Topic · Correctness under AI volume

How do I keep correctness under control as AI accelerates our code output?

Gist

Proof fails the merge with proof audit --fail-level warn at 3 PRs a day or 30. SonarQube scores new lines. CodeRabbit comments on every diff. Neither re-reads the shall when the queue grows.

proof audit --fail-level warn

Keep the quality gate for smells. Keep the review bot for the diff. The bar that does not move with volume is obligation_evidence_complete.

Request demo Queue vs bar

01 · The volume

More PRs is not more assurance.

Agents write faster than a reviewer reads. Cover on new code stays green because the model also wrote the test.

The wrap around the agent lives on guardrails for autonomous coding agents. The review queue lives on review at scale. The quality-gate incumbent lives on Proof vs SonarQube. This page is the throughput question: output went up; the approved shalls did not.

A ruleset on new code scales with lines. A comment bot scales with diffs. A human queue does not. None of those re-read SYS-REQ-116 after the 40th agent commit this morning. The obligation still wants nominal and negative. Volume does not fill the missing cell.

// this morning: 14 agent PRs, cover 96% on new code
// SYS-REQ-116:malformed_input:nominal   // still the only annotation
// SYS-REQ-116:malformed_input:negative  // still absent

obligation_evidence_complete is a verify-stage warning by default. Wire proof audit --fail-level warn and the missing negative fails the 14th push the same way it failed the first.

02 · The exhibit

Same shall. A bigger queue, or the same bar.

The dashboard says the team is shipping. The catalog still owes a negative. Click the tabs.

Volume tools

Looked at new-code %, comment count, open reviews
malformed_input:negative not in scope

14 PRs, gate green

The shall

When the payload is malformed, the parser shall reject it and leave the store unchanged.

No negative annotation

Volume tools

Still a bigger queue. Still a new-code score. Still no reject path.

Still the dashboard

Proof

Ask does malformed_input still have negative
Gate audit --fail-level warn

Merge blocked if unwitnessed

Same shall. A bigger queue, or the same bar. Click the tabs.

Who	What they notice	What they lose
SonarQube quality gate	New-code rules and coverage on the lines this PR added	They keep smells and org dashboards. They do not re-read the shall. Keep them.
CodeRabbit / review bots	Comments that scale with every agent diff	A comment is not a witness. Keep the bot. The gate H1 lives on Proof vs CodeRabbit.
The human queue	How many PRs are waiting	Reviewers do not scale with token spend. That queue lives on review at scale.
Proof	Each required evidence type on the obligation still has an annotated test, or the merge stays red	Proof does not invent the shall. Proof does not slow the agents. Jama still authors.

The check reads the obligation checklist, then the triple on the test. Volume is not an input.

proof audit --check obligation_evidence_complete --verbose
proof catalog show malformed_input

// SYS-REQ-116:malformed_input:nominal
// SYS-REQ-116:malformed_input:negative

proof audit --fail-level warn

Fourteen green PRs with only nominal annotated is fourteen misses of the same class. plain class: nominal only. error_handling and malformed_input: nominal plus negative. A comment without a run is not a witness.

We have not run SonarQube against that gate on a frozen corpus of agent PRs. The loss is named, not scored.

03 · The honest loss

A red Proof audit is not a throttle on the agents.

If nobody wrote the shall, there is nothing for obligation_evidence_complete to fail on except the checklist you already have.

Proof does not sandbox the model. Proof does not stop the first token. Cursor rules and CLAUDE.md still constrain the write. That wrap lives on the guardrails page. Proof does not score new-code smells. SonarQube still does. Proof does not invent a partition that was never a condition. 100% MC/DC on the written decision still misses that case.

A warning-by-default check is silent at the default fail level. The gate is proof audit --fail-level warn. A transform with no obligation checklist is skipped as information. Jama still authors the programme.

The wrap H1 lives on guardrails. The queue H1 lives on review at scale. Shipping faster without more bugs is an FAQ here, not a second URL.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What guardrails should I put around autonomous coding agents? The wrap around the write, not the bar after it. Guardrails.

What's the best way to review AI-generated code for correctness at scale? The queue versus the gate. Review at scale.

How do I scale AI coding agents without quality collapsing? Quality gate versus requirement gate. Proof vs SonarQube.

How do I let AI agents ship faster without shipping more bugs? Same bar, same command. FAQ on this URL. Do not mint a twin.

We have dozens of AI agents committing code. How do we keep it correct? Same gate. FAQ on guardrails.