Most marketing can't say that. Neither can most codebases.
of developers distrust the accuracy of AI-written code — 33% trust it. Stack Overflow survey, 2025
of teams use AI to write code. 30% trust what it writes. DORA, 2025
The gap between those numbers is where unwritten promises live.
func Get(data []byte, keys ...string) (value []byte,
dataType ValueType, offset int, err error) {
a, b, _, d, e := internalGet(data, keys...)
return a, b, d, e
}
// nextToken(data []byte) — position of next token skipping
// whitespace; -1 when the buffer runs out before a token.
recovered from code · commit history · tickets — 123 promises recovered and signed on our first public audit
Requirements are written in FRETish, a NASA requirements language, and checked by the Kind2 and Z3 solvers for consistency, realizability, and vacuity.
⚠ worst case: silent data loss
⚠ worst case: crash on bad input
situations to cover: 14 (illustrative slice — the real number is computed per requirement)
MC/DC condition coverage — the avionics standard — measured in eleven languages; per-requirement hazard analysis asks what the worst failure would be.
Every fix becomes a permanent test. The class dies, not the ticket.
MISS-001 escaped our audit with 100% coverage on the affected code. A user caught it. We published the full postmortem — what we missed, why, and the requirement that now prevents its whole family.
An audit firm that only shows you its wins is asking for faith. We don't ask for faith.
this page · claims: 7 · with evidence: 7 · asking for faith: 0 exit 0
Received. A named person replies — with their name on the reply.