Continuous Correctness Audit · for agencies and delivery firms
You keep the client. We add the proof.
Proof works inside your engagement as a specialist assurance subcontractor. We build the record of what the software must do, and produce a failing test for every confirmed issue. Your team owns the fixes.
You stay prime · Proof verifies · your team delivers
Production depth: Go, Rust, JavaScript, TypeScript, Solidity. Newer: Python, Zig, Java, C#. Mostly Java or .NET? Say so early. · Who you would deal with
Capacity is getting harder to sell than results.
A client who bought eight engineers asks what the number is now that a model writes the first draft. Procurement compares your rate card against three firms with the same capability deck. Growth inside your own accounts needs a better reason than “we have people available”.
The real work stays invisible. Your team feels it in the estimates they pad. You cannot put it in a proposal, because “this needs work” is an opinion, and your client has one already.
New EU rules are pushing regulated clients to demand inspectable evidence from the suppliers they depend on. The legal duty is theirs. Producing the engineering evidence can become part of your delivery. What each rule asks for →
A finding is a work order.
It arrives as work you can reproduce, understand, estimate and accept. Not another opinion about the code.
We index the client's code first. Their history and support queue supply the why. Out of that comes the intent graph: the promises the software makes, approved by the engineers who own it, linked to the code and tests that carry each one, and to every place the code breaks one. A finding looks like this:
jsonparser/proof/known-issues/KI-3.yaml ← real, public, on master id: KI-3 title: Set with array-index path component under an object parent produces malformed JSON output affected_requirements: - SYS-REQ-009 - SYS-REQ-110 - SYS-REQ-112 severity: high severity_basis: reproducer reproducer_command: go test -v -run TestSetArrayIndexUnderObjectMalformedJSON_KI3 ./... status: fixed
Read it as a scope document. The requirement says what the software owes. The reproducer is the acceptance test. It is agreed before anyone writes a line of the fix. When it goes green, the gate re-checks the requirement, the traceability and the coverage.
The gate then stays in the client's CI and runs on every release without us. The ongoing service keeps the record and the evidence current as the software changes. It reviews new behaviour, surfaces confirmed violations, and re-establishes the proof behind affected requirements. Read the whole record · what month twelve looks like
Why this one says fixed, and how we score severity
KI-3 is closed and the fix is upstream. That is why we can show you all 28 fields of a real record. Read it for shape, not as a demonstration of the headline. This particular test asserted the defect while it was live, then we inverted it to assert the fix. A delivered finding runs the other way: red on your client's main until the fix passes.
Severity is our assessment, weighted by reachability and impact; a starting point for your triage, not a CVSS determination.
The claim is bounded on purpose: within a declared scope, for declared behaviors, with evidence commensurate with the consequence of failure.
You are the prime. We are the specialist.
Your client signs one contract, with you. We work behind it as a named specialist subcontractor. We charge you a fixed wholesale install fee and a flat monthly standing-audit fee. Both are agreed before work begins. Neither depends on the number or severity of findings. You price and deliver the engineering work separately.
Owns and decides
Signs one contract, with you. Approves us as a named subcontractor and authorises the access. Approves what the software must do, chooses what to repair, and keeps durable rights to the requirements, tests, reproducers and evidence.
Builds, then keeps re-auditing
The install puts the intent graph, the evidence and the gate in place for one component. After that the standing audit keeps them current as the software changes: new behaviour reviewed, affected evidence invalidated, your fixes re-verified, findings validated, the current state signed. We control the method, and every confirmed finding reaches the client.
Sells, builds, maintains
Holds the client contract, sets the client-facing price and invoices. You can add margin to both the install and the standing audit. Remediation, features and ongoing delivery are yours. We do not approach your registered clients without your written approval.
Why the separation is not just good manners
The party grading a fix should not be the party that wrote it. That rule is older than us. Take DO-178C, the guidance airborne software is certified against. At higher criticality levels it marks many verification objectives as requiring independence. The check is done by someone other than the item's author.
Working under your contract does not weaken that, because we still never write the fix we grade. What it could weaken is reporting: a verifier that reports only through the party being measured can be leaned on. Regulated schemes solve this by routing the report both ways. Under 45 CFR 95.626 the verifier of an at-risk state system reports to two parties at once. It reports to the federal agency at the same time it reports to the State.
We borrow that rule rather than the org chart. Every confirmed finding reaches the client, in full, whatever it says about anyone. You cannot withhold one, and neither can we. The written terms say how it binds us.
Four things you can sell.
01
A reason to be in the room
You arrive at a review with specific, evidenced defects in the client's own code. That is not the meeting where you ask whether budget opened up.
02
Acceptance stops being an argument
Closure stops being an argument. The acceptance evidence is agreed before the fix, and both sides can run the same check. A red test can still mean an afternoon or a month. We define what completion means. You decide how to price the work to reach it.
03
Staff changes cost you less
A new engineer's first pull request is graded against approved promises. When something breaks, the record carries the origin we could establish.
