Plainproof

Plainproof: proof before you accept an AI-built change. Muse Spark 1.3 turns a plain-language requirement into checks and operates the running app through Meta's native computer tool; my code, not the model, decides PASS or FAIL. When a check fails, Muse Spark 1.3, called directly or through Meta's Muse Code agent, proposes a fix, which is accepted only if the same recorded path passes again with zero model calls. On real Meta Model API runs, both one-line bugs planted in a demo to-do app were caught, and every measured repair of them was accepted. People who direct AI coding agents often cannot audit the code they get back, but they can say what the app must do. Plainproof takes that plain-language requirement and checks it on the running app. How it works: 1. Muse Spark 1.3 turns the requirement into an operator task and deterministic checks (Responses API structured output, strict JSON schema). 2. Muse Spark 1.3 operates the app from screenshots through the native computer tool; a Playwright driver executes each action in a sandboxed headless browser whose HTTP(S) and WebSocket requests are restricted to the app's origin. 3. My code, not the model, decides the verdict by comparing the visible page text after every reload and after an independent audit reload (one extra reload that Plainproof performs itself, with no model call). Each run's new item carries a fresh text marker; a marker guard returns INCONCLUSIVE when that marker never appeared, so an untouched page cannot pass an add-then-delete test. 4. Every run writes a receipt: the plan, every action and screenshot, each check with its evidence snippet, models, time and cost. 5. Replay re-executes the recorded actions against another version of the app with zero model calls, so "the same path now passes" costs nothing to prove. 6. Repair closes the loop: from a FAIL receipt, a fixer reads the evidence and the app files and proposes the smallest edit. The default fixer is Muse Spark 1.3 with structured output; Muse Code, Meta's coding agent (running muse-spark-1.3), is an optional fixer run headless with file tools only. Plainproof applies the edit to a throwaway copy (never the original) and accepts it only if the same recorded path, replayed with zero model calls, now passes. Measured on the real Meta Model API (Oct 27, 2026): in every run that finished, the two planted bugs were caught (FAIL) and the correct app passed, at 34-118 s and $0.024-0.072 per check. Two other runs stopped early and did not count as a pass: one at step 2 on an HTTP 500, before retries were added, and one at a 180 s time budget (INCONCLUSIVE). Replay of the receipt from the reload bug (a missing save) against the correct app passed in 1.3 s with zero model calls. Repair on the two planted bugs (the bug variants contain no comments pointing at the bug): Muse Spark 1.3 was accepted (FIXED) 4 of 4 times at 4.3-6.1 s and under $0.01 each (Oct 29, Japan time). Muse Code was accepted in all 5 runs on Nov 1; the 4 runs with recorded cost took 40-86 s and $0.060-0.092 each. Both fixers made the same one-line fixes. Limits: a PASS or FIXED supports the recorded path and checks only, not every reading of the requirement. A fix could make the checked text appear without fixing other behavior, so the diff is kept for review. The browser sandbox is not a hardened VM.