Proof The public register

proof

/pruːf/

  1. n. Evidence establishing a fact with finality.
  2. n. A test impression taken for examination before the final printing.

— v. To render resistant to failure; to proof against.

Also the name of our practice, which does all three.

Proof is a continuous correctness audit: fixed fee, one component, four weeks, then standing.

We audit whether your software does what you promised — and we sign what we find1

To the engineer whose name is on the release,

We run a small practice with one service: the Continuous Correctness Audit. For a fixed fee, we take one component of your system — the parser everything depends on, the engine nobody dares touch — and spend roughly four weeks writing down, formally, what it promises to do.2 Then we establish, requirement by requirement, whether it keeps those promises — by proof where testing cannot reach,3 by measured coverage where it can.4 The audit does not end when we leave: it re-runs in your CI on every change and fails loudly the day code and promise part ways.

You keep a register a machine can check: each requirement traced to the code that implements it, the tests that exercise it, and a written account of what happens if it fails.5 Every finding in it is signed by the reviewer who made it — a person, with a name, who can be asked why.

$ proof audit
requirements     123 checked against HEAD
verification     122 hold
SW-REQ-142       FAIL  Set() silently drops value on key collision
audit: 1 finding · exit 1
Fig. 1The gate, failing honestly.

We audited one library in public first, so you could inspect the work before trusting us with yours: jsonparser, a widely used Go parsing library. The audit approved one hundred and twenty-three requirements and surfaced seven real bugs, among them a panic class reachable from eight call sites. It also missed one: a silent data loss in Set() — the failure recorded above as SW-REQ-142 — escaped review under one hundred per cent MC/DC coverage. We published the miss on the same register, postmortem included, because an audit that cannot admit error is not an audit. It is advertising.

The full register is public and live.6 Read it. Then, if there is a component whose failure you would rather not explain to anyone, write to us below.

Yours, in the belief that software can be vouched for —

Leonid Bugaev

Principal reviewer · Proof

Every finding carries a name.

Reply card

Tell us where to write, and — if you like — which component keeps you up at night.

Confidential. Fixed fee, scoped to one component.

Received. We read every reply ourselves, and we will write back from a named address — not a system.