Continuous Correctness Audit · for AI-native systems
A model writes the function. A model writes the test that agrees with it.
Neither knows what you meant. The test passes because it was derived from the same code it checks, so a green build measures agreement, and agreement was never the question. The question your board will eventually ask is “who vouches for this code, and can they show their work”, not “did CI pass”.
Software does the work now. Someone still has to vouch for it.
Most teams reading this page are living the shift from the inside: production changes a model wrote and a reviewer skimmed. The wider industry is building entire service firms on the same premise, software doing the work with people supervising it.
The failure mode is already on record: audit-style paperwork generated at volume, conclusions that look alike from client to client, and no evidence anyone can re-run. When that work gets questioned, there is nothing underneath it.
Whichever side of that shift you are on, the scarce asset is the same: evidence someone outside the building can re-run.
Four things model-written code gets wrong, and where the audit stands.
Signed intent, recovered first
We turn what you meant into requirements the engineers who own the component approve before any code is judged, about two hours of their time in week one. The spec exists outside the model that wrote the code. That is the point of it.
Tests measured against the spec
A generated test usually mirrors the code it was generated beside. We measure your suite against the approved requirements instead of the implementation, so a test that agrees with a wrong function gets counted as what it is: agreement.
MC/DC on the decision logic
Condition-level MC/DC — modified condition/decision coverage — a strictly harder bar than line coverage, on the decision logic that code-writing tools touch most and test least.
Timeouts and error paths
The least-tested surface in model-written code, by construction: models learn from examples, and examples are mostly happy paths. The bar requires timeout and error branches to hold at condition level, with evidence.
Each finding is a red reproducer, which is exactly the target a code-writing model needs: point your tooling at it, and the gate grades the whole change. A fix isn't done because the model says so; it's done when the reproducer finally passes and the gate agrees. The coverage bar is the same in all eleven languages we measure, so a polyglot codebase does not dilute the standard. Findings arrive agent-ready: every known issue carries a copy-ready prompt, context and reproducer included, so your own coding agents can be pointed at the fix with the evidence as the acceptance test. And unlike a session, the corpus persists: every future model and every future engineer inherits the same written intent instead of re-guessing it. None of this is hypothetical: read a public corpus, browse its live dashboard, or the ledger it feeds.
Almost-right is the default failure mode.
45%
Top AI frustration
Stack Overflow's 2025 survey: the leading frustration with AI tools is solutions that are “almost right, but not quite” (survey).
66%
More time fixing AI code
The same survey: two-thirds of developers spend more time fixing almost-right AI-generated code than they expected to.
One component a model helps write. Four weeks. Evidence in your repo.
Same engagement as the flagship Continuous Correctness Audit, aimed at a component where model-written changes land weekly and customers depend on the result. Fixed fee after scoping; roughly four weeks to a gate in your CI. Then the audit stands, on the cadence you choose, so the claim gets re-earned on every release.
When the board asks who vouches for this code, the answer is an artifact: the signed register, and evidence you can re-run in front of them. Full shape, commitments, and exclusions on the engagement page →
Sound familiar?
A fit if
- Model-written code already runs in production paths your customers depend on.
- You can name the component where a wrong merge costs real money.
- You have a release cadence an audit gate can attach to.
Not the right page if
- You need a certified penetration test or compliance checkbox first — engage a security firm for that artifact.
- There is no component you can name yet; start from the general engagement instead.
Request confidential scoping.
Your email is enough to start; the note is optional. We reply personally, with a scoping call or an honest no. Fees are quoted after scoping, fixed before work starts.