Proof — Continuous Correctness Audit

Green builds aren’t proof. Evidence is.

Proof runs a continuous correctness audit: your promises, formalized; your code, held to them; every finding signed by name.

Scroll

01 The Pattern

Every growing product tells the same story.

Edge cases accumulate. Contracts drift. Regressions come back wearing new commit hashes. Then AI multiplied the code — faster than anyone can vouch for it.

The industry built instruments for speed. Nobody calibrated one for truth. The people shipping the code say so themselves:

0%
of developers distrust the accuracy of AI-generated code Stack Overflow Developer Survey, 2025
0%
trust it Stack Overflow Developer Survey, 2025
0%
of teams have adopted AI-assisted development DORA Report, 2025
0%
report little or no trust in its output DORA Report, 2025
02 The Claim

Security firms audit whether your software can be broken into. We audit whether it works.

Same rigor. Different question. The instrument is pointed at correctness: what your software promises, and whether the code keeps the promise — today, and on every commit after.

03 The Gate

One command. One reading. No interpretation required.

The audit is an instrument, not an opinion. Re-run it and the reading holds. One blocking finding, and the gate says no — to us, to you, to the release.

04 The Lineage

Borrowed from industries where software is not allowed to fail.

None of this instrumentation is new. It has flown. We adapted it for teams that ship every day, not once a decade.

04.1

Requirements that compute

Written in FRETish, NASA’s structured requirements language for flight software — English a machine can check, not prose a reviewer skims.

04.2

Formal verification

The Kind2 model checker and the Z3 theorem prover interrogate the requirement set itself: realizable, consistent, non-vacuous — before a single test runs.

04.3

Avionics-grade coverage

MC/DC — the coverage criterion certification demands for the software that flies aircraft — applied to every decision in the audited scope.

05 The Miss

An instrument is only trustworthy if you publish its error bars.

We audited jsonparser, a widely used Go JSON library. The instrument did its work — and then it missed one, and we published that too.

0
Requirements formalized
0
Bugs found
1
Published miss

A silent data-loss bug in Set() escaped the audit — with 100% MC/DC coverage on the books. The postmortem is public: what the instrument measured, why the reading was clean, and what we recalibrated so that class of miss can’t recur.

An audit firm that only shows you its wins is asking for faith.
06 The Engagement

Calibrate the instrument on one component. Then keep it running.

Fee Fixed, quoted at scoping
Scope One component, precisely bounded
First reading ~4 weeks, then continuous on every commit
Accountability Every finding signed by name

Received. We read every note ourselves — a named person will reply.

Confidential by default · No deck, no drip campaign · A short conversation about scope