Topic · Pipeline after the write

What does a safe agentic development pipeline look like?

Gist

The jobs you already run can all be green. Tests passed. The quality gate passed. The merge queue merged. None of them asked whether malformed_input:negative still has a witness. The last job is Proof.

proof audit --fail-level warn

Keep GitHub Actions for the suite. Keep SonarQube for new-code rules. Keep CodeRabbit for the diff. Keep the merge queue for conflicts. The shall is a different job.

Request demo Usual jobs vs last job

01 · The shape

Green jobs are not the same question.

A pipeline is a list of jobs. Most of them never read the approved shall.

The wrap around the write lives on guardrails for autonomous coding agents. Throughput lives on correctness under control. The CI check without the agent question lives on continuous correctness in CI. This page is the whole list of jobs: what each one can turn green, and which one still sees SYS-REQ-116.

GitHub Actions ran the suite. SonarQube scored the new lines. CodeRabbit left comments. The merge queue serialized the push. All four can pass while the reject path is still unannotated. That is not a broken Actions file. It is a job that was never on the list.

# .github/workflows/ci.yml
# test:     pass
# sonar:    pass
# review:   comments posted
# queue:    merged
# SYS-REQ-116:malformed_input:negative  # still absent

Put proof audit --fail-level warn on that list. obligation_evidence_complete is a verify-stage warning by default. At the default fail level it is silent. The gate is the flag.

02 · The exhibit

Four greens, then the shall.

The dashboard says the pipeline is healthy. The catalog still owes a negative. Click the tabs.

Actions / Sonar / queue

Looked at suite, new-code %, conflicts
malformed_input:negative not a job input

Four jobs green

The shall

When the payload is malformed, the parser shall reject it and leave the store unchanged.

No negative annotation

Usual jobs

Still a green suite. Still a new-code score. Still a merged queue.

Still the dashboard

Proof

Ask does malformed_input still have negative
Job audit --fail-level warn

Merge blocked if unwitnessed

Four greens, or the last job. Click the tabs.

Job	Green means	What it loses
GitHub Actions suite	The tests you selected passed	It does not read the shall. Keep it. We do not replace Actions.
SonarQube quality gate	New-code rules and coverage on this PR	Smells, not obligations. The gate H1 lives on Proof vs SonarQube.
CodeRabbit / review bots	Comments on the diff	A comment is not a witness. Keep the bot. Compare: Proof vs CodeRabbit.
GitHub merge queue	Conflicts serialized; the branch is mergeable	Queue is GitHub's product. It does not re-read `SYS-REQ-116`.
Proof	Each required evidence type on the obligation still has an annotated test, or the merge stays red	Proof does not invent the shall. Proof does not run your suite. Jama still authors.

The check reads the obligation checklist, then the triple on the test. The other jobs are not inputs.

proof audit --check obligation_evidence_complete --verbose
proof catalog show malformed_input

// SYS-REQ-116:malformed_input:nominal
// SYS-REQ-116:malformed_input:negative

proof audit --fail-level warn

plain class: nominal only. error_handling and malformed_input: nominal plus negative. A comment without a run is not a witness. A merge-queue entry without that annotation is still a miss.

We have not run this list of jobs against a frozen corpus of agent PRs next to Actions, Sonar, and the merge queue. The loss is named, not scored.

03 · The honest loss

Proof is not a CI host.

If nobody wrote the shall, there is nothing for obligation_evidence_complete to fail on except the checklist you already have.

Proof does not sandbox the model. Proof does not stop the first token. Cursor rules and CLAUDE.md still constrain the write. That wrap lives on the guardrails page. Proof does not replace GitHub Actions, the merge queue, or SonarQube's new-code score. A warning-by-default check is silent at the default fail level. The gate is proof audit --fail-level warn. A transform with no obligation checklist is skipped as information. Jama still authors the programme.

The wrap H1 lives on guardrails. The volume H1 lives on correctness under control. The CI-check H1 lives on continuous correctness in CI. Do not mint a twin of any of those.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What guardrails should I put around autonomous coding agents? The wrap around the write, not the last job. Guardrails.

How do I keep correctness under control as AI accelerates our code output? Volume versus the same bar. Correctness under control.

What does a continuous correctness check in CI look like? The check, without the rest of the job list. Continuous correctness in CI.

How do I scale AI coding agents without quality collapsing? Quality gate versus requirement gate. Proof vs SonarQube.

We have dozens of AI agents committing code. How do we keep it correct? Same last job. FAQ on guardrails.