§1 · The software audit firm for the AI era

Implementation got faster.
Trust didn’t.

AI writes your code. Who vouches for it? Proof is an audit firm built for that question: senior engineers, amplified by a proprietary verification engine, continuously auditing the software you can’t afford to get wrong. You get confirmed findings and evidence your team can rerun. Not a hundred-page PDF.

every claim on this page is backed by an artifact you can open. drive the chain in §2 ↓

exhibit a

PR #482 · session policy

+214 −180 · co-authored: AI
review: 40 seconds

it was friday.
exhibit b · the alibi

CI, that night

✓ 214 / 214 tests green

“nothing to see here”
exhibit c

production down

sat · 2:14 am
panic: nil pointer dereference

nobody ever wrote down what it should do when the store is down…

root cause

The unwritten promise.

the question no one asked:
“and if the policy store is down?”

Case closed · verified specified · tested · re-checked every release
pinning up the postmortem…
Hope it worksProve it works
Tests passedIntent verified
Point-in-time PDFCorpus that reruns
Spec in someone’s headSpec proven sound
§2 · Run the chain yourself

Zero code changes. One crash bug. Every test was green.

This replays a real engagement: the Tyk API Gateway policy-merge engine. Proof’s job wasn’t to hunt bugs. It was to recover the intent, prove the spec, and keep intent, code, and tests verifiably linked. The bug fell out of the gap between them. You drive.

intentspecs/system/*.req.yaml
code// SYS-REQ-016
tests// Verifies: SYS-REQ-016
realizable · — consistent · — gaps · — suspect links · — traced · —
the experiment
Verified · retested
consoletyk case · public-safe

§3 · How correct systems go wrong

Drift accumulates quietly. Tests keep passing.

Most production failures aren’t syntax mistakes. They’re drift: the slow separation of what the code does from what everyone agreed it should do. A refactor here, an AI-assisted rewrite there, a hotfix under pressure. Each one green in CI, each one a little further from the intent. Because every requirement is linked to its code and tests, Proof flags the divergence as it happens: change the code and the requirement goes suspect, change the requirement and the stale tests surface.

intent — what was promised implementation — what actually ships v2.1 refactor AI-assisted rewrite hotfix under pressure suspect links caught — drift repaid tests passed the whole time ✓
fig. 1 — spec-code drift on a critical path, one release cycle the gap is the audit surface
0 loc

changed to find a crash bug in Tyk’s policy engine. The spec gap found it; the code never moved.

0%

traceability precision from annotation-based links. The best ML-based approach reaches 64%.

0s

for formal analysis to find the spec defect that let a NASA-reviewed eVTOL fly backwards.

0 checks

in one audit gate, spanning spec, implementation, verification, and documentation.

tyk case study, nasa fret research, and methodology · unpacked on the research blog
§4 · The verification chain

Six links between a promise and a proof.

Requirements tools, formal methods, coverage tools, and everyday software development have lived in four separate worlds. Proof fuses them into one chain where every link is checkable. This is the engine behind every audit.

link 1 · formalize Intent becomes a requirement

Plain English in, structured FRETISH out. Three levels, stakeholder to software, all in git as YAML.

when apply_requested and no_error the policy_engine shall always satisfy tags_merged = true
link 2 · prove the spec The spec itself gets verified

Realizability, pairwise consistency, vacuity, and gap analysis, run with model checkers, before code is ever judged.

$ proof verify ✓ realizable · 360ms (Kind2) ✓ consistent · 300/300 pairs ⚠ 1 output unconstrained
link 3 · trace Requirement, code, test: linked

Two-line annotations give bidirectional traceability with 100% precision. Change either side and the link goes suspect.

// SYS-REQ-016 func Apply(...) { ... } // Verifies: SYS-REQ-016 func TestApply(...) { ... }
link 4 · prove the data Properties hold for all inputs

Merge rules, special values, and invariants proven with the Z3 solver, universally, not by sampling.

