ProofMerge

ProofMerge is an evidence-first verifier for AI-generated pull requests. Instead of asking another model whether the code looks good, it makes the patch prove itself. Muse Spark 1.3 reads the PR description, keeps only promises it can quote exactly, and writes probe tests that try to break them. A probe must pass on the original code; it then runs 3 times on base and 3 times on the patch in a locked-down Docker sandbox (no network, read-only code). Muse Wonder 1.0 re-checks every claim and probe and can only move a result toward REVIEW. Plain code decides PASS, REVIEW or BLOCK. Every run writes proof.json, an HTML report and a sha256 manifest that `proofmerge replay` re-checks and re-runs. On a BLOCK it can suggest the smallest fix and verify it by re-running the failing probe. It runs as a CLI, a GitHub Action, a browser app that needs no terminal (Windows and Linux installers), and an Agent Skill for Muse Code, Claude Code and Codex. On a 28-PR synthetic smoke benchmark (16 faulty, 12 safe) no faulty change passed: 14 BLOCK, 2 REVIEW; one safe PR was a false BLOCK. PASS means no regression found within the tested scope, never "proven correct".