Topic · Before the merge

How can I trust code generated by Claude or Copilot before merging it?

Proof puts the shall on the merge. Copilot and Claude still write the patch. The bar they cannot talk past is proof audit --fail-level warn.

proof audit --fail-level warn

GitHub Copilot still completes. Claude still opens the PR. CodeRabbit still comments on the diff. None of them re-read an approved shall.

Request demo Suggestion vs shall

01 · The merge moment

A green suggestion is next tokens. It is not a witness.

The question people type names Claude and Copilot because that is what sat in the editor. Trust, at that point, is whether this change keeps a promise a person already approved. Not whether the model is usually right.

The generic agent loop lives on verify code an AI agent wrote. That page is the circular proof: function and test from the same context window. This page is the named assistants, at merge. You accepted the completion. The suite is green. The PR is open. What fails if the refund exceeds the capture?

Copilot completes against the open file. Claude writes a patch and often writes the test that agrees with it. A review bot reads the hunk. All three can be green while the shall is missing. The shall is not in the prompt, not in the diff comment, and not in the coverage report.

proof audit --fail-level warn
proof audit --check suspect_clean

The first command fails CI when an approved shall has no witness on this change. The second is the reverse: code newer than the linked shall. That reverse case is when an agent silently breaks an existing requirement, not this URL.

02 · The exhibit

Three greens. The refund still overshoots.

Shall: a refund never exceeds the original capture. Copilot filled the remaining authorization. The test it wrote used the same remaining-authorization fixture.

Inline completion

Looked at the open file, next tokens
Refund remaining authorization

ACCEPTED

The shall

A refund never exceeds the original capture.

Not in the file

The PR

Function from Claude
Test same window, same fixture

GREEN

The shall

Still not a check. Agreement is not the capture cap.

Outside

The assistants

Still green. The remaining-authorization path still ships.

PASSED

Proof

Shall refund ≤ original capture
Gate no witness, merge fails

audit red

Click the tabs. The completion and the PR can both be green. The shall is the third column.

What ran	Green?	What it looked at
Copilot completion	Yes	Next tokens in the open file. Not the capture cap.
Claude PR + tests	Yes	The function and the test from the same window.
CodeRabbit on the diff	Yes	The hunk. Style, local bugs. Not an approved shall.
`proof audit --fail-level warn`	No until a witness	Whether this change keeps the signed capture cap.

If the job is “complete the next line,” keep Copilot. If the job is “open a PR from a prompt,” keep Claude. If the job is “comment on this hunk,” keep CodeRabbit. If the job is “this refund must not exceed the capture, including the remaining-authorization spelling the model prefers,” those tools are the wrong instrument. That is the check we run.

03 · The honest loss

Proof is not Copilot, and it is not Claude Code.

We do not complete the next token. We do not replace the assistant. We fail the merge when the shall has no witness.

We have not run Proof and Copilot review, or Proof and Claude, on the same frozen corpus. A green proof audit means the approved shalls on this change have witnesses. It does not mean the model wrote the right shall. A person still has to approve the promise. Kind2 does not invent it.

CodeRabbit still reviews the diff. That compare is Proof vs CodeRabbit. The generic agent question stays on verify AI agent code. Guardrails for a fleet of autonomous agents stay on guardrails. Jama still wins at programme authoring. The commercial shape of the install is on the audit page.

Request demo How the install is bought

04 · Nearby questions

What people type next.

How do I verify code that an AI agent wrote is actually correct? Same mechanism, no named assistant. Verify AI agent code.

Who audits AI-generated code for correctness? The buyer question. Who audits.

What guardrails should I put around autonomous coding agents? The fleet merge exit, not the Copilot keystroke. Guardrails.

What's a reliable way to gate AI pull requests on correctness? The CodeRabbit compare owns that H1. Proof vs CodeRabbit.