Partner program · for agencies and delivery firms
You keep the client. We add the proof.
Proof works inside your engagement as a specialist assurance subcontractor. We build the record of what the software must do, and turn every confirmed finding into a reproducer your team can run. Your team owns the fixes.
You stay primeProof verifiesyour team delivers
01 · Why you are reading this
Capacity is getting harder to sell than results.
A client who bought eight engineers asks what the number is now that a model writes the first draft. Procurement compares your rate card against three firms with the same capability deck. Growth inside your own accounts needs a better reason than “we have people available”.
The real work stays invisible. Your team feels it in the estimates they pad. You cannot put it in a proposal, because “this needs work” is an opinion, and your client has one already.
New EU rules are pushing regulated clients to demand inspectable evidence from the suppliers they depend on. The legal duty is theirs. Producing the engineering evidence can become part of your delivery.
02 · The unit of work
A finding is a work order.
It arrives as work you can reproduce, understand, estimate and accept. Not another opinion about the code.
We index the client’s code first. Their history and support queue supply the why. Out of that comes the intent graph: the promises the software makes, approved by the engineers who own it, linked to the code and tests that carry each one, and to every place the code breaks one. A finding looks like this:
jsonparser/proof/known-issues/KI-3.yaml ← real, public, on master id: KI-3 title: Set with array-index path component under an object parent produces malformed JSON output affected_requirements: - SYS-REQ-009 - SYS-REQ-110 - SYS-REQ-112 severity: high severity_basis: reproducer reproducer_command: go test -v -run TestSetArrayIndexUnderObjectMalformedJSON_KI3 ./... status: fixed
Read it as a scope document. The requirement says what the software owes. The reproducer is the acceptance test. It is agreed before anyone writes a line of the fix. When the fix lands, the gate re-checks the requirement, the traceability and the coverage.
The gate then stays in the client’s CI and runs on every release without us. The standing audit keeps the record and the evidence current as the software changes: it reviews new behaviour, surfaces confirmed violations, and re-establishes the proof behind affected requirements.
Read the whole record → The public corpus it lives in →
Why this one says fixed
KI-3 is closed and its fix is upstream. That is why we can show you a real record in full: read it for shape, not as an open defect. A reproducer pins a finding one of two ways: it fails until the fix lands, or it asserts the broken behavior while that behavior is live and flips when the fix lands. The record says which; this one took the second path.
Severity is our assessment, weighted by reachability and impact; a starting point for your triage, not a CVSS determination. The claim is bounded on purpose: within a declared scope, for declared behaviors, with evidence commensurate with the consequence of failure.
03 · Who does what
You are the prime. We are the specialist.
Your client signs one contract, with you. We work behind it as a named specialist subcontractor. We charge you a fixed wholesale install fee and a flat monthly standing-audit fee, both agreed before work begins. Neither depends on the number or severity of findings. You price and deliver the engineering work separately.
Owns and decides
Signs one contract, with you. Approves us as a named subcontractor and authorises the access. Approves what the software must do, chooses what to repair, and keeps durable rights to the requirements, tests, reproducers and evidence.
Builds, then keeps re-auditing
The install puts the intent graph, the evidence and the gate in place for one component. After that the standing audit keeps them current as the software changes: new behaviour reviewed, affected evidence invalidated, your fixes re-verified, findings validated, the current state signed. We control the method, and every confirmed finding reaches the client.
Sells, builds, maintains
Holds the client contract, sets the client-facing price and invoices. You can add margin to both the install and the standing audit. Remediation, features and ongoing delivery are yours. We do not approach your registered clients without your written approval.
Why the separation is not just good manners
The party grading a fix should not be the party that wrote it. That rule is older than us. Take DO-178C, the guidance airborne software is certified against: at higher criticality levels it marks many verification objectives as requiring independence, so the check is done by someone other than the item’s author.
Working under your contract does not weaken that, because we still never write the fix we grade. What it could weaken is reporting: a verifier that reports only through the party being measured can be leaned on. Regulated schemes solve this by routing the report both ways. Under 45 CFR 95.626, the US federal rule for independent checks on at-risk state benefit systems, the verifier reports to the federal agency at the same time it reports to the State.
We borrow that rule rather than the org chart. Every confirmed finding reaches the client, in full, whatever it says about anyone. You cannot withhold one, and neither can we. It binds us the same way the five commitments do: in the engagement, in writing.
04 · What changes for you
Four things you can sell.
A reason to be in the room
You arrive at a review with specific, evidenced defects in the client’s own code. That is not the meeting where you ask whether budget opened up.
Acceptance stops being an argument
The acceptance evidence is agreed before the fix, and both sides can run the same check. A red test can still mean an afternoon or a month. We define what completion means; you decide how to price the work to reach it.
Staff changes cost you less
A new engineer’s first pull request is graded against approved promises. When something breaks, the record carries the origin we could establish.
Something to say in an RFP
Every firm on the shortlist claims senior people. You commit to an independent correctness audit, and the reader can check it: the bar is published, and so is a defect we missed.
