Continuous Correctness Audit · for AI-native systems
A model writes the function. A model writes the test that agrees with it.
Neither knows what you meant. The test passes because it was derived from the same code it checks, so a green build measures agreement, and agreement was never the question. The question your board will eventually ask is “who vouches for this code, and can they show their work”, not “did CI pass”.
Request confidential scoping The engagement
Software does the work now. Someone still has to vouch for it.
Most teams reading this page are living the shift from the inside: production changes a model wrote and a reviewer skimmed. The wider industry is building entire service firms on the same premise, software doing the work with people supervising it.
The failure mode is already on record: audit-style paperwork generated at volume, conclusions that look alike from client to client, and no evidence anyone can re-run. When that work gets questioned, there is nothing underneath it.
Whichever side of that shift you are on, the scarce asset is the same: evidence someone outside the building can re-run.
Four things model-written code gets wrong, and where the audit stands.
Signed intent, recovered first
We turn what you meant into requirements the engineers who own the component approve before any code is judged, about two hours of their time in week one. The spec exists outside the model that wrote the code. That is the point of it.
Tests measured against the spec
A generated test usually mirrors the code it was generated beside. We measure your suite against the approved requirements instead of the implementation, so a test that agrees with a wrong function gets counted as what it is: agreement.
MC/DC on the decision logic
Condition-level MC/DC, a strictly harder bar than line coverage, on the decision logic that code-writing tools touch most and test least.
Timeouts and error paths
The least-tested surface in model-written code, by construction: models learn from examples, and examples are mostly happy paths. The bar requires timeout and error branches to hold at condition level, with evidence.
Each finding is a red reproducer, which is exactly the target a code-writing model needs: point your tooling at it, and the gate grades the whole change. A fix isn't done because the model says so; it's done when the reproducer finally passes and the gate agrees. The coverage bar is the same in all eleven languages we measure, so a polyglot codebase does not dilute the standard. Findings arrive agent-ready: every known issue carries a copy-ready prompt, context and reproducer included, so your own coding agents can be pointed at the fix with the evidence as the acceptance test. And unlike a session, the corpus persists: every future model and every future engineer inherits the same written intent instead of re-guessing it. None of this is hypothetical: read a public corpus, browse its live dashboard, or the ledger it feeds.
Two numbers, and only two.
Stack Overflow's 2025 developer survey put the top frustration with AI tools at 45%: solutions that are “almost right, but not quite.” The same survey found 66% of developers spending more time fixing almost-right AI code (the survey).
One component a model helps write. Four weeks. Evidence in your repo.
The same mechanics as Proof's flagship Continuous Correctness Audit. You choose one component with us, one where model-written changes land weekly and customers depend on the result. We scope it and quote a fixed fee, agreed before work starts. Roughly four weeks end to end.
Every finding ships with a runnable reproducer that fails on your current main, validated by a named reviewer, or it does not ship. The evidence corpus lands in your repo as plain YAML and executable tests, and the audit gate runs in your CI without us. Optionally continuous afterwards, a retainer on the cadence you choose, up to daily, so the claim gets re-earned on every release.
When the board asks who vouches for this code, the answer is an artifact: the signed register, and evidence you can re-run in front of them. Every finding is signed by name, so we take a limited number of engagements each quarter. The full engagement contract is on the flagship page →
Sound familiar?
A fit if
- Model-written code already runs in production paths your customers depend on.
- You can name the component where a wrong merge costs real money.
- You have a release cadence an audit gate can attach to.
Request confidential scoping.
Your email is the only required field; the rest is optional context. We reply personally, with a scoping call or an honest no. Fees are quoted after scoping, fixed before work starts.