# proba — the assay stamp for agent-written code > Every merged pull request, hallmarked. Proba mints a signed, immutable record for each merged PR: who wrote it, which harness, whether a qualified human actually supervised it, and whether your own declared bar was met. It never scores your code. - Canonical page: https://dirahq.sh/proba - Install: the proba GitHub App - Checks: five-minute install, no CLI · free on public repos · observe-only by default Records, never opinions: CI state, reviewer identity, supervision minutes, guard compliance. Every element observable — so a hallmark is undisputable by construction. ## The load-bearing decision A hallmark says what is in the alloy. It never says the jewelry is beautiful. Proba certifies *provenance and process* — never quality. It records that CI was green, that a non-author human reviewed, how many engaged supervision-minutes were spent, that guards were respected. It will never tell you a change is good. - **Observable facts only** — every claim can be re-derived from the record. - **No score, no grade, no 8/10** — one wrong "passed" on a bad change would poison the whole record. - **Your bar, not ours** — pass/fail is measured against the policy your org declared. The question no engineering leader can answer today: *"For this shipped change — was it agent-written, did a qualified human actually supervise it, and did it clear the bar we tell customers we enforce?"* | | | | --- | --- | | today | co-author trailers and vibes | | in audit | "we don't know, per change" | | with proba | a record, per change, signed | ## How deep the evidence goes — fineness Gold is stamped 585, 750 or 999 for how much of it is really gold. Fineness is how much of your change is really evidenced — and it rises as you install more of the suite. The ladder is the product: install in five minutes, see "your hallmarks assay at 585", and the record itself tells you exactly what is missing to go higher. ### 585 — GitHub App only Install stack: `+ proba app`. - CI green at merge - Review by a non-author human - Agent authorship *inferred* from trailers & bot accounts Weak provenance — and labelled as such on the hallmark. Five minutes to install; no code changes. ### 750 — + dira capture Install stack: `+ proba app` / `+ dira on the workstation`. - Everything in 585 - Cryptographically attributed sessions - Which harness wrote it - Engaged supervision-minutes per change The layer a code host structurally cannot see: what happened on the workstation. ### 999 — + zavet Install stack: `+ proba app` / `+ dira on the workstation` / `+ zavet in the repo`. - Everything in 750 - Decisions referenced by the change - Guards respected, not bypassed - Covering spec current at merge Intent, not just activity. The strongest claim anyone can make about agent-built code. ### The hallmark, at each grade A hallmark for the same PR (`acme/platform#4172`, `Stream export responses row-by-row`, `a3f91c2 · 14 files · +612 −188`) reads differently depending on fineness: | Element | 585 | 750 | 999 | | --- | --- | --- | --- | | ci | ✓ green · 3 required checks | ✓ green · 3 required checks | ✓ green · 3 required checks | | human review | ✓ non-author · @m.ivanova | ✓ non-author · @m.ivanova | ✓ non-author · @m.ivanova | | authorship | ~ claude-code (inferred) | ✓ claude-code (signed session) | ✓ claude-code (signed session) | | supervision | — no dira (750 locked) | ✓ 47m engaged (4h 20m agent) | ✓ 47m engaged (4h 20m agent) | | intent | — no zavet (999 locked) | — no zavet (999 locked) | ✓ D-0042 referenced (guards respected) | | policy | policy 750+ · not met | policy 750+ · met | policy 750+ · exceeded | ## What you do with the record is your call — the enforcement dial Opt-in, per repo or org-wide. Every position is a position — none of them is the product. Move right when you're ready, never because we shipped an update. ### Observe — default on install A neutral check appears on every PR. Grades are recorded, the posture view fills up, and absolutely nothing about your workflow changes. Zero risk — this is where every org starts and where many happily stay. - Neutral check — never red, never blocking - Hallmarks minted for every merged change from day one - Backfills the posture view so the 585 → 750 gap is visible - Turn it on Friday; nobody notices until Monday PR check: `●` proba / assay — assayed at 750 · recorded — badge **Neutral**. merge: unaffected · override: n/a — nothing to override · on outage: no check reported. ### Signal — your policy, GitHub enforces The check now reports pass or fail against the assay policy your org declared — "750+, non-author review, guards clean." Whether that check is required is your branch-protection setting. GitHub enforces; proba only reports. - Pass/fail measured against your own declared bar - Required-or-not stays a GitHub branch-protection decision - Fail-open on a proba outage, configurable - Break-glass overrides are recorded into the hallmark, never blocked PR check: `✕` proba / assay — assayed at 585 · policy requires 750 — badge **Failing**. merge: blocked only if you marked