Proof · a record of what your software promises
Proof writes down the promises in your code. Your engineers sign them. A gate checks every commit against them.
Machines find the promises. Your engineers sign them. The gate enforces them.
public on buger/jsonparser123 promises signed
Set() replaces one value and changes nothing else.
Proof writes a test that fails if that promise breaks.
The test fails on main.
Merged in the project's own repository.#421
The test stays. Every commit is checked.
Public receipt
We ran Proof on a mature open-source project. Everything below is public, and you can run it again.
buger/jsonparser, a 5,600-star Go library, more than ten years in production.
Promises signed
Real upstream bugs found and fixed
Missed promise published
Each finding is a test that failed on main.
Not an opinion, not a warning, not a suggestion.
A boolean is only true for the exact token true.
A unicode escape is rejected unless four hex digits follow it.
Fixed upstream #271Set() on an array-index path never drops a sibling value.
An integer too large for int64 returns an error and never wraps.
Fixed upstream #279A UTF8 decode never reads past the length the config declares.
Fixed upstream #283An empty array returns the empty sentinel and never a nil slice.
Fixed upstream #287EachKey visits a key once, even when the document repeats it.
Seven promises, seven failing tests, seven merges in the project's own repository.
Don't take our word for it.
We publish the promises we get wrong on the same register as the ones we get right. That is the only way you can check us.
How it works
Five stages. Your engineers own the second one. The gate owns the last two.
Proof reads your code and writes down the promises it already makes.
Your engineers read each promise and sign it. Nothing counts before a person signs.
Each signed promise gets a test that fails when that promise breaks.
The gate runs on every commit. A broken promise stops the merge.
The test stays in your suite. The same break cannot return unseen.
The promise graph
Every promise is joined to the code that carries it and to the tests that check it. The gate reads those joins on every change.
Now picture 123 of these across one repository.
A commit changes refund.go. The map shows the promises of that file.
Fig. 02 · The blast radius of one promise that is not written down. Example. The promise is only in a document. No check can fail on it. The failure occurs at your customers.
The product
The product is two screens. One asks a person to accept a promise, and the other refuses a merge that broke one.
Proof found 3 new promises in this pull request.
“A refund never exceeds the captured amount.”
82func Refund(ctx, id string, amt Money) error {··+96 if amt.Cents > ch.CapturedCents {+97 return ErrRefundExceedsCapture98 }
$proof gate --base mainloading 123 signed promises123 checked in 4.2s122 passFAIL TestRefundNeverExceedsCapture promise SYS-0182 “A refund never exceeds the captured amount.” broke at refund.go:96 signed by leonid, 14 Jul 2026exit 1merge blockedread the promise:portal.reqproof.com/p/SYS-0182The register it all lands in
The objection
Of course.
Tests check what your engineers remembered to write down.Proof finds the promises they never wrote down.
Fig. 05 · The arrows run opposite ways. A test starts in one person's memory and ends at one assertion. A promise starts in the code, passes through a person who signs it, and ends at every commit after that.
Attached
A promise stays attached to the code it governs, so it moves with the code as the code changes.
Named
A failure tells you which promise broke, not only which assertion failed.
Before the merge
You can see everything one change touches before you merge it.
Who it is for
“We ship ten times faster now. Review speed did not increase ten times. I approve releases that I cannot examine myself.”
What Proof gives you: a map and a gate that you keep. The gate held the release to its promises before you sign it.
“I open the register and search for bad work.”
What Proof gives you: a live map, a published miss, and tests that fail on main. Run the tests again. Then tell your CTO.
“One bug in routing, auth, or billing touches every customer at the same time.”
What Proof gives you: the shared path as signed promises. A break on that path is a test that fails.
“My agents write most of the code now. I need a record that they must obey.”
What Proof gives you: a written record of the promises in the code. Agents can read the record. Agents cannot approve the record.
Accountability
Machines check everything, every time. People decide what a machine must not decide alone. This limit is written in the configuration. You can move it.
Agents
Run every check, on every commit. The quantity is more than a person can read.
A person
One person validates each finding before it reaches you. People sign the promises, the bar, and our misses.
Your engineers
Sign the promises. Each item an agent writes has a draft mark. An agent cannot approve its own requirement.
Fig. 03 · CI is green in the two pictures. The second picture is possible only after the promises are written down.
The whole method →Our misses are published. MISS-001, signed by Leonid Bugaev.
Enterprise
Proof sits between your repository and your CI. Nothing else about your setup changes.
Fig. 06 · One box in the middle. Your repository on one side, your CI on the other, and a person inside the box on every promise.
The six questions we are asked first
Three questions we answer in writing rather than on a page: running Proof on your own hardware, which models we may use, and where the data sits. Ask at [email protected] and you get a written answer.
What you keep
Four artifacts. They stay in your repository, under your licence.
We recover every promise of your component from the code. Your engineers sign each one.
Each break has a test that fails on your current main. A person validates each break before you see it.
Select a function or a promise. The map shows what else changes. Your engineers, your CI, and your agents use the same map.
The gate reads the map on each change. A broken promise stops the merge.
If we stop work tomorrow, your map, your gate, and your register continue to operate.
Final receipt
Set() replaces one value and changes nothing else.
This promise was implicit for years. Proof made it explicit, found the violation, produced the failing test, and the maintainer fixed it upstream.
We run Proof on one public project each quarter, at our own cost. There is no invoice and no follow-up.
Leonid Bugaev · founder
signs the promises we publish, and the ones we miss