receipts · what we audited, and what it found
One public audit, on the Go JSON library buger/jsonparser: 5,600 stars, more than ten years in production. The register is open, and every finding on it is a test you can run on your own hardware.
requirements, approved by the engineers who own the code.
findings fixed upstream, in public pull requests.
functions traced into the graph, each bound to the promises it answers for.
published miss, with a blameless, signed postmortem.
Ten open known issues on the public register: five High, two Medium, two Low, one Info. Each row names the failure, carries an identifier such as KI-5, and links to the requirements it breaks. Fixed and withdrawn entries stay on the record.
both releases passed their own test suites before the gate ran.
Set() could drop sibling values without reporting an error. It escaped one of our audits of that code. A downstream user found it, and told us.
We published a blameless postmortem, signed by Leonid Bugaev, and pinned the whole defect class so the same shape of bug turns the gate red on the day it returns.
The affected code carried 100% MC/DC coverage at the time of the miss. Coverage of the code was full, and the promise still broke. That is why coverage is counted against intent as well as against code.
One release fixed three previously tracked issues and introduced two new High-severity defects, inside otherwise valid fixes.
The gate held: both new defects arrived with reproducers that failed on the release candidate.
A 14-commit delta passed 1,870 tests, and review still found an incomplete stack-overflow fix, a live sibling of another corrected bug, and non-determinism in a new feature.
The gate held: all three were pinned as classes, so the shapes cannot return quietly.
Review did not speed up to match, and trust did not keep up either. Reading every diff was already hard; it stops being possible once the diffs arrive faster than people can read them. The team still has to answer for the release.
of developers distrust the accuracy of AI output, against 33% who trust it. Stack Overflow Developer Survey, 2025
adoption of AI coding tools, with about 30% reporting little or no trust in what comes out. DORA, 2025
of those surveys are needed to read the register. We cite them as context for the buying decision; nothing on this site depends on them.
fig. 01 · Schematic. A green suite reports the first bar. The second bar is the one your promises live in, and it is the one Proof counts.
proof · reqproof.com · sheet 04 of 05 · rev continuous