The answers we give in the room.

AutoSys JIL and Control-M DEFTABLE XML for batch; BPMN 2.0 and DMN for modeled processes; IBM BAW .twx archives; Pega export detection; crontab. Plus case-system event logs and file-share and mailbox exports for discovering workflows nobody modeled.

Depth varies by format and we will tell you where it is thin rather than let a demo imply otherwise. The honest current edge: JIL dependency parsing covers success() and done() conditions; the s()/d() shorthand and box-job grouping are in progress. If your estate leans on those, say so and we will be specific about what a proof would and would not cover this month.

The pipeline is the same: the Control-M export becomes a process model, the model becomes an event-sourced graph, your run history replays against it. The published diverging proof on this site is in fact a Control-M end-of-day batch. What changes is the export command you run and the shape of the history columns, and the loader is deliberately forgiving about the latter.

Process mining tells you what your processes are — variants, bottlenecks, rework. Useful, and our Scanner does a form of it for discovery. But mining describes; it does not verify a replacement.

Prove answers a different question: if we ran this on the new runtime, would it have decided the same things? That requires actually executing a model against recorded history and diffing the decisions — which is why the Engine and the proof are the same machinery, not two products with a shared logo.

Durable execution platforms are excellent at running new workflows you write for them. Neither they nor we make the 20-year-old chain disappear — but the hard part of replacing it is not execution, it is justifying the switch to people whose job is to say no. We built the justification artifact first and the runtime second. If you already run a durable platform, the proof is still useful: it tells you which chains are safe to move onto it.

Less than you expect. Zero third-party runtime dependencies means the software bill of materials is CPython plus our package — the review is a code review, not a supply-chain investigation. There is no network I/O in the core, no telemetry, and no hosted service holding your data.

The full posture, including hostile-input handling and the filesystem discipline, is on the trust page, and SECURITY.md ships in the package.

Not yet, and we would rather say so plainly than imply otherwise with a badge nobody can click. The clock is started.

It is worth knowing what SOC 2 would and would not tell you here: it audits the controls of a service organization handling your data. We are not a service organization for this product line — nothing runs on our infrastructure and no customer data reaches us. For an air-gapped tool, the meaningful assurances are the ones you can verify yourself: no egress, no dependencies, source you can read. Those are available today.

No. The core opens no sockets at all — --network none is the reference deployment and the test suite passes under it. If we later add Marketplace metering for a paid tier, it will be an explicit, documented mode whose only egress is the AWS metering endpoint through your own VPC endpoints, and never in the free Scanner.

It cannot see what your history did not record — if an export omits a job, the proof reports a coverage gap and refuses to pass. It does not measure performance or capacity. It does not validate the business correctness of a job's output; it validates the decisions around it — which jobs run, in what order, under what conditions, with which gates and which containment. And it is not a migration: moving production is a separate, deliberate act.

Expected, and handled. Duplicate rows for the same job and day keep the last one with a warning — matching how a rerun overwrites a day's record in most schedulers. Statuses map from several vendor vocabularies. Start and end times are optional; supplying them enables the dependency-ordering checks, and omitting them simply narrows what the proof can assert.

What we will not do is guess. An unknown status word or a malformed row stops the run and names the line number. Evidence tooling that improvises is worse than none.

The opposite. A divergence is the estate telling you something nobody wrote down — a force-start convention, an unmodeled calendar, a dependency that lives in one person's head. You have bought that discovery for the price of a two-week pilot instead of finding it during a cutover weekend.

We will not quietly tune the model until it passes. That would be manufacturing the answer you paid us to find.

Because we publish one that fails, and because failing is under test. Seeded corruptions — a dropped dependency, a flipped status, a job that "ran" downstream of a failure, timestamps that violate an ordering — must flip the verdict with the correct category populated, and the clean baseline must still pass. If a mutation fails to flip the verdict, our build goes red.

You can also check it yourself in about a minute: append one row to your history claiming a downstream job ran on a night its upstream failed, and re-run the proof. It should diverge and name that job. Do that before you trust any verdict we hand you.

No catch, and no time limit. An assessment nobody can run is worth nothing, so we made the assessment maximally spreadable — no account, no seat count, no expiry, no phone-home. What we sell is what comes after: the proof, the runtime, and the governance. If you run the Scanner forever and never pay us, the product still did its job.

Through AWS Marketplace, so purchases land on the AWS bill you already have. Because our software deploys into your own account rather than a vendor-hosted service, it sits naturally on the right side of the committed-spend drawdown rules. Multi-year terms paper as private offers your finance team has seen before. Direct purchase is available for pilots.

The fair question, asked plainly, so here is the plain answer. The artifacts are self-contained HTML and JSON that need none of our software to read — a proof bundle from today is still readable in ten years by anything that opens a file. The event logs are plain JSON Lines, documented, and yours. The runtime is a container running in your account with no control plane to switch off; it does not stop working when we stop answering email.

That does not make us a safe bet on its own — it makes the downside bounded, which is the most any small vendor can honestly offer. For anything larger than a pilot, ask us about source escrow.

Yes, and increasingly that is the shape. The tooling is what makes a modernization bid cheaper and provable; the integrator keeps the relationship and the engagement. If your SI wants to run proofs under their own banner, point them at us.