRD-derived acceptance tests, not tests inferred from the code
  • +Unsafe quarantined and justified, or absent
  • +Guidelines carried forward, so unit costs fall with every job
buildclean
differential487 / 487
acceptance96 / 96
unsafe0 blocks
verdictequivalent
Where we fit

Everyone translates. Almost nobody proves.

The market has plenty of tools that emit Rust. The scarce good is evidence that the Rust does what the original did.

Verified output CODE ATLAS Galois / SAW Code Metal ($1.25B) Mechanical Orchard Amazon Q (no Rust) Corrode / Ferrous c2rust (unsafe out) Copilot / Cursor
Top-down · defense Best-effort output Bottom-up · enterprise

Uncontested quadrant. Code Metal's $1.25B valuation prices the category — and it sits on the defense side, top-down.

Pricing

Free for one engineer. Seven figures for the enterprise.

One metric: validated KLOC. You pay for proven output — failed translations cost you nothing.

Scan
Free
The engineer

Finds what the retired engineer knew. The “it found the bug” moment, on your own repo.

Run a scan
Team
$3–6K/mo
The growing team

Full pipeline: spec, rewrite, and the proof — plus usage as you scale.

Talk to us
Enterprise
$150–400K/yr
The platform org

On-prem, audit trail, private models. Their code never leaves the building.

Talk to us
Modernize
$1–3M
The migration mandate

Committed program with verified-equivalence SLAs against a fixed scope.

Scope a program

Land in 60 days. A free scan finds what the retired engineer knew. In the POC, your engineers watch the harness verify the rewrite — line by line.

Status

Beta is live. Migrating real C projects today.

We publish results on MIT Lincoln Lab's open TRACTOR benchmark, refreshed every six months. No commercial vendor has done it yet.

Shipping

Design-partner repos in active testing

The scan → spec → rewrite loop is running end to end on real codebases.

In flight

Three open-source C → Rust migrations

ubase, Cano and MicroPython testbeds — every benchmark published and re-runnable.

Improving

The optimization loop is running

Token use, memory and recursive self-improvement — unit costs fall with every job.

“The biggest risk in AI coding is not that the model cannot write code. It is that nobody can prove the model understood the system.”
Lawrence Lu
Founder & CEO
Array Networks — IPO in Taiwan and China
629 Networks — acquired by Proofpoint
Executive roles at Array Networks, NebuAd and Vidder
25+ years of technical leadership across AI, IoT, networking, compilers and cybersecurity
Next step

Whoever proves equivalence owns the market.

A 45-minute deep dive on a live C repo: scan → spec → rewrite → verify. We show the proof, not the pitch.

lawrence@codeatlas.tools