Topic · AI-native audit

Who audits AI-generated code for correctness?

Proof installs a Continuous Correctness Audit on one component whose code is mostly model-written. The owners of that component approve the shalls. Then the same checks re-run in CI.

proof audit

CodeRabbit still reviews the diff. Crowdtesters still click the happy path. An LLM eval still grades the model. None of them hold the code and the tests to a shall a human signed.

Request demo The triangle vs the shall

01 · The circular proof

The model wrote the function and the test that agrees with it.

Agreement was never the question. The question is whether either artifact matches a shall someone approved.

Verifying one patch before merge is the developer loop. An independent check that the component still does what you sold is the correctness audit. This page is the buyer question when most of the code, and most of the tests, came out of a model: who holds both to intent that did not come from that window.

The install is the same shape as the other audit: one component, about four weeks, a fee fixed after scoping. We draft the requirements from the code, the tracker, and the docs nobody updated. Owners approve every clause before any line is judged. A person validates every finding before you see it. What stays is not a PDF. The graph, the records, and the gate land in the repository.

proof audit --check spec_lint_ac_subset_of_satisfies
proof audit --check acceptance_criteria_witnessed

spec_lint_ac_subset_of_satisfies fails if an acceptance criterion is not a subset of a shall. acceptance_criteria_witnessed fails if a shall has no witnessed criterion. A green unit test the model also wrote does not clear either check.

02 · The exhibit

Two artefacts can agree and still miss the shall.

Same commit. The test is green because it was derived from the code it is checking. Click the tabs.

Model-written code

Source the same window
Tests also from that window

Build is green

The approved shall

Not in context. Not a witness. The PR bot never opened it.

Not consulted

The green build

Still agrees with itself. That was never the bar.

Agreement

Proof

Bar owner-signed shalls
Fail no witnessed criterion

Merge blocked

Same commit. Two bars. Click the tabs.

Job	LLM eval / PR bot / crowdtest	Proof
Who writes the bar	The model, a linter, or a click script.	Shalls the component owners approve.
What agrees	Code and tests from the same context window.	Each artifact against the signed shall.
What you keep	A score, a comment thread, or a PDF.	A gate in CI. The same bar on the next commit.
When it fails	Style, a vuln, or a path a tester clicked.	When `proof audit` is red.
Stops the merge?	If someone reads the thread and blocks.	Yes, when the check is on the audit.

We have not run a frozen corpus of model-written components against crowdtest firms, PR bots, or LLM evals. The loss is named, not scored. CodeRabbit still reads the diff. Applause still clicks the product. Those jobs stay. They are not a substitute for a witnessed shall.

03 · Honest loss

Proof does not evaluate the model.

It does not red-team the LLM, score a leaderboard, or sandbox the agent. It fails the merge after the files are already in the tree.

This is not a pentest, not SOC 2, and not an LLM eval. Snyk still owns the vuln inbox. Jama still authors the programme. A green proof audit means the checks we selected passed on the approved shalls. It does not mean we selected every promise a salesperson ever made, and it does not mean the model will stop writing the next wrong function.

The developer question (is this new function actually correct) stays on verify AI agent code. The independent-check question that does not name AI stays on software correctness audit. After week four the gate is in your CI. The engagement can stop. The bar does not. That install is the audit.

Request demo How the install is bought

04 · Next

What people type next.

How do I verify code that an AI agent wrote is actually correct? New function, new test, same context window. Verify AI agent code.

Is there an audit specifically for AI-native or model-written systems? Yes. This page. The instrument is the same Continuous Correctness Audit. The circular proof is why the install exists for this stack.

How do I get assurance on a system where most of the code was written by AI? Owners sign the shalls. Then proof audit re-runs. The commercial shape is on the audit page.

How do I catch when an AI agent silently breaks an existing requirement? Reverse suspect: the code is newer than the shall. Silent requirement break.