Requirements that test themselves.

Intent Evidence Verified

The moving graph behind this headline is drawn from the public jsonparser project. It centres on the requirement SYS-REQ-009. Around it are the requirements that requirement rests on, the source files and test files that implement and verify it, the change that touched it, and the known issue and defect record that strengthened it. Every identifier in the graph is real and can be checked in the repository. The same requirement is set out in full in the next section.

Proof builds a living graph of what your software must do, what depends on it, and what proves it. The same graph guides your engineers and coding agents.

Two graphs

A code graph tells you what calls what.Proof tells you what depends on what being true.

Select a component, requirement, issue, or change. Proof shows the intent it rests on, the promises downstream, and the code, tests, documents, and contracts that may need to be reconsidered.

Code graph

3 nodes · one kind of edge

function A function B function C calls calls

Proof

6 nodes · five kinds of edge

STAKEHOLDER NEED PAY-STK-005 rests on REQUIREMENT · PAY-SW-042 ✓ “Refunds cannot exceed capture.” REQUIREMENT PAY-SW-018 ✓ CODE refund.go:82-104 HAZARD 3 analyzed depends on implemented by challenged by EVIDENCE refund_test.go:41 ✓ proves STAKEHOLDER NEED PAY-STK-005 rests on REQUIREMENT · PAY-SW-042 ✓ “Refunds cannot exceed capture.” REQUIREMENT PAY-SW-018 ✓ depends on CODE refund.go:82-104 implemented by HAZARD 3 analyzed challenged by EVIDENCE refund_test.go:41 ✓ proves
Fig. · Example service · The same system, seen two ways. Example. Colour carries state: green is verified knowledge, the hazard branch is marked as a hazard, and grey is structure with nothing proving it.

See the blast radius before you touch the code.

Change this. What else did you change?

Select a requirementfour of them are live in this figure

THE CHANGE DEPENDENT INTENT COMPONENTS PUBLIC SURFACE PAY-042 PAY-18 PAY-61 PAY-94 PAY-042 PAY-18 PAY-61 PAY-94

IF THIS CHANGESPAY-042PAY-18PAY-61PAY-94

5 files · 13 tests · 1 parent requirement · related obligations

2 files · 5 tests · 1 parent requirement · related obligations

1 file · 3 tests · 1 parent requirement · related obligations

2 files · 5 tests · 1 parent requirement · related obligations

Fig. · Example service · One requirement, walked out to everything that rests on it. The PAY-* service is invented for this drawing and the counts are illustrative.

Change and defect lineage

Every change should explain itself.

A commit says what text moved. A Proof change record says why the behavior moved, which components and requirements were affected, what code and documentation changed, and which evidence made the result acceptable.

CHANGE RECORD feature refactor behavior change defect fix

CHANGE RECORDfeaturerefactorbehavior changedefect fix

Four kinds of change record. Two of them are shown below.
CHANGE-1042 Verified

KINDfeature

INTENT

Support nested array updates.

COMPONENTS

parser

REQUIREMENTS

2 added · 3 affected

IMPLEMENTATION

4 files

DOCUMENTATION

1 document updated

EVIDENCE

8 tests · 2 properties · hazard review

APPROVED BY

maintainer

ExampleHand written for this page. The identifier, the counts and the approver are illustrative. The record beside it is real and links to its file.

DEFECT-260726-MFPA Covered by requirement the record’s own status: the instance is fixed and the obligation now sits on the requirement, so the class is not declared closed

KINDdefect fix

ORIGIN

Known issue KI-3

VIOLATED INTENT

SYS-REQ-009

REPRODUCER

pins the break on the affected revision

FIX

parser.go

INSTANCE

fixed

DEFECT CLASS

evidence attached / status explicit

REGRESSION

permanent test retained

Open problems remain known issues. When the fix is verified, Proof creates a defect record using the same evidence-bearing model as any other change. The issue closes; the proof stays.

See a change move through Proof →

Self-invalidation

The graph knows when it needs to be proven again.

Software knowledge becomes dangerous when it silently goes stale. When code, a requirement, or documentation changes, Proof identifies the relationships and evidence that may no longer be current.

It does not automatically declare the requirement false. It withdraws yesterday’s confidence until the affected obligations are reviewed or rerun.

BEFORE REQUIREMENT CODE DOC EVIDENCE CHANGE DETECTED REQUIREMENT CODE DOC EVIDENCE STALE ? * ? AFTER VERIFICATION REQUIREMENT CODE DOC EVIDENCE

Change recordCHANGE-1042

ExampleThe record id and its fields are hand written for this page. The state change they illustrate is the real mechanism.

EVIDENCE REQUIRED

VERIFIED

Fig. 05 · One requirement and the three things attached to it, before the change, at the moment the change lands, and after verification runs. The record stays open until the affected obligations are reviewed or rerun.

Proof does not just remember what was true.It knows what must be checked again.

