Proof — Continuous Correctness Audit

An audit is a photograph.
This is a heartbeat.

Every finding becomes a permanent regression test. Every miss retires a whole bug family. Every quarter, another component comes under the bar. Month twelve knows more than month one.

Kind2 + Z3 model checking FRETish requirements (NASA) MC/DC coverage · 11 languages Hazard analysis Named engineer signatures

Everything below is drawn from a real audit — read the public jsonparser dossier →

Drag a year of assurance

Requirements under proof and bug classes closed, months one through twelve An area chart that grows as the month slider advances. Requirements under proof climb from zero to 123 over months one to four, then step upward as a second component enters, reaching about 240 by month twelve. A lower strip shows cumulative bug classes closed, stepping from zero to seven. Months five onward are a modeled projection. 0

Modeled on the jsonparser public audit; your curve depends on scope. Months 5–12: modeled projection

MONTH 1 OF 12

0
requirements under proof
0
classes closed forever
0
regression pins standing
1
components under the bar

MONTH 1

The promises get written down — engineers sign 123 requirements.

View the model as a table (observed months marked ·)
MonthReqs under proof Classes closedPins standingComponents

01 — Permanence

Classes close, not tickets.

A ticket closes once and can reopen anywhere. A class closes permanently: the finding lands as a failing reproducer, the fix makes it pass, and the pin stands in the gate forever. Its siblings get swept in the same pass — in the jsonparser audit, one panic class was closed at all eight sites where it lived, not just where it was found.

And when the audit itself misses, that closes a class too.

Published miss — jsonparser Set()

A data-loss defect in Set() escaped the audit — with 100% MC/DC coverage on the function. We published the postmortem, root-caused why the obligations didn't reach it, and turned the gap into a new gate check. That check now re-runs on every audit, of every codebase, permanently. Read the postmortem on the public portal →

02 — Operation

Agents and humans, one loop.

Every finding ships with an agent-ready prompt: the failing reproducer, the requirement it violates, and the constraints a fix must hold. Point your coding agent at it, or your engineers — the gate grades both the same way. Exit 0 or exit 1. No review theater.

Agents fix

Each finding carries a self-contained prompt an agent can act on directly.

Humans sign

Named engineers approve every requirement. A signature, not a checkbox.

The gate grades

CI exits 1 until every promise holds — whoever, or whatever, wrote the code.

90% / 30%

of teams now use AI to write code / trust what it writes. — DORA, 2025

46% vs 33%

developers who distrust AI-generated code accuracy vs trust it. — Stack Overflow survey, 2025

03 — Engagement

Four weeks to the first gate. Then it compounds.

We start with one component, fixed fee, about four weeks: requirements written and signed, findings delivered as failing reproducers, the gate live in your CI. Then the continuous phase — flat month to month — keeps every pin standing and brings the next component under the bar.

Fixed fee, scoped to one component

~4 weeks to a live CI gate

Continuous phase: flat, month to month

Stop any time — specs, pins & gate stay yours and keep running

Start the curve this quarter.

Tell us where to reach you and we'll come back with a scoping call — which component first, what the gate will check, and the fixed fee.

Received. We'll reply within one business day.

No deck, no drip campaign — a scoping reply from the engineer who runs your audit.