Topic · Correctness audit
How do I get an independent check that my software actually does what we promised customers?
Proof installs a Continuous Correctness Audit on one component. Your engineers approve the shalls. Then the same checks re-run in CI, signed by a named reviewer, with a reproducer on every finding.
proof auditApplause, Testlio, and QA Wolf exercise the product as a customer. Cobalt and SOC 2 check whether you can be hacked, or whether you follow the controls you wrote. None of them re-read the code against the promise.
01 · The distinction
Independence is cheap. A falsifiable promise is not.
Most “software audit” search results are a license count, an M&A due-diligence scan, or a week of crowdtesters. Those are real jobs. They are not a check that the component still does what you sold.
The install is bounded on purpose: one component, about four weeks, a fee fixed after scoping. We draft the requirements from the code, the tracker, and the docs nobody updated. The owners of the component approve every clause before any line is judged. A person validates every finding before you see it.
What stays is not a PDF. The graph, the records, and the gate land in your repository. After week four, a broken shall blocks the merge whether or not the engagement continues. That is the independent check: the same bar, on every change, without the delivery team grading its own exam.
proof audit --check spec_lint_ac_subset_of_satisfies
proof audit --check acceptance_criteria_witnessedspec_lint_ac_subset_of_satisfies fails if an acceptance criterion is not a subset of a shall. acceptance_criteria_witnessed fails if a shall has no witnessed criterion. Crowdtesting does not have those exits. A SOC 2 letter does not either.
02 · The exhibit
Four things people buy when they type “independent check.”
The models that searched this question named Applause, Testlio, QA Wolf, Cobalt, and TestRail. Those are the right firms for their jobs. Here is the split.
| Job | Crowdtest / pentest / SOC 2 | Proof |
|---|---|---|
| Who writes the bar | A test script, a pentest scope, or controls you defined. | Shalls the component owners approve. |
| What gets exercised | The product as a customer, or the attack surface. | The code against each approved clause. |
| What you keep | A report. It ages on day two. | A gate in CI. The same bar on the next commit. |
| When it fails | When a tester files a ticket, or a control is missing. | When proof audit is red. |
| Finding shape | A write-up. Sometimes a screenshot. | A confirmed finding with a reproducer, signed by a named reviewer. |
If the promise is “imports 100,000 records,” Applause can click through the happy path on a phone. If the promise is “SOC 2 Type II,” Schellman can attest the controls. If the promise is “this parser does not drop a field the shall named,” those firms are the wrong instrument. That is the audit we run.
03 · The honest loss
This is not a pentest, not SOC 2, and not a license count.
Google still serves Certero and Flexera for “software audit.” Black Duck still owns M&A due diligence. Proof will not produce those artifacts.
We do not replace Applause on a device matrix, Cobalt on an attack surface, or a Type II letter. We do not count seats. We are not DO-178 ISVV and we are not a qualified tool. The install is one component, not the estate. Jama still wins at programme authoring.
A green proof audit means the checks we selected passed on the approved shalls. It does not mean we selected every promise a salesperson ever made. Claims that never reached a requirement are outside the bar until someone writes them down and an owner signs them.
Security findings live on the Snyk compare. The commercial shape of the install is on the audit page.
04 · Nearby questions
What people type next.
Is there a service that audits whether my code matches its requirements? Yes. That is the install. Keep Jama for the programme; Proof re-reads the code. The ALM split is on the Jama page.
We passed a security audit but still ship functional bugs. A Snyk pass is a vuln scan. The requirement gate is a different check. That split is on the Snyk page.
Can it re-run on every release instead of a one-time report? After week four the gate is in your CI. The engagement can stop. The bar does not.