SoloTrace: Every Requirement, Proven

The problem. Banks, insurers and healthcare companies must show auditors that every written requirement is implemented and tested before each release. Today this traceability check is manual spreadsheet work. When a regulation changes the spec, nobody knows which parts of the code still comply. AI coding assistants add a new risk: the tests pass, the AI says "done", and the requirement is still not met. We measured this ourselves. After IBM Bob's first fix round, its own verdicts said 12 of 12 requirements were covered. SoloTrace proved only 6 of 12. The solution. SoloTrace is an audit workflow built around IBM Bob 2.0, with a strict rule: an AI verdict is a claim, not evidence. 1. Read. Bob reads the requirements PDF and extracts each requirement, its acceptance criteria and its risk level. 2. Audit. Bob runs one subagent per requirement in parallel. Each returns a verdict (covered, untested, contradicts, missing) with verbatim code quotes and the tests that check it. 3. Verify. SoloTrace finds every quote in the audited commit again. It rejects invented or paraphrased code and trivial snippets, and refuses any path outside the project. 4. Sign-off. A human compliance officer approves the fix plan before any code changes. 5. Fix. Bob writes a failing test first, then the fix, then runs the whole suite. 6. Prove. SoloTrace sabotages each requirement on purpose, for example by moving a limit by one cent or removing the sanctions check. The tests must catch every sabotage. A requirement counts as proven only if the quoted code is real, a cited test exists and passes, and every sabotage is caught. 7. Report. A traceability matrix, an audit report and a public dashboard. Demo. LedgerLite is a sample payments API built from spec v1.0, then audited against v2.0: a lower approval threshold, a daily cap, sanctions screening and account masking. - Baseline: 4 of 12 requirements covered, and 9 of Bob's 36 code quotes did not exist in the code. - Round 1: 12/12 "covered" by the AI, but only 6/12 proven, because 11 of 34 sabotages went unnoticed. - What proving exposed: PIN lockout that never persisted, money stored as floating point, a race that allowed overdrafts, and approvals anyone could make. - Independent check: an independent adversarial reviewer wrote 42 more sabotages without seeing the tests. - Final audit: Bob's own final audit wrote 11 more, and one of them found a real gap in rollback on failed approvals. That gap was fixed. - Final result: 12/12 proven, 99 of 99 sabotages caught, 82 of 85 code quotes verified with none invented, 316 tests passing, and a human sign-off tied to that exact result. Why it matters. "Tests pass" and "the AI says done" are not compliance evidence. SoloTrace makes the evidence checkable. Every number is reproducible from git history with one command, and CI blocks publishing if a citation is invented. It works on any repository with Bob's SoloTrace Auditor mode.