Agents

Give your agents the same understanding.

Your agent shouldn’t have to rediscover your system every time. Through MCP, coding agents query the same components, requirements, dependencies, hazards, issues, changes, reproducers, and verification obligations that your engineers see.

Code tells an agent what the system does.Proof tells it what the system must not stop doing.

The connection

DEVELOPER a person AGENT claude code, cursor PROOF the intent graph mcp DEVELOPER a person AGENT claude code, cursor PROOF the intent graph mcp
agent session proof mcp · jsonparser

~/src/jsonparser

I need to change Set() for nested arrays.

What can this affect?

Proof

RELEVANT INTENT

SYS-REQ-009 · SYS-REQ-069 · SYS-REQ-110

BLAST RADIUS

1 component · 5 files · 13 tests · 3 hazard obligations

HISTORY

1 related defect record · 2 known issue classes

REQUIRED BEFORE COMPLETION

  • reproducer
  • boundary obligation
  • nested-mutation property
  • documentation review

answered from the intent graph

The answer is not a file list. It is the intent the change touches, what the change can reach, what already went wrong here, and the evidence the change has to produce before it can be called done. The requirement identifiers are real and published; the counts in this session are illustrative.

Agent fix loop

Give the agent the evidence, not the bug report.

A normal issue asks the agent to reproduce the problem, reconstruct the intended behavior, find the relevant code, decide what else could break, and invent a completion test.

A Proof issue arrives with the violated requirement, blast radius, hazard context, reproducer, relevant code, and the evidence required to close it.

NORMAL ISSUE

“Set sometimes corrupts nested data.”

  1. 01investigate
  2. 02reproduce
  3. 03infer intent
  4. 04find code
  5. 05guess blast radius
  6. 06write test
  7. 07fix
  8. 08hope

PROOF ISSUE

arrives with

  • requirement
  • component
  • hazards
  • blast radius
  • reproducer
  • required evidence
  1. 01agent runs failure
  2. 02agent changes code
  3. 03Proof reruns obligations
  4. defect record is created

No reproducer, no finding.

Both columns are the same defect. The difference is what the work starts with.

The agent begins at the fix loop,not at the archaeology loop.

Compounding knowledge

Every change makes the next change safer.

Features, fixes, incidents, misses, reproducers, approvals, and evidence do not disappear into old pull requests. They remain attached to the intent they changed.

The next engineer—or the next agent—starts with the accumulated model of the system instead of reconstructing it from raw code.

ACCUMULATED MODEL WHAT STAYS ATTACHED FEATURE new behavior CHANGE RECORD what changed, and what proved it NEW REQUIREMENT + EVIDENCE requirements and evidence retained ISSUE an open known issue REPRODUCER the failure, kept as a test DEFECT RECORD evidence-bearing history after closure CLASS KNOWLEDGE hazard and class knowledge retained NEXT CHANGE starts with more context everything above is still attached ACCUMULATED MODEL WHAT STAYS ATTACHED FEATURE CHANGE RECORD NEW REQUIREMENT + EVIDENCE ISSUE REPRODUCER DEFECT RECORD CLASS KNOWLEDGE NEXT CHANGE
One lap. Every step leaves a line open, so the bundle is one line wide at the top and seven wide at the bottom. The band on the left carries all of it back to the start, which is why the next lap begins with more than this one did.

Public proof

We ran it on real software.

Public repository

github.com/buger/jsonparser

We started with jsonparser, a decade-old Go library we could not hide from. Formalizing its behavior produced 123 requirements, 28 of them approved so far, and the review found six defects that were then fixed upstream. Two further defects escaped the review, with 100% MC/DC on the affected code. The postmortem that names both is public, so the register carries two.

We published the miss, the proof gap, the reproducer, and the fix.

123

requirements

6

defects found and fixed upstream

2

misses published

Each finding carries a test you can run.

Not an opinion, not a warning, not a suggestion.

One finding, end to end

01requirement

SYS-REQ-009approved

Set() replaces the addressed value, creates a type-consistent path, or returns KeyPathNotFoundError. A person who owns the code approved that sentence before any code was judged against it.

specs/system/requirements/ · SYS-REQ-009.req.yaml

02defect

KI-3was violated

An array-index path component under an object parent produced malformed JSON output, and Set() returned it with a nil error. The caller had no signal that the bytes could not be parsed again.

proof/known-issues/ · KI-3.yaml

03reproducer

set_spec_test.goasserted the bug

One executable test, pinning the failure while it was live: it asserted that the output was not valid JSON. The file carries // Verifies: SYS-REQ-009 and // Reproduces: KI-3 on one screen, so it says which promise it proves and which failure it pins.

set_spec_test.go · TestSetArrayIndexUnderObjectMalformedJSON_KI3

04affected revision

parser.gointroduced_in: inceptionviolated here

The record names the code that carried it and dates it to the library's first release, so every revision before the fix is affected. The requirement's own history stamps the window: verification failing on 26 July 2026, passing again the next morning.

