Green builds aren’t proof. Evidence is.

Proof turns the promises your software makes into tests that run in your CI — and shows you the evidence.

project	what we found	how long it was there	status
rsync†	3 long-lived issues in the new release — memory safety, silent data corruption on resumed transfers, a temp-file race report ↗PR ↗	up to ~20 years	fixed · shipped ✓
jsonparser	123 requirements written down and signed · 7 findings · 1 published miss — postmortem public register ↗postmortem ↗	long enough to matter	fixed · gate live ✓
assorted OSS†	assorted upstream fixes — merged PRs across N projects PRs ↗	varies	merged ✓

† draft data for design review — final facts and links pending.

Q.01 / 05

Which of your promises has nobody ever written down?

CLAIM 001

We dig them out of your code.

EVIDENCE

func Get(data []byte, keys ...string) (value []byte,
        dataType ValueType, offset int, err error) {
        a, b, _, d, e := internalGet(data, keys...)
        return a, b, d, e
}

// nextToken(data []byte) — position of next token skipping
// whitespace; -1 when the buffer runs out before a token.

recovered from code · commit history · tickets — 123 promises recovered and signed on our first public audit

check it yourself ↗

signed · the practice

01 / 05 · the dig

jsonparser · set.gorecovered from code · history · tickets

Recovered promises

saving a value must not delete others

invalid input must not crash

results must match what was stored

func (d *Document) Set(key string, val []byte) error {
    if !json.Valid(val) {
        return ErrMalformed         // never crash on bad input
    }
    idx := d.find(key)
    d.buf = splice(d.buf, idx, val) // one key changes, siblings stay
    return d.verify(key, val)       // read back what was written
}

Your code knows what it does — not why. We dig the promises out.

02 / 05 · the contract

REQ-JP-201criteria → integration tests

When Set() writes one value, every other value survives.

Acceptance criteria

Saving preserves all other values
Malformed input returns an error, never a crash
What you read equals what you wrote

Approved before any code is judged Signed: your engineer ✓

Each promise becomes a requirement your engineers sign — with its acceptance criteria.

03 / 05 · the proof

REQ-JP-201 · formalizedFRETish · checked by solvers

“When Set() writes one value, every other value survives.”

when Set(key, value) executes, the document shall retain every sibling entry

REQ-JP-202if input is malformed, Set shall return an error

REQ-JP-203when Get follows Set, it shall return the stored value

NO CONTRADICTIONS · machine-checked ✓

Then we turn them into math — and prove no two promises contradict.

04 / 05 · the coverage

situations to cover: 14 MC/DC condition coveragehazard analysis

An illustrative grid of condition combinations fills in one by one; two rows are flagged as worst cases: silent data loss, and crash on bad input.

illustrative slicethe real answer is computed per requirement

The math tells us how many tests are enough — including the worst cases.

05 / 05 · the gate

CI · your pipeline runs on every commitpinned forever

$ go test ./...

TestRegression_MISS001 ...... FAILPASS

sibling value lost after Set() — promise broken fix landed · siblings preserved on every write

v1.1

v1.2

v1.3

v1.4

v1.5

∞forever

// Verifies: REQ-JP-201exit 1 · merge blockedevery release since · green

They run in your CI on every change. Forever.

Q.02 / 05

If your software silently lost data tonight, would anyone notice?

CLAIM 002

We are wrong sometimes. We say so, in public, with our name on it.

EVIDENCE

Usually nobody notices — that is exactly how we met this bug. A JSON library was quietly losing sibling data on save; the output was still valid JSON, so every test stayed green. MISS-001 escaped our audit with 100% coverage on the affected code. A user caught it. We published the full postmortem — what we missed, why, and the requirement that now prevents its whole family.

An audit firm that only shows you its wins is asking for faith. We don’t ask for faith.

check it yourself ↗

signed · L. Bugaev

Some signatures never automate.

Q.03 / 05

When an AI agent ships code at 2am, who vouches for it?

CLAIM 003

Machines check everything, every time. People sign what machines can’t.

EVIDENCE

Nine in ten teams now use AI to write code; three in ten trust what it writes. We close that gap by refusing to care who typed the change: agent-written and human-written code are graded by the same bar, against the same signed requirements, on every commit. A finding’s authority is its reproducer — a failing check anyone can re-run, not a reviewer’s glance. People sign what no machine can: the promises your engineers approve, the bar the code is graded against, and our mistakes.

The gate vouches. Not the author.

signed · the practice

Q.04 / 05

The bug you fixed last year — are you sure it stayed fixed?

CLAIM 004

Bugs we close stay closed.

EVIDENCE

F-001 unguarded negative index → panic · lived at eight call sites · closed the same day · pinned on every release since

MISS-001 silent data loss in Set() · closed, family swept · pinned forever

Every fix becomes a permanent test. The class dies, not the ticket.

check it yourself ↗

signed · the practice

Q.05 / 05

What would it cost to know?

CLAIM 005

A fixed fee, agreed before we start. One component. About four weeks. Then it keeps running — with or without us.

EVIDENCE

Fixed feeagreed up front

One componenta real slice, not a survey

~4 weeksscoped before we start

Yours to keepruns in your CI without us

appendix, for the skeptics

We make multiple excavation passes over your code, commit history, tickets, and docs. Requirements are written in FRETish, a NASA requirements notation, then checked for consistency, realizability, and vacuity by the Kind2 model checker and the Z3 theorem prover — before any code is judged. MC/DC condition coverage — the avionics standard — answers “how many tests are enough?” per requirement, measured across eleven languages, and every requirement carries its own hazard analysis. A 179-check audit gate holds the chain together on every commit. Stop anytime; everything keeps running.

signed · the practice

this page · claims: 8 · with evidence: 8 · asking for faith: 0 exit 0

Make us prove it.

Received. A named person replies — with their name on the reply.