$ proof properties verify ✓ rate limits compare by duration ✓ -1 means unlimited in quota 19/19 proven for all inputs
link 5 · cover MC/DC closes the loop

Every boolean condition shown to independently affect the outcome. Go in production, the first MC/DC for Go anywhere. JS/TS in beta.

$ proof mcdc measure ./pkg/... decisions 38/42 covered conditions 93.6% hotspot hasAuth (skipped)
link 6 · gate One audit, 52 checks

Spec, implement, verify, document. Every pass updates the evidence corpus and regenerates audit-ready SRS and compliance docs.

$ proof audit ✓ spec · 17 checks ✓ implement · 7 ✓ verify · 21 · document · 4
§5 · The audit model

What audit firms got right, rebuilt for the AI era.

The great security audit firms proved something important: teams will pay for senior outside experts who go deep and put their name on the result. The model has two old constraints. Expert attention doesn’t scale, so audits stay scarce and expensive. And the deliverable is a PDF: accurate the day it lands, stale after the next merge.

Proof keeps the standard and changes the economics. The verification chain above does the exhaustive part; senior review does the judgment part. Because the engine does the heavy reading, the audit doesn’t have to end. It reruns every few days, weekly, or per release, and every pass leaves the evidence corpus stronger than it found it.

Point-in-time audit
One engagement, one PDF

Findings frozen at a commit. Two merges later, nobody can say which conclusions still hold.

Scanner subscription
Volume without judgment

A queue of unranked alerts your team learns to ignore. High recall, low signal, no accountability.

Continuous Correctness Audit
Expert judgment that reruns

Intent formalized, spec proven, chain traced, findings confirmed with reproducers. Retested on every pass, reusable in every review.

§6 · The deliverable

An evidence corpus, living in your repo.

Everything the audit produces is a file in git that your team owns and CI can rerun. No dashboards to lose access to, no report to shelve. When enterprise security review asks how you know, you show them the corpus and rerun it in front of them.

$ tree — after the first audit cycle
specs/**/*.req.yamlformalized requirements, three levels, reviewed and approved
src/** · // SYS-REQ-xxxannotations tracing every critical path to its requirement
tests/** · // Verifies:expanded tests and reproducers for every confirmed finding
evidence/mcdc/MC/DC witness rows and coverage reports per requirement
evidence/formal/realizability, consistency, and Z3 property proofs
generated-srs.htmlaudit-ready SRS and compliance docs, regenerated each pass
§7 · The honest questions

Four boxes to tick before the next release.

§8 · Who hires Proof

Pick your seat at the table.

We ship ten times faster now. Review didn’t get ten times faster. I sign off on releases I can’t personally vouch for anymore.

what proof changes

Your critical paths get formal requirements, verified links to code and tests, and an external audit on a cadence you set. You stop vouching from memory and start pointing at evidence.

§10 · The boundary

Publish the evidence. Keep the engine.

Everything we deliver must be inspectable without trusting a black box: methodology, requirements, reproducers, MC/DC and formal artifacts, severity reasoning. The engine that makes this repeatable at commercial speed is the part we keep. You can audit our audit. That’s the point.

§ Q.E.D. · Start

Bring one critical code path. 

We’ll scope the path, name the evidence worth producing, and tell you honestly whether a Continuous Correctness Audit is the right fit. If it isn’t, you’ll leave knowing that too.

what
Proof is a consultancy-led continuous audit for critical software, built by ProbeLabs on proprietary verification tooling.
how
Intent formalized into proven requirements, traced to code and tests, covered with MC/DC and formal methods, gated by a 52-check audit.
for whom
Founders, CTOs, platform leads, security teams, and maintainers shipping AI-accelerated code on paths where failure is expensive.
deliverable
An evidence corpus in your repo: requirements, traces, reproducers, coverage and formal artifacts, rerunnable in CI.
Leonid Bugaev, founder behind Proof

Leonid BugaevFounder, ProbeLabs. Two decades in API infrastructure; Proof exists because shipping got faster and vouching didn’t.

Don’t submit secrets or private source code here. Form data is used for scoping and follow-up; see Trust.