parser.go · createInsertComponent

05fix

DEFECT-260726-MFPAon master

Set() now replaces a mismatched container with the type the path expects, so every non-erroring call returns valid JSON. The defect record names the root cause, the obligation it added, and the regression test.

proof/problem-reports/ · DEFECT-260726-MFPA.yaml

06new evidence

set_spec_test.gopassing

The same test as step 03, still in the suite, flipped at the fix: it now asserts that every cross-type call returns valid JSON. The obligations on the requirement run against it again.

proof/ · evidence/ki3-set-array-index-under-object.yaml

07re-approved requirement

SYS-REQ-009verified

The same sentence as step 01, re-approved by the engineer who owns the code once the hardening was attached, with the defect named in the record as the reason for the re-approval.

specs/system/requirements/ · SYS-REQ-009.req.yaml, verification block

Seven steps, seven records, and each one is a file in the public repository. The requirement that opens the chain is the requirement that closes it.

The register

Six defects, four records, eight defect files. proof/problem-reports/ holds eight defect records and every one is fixed on master. Two of the eight were reported by outside contributors, credited by name in the CHANGELOG, which leaves six the review found by itself. The register below shows four records because it lists known issues, not defect files, and KI-2 and KI-4 were fixed later, in v1.6.0. The two published misses are the two credited outside, so they sit beside the six rather than inside them.

Finding What was wrong Result
KI-1

An empty key path component panicked in the key search instead of returning an error.

KI-1.yaml

Fixed
KI-2

ParseInt("-") returned zero with no error, a silent false success on sign-only input.

KI-2.yaml

Fixed
KI-3

Set() with an array-index path component under an object parent produced malformed JSON output.receipt above

KI-3.yaml

Fixed
KI-4

Set() on a top-level array index beyond the length returned a not-found error instead of appending.

KI-4.yaml

Fixed

Four issue records on the project's master branch, every one of them status: fixed, every one of them carrying the command that reproduces it. The wider defect history, including the two misses below, sits beside them in proof/problem-reports/.

We publish the promises we get wrong on the same register as the ones we get right. That is the only way you can check us.

How Proof knows

“Verified” should mean something you can rerun.

Proof checks the requirement before it judges the code, connects the claim to implementation and evidence, analyzes how it can fail, and leaves the resulting checks in your CI.

  1. 01

    APPROVE THE INTENT

    Engineers sign what the component must do.

  2. 02

    ANALYZE THE OBLIGATIONS

    Formal semantics and hazard analysis define what evidence is needed.

  3. 03

    BIND THE EVIDENCE

    Code, documentation, tests, proofs, reproducers, and coverage attach to the claim.

  4. 04

    RE-EARN THE RESULT

    Changes invalidate affected evidence and the gate runs again.

ON EVERY CHANGE ON EVERY CHANGE

Instruments

FRETish · Kind2 · Z3 · hazard analysis · MC/DC

property tests · fuzzing · executable reproducers · CI gate

Accountability

Who checks the checker.

Machines check everything, every time. People decide what a machine must not decide alone. This limit is written in the configuration. You can move it.

Agents

Run every check, on every commit. The quantity is more than a person can read.

A person

One person validates each finding before it reaches you. People sign the promises and the bar, and decide that a miss gets published. The published postmortem carries no personal signature, and we say so where we publish it.

Your engineers

Sign the promises. Each item an agent writes has a draft mark. An agent cannot approve its own requirement.

1 · counted against code ci green every line your tests touch, executed 2 · counted against the promises ci green covered by a test that can fail promises no test can fail on 1 · counted against code ci green every line your tests touch, executed 2 · counted against the promises ci green a test that can fail promises no test can fail on

Fig. 08 · CI is green in the two pictures. The second picture is possible only after the promises are written down.

Installation

Install Proof on one consequential component.

The Continuous Correctness Audit is the fastest way to build the first production-grade intent graph inside your software. We recover and formalize the requirements, your engineers approve them, and Proof binds the component to its hazards, code, documentation, issues, changes, and evidence.

Continuous Correctness Audit

The installation

Scope

ONE COMPONENT

  • roughly four weeks
  • fixed fee after scoping

What you keep

  • approved requirements
  • intent graph
  • hazard analysis
  • executable findings
  • change and defect evidence
  • agent access
  • CI gate

You finish with the graph, the evidence corpus, and a gate in your CI. Everything that runs stays yours.

The audit is how Proof gets installed. Proof is what stays.

Request confidential scoping → See the full engagement →

What you get is a file tree in your repository, not a PDF in your inbox.

Prove your software does what you promised.

What requirements are hiding in your codebase?

We run Proof on one public project each quarter, at our own cost. There is no invoice and no follow-up.

Leonid Bugaev · founder
sets the bar these promises are judged against, and publishes the misses on the same register