04
Something to say in an RFP
Every firm on the shortlist claims senior people. You commit to an independent correctness audit, and the reader can check it: the bar is published, and so is a defect we missed.
One model, six steps.
No second vendor relationship for your client to negotiate. They approve a named subcontractor and authorise the access.
CLIENT
|
+-- PARTNER (prime contract, invoices, delivery)
|
+-- delivery your engineers, your rates
+-- Proof assurance fixed wholesale fee, under your paper
01 · you sell it
You sell the assessment as part of your engagement.
02 · the client authorises
The client approves Proof as a named specialist subcontractor.
03 · we deliver the baseline
One component. Requirements your client's engineers approve, and a register of confirmed findings.
04 · you sell the fix
You scope, price and perform the remediation, at your own rates.
05 · we verify
We grade the result against the requirement, and the gate stays in their CI.
06 · the audit stands
The gate runs on every merge. Each month we review what changed, update the bar, validate new issues, re-verify your fixes and sign the current state.
07 · coverage grows
Coverage expands one component at a time. A new component is separately scoped, or covered by a plan whose monthly price includes it.
Pick a secure account, not your largest. And pick a component that is outside a live warranty: see the timing warning below.
What keeps you in the account.
A first engagement produces confirmed findings. What keeps a partner in the account is what comes after.
Changes carry their own record
A feature or behaviour change gets a record that states its intent and the requirements it moves. Your team keeps building, and the graph says what the work was for.
Fixed defects leave evidence behind
A closed finding leaves the original failure, the root cause, and a regression test pinned in CI. The audit warns when one passing test is used to claim a whole class is closed.
Coverage grows one component at a time
A new component gets a full install, separately scoped or covered by a plan that includes it. More covered surface is more work you are already positioned to do, and more margin on both our lines.
Your agents read the same data
Proof Portal exposes a read-only MCP endpoint. A coding agent gets the requirement, the known issues, the blast radius and the reproducer, with a token that sees exactly what its owner sees.
What an agent can and cannot do
Fifteen read-only tools over streamable HTTP, authenticated with a personal access token. They read the intent graph directly: look up a requirement and its evidence, list open findings, walk the graph around a node, compute a blast radius, find the tests that verify a requirement, and fetch a finding's reproducer. Any client that speaks HTTP MCP connects, including Claude Code and Codex.
The endpoint is read-only by construction. An agent cannot change your client's code, edit the audit, or start one. Audits are run by a person. A token inherits exactly the access its owner has and nothing more, and cross-account isolation is pinned by a security suite that gates every deploy.
The sentence that opens it.
We want to put an independent check around one component you depend on. We bring in a specialist as a named subcontractor under our contract with you. They write down what the component must do, and your engineers approve it. Any violation comes back as a test we can run ourselves. My team fixes what it finds. They verify the result and leave the checks running in your CI. You keep the requirements, the tests and the evidence.
Do not present the results alone. We co-present them with you. That is what keeps the evidence credible in your client's eyes, which is the whole reason it is worth anything to them.
You own the relationship. We protect the evidence.
Yours
- You control the sale and the account.
- You hold the client contract and invoice the client.
- You own the remediation and the delivery that follows.
- We do not approach your registered clients without your written approval.
- Co-brand it: delivered by you, assurance by Proof.
Ours
- We control the method and the bar.
- Every confirmed finding reaches the client, in full.
- Not paid per finding, and no percentage of the remediation. Our fees are fixed from the declared scope and change cadence.
- The client keeps durable rights to the requirements, tests, reproducers and evidence.
- No full white-label, while independent evidence is part of the claim.
A fit, or not.
A fit if
- You own a delivery outcome, not only the people. Your contract names a deliverable.
- You hold an account where you could raise this with a VP of Engineering.
- Your engineers could take a queue of reproducers and burn it down.
- You would rather compete on what you can prove than on your rate.
Not this page if
- You want published margins and a partner portal. We have neither.
- You need a certified penetration test. Engage an accredited security firm.
- You only place individual engineers, and the client directs the work.
- You want the audit branded as your own work.
- Your own team would be the one told about the findings. Read the engagement instead.
Before you pick a component: the warranty warning
Not every finding becomes paid work for you. Where the code sits inside a warranty period, an SLA, or a fixed-price scope, the fix is yours to absorb. Warranties normally cover every defect found in the period, whoever finds it, and acceptance does not close the question.
So the timing matters more than the account. The right moment to bring us in is before you sign, or before your client accepts. Six weeks into a warranty is the wrong moment. Check your own contract first; we cannot read it for you.
The reverse is also worth knowing. If you are taking over somebody else's codebase, no standard clause protects you from what they left behind. A dated baseline is the only thing that does, and that is what the first engagement produces.
Start with one account.
You need not name the client. Tell us what your team maintains, the stack, and who would own the remediation. We reply personally, with a scoping call or an honest no. Nothing is agreed until it is in writing.
Terms and the awkward questions · Selling into regulated accounts · The engagement