The page background is a live ink-on-paper drawing that spans the whole visit: commits flow from a station labeled YOUR AGENTS on the left into a vertical gate of 179 checks. Most pass through and exit right toward SHIP, where the promises hold. Roughly one in seven turns red at the gate and loops down to a REPRODUCER station, where each catch is triaged: about two thirds are confirmed — every confirmed finding ships as a failing test and returns to re-enter the flow fixed — and the rest are cleared as not-an-issue, re-ink to black on the spot, and rejoin the flow directly. Each confirmed fix settles as a permanent ink dot on the outermost ring of a CORPUS below, which accretes like tree rings. A thin stream rises to a SIGNATURES station at top right, where people sign the promises and the bar. At the gate, a small readout cycles through the kinds of checks it runs; occasionally one check flips red, is caught with a reproducer, and recovers. All page content sits on opaque paper panels above this drawing.

Green builds aren’t proof. Evidence is.

Proof turns the promises your software makes into tests that run in your CI — and shows you the evidence.

Below, drawn live: your commits, the 179-check gate, and the corpus that never forgets.

the receipts ↓

The Receipts

Issues we found. Fixes that shipped. Check every row.

PUBLIC WHERE THE OWNER SIGNED · DRAFT ENTRIES MARKED †

rsync^† · findings

Finding	Age	Status	Links
memory safety in path handling	~20 yrs	fixed, shipped ✓	report ↗PR ↗
silent data corruption on resumed transfers	~15 yrs	fixed, shipped ✓	report ↗PR ↗
temp-file race	~10 yrs	fixed, shipped ✓	report ↗PR ↗

jsonparser · findings

Finding	Scope	Status	Links
F-001 · unguarded negative index → panic class	8 call sites	closed same day, pinned ✓	register ↗
MISS-001 · silent data loss in Set() · escaped with 100% MC/DC · caught by a user	1 function + sibling sweep	postmortem public ✓	postmortem ↗
123 requirements signed · full register ↗

assorted upstream^† · merged PRs

Contribution	Status	Links
input-validation fix · parser hardening	merged ✓	PR ↗
bounds check on length decode	merged ✓	PR ↗
error-path file-handle leak fix	merged ✓	PR ↗

curl-adjacent tooling^† · findings

Finding	Status
protocol edge case in redirect handling	fixed upstream ✓
unsafe TLS option default	fixed ✓

engagement private — summary only

an embedded RTOS vendor^† · findings

Finding	Status
ISR-latency promise formalized, then violated under load	fixed, verified ✓
watchdog re-arm race	fixed ✓

engagement private — summary only

a payments platform^† · findings

Finding	Status
idempotency-key race in the retry path	fixed ✓
rounding drift in currency conversion	fixed ✓

engagement private — summary only

an industrial telemetry stack^† · findings

Finding	Status
backpressure data loss under burst ingest	fixed ✓

engagement private — summary only

your project one component, about four weeks request scoping →

† draft data for design review — final facts and links pending.

Q.01 / 05

Which of your promises has nobody ever written down?

CLAIM 001

We dig them out of your code.

EVIDENCE

func Get(data []byte, keys ...string) (value []byte,
        dataType ValueType, offset int, err error) {
        a, b, _, d, e := internalGet(data, keys...)
        return a, b, d, e
}

// nextToken(data []byte) — position of next token skipping
// whitespace; -1 when the buffer runs out before a token.

recovered from code · commit history · tickets — 123 promises recovered and signed on our first public audit

check it yourself ↗

signed · the practice

01 / 05 · the dig

jsonparser · set.gorecovered from code · history · tickets

Recovered promises

saving a value must not delete others

invalid input must not crash

results must match what was stored

func (d *Document) Set(key string, val []byte) error {
    if !json.Valid(val) {
        return ErrMalformed         // never crash on bad input
    }
    idx := d.find(key)
    d.buf = splice(d.buf, idx, val) // one key changes, siblings stay
    return d.verify(key, val)       // read back what was written
}

Your code knows what it does — not why. We dig the promises out.

02 / 05 · the contract

REQ-JP-201criteria → integration tests

When Set() writes one value, every other value survives.

