"Critical. Severity 9.1." You have seen the output. A tool decides something is dangerous and hands you a number, or a color, or a rank. The number is meant to convey confidence, and it does convey something, but not what an auditor needs. A score is a conclusion with the reasoning deleted. You cannot check it. You can only believe it or dismiss it, and once a few of them turn out wrong, you learn to dismiss.
Every Acutis verdict can instead emit a proof bundle: a structured, machine-readable record of how the verdict was reached and exactly what it rests on. Not a score to trust, a document to audit. This post is about what is in that record, and why the most important field in it is a count that is always zero.
The problem with a numberConclusions with the reasoning deleted
A risk score compresses a chain of judgments into a single value, and in doing so throws away every judgment. Was this flagged because user input reaches a sink, or because a pattern loosely matched? Which sanitizer was credited, and on what basis? What did the tool assume it could not check? The score cannot say. It is the answer with the working erased.
For a developer in a hurry that is merely annoying. For an auditor it is disqualifying, because an audit is precisely the act of inspecting the working. A compliance reviewer preparing a SOC 2 or SSDF evidence pack cannot attach "severity 9.1" as proof of anything. They need to see what was checked, what held, and what was taken on faith. A number offers none of that, which is why security findings so often become a spreadsheet nobody can defend.
A score says trust me. A proof says check me. An audit is the difference, and only one of the two survives it.
The bundleWhat a verdict carries with it
When Acutis reaches a verdict, it can serialize the reasoning into a bundle built for handoff. There is no source code in it, so it is safe to store and share; what it contains is the shape of the decision. The verdict itself, allow or block. The typing rules that were applied and the boundary constraints that were checked. The coverage: which call sites were accounted for, so a reader can see nothing was skipped. And when the verdict turns on a specific flow, the property trace, the actual path a value took from where it entered to where it was used, with the security properties it carried at each step.
A block carries its counterexample, the witnessing flow that violates a boundary, so a fix has something concrete to target rather than a vague warning. And the whole thing is emitted as structured data, so it can be diffed, stored in an evidence system, or attached to a compliance artifact without a human retyping it. The bundle is the working, preserved, in the form an auditor and a machine can both read.
The honest coreEvery assumption, graded and disclosed
Here is the field that matters most, and it is the one most tools would never print. No verifier establishes every claim with equal force. Some things Acutis checks by abstract interpretation of the actual code. Some it corroborates by executing a declared transform against a battery of attacks and watching what survives. And some it simply trusts, because the relevant code lives in a library it was told about but cannot see into. Those are genuinely different strengths of evidence, and a bundle that presented them as uniform would be lying by omission.
So the bundle grades them. Each trust assumption behind a verdict is tagged with the tier of evidence that backs it, ordered from strongest to weakest: proven, then runtime-corroborated, then statically checked against the code's own body, then trusted-because-external, then trusted-because-declared. An auditor reading the bundle can see at a glance how much of the verdict was empirically established and how much was assumed, and can push exactly where the evidence is thinnest.
And there is one invariant the bundle enforces above all: the count of silently trusted assumptions is always zero. Acutis may trust things, every verifier must, but it is not permitted to trust them quietly. Every assumption that carries weight in a verdict is written down and labeled. Nothing load-bearing is hidden. That is the discipline that separates a proof you can audit from a score you must swallow.
To keep this honest: what exists today is the per-verdict bundle described above, emitted as structured evidence with the graded, fully-disclosed assumptions. The natural next step is to chain those bundles into an append-only ledger, so that a codebase accumulates a tamper-evident history an auditor can walk end to end. That chaining is a direction we are building toward, not a feature you can turn on this afternoon, and we would rather draw the line clearly than let the vision read as a claim. The single bundle is real now. The ledger is the road from here.
The shiftFrom alarms in a spreadsheet to evidence on the record
Put the pieces together and the artifact changes character. A conventional tool leaves behind a pile of findings, each a number someone has to argue about, aging into a backlog nobody trusts. Acutis leaves behind a record: for each verdict, what was decided, why, what it covers, and precisely what it assumed, in a form a machine can store and a human can defend. The output stops being an alarm to triage and becomes evidence to file.
That is the reframe. Not a bigger number or a brighter color, but a different kind of object entirely, one built to be read by the person whose job is to distrust it. A score asks for faith. A proof invites the audit and is built to pass it.