it required · override: allowed · recorded as evidence · on outage: fail-open (default). ### Enforce — critical path Proba manages branch-protection rulesets centrally across the org — the real enterprise pain nobody solves by hand on 400 repos. The only dial position with critical-path risk, which is exactly why it is a position and not the default. - Org-wide rulesets managed from the policy editor - Overrides only through the recorded break-glass flow - Fail-closed available for regulated pipelines - Built when the first enterprise buyer asked — not before PR check: `⛨` proba / assay — ruleset acme-org/assay-750 · required — badge **Required**. merge: blocked until policy is met · override: break-glass only · who, when, why · on outage: fail-closed available. ### Break-glass, recorded Overrides are never prevented — they become evidence. Who overrode, when, and the stated reason all land inside the hallmark, permanently. A team that ships at 3am gets to ship at 3am; the record simply says so. ``` override: true · by @d.petrov at 2026-08-04 03:12Z reason: "P1 rollback, reviewer paged" ``` ## Not another dashboard you're supposed to visit daily Proba has exactly three screens. If a fourth ever appears, something has gone wrong with the product. 1. **The hallmark page** — one per merged change, shareable by link. The proof object — what you send to a customer, an auditor, or a sceptical VP. 2. **Posture view** — fineness distribution over time for a repo or the whole org — plus the changes that were never assayed at all. 3. **Assay-policy editor** — where you declare the bar — minimum fineness, review rules, guard requirements — and where the dial lives. ## Where it sits in the suite One evidence chain, four products, no opinions anywhere in it. - **dira** — signed sessions and anchored artifacts. The workstation truth 750 runs on. https://dirahq.sh/ - **zavet** — recorded intent: decisions, guards, specs. The only way to reach 999. https://dirahq.sh/zavet - **proba** (you are here) — notarized process. Turns the chain into something an auditor accepts. - **miara** — priced future. Fineness filters which past work counts as comparable. https://dirahq.sh/miara ## The European AI Act — enforceable since 2 Aug 2026 Article 17 wants design control. A hallmark is the per-change receipt for it. The Act asks for oversight that is real and a quality system that records it. Nobody argues with that; the problem is that the evidence lives in five places and expires. A hallmark collapses it into one signed artifact per merged change — minted at merge, never edited afterwards. - **Art. 14 · 26(2)** — Human oversight, with a number attached: supervision minutes from dira, per change. The difference between *a human reviewed this* and *we have a policy saying humans review things*. - **Art. 17 · QMS** — Design control and change control, per merge: CI state at the merge commit, a review by someone other than the author, recorded decisions respected, branch protection not bypassed. - **Art. 12 · 19 · records** — Immutable and non-repudiable — `ed25519`-signed, carrying the merge SHA and the installation id. Break-glass overrides are recorded as evidence rather than hidden as exceptions. - **Coverage is honest** — A merged PR with no hallmark shows in the ledger greyed and marked *not observed*, with the reason. An unobserved merge is not a passing merge, and a coverage number that hides them is worse than none. What a hallmark will never say is *compliant*. No product can certify you against the AI Act, and any dashboard printing that word is selling you an opinion dressed as a record. Proba states what was observed, at a declared fineness, and leaves the conclusion to the person whose signature is on it. The full article-by-article mapping: https://dirahq.sh/letopis#aiact ## Pricing Free where the badge is the marketing. Public repos never pay. Private repos pay for the dial position they actually use. | Plan | Price | For | | --- | --- | --- | | Open Source | €0 forever | Public repositories | | Team (most orgs) | €18 / active dev / mo, or €180 a year — two months free | Private repos, declared policy — 2–50 active devs, 51+ → talk to us | | Enterprise (Enforce) | Talk to us | Central rulesets across every repo | **Open Source** — all three fineness grades; public hallmark pages & README badge; Observe and Signal; unlimited contributors. **Team** — everything in Open Source, on private repos; assay policy per repo; Signal (pass/fail against your own bar); org posture view & unassayed backlog; recorded break-glass overrides. **Enterprise** — everything in Team; org-wide rulesets, centrally managed; fail-closed option; audit export & data residency; SSO · SCIM. Nobody hand-configures branch protection on 400 repos — that is what Enforce is for. It is a dial position, not the product. --- Proba doesn't stop you. It remembers. Install the GitHub App, ship nothing differently, and see what your merged code assays at. See also [/index.md](https://dirahq.sh/index.md), [/zavet.md](https://dirahq.sh/zavet.md), [/miara.md](https://dirahq.sh/miara.md).