Acceptance criteria

Saving preserves all other values
Malformed input returns an error, never a crash
What you read equals what you wrote

Approved before any code is judged Signed: your engineer ✓

Each promise becomes a requirement your engineers sign — with its acceptance criteria.

03 / 05 · the proof

REQ-JP-201 · formalizedFRETish · checked by solvers

“When Set() writes one value, every other value survives.”

when Set(key, value) executes, the document shall retain every sibling entry

REQ-JP-202if input is malformed, Set shall return an error

REQ-JP-203when Get follows Set, it shall return the stored value

NO CONTRADICTIONS · machine-checked ✓

Then we turn them into math — and prove no two promises contradict.

04 / 05 · the coverage

situations to cover: 14 MC/DC condition coveragehazard analysis

An illustrative grid of condition combinations fills in one by one; two rows are flagged as worst cases: silent data loss, and crash on bad input.

illustrative slicethe real answer is computed per requirement

The math tells us how many tests are enough — including the worst cases.

05 / 05 · the gate

CI · your pipeline runs on every commitpinned forever

$ go test ./...

TestRegression_MISS001 ...... FAILPASS

sibling value lost after Set() — promise broken fix landed · siblings preserved on every write

v1.1

v1.2

v1.3

v1.4

v1.5

∞forever

// Verifies: REQ-JP-201exit 1 · merge blockedevery release since · green

They run in your CI on every change. Forever.

Q.02 / 05

If your software silently lost data tonight, would anyone notice?

CLAIM 002

We are wrong sometimes. We say so, in public, with our name on it.

EVIDENCE

Usually nobody notices — that is exactly how we met this bug. A JSON library was quietly losing sibling data on save; the output was still valid JSON, so every test stayed green. MISS-001 escaped our audit with 100% coverage on the affected code. A user caught it. We published the full postmortem — what we missed, why, and the requirement that now prevents its whole family.

An audit firm that only shows you its wins is asking for faith. We don’t ask for faith.

check it yourself ↗

signed · L. Bugaev

Some signatures never automate.

Q.03 / 05

When an AI agent ships code at 2am, who vouches for it?

CLAIM 003

Machines check everything, every time. People sign what machines can’t.

EVIDENCE

Nine in ten teams now use AI to write code; three in ten trust what it writes. We close that gap by refusing to care who typed the change: agent-written and human-written code are graded by the same bar, against the same signed requirements, on every commit. A finding’s authority is its reproducer — a failing check anyone can re-run, not a reviewer’s glance. People sign what no machine can: the promises your engineers approve, the bar the code is graded against, and our mistakes.

The gate vouches. Not the author.

signed · the practice

Q.04 / 05

The bug you fixed last year — are you sure it stayed fixed?

CLAIM 004

Bugs we close stay closed.

EVIDENCE

F-001 unguarded negative index → panic · lived at eight call sites · closed the same day · pinned on every release since

MISS-001 silent data loss in Set() · closed, family swept · pinned forever

Every fix becomes a permanent test. The class dies, not the ticket.

check it yourself ↗

signed · the practice

Q.05 / 05

What would it cost to know?

CLAIM 005

A fixed fee, agreed before we start. One component. About four weeks. Then it keeps running — with or without us.

EVIDENCE

Fixed feeagreed up front

One componenta real slice, not a survey

~4 weeksscoped before we start

Yours to keepruns in your CI without us

appendix, for the skeptics

We make multiple excavation passes over your code, commit history, tickets, and docs. Requirements are written in FRETish, a NASA requirements notation, then checked for consistency, realizability, and vacuity by the Kind2 model checker and the Z3 theorem prover — before any code is judged. MC/DC condition coverage — the avionics standard — answers “how many tests are enough?” per requirement, measured across eleven languages, and every requirement carries its own hazard analysis. A 179-check audit gate holds the chain together on every commit. Stop anytime; everything keeps running.

signed · the practice

this page · claims: 8 · with evidence: 8 · asking for faith: 0 exit 0

Make us prove it.

Received. A named person replies — with their name on the reply.