Less human time
per accepted change.
Stop rebuilding context and repeating checks. Review the evidence. Make the decisions that need you.
Give agents a
higher standard.
Adding proof to real-world software.
Inside Proof · Real project work
Review the change.
Inspect the evidence.
See a proposed fix, the requirement behind its checks, and a separate migration example. Each view links to real project evidence.
A parser fix · Omarchy
A parser removed a comma from inside a text value. The output still parsed, but the data changed.
Before · parsed
Keep f{.bak} Proposed fix · parsed
Keep f{.bak,} The comma is part of the label. Removing it changes the user’s data.
See what supports the fix.
Two test files passed. The record connects their results to the requirement and changed code, while keeping the remaining approval visible.
Why are these the right checks? ↓ Follow the complete review ↗
e491b524, captured 16 October 2026. One behavior difference still needed approval; the baseline later changed and a recheck is pending. Open full size ↗ · Exact portal record ↗ The same fix · Its requirement
Make the rule precise.
Then derive the checks.
A comma inside text must stay intact. Remove it only outside a string, when the next relevant character closes the object or array.
Proof connects that promise to a formal condition and its tests. You can inspect what the rule says, which cases it needs, and what the recorded checks establish.
Explore the four cases below ↓ How requirements guide verification ↗
e491b524. Open full size ↗ · Exact requirement ↗ LiteLLM · Python-to-Rust mirror
See what changed
behind the rewrite.
The Python implementation rejects a malformed OCR response. The Rust version substitutes default values. Both implementations cannot preserve the same behavior here.
Proof’s mirror exposes the difference so the team can decide what the new implementation should do. The overview groups four Low findings: two target issues, one inherited issue and one divergence.
Follow the migration example ↗ Inspect the live mirror ↗
Inside Proof · From a requirement to its checks
How do I know
I’ve tested enough?
A real Omarchy parser rule
Remove a comma only when it is outside a string and the next relevant character closes the object or array.
Looking ahead skips whitespace and // comments.
- 2 conditions
in this decision - 4 possible input
combinations - 3 cases show both
independent effects
Source-derived explanation · not a live execution
| Case | Inside a string? | Next relevant character closes? | Remove the comma? |
|---|---|---|---|
| 1 | No | Yes | Yes |
| 2 | No | No | No |
| 3 | Yes | Yes | No |
| 4 | Yes | No | No |
Change one condition.
Does the decision change?
Modified Condition/Decision Coverage (MC/DC) checks whether each condition can independently change the decision.
Two comparisons share case 1. Cases 1 + 2 isolate the closing character. Cases 1 + 3 isolate whether the comma is inside a string. Both comparisons flip the required decision.
Why seven assertions, then?
Three cases are a minimal unique-cause MC/DC set for this decision only. The real test also checks escaped quotes, comments and end-of-input, for seven assertions. This is a coverage target, not three observed tests or proof of complete correctness.
The source also records defensive exclusions. This explanation is based on e491b524; the review needs rechecking after a baseline change.
Less human time
Less rework.
Fewer regressions.
Find problems earlier. Keep regression checks and the lesson behind each fix.
More work safely
delegated to agents.
Let agents investigate, implement and verify within your rules.
01 / How Proof works
Higher standards.
Less work by hand.
Proof is software assurance for agentic engineering. It recovers intent, keeps agents within approved requirements and brings regulated engineering rigor to each change. You get evidence your toughest QA can review without testing everything again.
See the evidenceRequirements management
Recover intent. Make approved requirements the source of truth your agents must follow.
Hazard analysis
Find failure risks, guide fixes and require evidence before closing them.
MC/DC testing
Bring decision coverage used in safety-critical avionics to agent workflows.
Formal verification
Formalize requirements and critical code. Verify selected properties under stated assumptions.
A change. And the evidence to review it.
Your agent does the engineering.
You make the decisions that need you.
The Software Intent Graph connects approved intent, code, risks and evidence to each acceptance decision.
02 / Beyond the diff
“Just one line.”
The impact rarely stops there.
The Software Intent Graph connects requirements, code, dependencies, risks and checks. Your agent can see what a change must preserve, including promises the prompt never mentions.
It stays with your code and reaches agents through MCP. Select a label to explore the Omarchy menu fix.
See what depends on the change.
Intent. A new selection prompt must not leave an old uninstall confirmation active. This is the behavior the Omarchy fix preserves.
Code. The fix dismisses the previous uninstall confirmation when a new selection prompt arrives.
Dependencies. Selection, confirmation and the Enter key share menu state. Changing the prompt affects which action Enter can trigger.
Risks. A stale confirmation can turn Enter into an unintended uninstall. Dismissing it must preserve the normal selection flow.
Evidence. A 10-check regression suite fails before the fix and passes after it. A separate recording shows the behavior in the real shell.
