What is negative testing, and how do I keep the reject path true in CI?

Wikipedia, SmartBear, Tricentis, and GeeksforGeeks define the same act: feed invalid or unexpected input and check the software refuses it. That sits next to positive testing on the glossary. Proof does not replace that act. It asks a narrower question: if you wrote a security-classed requirement, is there a test that exercises the precondition-absent shape, or only the authorized happy path?

The motivating miss is mechanical. A request handler begins with if !cfg.JWT.Enabled { return Skipped }. The spec encodes only the happy path. The integration tests exercise the happy path with the control enabled. Review is performed. The audit reports clean. An attacker who flips the config flag bypasses the control entirely. No test ever asserted the unmet precondition was a reject.

The command is deterministic. It does not call a model. It does not generate the negative cases. It refuses a silent pass when an active security-classed requirement has no :negative triple-form witness.

proof audit --check negative_path_witness_required
proof catalog list --domain security

The first command is the reject-path floor. The second lists the live security-domain classes. Green happy-path coverage after a shall that names auth_required is how the skip branch stayed untested.

The witness looks like this on a test file:

// SYS-REQ-100:auth_required:negative
func TestEnforce_JWTConfigDisabled_Rejects(t *testing.T) {
    // arrange: cfg with JWT.Enabled = false
    // act: invoke the request handler
    // assert: 401 / 403 / denied, not Skipped
}

A requirement carrying auth_required and csrf_protection is satisfied on this gate as soon as either class has a :negative witness. Per-class evidence depth remains obligation_evidence_complete. This gate is the security-grade reject-path floor, as a union, so one quality test is enough here.

If the reject path is structurally impossible to drive from the harness, opt out on the spec with audit_ignore and a reason of at least 16 characters. Waived requirements stay visible in the summary. They never look like a silent skip.

We have not run SmartBear, Tricentis, and Proof on the same frozen corpus, and we have not scored this witness as a proof of the Go. The loss is named, not scored.

go test still owns the execution. Wikipedia and SmartBear still own the glossary. Jama still authors the shall. Proof stores the requirement in the repo and fails a silent pass when that shall has a security class and no reject-path witness. It does not invent the invalid inputs. It does not execute the test unless you wrote one. Non-security classes stay silent. The union semantic means one :negative on any listed security class clears this gate, not every class.

Proof is not Tricentis. It is not SmartBear. It is not ISTQB training. Jama still authors. VectorCAST or LDRA still win at a qualified C toolchain.

Random invalid input still lives on fuzz testing. The class of bugs the suite never checks still lives on bugs tests never check. Two implementations on the same input still live on differential testing.

What is the difference between positive testing and negative testing? Positive tests pin valid input. Negative tests pin invalid input. Wikipedia and SmartBear still win that glossary. proof audit --check negative_path_witness_required is the reject-path floor after the tests exist.

Is Proof an alternative to Tricentis or SmartBear? No. Keep the runner and the glossary. Proof checks that a security-classed shall sits on a real reject-path test. Jama still authors.

Does a happy-path test count? No. A bare // Verifies: on an authorized case witnesses the happy path. The security class needs its own :negative triple.

Does this cover every invalid input? No. The gate is security-classed requirements only. Fuzzing still lives on fuzz testing. Completeness of the input domain lives on equivalence partitioning.

How do I find the class of bugs my tests never check for? That H1 lives on bugs tests never check. This page is the reject-path witness, not that cluster.