ProofPatch Fix bugs. Show proof.

A reproducible verification workflow for AI-assisted repairs, built for the IBM Bob 2.0 Hackathon. The live app executes trusted bundled Python code; no AI service or API key is required. A pagination export drops task 4 when records share timestamps. ProofPatch connects a baseline assertion failure to a candidate repair, checks that mandatory tests and inputs are unchanged, and creates a rerunnable evidence package. A deliberately incorrect repair demonstrates rejection. The three CLI verifier commands return success when their intended outcomes occur. Raw pytest on the baseline or bad patch intentionally fails. python -m pytest defaults to verifier system tests, so routine project checks can finish green. On PowerShell set $env:PROOFPATCH_VARIANT="candidate" before the raw pytest command. The full suite always covers preview sizes 2, 3 and 4. Page size changes the independent ID preview only. Each subprocess has a 15-second limit; one candidate verification can take roughly 45 seconds in a worst-case sequence of timed-out children. The web UI is synchronous during a run. report.json, summary.md, patch.diff, full baseline and selected stdout/stderr, JUnit XML, checksums.json, and snapshot/ containing all executable sample code, regression and acceptance tests, fixture, conftest.py, configuration, requirements and frozen manifest. Run summary.md instructions from snapshot/ to reproduce the checks. The manifest detects accidental or unreviewed changes relative to a local reference. A maintainer who changes both manifest and files can change that reference. SHA-256 hashes are not signatures, authorship proof, or trusted timestamps. This release manifest was created after the original build. Original Bob provenance must be established with the team's actual session artifacts. Never regenerate the manifest just to bypass a failed integrity check. Creating a new manifest requires a complete matching suite, a reproduced baseline assertion and a passing candidate. Existing evidence remains bound to its own snapshot. The dataset is synthetic and the bad patch is an intentional negative control, used to test rejection. The verifier accepts only bundled variants; it is not an execution sandbox for arbitrary uploads. The repaired pagination code assumes unique integer IDs and comparable datetime values. It reads an in-memory dataset and is not a production database adapter. Performance and commercial benefits beyond observed local runs remain hypotheses. We used IBM Bob during our original development. After our allocated credits were consumed, we continued local engineering and testing with Codex assistance. See PROVENANCE.md for the contribution record. MIT license applies to the team's original project code; dependency licenses remain their own.