§1 · The software audit firm for the AI era
Implementation got faster.
Trust didn’t.
AI writes your code. Who vouches for it? Proof is an audit firm built for that question: senior engineers, amplified by a proprietary verification engine, continuously auditing the software you can’t afford to get wrong. You get confirmed findings and evidence your team can rerun. Not a hundred-page PDF.
every claim on this page is backed by an artifact you can open. drive the chain in §2 ↓
PR #482 · session policy
+214 −180 · co-authored: AI
review: 40 seconds
CI, that night
✓ 214 / 214 tests green
“nothing to see here”production down
sat · 2:14 am
panic: nil pointer dereference
nobody ever wrote down what it should do when the store is down…
The unwritten promise.
the question no one asked:
“and if the policy store is down?”
Zero code changes. One crash bug. Every test was green.
This replays a real engagement: the Tyk API Gateway policy-merge engine. Proof’s job wasn’t to hunt bugs. It was to recover the intent, prove the spec, and keep intent, code, and tests verifiably linked. The bug fell out of the gap between them. You drive.
Drift accumulates quietly. Tests keep passing.
Most production failures aren’t syntax mistakes. They’re drift: the slow separation of what the code does from what everyone agreed it should do. A refactor here, an AI-assisted rewrite there, a hotfix under pressure. Each one green in CI, each one a little further from the intent. Because every requirement is linked to its code and tests, Proof flags the divergence as it happens: change the code and the requirement goes suspect, change the requirement and the stale tests surface.
changed to find a crash bug in Tyk’s policy engine. The spec gap found it; the code never moved.
traceability precision from annotation-based links. The best ML-based approach reaches 64%.
for formal analysis to find the spec defect that let a NASA-reviewed eVTOL fly backwards.
in one audit gate, spanning spec, implementation, verification, and documentation.
Six links between a promise and a proof.
Requirements tools, formal methods, coverage tools, and everyday software development have lived in four separate worlds. Proof fuses them into one chain where every link is checkable. This is the engine behind every audit.
Plain English in, structured FRETISH out. Three levels, stakeholder to software, all in git as YAML.
Realizability, pairwise consistency, vacuity, and gap analysis, run with model checkers, before code is ever judged.
Two-line annotations give bidirectional traceability with 100% precision. Change either side and the link goes suspect.
Merge rules, special values, and invariants proven with the Z3 solver, universally, not by sampling.
Every boolean condition shown to independently affect the outcome. Go in production, the first MC/DC for Go anywhere. JS/TS in beta.
Spec, implement, verify, document. Every pass updates the evidence corpus and regenerates audit-ready SRS and compliance docs.
What audit firms got right, rebuilt for the AI era.
The great security audit firms proved something important: teams will pay for senior outside experts who go deep and put their name on the result. The model has two old constraints. Expert attention doesn’t scale, so audits stay scarce and expensive. And the deliverable is a PDF: accurate the day it lands, stale after the next merge.
Proof keeps the standard and changes the economics. The verification chain above does the exhaustive part; senior review does the judgment part. Because the engine does the heavy reading, the audit doesn’t have to end. It reruns every few days, weekly, or per release, and every pass leaves the evidence corpus stronger than it found it.
Findings frozen at a commit. Two merges later, nobody can say which conclusions still hold.
A queue of unranked alerts your team learns to ignore. High recall, low signal, no accountability.
Intent formalized, spec proven, chain traced, findings confirmed with reproducers. Retested on every pass, reusable in every review.
An evidence corpus, living in your repo.
Everything the audit produces is a file in git that your team owns and CI can rerun. No dashboards to lose access to, no report to shelve. When enterprise security review asks how you know, you show them the corpus and rerun it in front of them.
Four boxes to tick before the next release.
What each critical path must do exists as reviewable requirements, not as memories distributed across senior engineers.
The suite would fail if the code stopped doing what was intended, not merely if it stopped doing what it currently does.
When AI or a hotfix rewrites a critical path, something flags that the requirement, tests, or docs no longer agree.
When enterprise security review asks how you know, there’s an evidence packet, not screenshots and Jira archaeology.
Pick your seat at the table.
We ship ten times faster now. Review didn’t get ten times faster. I sign off on releases I can’t personally vouch for anymore.
Your critical paths get formal requirements, verified links to code and tests, and an external audit on a cadence you set. You stop vouching from memory and start pointing at evidence.
One path where being wrong is expensive.
The first engagement doesn’t cover everything. It covers something that matters: the path customers depend on, attackers probe, auditors question, or releases keep touching.
GraphQL routers and gateways, SDKs, parsers, and the plumbing everyone downstream silently depends on.
scope this → libraries Tier-one library auditsHigh-profile libraries where one confirmed finding builds more trust than a year of marketing.
scope this → ai-native systems AI-native product teamsAgents, tool-calling workflows, and AI-authored changes that create behavior paths ordinary review never sees.
scope this →Publish the evidence. Keep the engine.
Everything we deliver must be inspectable without trusting a black box: methodology, requirements, reproducers, MC/DC and formal artifacts, severity reasoning. The engine that makes this repeatable at commercial speed is the part we keep. You can audit our audit. That’s the point.
Bring one critical code path.
We’ll scope the path, name the evidence worth producing, and tell you honestly whether a Continuous Correctness Audit is the right fit. If it isn’t, you’ll leave knowing that too.
- what
- Proof is a consultancy-led continuous audit for critical software, built by ProbeLabs on proprietary verification tooling.
- how
- Intent formalized into proven requirements, traced to code and tests, covered with MC/DC and formal methods, gated by a 52-check audit.
- for whom
- Founders, CTOs, platform leads, security teams, and maintainers shipping AI-accelerated code on paths where failure is expensive.
- deliverable
- An evidence corpus in your repo: requirements, traces, reproducers, coverage and formal artifacts, rerunnable in CI.
Leonid BugaevFounder, ProbeLabs. Two decades in API infrastructure; Proof exists because shipping got faster and vouching didn’t.
Don’t submit secrets or private source code here. Form data is used for scoping and follow-up; see Trust.