The engine came first. The public proof came next.

Proof started as a verification engine. Managed requirements, formal proofs, and condition-level coverage already existed. They were locked inside regulated industry. The engine brought them out. The engine is the product.

The question that stayed was whether anyone could prove the software did what they promised.

An engine alone convinces nobody. Someone accountable has to point it at real code, judge what it finds, and publish what it missed. The platform builds the Software Intent Graph. A named assurance practice stands behind what the graph says.

We build the instruments we audit with. The boundary is a policy. Publish our evidence. Keep the engine. Public work lands in the open, and anyone can re-run it. Client work never lands anywhere public.

The first public audit on the register is of our own library. Leonid wrote jsonparser and has maintained it in public for ten years. The audit turned its behavior into requirements. It found real bugs that had survived years of production use and fuzzing. The misses, with their postmortems, sit on the same register as the wins.

The flagship rsync audit followed. Two public audits are on the record. Both catalogues are public, including the findings we later withdrew.

Leonid has spent two decades building infrastructure tools engineers run in production. GoReplay is a traffic-replay system, maintained in the open for over a decade. jsonparser is a Go JSON library that thousands of public repositories depend on.

The repositories are public. The adoption numbers are on them, not here. He ran engineering at Tyk, an API management platform.

Findings are issued against a published bar. A finding stands on a runnable reproducer. Machines check every claim, every time. A person validates every finding before it reaches you. You never open a finding that nobody checked.

Names go on the promises, on the bar, and on the decision to publish a miss from public work. Private engagement evidence stays private unless the customer authorizes disclosure. A published postmortem carries no personal signature. We say so where we publish it.

You rely on that bar, on the engine that enforces it, and on evidence that re-runs in your repository. You do not rely on anyone being present each day. The corpus re-runs in your CI without us. One named principal can stand behind only so much work. The practice takes a limited number of engagements each quarter.

Generated claims are cheap now. Checkable ones are not.

Every figure in this section is counted on Proof’s own corpus. We do not publish that corpus. Take the figures as stated, not as checked.

Proof runs under the same discipline it sells. The corpus holds nearly two thousand requirements, across four specification levels, from stakeholder intent to integration contracts. Every function is annotated. Orphan code is zero. Each change is checked the same way client work is checked.

That corpus stays private, for the same reason a client corpus does. A full requirements tree describes its system completely enough to rebuild it. This one describes the engine. The public reference is the jsonparser audit, browsable file by file.

Three of the instruments are public. They are the checkable half of the portfolio.