No pitch. This is the deliverable.
The working register from our public audit of jsonparser, a widely used Go JSON library. Each finding: formal requirement, reproducer pinned as a permanent regression, hazard note, named signature, and an agent-ready fix prompt. Click any row.
| ID | Class | Severity | Status | Evidence | Class-closed? |
|---|
Notes F-001 and MISS-001 are documented verbatim from the public audit. Rows marked REPRESENTATIVE illustrate the register format for the remaining findings without disclosing pre-publication detail. Nothing here is a testimonial, a logo, or an invented customer — it is the artifact itself.
Every finding above carries a named signature. The live register re-runs in CI on every change to the audited component — a row cannot silently disappear, and a closed class cannot silently reopen.
Schedule A — Method of work
PRF-R-01 · §AA.1Every fix closes a class, not a bug
A patched line is a bug fixed once. We root-cause each finding, sweep the codebase for every sibling site sharing the cause — F-001's panic class surfaced at 8 call sites — and the reproducer becomes a permanent regression pin. That class of failure can never silently return.
Even our one published miss got the same treatment: MISS-001 escaped with 100% MC/DC coverage, was caught by a downstream user, root-caused in a public postmortem, and its class was closed with a new gate check.
A.2The corpus compounds
The register sits on 123 approved requirements — a formal model of what the code must do, checked by Kind2 + Z3, written in FRETish (NASA lineage), with per-requirement hazard analysis and MC/DC coverage across 11 languages.
Each quarter, one more component comes under the bar. Month 12 knows everything month 1 learned, plus everything since. Confidence isn't a snapshot — it accrues.
A.3Agents and humans, same register
Every finding carries an agent-ready prompt: requirement, reproducer, sweep list, constraints. Hand it to a coding agent and it starts the fix with the full contract. Humans sign findings by name. The gate grades both the same way.
Industry context: 90% of teams now use AI in delivery, 30% trust its output (DORA 2025). 46% of developers actively distrust AI-generated code accuracy vs 33% who trust it (Stack Overflow 2025). The gap is verification. That's what the register is.