Severity
Every finding is graded, in the open. No burying a high behind a summary paragraph.
Proof is a standing audit of the promises your software makes. It re-runs on every change. When a promise breaks, you know first — as a signed finding with a reproducer, not a production surprise. The flat line is the product.
An audit you can't inspect is an opinion. Proof keeps a public register of every requirement it watches and every finding it raises — nothing summarized away, nothing quietly dropped. Each row carries its own evidence.
| ID | Class | Severity | Status | Evidence | Signed |
|---|---|---|---|---|---|
| F-001 | panic on malformed input · 8 call sites | HIGH | CLOSED · SAME DAY | reproducer + regression pin | named auditor |
| F-004 | Set() silent data loss | HIGH | CLOSED · FAMILY SWEPT | reproducer + public postmortem | named auditor |
| F-REP | contract drift (representative example) | MED | CLOSED | spec diff + pinned test | named auditor |
Every finding is graded, in the open. No burying a high behind a summary paragraph.
Open, closed, or waived — with the who and the when. The register never forgets a row.
A reproducer, a spec diff, a pinned test. Every claim on the register is re-runnable, not asserted.
A named person stands behind each verdict. Confidence you can attribute is confidence you can question.
When the trace spikes, Proof doesn't patch the one site and move on. It formalizes the broken promise, sweeps the whole family, and pins a regression so the class cannot come back. From the jsonparser engagement:
A silent data-loss defect in Set() escaped the initial audit — with 100% MC/DC coverage on the function. A downstream user caught it. We published the postmortem publicly, formalized the missing promise as a requirement, swept the entire defect family, and pinned it.
A one-time review depreciates the moment it's delivered. A standing audit appreciates: every approved requirement, every closed class, every pinned regression stays in the corpus and is re-verified on every change. The instrument never starts from zero.
Approved requirements stay approved until deliberately retired. The audit spends its effort on what changed, not on re-proving last quarter.
Every closed class carries a pinned regression. A recurrence isn't a new bug — it's an alarm on a known promise, caught before merge.
When code moves away from its spec, the trace shows it as drift — visible on the register, not discovered in an incident review.
The engagement is deliberately small and sharp: one component, fixed fee, about four weeks to a signed register — then the audit keeps running as your code keeps changing.
Pick the code whose failures cost you sleep — a parser, a billing path, a sync engine. Fixed fee, agreed up front.
We formalize what the component actually guarantees. You approve each requirement — nothing enters the corpus unsigned.
Findings land on the register with severity, reproducer, and status. Classes get closed and pinned, not patched.
The audit re-runs on every change. The steady reading — and the first word when it spikes — is what you're buying.