Source-bound toolchain
Build the proof tooling from the submitted source instead of trusting a pre-existing executable. The toolchain is part of the evidence.
Use case — Ada & SPARK
SPARK contracts, checked where it counts.
GNATprove verifies the contracts. The Job verifies that the verification happened — on the exact source, under the frozen policy.
Formal verification guidance in safety-critical regulation is converging on exactly this shape: annotated contracts, an independent prover, and an acceptance record that binds the result to the code it was run on. FalseGreen is that acceptance layer: the proof tool stays the witness, the Job owns the boundary.
Read the SPARK case studyA SPARK Job, end to end
contracts + warning policy · frozen
↓ source-bound build
gprbuild · gnatprove
↓ signed result
contracts verified · evidence bound
Why SPARK
The prover is a witness. The acceptance boundary is the product.
A prover run in the wrong checkout, with a stale toolchain, against a relaxed warning policy, is worse than no prover run: it manufactures confidence. The Job freezes the perimeter — which source, which build, which regressions, which warnings are allowed — and reports what actually happened inside it.
Exact warning policy
Allowed prover warnings are enumerated in the contract. Unknown warnings or tool failures fail the criterion — no silent drift.
Regulator-shaped records
Signed reports with contract identity, per-criterion results, and environment capture: the artifacts a safety case review asks for.
Real evidence
What SPARK work actually produced.
The evidence below is from real work on the 0.4.0 platform — a documented upstream case study and a real Job, not illustrations.
Upstream SPARK fix, full story
SPARK Case Study — from wrong theories to ACCEPT
A real contribution to the SPARK toolchain: a rejected first theory, a frozen verification perimeter (source-bound build, maintainer regressions, exact SARIF policy), and the repaired source reaching FalseGreen ACCEPT. The complete timeline is documented in the case study.
Real 0.4.0 Job
Job d7685242 — verdict Accepted
A SPARK workspace through the 0.4.0 platform: GNATprove verifies the SPARK contracts, the program compiles with gprbuild, and the test suite passes. The signed report binds all three criteria to the exact source.
End-to-end, through the live Internet
Ada lane: green
The hosted end-to-end world ran the Ada/SPARK lane over the real network path — real git, real CI, real job image — with the acceptance and blocking outcomes both exercised.