Witness
26
bugs proven by execution, each one shipped with the failing test that proves it.
AI code review thatproves every claim
Witness writes a repro test, runs it at your base and head commit, and lets only a proven bug block the merge.
Repro test · 2 runs
base 7c41a091 passed · 0.42s
head 9c2d4b11 failed · 0.39s
ProvenSeverity score0.810critical
Sandboxed runat your base and head SHA
charge() dereferences a None currency when the account has no default
Blocks mergeMerge gateHeld1 proven bug blocks it. 2 more are advisory.
Refuted by itself5of its own claims, disproved before they reached a PR
26 proven10 open
9 stages · 4 parallelthe sandbox proof runs at stage 7
Proof in every
high-risk review
high-risk review
Audit chain
#1426ca78d6…b1d6
#1427954505…f771
#14288dbdc9…7fd0
hash verified26 bugs proven by execution · 5 of its own claims refuted before they reached a PR
Fifteen seconds
Watch Witness prove a bugbefore it reaches main.
Why Witness
A reviewer that earns trustby provingevery claimandowning its mistakes.
Findings per review
1.1714 specialists in parallel, 1 coordinator
89 published27 suppressed122 dropped
of 246 raised. The coordinator drops speculation, nitpicks and duplicates before you see them.
Self-caught false positives
0.119Claims it refuted with its own test before they reached a pull request.
n = 42Median review
28.7sWhat it does
Evidence built intoevery pull request
Three mechanics that replace an AI reviewer’s opinion with evidence your team can check, re‑run and audit.
See a proven findingSee a findingProof by execution
A repro test runs at your base and head commit. The failing output is attached to the finding, so nobody argues about whether the bug is real.
Learn moreSeverity you can recompute
Six weighted inputs, printed next to the score. Reachability, blast radius, test coverage: arithmetic you can check by hand.
Learn moreA record nobody can edit
Fingerprints stop the same nitpick from coming back, and every decision lands in a hash-chained audit trail.
Learn moreThe review team
Four specialists.One coordinated review.
Bugs, security, tests and quality run in parallel on every pull request. A coordinator merges them and drops the noise before anything reaches you.
Bugs & correctness
Null dereferences, money rounding and broken contracts. 42 published, 16 of them proven with a failing test.
Security
Token handling, auth gaps and exposed data, ranked by how reachable the code path really is. 21 published, 10 proven.
Tests & quality
Witness writes the repro test itself. Suggestions face the same bar: 83 of 127 were dropped as noise before anyone read them.
One coordinated review
246 findings raised, 89 published: about 1.171 per pull request, merged into one comment and never an approval.
charge() dereferences a None currency when the account has no default
bugs · checkout-service #4821
app/billing/charge.py:41
batch_total() sums payout amounts as floats and loses a cent on large batches
bugs · ledger #318
app/payouts/batch.py:43
revoke_session() deletes the access token but leaves its refresh token live
security · identity-gateway #208
app/auth/session.py:44
apply_partial_refund() returns the whole processing fee on a partial refund
bugs · ledger #340
app/refunds/reconcile.py:13
get_signing_keys() caches the key set forever despite the one-hour comment
bugs · identity-gateway #227
app/auth/jwks.py:12
schedule_batch() applies the 16:00 CET cut-off in UTC
bugs · ledger #336
app/payouts/batch.py:55
verify_pkce() accepts code_challenge_method=plain
security · identity-gateway #223
app/oauth/authorize.py:35
_check_conditions() accepts assertions issued ten minutes in the future
security · identity-gateway #214
app/sso/saml.py:32
How it works
Nine stages. One comment.
Follow the demo review of PR #4821 from the webhook to the merge gate: 41.2 seconds, start to finish.
26 bugs proven across 71 reviews
Proven, or itdoesn’t block.
Paste a pull request and watch Witness review it, stage by stage. It is read‑only: nothing is written to the PR.