Fig. 1 — enlarged from sheet 01
Finds the bugs that type-check and pass tests but break at runtime, by comparing what each side of an API boundary actually does.
suss reads both sides of an API boundary and compares what each one actually does, rather than what its types promise. A caller that handles three error shapes against a callee that returns four is a bug the type checker will sign off on, and suss reports it.
The expensive bugs are the ones that passed every check. Types record what someone intended, and tests cover what someone thought to test, so when two services drift apart, both stay green and the bug shows up in production first. More in the blog post.