The cutaway illustrates five connected layers: intent, what must hold; code, what implements the change; dependencies, what relies on it; risks, how it could fail; and evidence, the checks needed to support the change.
03 / Beyond code review
Code review was
never enough.
Proof helps you answer the questions a diff leaves open.
Follow a real Omarchy fix: an unexpected uninstall, the behavior it must preserve, and the checks that show the difference.
Omarchy PR 14054 · Recorded verification
Enter should answer the new prompt, not uninstall an app.
An old uninstall confirmation could stay open behind a new prompt. Pressing Enter then removed the app instead of returning the selected value.
The regression test fails before the fix and passes after it. Ten regression checks cover the prompt transitions and intentional confirmation behavior. A separate audit records 69 tests passed, with seven further passing checks in the behavior comparison.
The regression harness uses real QML function bodies with stubbed services. A separate recording shows the behavior in the real shell. These results support the scoped fix; maintainer acceptance is a separate decision.
04 / Knowledge that compounds
Every change makes
the next one stronger.
Proof keeps the intent, decisions, checks and lessons from each change in your Software Intent Graph. The next engineer or agent starts with what you already learned.
The more you use Proof, the less your agents need to rediscover.
Open issues stay visible. Evidence is checked again when its basis changes.
See what the next change inheritsProof retains
Software Intent Graph
Feature / change
New behavior or an intended update.
Change record
What changed, why, and the evidence behind it.
Requirements + evidence
New, updated and preserved requirements, with evidence.
- If a problem is found
Known issue
An unresolved problem, kept visible.
Reproducer
The failure kept as a repeatable test.
Verified fix / defect record
After verified closure: the issue, cause, fix and regression evidence.
Hazard & class knowledge
Related risks, limits and lessons. Broader risks can remain open.
Next change
Your agent starts with everything above attached.
05 / Public proof ledger
The proof is public.
Real projects. Reproducible findings. Fixes and limitations you can inspect.
Explore the proof ledgerSelected public records
rsync
Access-control fix and regression tests.
Released in 3.5.0gRPC-Go
Reject invalid credential metadata.
Merged upstreamGraphQL Hive Router
jsonparser
What the checks missed, and why.
Published postmortem Founder-maintained project
The misses belong in the record, too.
06 / FAQ
The obvious questions.
What the promise means, and where you still decide. Open any question.
-
01
What work does Proof remove?
Proof connects the intended behavior, relevant checks, observed results and remaining gaps so reviewers spend less time reconstructing them. Required manual checks and product decisions remain explicit. A pilot measures the work saved on your changes, including setup and later rework.
-
02
What does “NASA-grade” mean here?
It describes our ambition to bring requirements management, hazard analysis, MC/DC and formal methods into everyday agent workflows. Each method has a defined scope and needs appropriate inputs. Proof is not a DO-178C certification or a qualified replacement for your assurance process.
-
03
Who still has to say yes?
You can control what is required to be approved by humans and what is required to be approved by the agents. If you want the full agentic flow for the components you trust, that is totally possible. You can whitelist a component and say that it requires human approval whenever a change will touch it.
-
04
Is Proof a coding agent?
No. Proof is a platform, and it consists of these parts.
- Harness It lives inside your coding agent, works with any coding harness, and adds the required determinism and the engineering quality flow inside it. It then uploads these results to the dashboard.
- Orchestrator It lives inside your CI/CD. It can automatically triage all of the issues and the pull requests and do the code reviews for them. You can also connect it via MCP and make it work by generating the pull request with those changes, technically turning it into the AI factory you can actually trust.
- Dashboard Where those results go.
- MCP Humans or agents can use it to review the changes, see the overview of your system, and use this data to plan future changes or fix bugs.
-
05
Do I need written requirements first?
Proof has a flow to recover the intent from your code comments, pull requests, and Jira for the initial onboarding. Moving forward, Proof can act as a sidecar, which works in parallel with your standard development. Or you can start using it for your development directly, and use requirement management as your source of truth.
-
06
Do MC/DC and formal verification run on an ordinary pull request?
If the change this pull request touches requires this kind of evidence, then yes. Proof does not cut corners. It enforces what kind of evidence is required for the given change. If that evidence is formal verification, then yes, it absolutely should be done. Proof also knows how to run only the required subset of the tests. It can cut your CI/CD time by running only the necessary tests, while increasing your test coverage multiple times.
-
07
What does the first engagement include, and what does it cost?
Start with one change, in the agent workflow you already have. The repository stays closed on the first call. If you want the standing version, that is one component over about four weeks, with a few hours from the people who own it. The fee is quoted when the scope is clear, and fixed before the work starts. What we produce stays in your repository if you stop.
Start small. Learn from real work.
Ship with proof.
A feature, a fix, or work you hesitate to delegate.
See what your agent can take off your hands.
Send a link or a few sentences.
[email protected] Book a demoWe’ll scope a first use of Proof in your existing repo and agent workflow.
