How sure are you?

Usually not. That is exactly how we met this bug.

jsonparser is a JSON library that has been trusted in production for a decade. Its Set() function could silently lose data — no error, no panic, just a wrong result handed back as if nothing happened. A test suite ran green over it for years.

This one got past our audit too — it escaped with 100% MC/DC coverage on the affected code, and a downstream user found it first. We treated the miss as a finding against ourselves: a public postmortem was published, the requirement that would have caught it was added and enforced, the whole failure class was swept for siblings, and the fix was pinned so it can never quietly return.

MISS-001 · postmortem public

More than you think — and a test suite cannot catch a promise nobody wrote down.

Every codebase carries obligations that exist only in old tickets, commit messages, and the heads of whoever wrote them. Proof recovers those requirements from your code, its history, and its issue tracker, states each one precisely in FRETish — a structured requirements notation with NASA lineage — and puts every line in front of your engineers to approve.

On jsonparser, that produced 123 approved requirements: the library’s actual contract, written down and signed for the first time in its ten-year life.

123 approved · FRETish · NASA lineage

The gate does — not the author.

The industry has already voted with its anxiety. Stack Overflow’s 2025 survey: 46% of developers distrust AI-generated code, against 33% who trust it. DORA 2025: 90% have adopted AI tools — and 30% report little or no trust in what those tools produce. Adoption without trust is the defining gap of this decade.

Proof closes it by refusing to care who typed the code. Agent-written and human-written changes are graded by the same bar, against the same signed requirements. And every finding ships with an agent-ready fix prompt, so the machinery that wrote the defect can be pointed straight at repairing it.

same bar, either author

Under Proof, a fix is not finished when the ticket closes.

Every confirmed defect becomes a permanent regression pin: a reproducer that runs on every audit, forever. If the bug ever tries to come back, it is caught before it ships — not rediscovered by a customer.

And every miss is root-caused, not just patched. If one function could fail this way, the functions shaped like it are swept too, and the whole pattern is pinned. Classes of bugs go extinct. Tickets merely close.

reproducer → pin → forever

With Proof, yes — and you would not need an engineer in the room to do it.

Every engagement maintains a register: each finding carries its severity, its current status, a runnable reproducer, and a named signature — a person who put their name on the judgment. It is written to be read by people who will never open the repository: your customers, your auditors, your board.

You do not have to imagine it. The jsonparser register is live and public.

portal.reqproof.com/projects/jsonparser

A fixed fee. No meters, no surprises.

The engagement starts with one component, about four weeks, for a fixed fee. At the end you hold a signed requirement register with evidence behind every line — whether or not you continue.

Then it becomes continuous: a flat rate, every change audited against the register, the pins running on every build. Stop any time. The register, the reproducers, and the evidence are yours, and everything keeps running without us.

fixed fee · exit anytime