Crazy Diamond

Exhibit A is a proof-before-accusation security engine for pull requests. Security tools drown maintainers in suspicions nobody verifies; Exhibit A only reports what it can prove. For each suspicion, an adversarial agent writes an exploit test that must fail against the vulnerable code inside an isolated, resource-limited sandbox for the oracle-observed reason, then pass after the fix, with bypass variants blocked. A green result means "nothing could be proven," never "safe." Ships as a CLI, a GitHub Action that comments PROVEN findings with verified fix suggestions on the PR, and a live dashboard. Proven live on a demo repo: path traversal (CWE-22) detected, fixed, and re-verified green.