Contracts are the single source of semantic truth. You write them once as plain Python; the same artifact runs as a test today and lowers to a Coq proof obligation tomorrow. The gradient is BDD → executable contracts → mechanised proof, and each rung is useful on its own.
Specification-driven verification. Contracts — preconditions, postconditions, invariants, frame conditions, and exception exits — written as plain Python functions and organised by entry point. The contract language is the single source of semantic truth from which every test and proof artefact is derived.
Mechanised proof for vanilla Python. Contracts are plain assert statements — no imports, no decorators. A Coq + SMT pipeline proves properties; an LLM oracle handles the rest. Zero runtime overhead under python -O.
An MCP-based proof assistant for Rocq. Hash-addressed goals, coq-lsp-authoritative state, and parallel goal closure let frontier LLMs discharge real theorems — PCF type preservation for $0.06.
Vericoding Services
Models now write more code than you can review line by line. You specify what the program must do. We prove the implementation meets that specification, and where latency or compute cost is the problem, we replace it with a faster program that still does.
See the services
Software's core problem is knowing what it should do. AI-guided certified program refinement — vericoding — makes specification the artefact we tinker with, and lets AI guess program transformations that a theorem prover certifies.
From exam-gaming models to speciation and military embodiment — a map of AI risks, how we might assess them, and why mitigation is harder than it looks.
You do not have to go from zero to verified in one step. You can start with Gherkin scenarios, graduate to executable contracts with specsaver, and then bring in a theorem prover when you are ready. Contracts are the bridge.