Topic · Formal verification

Is there a service that does formal verification of a component for me?

Yes. Proof hangs Z3 lemmas on the functions you ship and Kind2 on the shalls, on one component. Then proof audit --fail-level warn fails the merge. TrustInSoft still wins on C. A Coq shop still wins on a kernel.

proof audit --fail-level warn

The DIY command for one function lives on the Z3 page. This page is the engagement: someone else attaches the lemmas, you keep the gate.

Request demo Report vs this function

01 · A report is not a solver

Formal verification as a service is lemmas that stay, not a PDF that ages.

UNSAT on the lemma means no input falsifies it. A slide that says “proved” is a date.

How you prove one Go function yourself lives on the Z3 / Kind2 page. The independent-check question that does not name solvers lives on software correctness audit. How you buy the install lives on the audit page. This page is the buyer question that names formal verification: is there a firm that will do that work on one component, and leave the check in CI.

proof verify-lemma scans // reqproof:lemma annotations, translates the function into SMT-LIB, and asks Z3 (or cvc5). UNSAT is PROVED for every parameter assignment. Kind2 is the other solver: proof realize specs/system <component> asks whether the shalls have any implementation at all. The service is those two instruments, installed, then gated.

proof verify-lemma --solver z3 ./pkg/...
proof realize specs/system ./...
proof audit --fail-level warn

The first command is the lemma. The second is realizability on the shalls. The third is the job that remains after we leave. Exit 0 is all checks pass. Exit 1 is an error at the selected level. Exit 2 is warnings only when fail-level is warn, and that still fails the job.

02 · The exhibit

Same property. Two artefacts.

Last quarter a consultancy wrote “the component was proved.” This push the lemma is next to the function. Click the tabs.

The PDF

When dated, signed, filed
CI not this merge

Looks closed

The function

The body moved. The report did not re-read it.

Unasked this push

The PDF

Still on the share. Still last quarter.

File exists

Proof

Lemma // reqproof:lemma on the function
Solver Z3 UNSAT, or Kind2 on the shalls

Merge blocked if it fails

Same property. Two artefacts. Click the tabs.

Who	What they prove	What they lose
TrustInSoft / Frama-C / CBMC	C (and cousins) at source level	They still win there. Proof lemmas are not that stack.
Coq / Isabelle shop	A kernel, a paper, a model in their language	The artefact is rarely the function you merge this week.
Certora	Solidity against a spec they wrote	Keep it for the contracts they already model. Not this Go component.
`proof verify-lemma` (you)	The lemma you hung on one function	DIY. That H1 stays on Z3 / Kind2.
Proof as the service	One component: lemmas + Kind2 shalls + the CI gate	Not Coq. Not C. Not a whole-system TLA+ model.

If the job is “prove this C module with a qualified analyzer,” keep TrustInSoft. If the job is “prove this Go (or Solidity) component against shalls we can re-run,” the lemmas have to live next to the function, and the job has to fail the merge. Proof does not invent the shall. It fails when the signed one has no witness, or when the lemma is not UNSAT.

03 · The honest loss

This is not Coq, and it is not TrustInSoft.

PROVED means the lemma you wrote, on the types we model. It does not mean the component is correct in every language a paper uses that word.

We have not run Proof and TrustInSoft, or Proof and a Coq consultancy, on the same frozen corpus. SPARK, Frama-C, and CBMC still win on C. Dafny and TLA+ still win when the spec is an arbitrary language. Kind2 is not TLA+ for sagas. Jama still wins at programme authoring. Expression lemmas do not model uint256 wraparound; Solidity claims that need wraparound stay on SMTChecker or an external proof annotation. Someone still has to approve the shalls on one component.

The DIY solver question stays on Z3 / Kind2. The independent-check question that does not name formal verification stays on software correctness audit. The CI clock stays on continuous correctness check in CI.

Request demo How the install is bought

04 · Nearby questions

What people type next.

How do I prove a specific function meets its specification using something like Z3 or Kind2? You run the solver. Z3 / Kind2.

How do I get an independent check that my software actually does what we promised customers? The audit question that does not name solvers. Software correctness audit.

What does a continuous correctness check in CI look like? The job, not the engagement. Continuous check in CI.

How do I write machine-checkable requirements for my software? The language. FRETish.