05 · The operating model
One model, six steps.
No second vendor relationship for your client to negotiate. They approve a named subcontractor and authorise the access.
CLIENT | +-- PARTNER (prime contract, invoices, delivery) | +-- delivery your engineers, your rates +-- Proof assurance fixed wholesale fee, under your paper
01 · You sell it
You sell the assessment as part of your engagement.
02 · The client authorises
The client approves Proof as a named specialist subcontractor.
03 · We deliver the baseline
One component. Requirements your client’s engineers approve, and a register of confirmed findings.
04 · You sell the fix
You scope, price and perform the remediation, at your own rates.
05 · We verify
We grade the result against the requirement, and the gate stays in their CI.
06 · The audit stands
The gate runs on every merge. Each month we review what changed, update the bar, validate new issues, re-verify your fixes and sign the current state.
Pick a secure account, not your largest. And pick a component that is outside a live warranty: the timing warning is below, next to fit.
06 · After the first backlog
What keeps you in the account.
A first engagement produces confirmed findings. What keeps a partner in the account is what comes after.
Changes carry their own record
A feature or behaviour change gets a record that states its intent and the requirements it moves. Your team keeps building, and the graph says what the work was for.
Fixed defects leave evidence behind
A closed finding leaves the original failure, the root cause, and a regression test pinned in CI. The audit warns when one passing test is used to claim a whole class is closed.
Coverage grows one component at a time
A new component gets a full install, separately scoped or sized into the standing fee at scoping. More covered surface is more work you are already positioned to do, and more margin on both our lines.
Your agents read the same graph
Your coding agents query the intent graph directly: the components, requirements, dependencies, hazards, known issues, changes, reproducers and verification obligations your client’s engineers approved. The agent starts from approved intent instead of rediscovering the system from raw code.
What an agent can and cannot do
The agent’s access is read-only by construction, and it sees exactly what its owner is allowed to see. An agent cannot change your client’s code, edit the audit, or start one; audits are run by a person.
Agents reach the graph over MCP — Claude Code, Codex, or any MCP client connects to the same live surface your client’s engineers read. What the agent receives →
07 · What to say to your client
The sentence that opens it.
“We want to put an independent check around one component you depend on. We bring in a specialist as a named subcontractor under our contract with you. They write down what the component must do, and your engineers approve it. Any violation comes back as a test we can run ourselves. My team fixes what it finds. They verify the result and leave the checks running in your CI. You keep the requirements, the tests and the evidence.”
Do not present the results alone. We co-present them with you. That is what keeps the evidence credible in your client’s eyes, which is the whole reason it is worth anything to them.
08 · The boundary
You own the relationship. We protect the evidence.
Yours
- You control the sale and the account.
- You hold the client contract and invoice the client.
- You own the remediation and the delivery that follows.
- We do not approach your registered clients without your written approval.
- Co-brand it: delivered by you, assurance by Proof.
Ours
- We control the method and the bar.
- Every confirmed finding reaches the client, in full.
- Not paid per finding, and no percentage of the remediation. Our fees are fixed from the declared scope and change cadence.
- The client keeps durable rights to the requirements, tests, reproducers and evidence.
- No full white-label, while independent evidence is part of the claim.
09 · Fit
A fit, or not.
A fit if
- You own a delivery outcome, not only the people. Your contract names a deliverable.
- You hold an account where you could raise this with a VP of Engineering.
- Your engineers could take a queue of reproducers and burn it down.
- You would rather compete on what you can prove than on your rate.
Not this page if
- You want published margins and a partner portal. We have neither.
- You need a certified penetration test. Engage an accredited security firm.
- You only place individual engineers, and the client directs the work.
- You want the audit branded as your own work.
- Your own team would be the one told about the findings. Read the audit itself instead.
Before you pick a component · the warranty warning
Not every finding becomes paid work for you. Where the code sits inside a warranty period, an SLA, or a fixed-price scope, the fix is yours to absorb. Warranties normally cover every defect found in the period, whoever finds it, and acceptance does not close the question.
So the timing matters more than the account. The right moment to bring us in is before you sign, or before your client accepts. Six weeks into a warranty is the wrong moment. Check your own contract first; we cannot read it for you.
The reverse is also worth knowing. If you are taking over somebody else’s codebase, no standard clause protects you from what they left behind. A dated baseline is the only thing that does, and that is what the first engagement produces.
The engine is language-agnostic; the published work is Go, and that is the only depth we can show you today. Python, Zig, Java, and C# are newer; we will tell you honestly where each stands. C and C++ arrive through the compiler’s own coverage measurement, in the same gate. Another stack? Say so on the form and you get an honest timeline.
Start
Start with one account.
You need not name the client. Tell us what your team maintains, the stack, and who would own the remediation. Every request gets a reply — a scoping call or an honest no.
The engagement your client would get, in full: the Continuous Correctness Audit.
Who you would deal with: about the practice.
Prefer a call? Ask for 20 minutes →