100% MC/DC. Two bugs still escaped.

The stakes were not hypothetical. jsonparser sits in dependency graphs it never asked to join: log pipelines, service meshes, API infrastructure. It ships inside Grafana Loki and, transitively, a good slice of the cloud-native stack. A silent bug in a library like this becomes somebody’s incident, three layers up, with a green build.

One caveat belongs at the top of the story. We chose this subject, and we maintain it. Recovering intent from code you already know is the easiest version of the job, and a self-selected subject is a weaker claim than an assigned one. That limitation is published with the rest.

That is a strong position, and we held it. All 279 non-test functions declare the requirements they serve in the source itself — most on the function, a handful at the top of their file — so the trace moves when the code moves. That count was taken when the audit closed; master carries 280 today, and git grep -h '^func ' -- '*.go' ':!*_test.go' re-counts it. A structure-aware fuzzer that mutates the key path as well as the bytes was built mid-campaign and stays in the suite.

One calibration story shows why the position felt solid. Years ago, OSS-Fuzz caught a real panic in Delete by mutating bytes at random. Encoded as a solver constraint against the formalized spec, the same defect fell out as a counterexample in six milliseconds. Random search found it once, by luck; once specified, it cannot be missed again.

Everything in that account depends on the behavior being specified first.

One register record is worth pulling out now, because the next section turns on it — and it sits beside the six rather than among them. KI-1 is a single record standing for a panic class repeated at several call sites: the same unchecked dereference, spelled slightly differently each time. Its only defect file is DEFECT-260726-QS2V, which is one of the two an outside contributor is credited for. A hazard sweep hunted that class, found seven sites, fixed all seven and reported clean. The eighth spelling belongs to the next section.

The review also caught the benchmark lying: since 2017, the suite had been measuring a different library under encoding/json’s name, and the issue reporting it had been open for nine years. And it made the parser faster: formalizing string handling exposed an unbounded backslash scan, and the fix took one hot path from 128 microseconds to 22.

Alongside the review, the decade-old backlog went to zero: fifty open issues and twelve open pull requests, closed or merged across six releases with zero breaking changes. The CHANGELOG carries the release-by-release record, and the ten-year writeup tells it long-form.

One of two. Ask Set to write 9 at index [5] of the array [1,2], and it handed back [9]. No panic. Valid JSON. The rest of the data, gone. The branch that should have grown the array only fired when its first element was an object; scalar arrays fell through to code that overwrote them, and a comment in the source described the overwrite as intentional.

Two of two. Ask Set to write at the path "a" then "", and it panicked. The empty path component was the same failure class the hazard sweep had already closed: seven sites found, seven fixed, reported clean. The eighth was written keys[depth:][0][0] instead of keys[i][0], and the pattern the sweep matched on did not see it.

How they surfaced is recorded honestly, because the record is in tension with itself: our own problem reports file both as audit findings, while the project’s changelog credits an outside reporter for each of the two, by name, in the release that shipped the fixes. The gate stopped neither — that part is not in dispute — and we published the disagreement. The changelog also records three more escapes fixed in v1.3.1 with no postmortem of their own; the audit page records that as a gap in the register, which is a different thing from having had no other misses.

Nobody had written the requirement for what scalar arrays deserve from Set, so no check on earth was counting that case. The coverage number was complete and it was measured over the behavior somebody had named.

The panic site failed the same way for a second reason. The sweep was looking for one spelling of an unsafe construct, and the property behind that construct was never written down, so a slice expression and a second index level were enough to hide the same mistake in plain sight. A pattern can only match what it was given. A requirement is what makes the property itself checkable.

Then the hardening. Two requirements that did not exist before, both now approved: SYS-REQ-110 says what Set owes an array index past the end of the array, for every element type, including the ones the old code skipped; SYS-REQ-111 says the empty path component is a defined input on every entry point and must never panic.

And three pieces of machinery, because a requirement with nothing checking it is a sentence: a reference oracle that compares output against the standard library, a fuzzer that mutates the key path as well as the bytes, and a signal rule that flags the unguarded dereference in every spelling, including the one the sweep walked past.

The misses got more than fixes: each one retired as a class. And the class claim stays honest — one passing reproducer proves an instance dead; closing a whole class takes more evidence than one test.

The audit behind this postmortem is the same engagement we sell: requirements your engineers approve, the code held to them, the evidence in your repository, re-run on every release. Yours stays private, always — the trust page explains why that is structural. A person validates every finding before it reaches you. When a defect slips through, the miss is recorded in your register and the bar is widened. Misses from public Proof work are published, and private engagement evidence stays private unless you authorize disclosure.