Proven for organisations

What an organisation asks before it lets a code reviewer near its code, and what Proven answers. Each line links to the page or the decision that holds the detail. Where something is still being built, it says so.

Your code stays yours

It runs where your code is. On GitHub as an Action, on your own Gitea (ADR-0022), or from the command line on your own machines.
The change under review runs with no network and no secret. The Prover runs a test in a container with the network off, no environment passed in and one read-only mount of the checkout; the command it runs is built by Proven, never taken from a model (ADR-0025).
A model's answer is untrusted input. Every prompt and every answer goes through a guardrail, on by default (ADR-0005), and every query Proven sends to your data is built from a fixed template, never written by a model (ADR-0032).
Air-gapped mode, where nothing leaves your network: set PROVEN_NETWORK=local and Proven refuses any address outside your network, when it reads its settings and again when it dials (AIR_GAPPED.md, ADR-0034).

Every finding can be checked, later, by someone else

Evidence, not opinion. A finding is reported only with a test that fails on the change and passes before it, or a query and the rows it returned (ADR-0002), and each finding names its level of proof (ADR-0044).
A signed evidence pack for every review, and proven verify re-derives every verdict from the recorded evidence offline, so an auditor does not have to trust the stored result (EVIDENCE_PACK.md, ADR-0035).
Model receipts kept in custody: the signed receipts of the model calls behind a review are checked and kept (RECEIPT_CUSTODY.md).
Machine-readable output for your tools: JSON and SARIF for code scanning (OUTPUT_FORMATS.md).

Your rules, your data, your models

An organisation policy file sets the floor for every repository, with exceptions that accept one known finding until a date, with an owner and a reason (POLICY.md, ADR-0036).
No hidden settings. Every setting is listed with its default in CONFIGURATION.md (ADR-0013).
Your data layer through Zetaris: vulnerability and exploit data today, and the same path for your own sources (ZETARIS_USL.md, ADR-0046). Plugging in your own lists (banned packages, service criticality, code owners) is still in the plan.
Your evidence store: where review evidence is kept is an adapter (ADR-0047).
Every model is configurable, and the reviewer comes from a different model family than the author (ADR-0008, ADR-0010). Meterless Nightshift is the primary AI provider (ADR-0019).
Bring your own second reviewer from any OpenAI-compatible provider (ADR-0037): being built.

You can watch it and measure it

Every review is observable through OpenTelemetry, into Grafana or the monitoring you already run (ADR-0045).
Proven's own code is security-reviewed as a whole, piece by piece, and its weaknesses are published once fixed (security review, SECURITY.md).
What it does not do yet is listed, measured and dated, on the front page: Honest limits.

Try it

One command starts a lab on your machine with a Git server, demo pull requests reviewed by Proven and a live dashboard: LAB.md.