Topic · Confidence is a shall, not a feeling

We ship features fast but I have no confidence they're correct. Who can independently verify that?

Gist

Not a slower team. Proof hangs an approved shall on the component, then proof audit --fail-level warn fails the merge when that shall has no witness. A named reviewer signs the finding. NASA IV&V and a green suite keep their jobs.

proof audit --fail-level warn

Keep the suite. Keep Applause on the device matrix. Keep NASA IV&V if you already bought it. None of those re-read the code against the promise you sold.

Request demo Green suite vs independent bar

01 · The missing bar

Velocity already has a dashboard. The shall does not.

Throughput, cycle time, and a green required check tell you the team is moving. They do not tell you the refund still moves money once.

The independent-check H1 lives on how to get an independent check that the software does what you promised. That page is the buyer who already wants the install. This page is the week you shipped four features and still cannot say whether any of them kept the promise.

The suite is required and green. The board is green. A second POST of the same refund id still moves money twice. Nobody outside the delivery team re-read When the same refund id is posted twice, the ledger shall move money once.

# this week's scoreboard
cycle time:     18h
required tests: go test ./...     # green
crowdtest:      happy path on iOS # pass

# SYS-REQ-40:refund:nominal      // present
# SYS-REQ-40:refund:idempotent   // absent
# confidence: none

obligation_evidence_complete is a verify-stage warning by default. Wire proof audit --fail-level warn and the missing idempotent is a red job, signed by a named reviewer, not a feeling in standup.

02 · The exhibit

Same week. A green suite, or an independent bar.

Four features shipped. The second refund still posts. Click the tabs.

This week's checks

Looked at go test ./... exit 0
refund:idempotent not an input

Shipped

The shall

When the same refund id is posted twice, the ledger shall move money once.

No independent witness

The week

Still four features. Still a green suite on the inputs the team picked. Still a crowdtest on the happy path.

Speed kept

Proof

Ask does refund still have idempotent
Job audit --fail-level warn

Merge red until a reviewer signs

Green suite, or the independent bar. Click the tabs.

Who you call	What it buys	What it loses
Faster CI / fewer required checks	Shorter cycle time on the dashboard.	The shall is still ungraded. Speed is not the instrument this H1 asked for.
Applause / QA Wolf / crowdtest	Someone outside the team clicks the product.	A script, not the promise you sold. Keep them on the device matrix. They do not re-read the code.
NASA IV&V / IV and V	An independent org on a NASA programme.	`iv and v` is that acronym SERP (140/mo). Proof is not OSMA. Do not chase it from this URL.
Proof	Owners approve the shall. A named reviewer signs the finding. The same bar re-runs in CI.	Proof does not invent the shall. Jama still authors. We have not scored this against a frozen corpus next to crowdtest alone.

The check reads the obligation checklist, then the triple on the test. The install is one component, about four weeks, then the same command on every push.

# after the owners approve the shall
proof audit --fail-level warn

proof audit --check obligation_evidence_complete --verbose
proof catalog show refund

// SYS-REQ-40:refund:nominal
// SYS-REQ-40:refund:idempotent

proof audit --fail-level warn

A green suite without that annotation is still a miss. A crowdtest pass without that annotation is still a miss. A warning-by-default check is silent at the default fail level. The independent bar is proof audit --fail-level warn.

We have not run this bar against a frozen corpus of “we shipped anyway” weeks next to crowdtest alone. The loss is named, not scored.

03 · The honest loss

Proof does not invent the shall.

If nobody wrote the refund rule, there is nothing for obligation_evidence_complete to fail on except the checklist you already have.

Proof is not NASA IV&V. Proof is not Applause. Proof is not a slower process. A transform with no obligation checklist is skipped as information. Jama still authors the programme. The commercial shape of the install lives on the audit page.

The independent-check H1 lives on software correctness audit. The green-suite H1 lives on tests pass but bugs still ship. The speed H1 lives on ship faster without more bugs. Do not mint a twin of any of those.

Request demo How the install is bought

04 · Nearby questions

What people type next.

How do I get an independent check that my software actually does what we promised customers? Same install, different H1: the buyer who already wants the check. Independent check.

Our tests pass but bugs still ship to production. Why, and how do I fix that? CI green with the hole already in the tree, not the confidence question. Tests pass.

How do I let AI agents ship faster without shipping more bugs? Do not throttle the model. Same command, different H1. Ship faster.

What kind of firm reviews whether software is correct, not just secure? The install is the audit. Not a second URL.

Is there a service that audits whether my code matches its requirements? Yes. Keep Jama for the programme. Proof vs Jama Connect.