MergeProof — Evidence-Backed Pre-Merge Verifier

Software teams often review whether code looks correct, but not whether it still matches the requirements, contracts, acceptance criteria, and architectural decisions that are supposed to govern it. This creates a dangerous gap: tests may pass while boundary conditions drift, required API fields disappear, outdated requirements are treated as current, or generic best practices are reported as if they were actual project requirements. MergeProof is a read-only pre-merge verification workflow built around IBM Bob. Before a human makes a merge or release decision, MergeProof traces applicable requirements to the changed implementation and tests, resolves source authority and supersession, identifies missing acceptance coverage, distinguishes real requirement violations from engineering opinions, and explicitly abstains when authoritative evidence remains unresolved. Users open an isolated repository workspace in IBM Bob, activate the MergeProof mode, and run the MergeProof skill. Bob reads the run context, source registry, requirements, changed files, and relevant tests. It then performs a structured evidence workflow: source authority resolution, requirement tracing, implementation observation, test and acceptance analysis, evidence classification, severity resolution, conflict handling, self-audit, and final report synthesis. The output is a canonical machine-readable report with one of three advisory states: PASS, REVIEW_REQUIRED, or ABSTAIN. Every material finding is tied to concrete source and repository evidence. MergeProof never performs merge, approve, reject, commit, push, or production-code edits. Human reviewers retain all merge authority. What makes MergeProof different from a generic AI code reviewer is its evidence discipline. It does not silently choose between conflicting sources, does not turn external best practices into project requirements, and does not invent severity when the project rules cannot support one. Reports are checked against a frozen schema and deterministic validator. The project also includes a seeded demo and an eight-case TRIAGE evaluation corpus covering deadline boundary drift, API contract drift, harmless refactoring, ambiguous requirements, missing acceptance tests, conflicting sources, unsupported best-practice risks, and explicitly superseded requirements. MergeProof is designed for developers, maintainers, and review teams who need a defensible answer to a simple question before merging: what does the repository evidence actually support?