prova drives ISO 20022, ISO 8583 and FIX at a payment host, card switch or trading venue, and proves whether it behaved as it must. A well-formed approval of a payment the account cannot cover is still a defect. prova finds it, names the rule it breaks and cites the evidence, and an independent SAT-backed check and a second rules engine confirm the verdict. It is not an AI explanation; nothing in prova guesses.
One 23 MB program. 25 MB of memory at rest. The web console, the reference manual, the database, 66 scenarios and six simulated targets are built in. Copy it, run it, open the browser.
Sign in as demo with password try-prova-now · simulated targets only · look at everything, change nothing
Download v0.2.0 for Linux · macOS, Apple Silicon · Windows — one file, nothing to install
Why prova · What it does · What it looks like · Running it · How it compares · Security · FAQ
prova is a test and proof harness for the systems that move money. It sends real wire messages — a pacs.008 credit transfer, an ISO 8583 0100 authorisation, a FIX NewOrderSingle — to the system under test, reads what comes back, and decides whether that answer was right given what was known: the balance, the account's currency, the instruction already processed, the value date.
The verdict is pass, fail or indeterminate, and it comes with its proof. Each verdict is decided by formal argumentation over the evidence of the exchange under grounded semantics. The Proof screen shows the argument graph, the cited chain of steps, a certificate from an independent re-check (C++ and CaDiCaL), and the verdict of a second, separately written rules engine. When the evidence does not decide it, prova says so and names what would.
It is built for the people who sign off. A release manager who needs more than "the tests passed", an auditor working to PCI DSS or SOX, a migration lead moving from SWIFT MT to ISO 20022 before the CBPR+ coexistence period ends: each gets a record of every verdict, who ran it, and why it holds, kept in prova's database and exportable as CSV.
Every payment and trading system is tested with simulators and format validators. They answer one question — did the response look right? — and miss the defects that matter:
- a host that approves a payment larger than the balance returns a perfectly valid
ACSC; - a switch that processes the same instruction twice returns two valid confirmations;
- a venue that fills an order over buying power returns a valid ExecutionReport.
prova asks the second question: was that the right answer? It ships simulated targets with exactly these planted defects, so the first ten minutes show prova catching them.
Protocols
- ISO 20022 — pacs.008/009 credit transfers, pacs.004 returns, camt.056 cancellations (answered by camt.029), pacs.028 status requests and pain.001 customer initiations (answered by pain.002), with pacs.002 status reports, over a length-prefixed session; IBAN or proprietary accounts; the ISO external reason codes (AM01–AM12, AC01, AC04, AC06, RC01, DT01, NOOR, ARDT …).
- ISO 8583 — 0100 authorisations, 0200 purchases, 0400 reversals and 0800 network management, with a real bitmap packager including the secondary bitmap; chip, PIN and MAC checks (DE55 EMV BER-TLV with the 9F26 cryptogram, DE52 PIN block, DE64 MAC); DE39 response codes.
- FIX 4.4 and 5.0 SP2 — tag=value codec with BodyLength and CheckSum, the session layer over FIX.4.4 and FIXT.1.1 (Logon, Heartbeat, TestRequest, sequence numbers, ResendRequest and SequenceReset gap-fill recovery), NewOrderSingle, OrderCancelRequest, OrderCancelReplaceRequest and OrderStatusRequest, answered by ExecutionReport (including partial fills) and OrderCancelReject.
- Message validation — check an ISO 20022 message against the official XML schema and the CBPR+ usage-guideline profile (structured addresses, UETR, LEI); findings name the rule, field and fix, and export as SARIF. Cross-checked against libxml2.
- MT103 ↔ pacs.008 transformation for the ISO 20022 migration — convert, drive the converted message, prove the result.
Verdicts
- A casebook of sixteen protocol-agnostic controls: structural and field validity (ISO 4217 currencies and decimals, BIC format, IBAN and Luhn check digits, PIN-block, MAC and EMV chip-data checks), funds, currency, value date, duplicates, account and card state, transaction limits, references to originals, cancellation state, status reports, market hours, listed instruments, positions and the prescribed reason code.
- Grounded argumentation semantics: every verdict is a graph you can read and a cited chain of steps.
- A second engine: the same controls written in quorum's casebook language and compiled by its
cbccompiler, which checks all 8,388,608 combinations of its 23 readings before emitting anything. The two engines agree on all 114,048 generated test cases and on every shipped scenario. - A certificate for every verdict from the C++
prova-proofcompanion (SAT-backed with CaDiCaL), or the in-process checker. - Indeterminate is an answer, with the evidence that would settle it.
Testing
- Scenarios in JavaScript or Lua, sandboxed, with standards-valid synthetic data (Luhn PANs, IBANs, BICs) and reproducible seeds.
- 75 scenarios (36 ISO 20022, 22 ISO 8583, 17 FIX) and thirteen suites: regression, controls, field validation and payment initiation; returns, cancellations and status; card controls and card security; reversals and network; order controls and the order lifecycle; and a CBPR+ readiness pack.
- A message validator (
prova validate, or the Validate screen) with schema + CBPR+ findings and SARIF output, and a Counterparty composer to act as the far side of the exchange. - Load tests with throughput and p50/p95/p99 — and every request still judged.
- Record and replay: capture traffic as a cassette, re-prove it offline after the rules change.
- CI:
prova runwrites JUnit and JSON and fails the build on a failed proof;prova validategates on malformed messages.
Operation
- An embedded SQLite database of every run with its full proof, suite and load history, and an activity log — no database server.
- Reports: pass rate by day, target, protocol, scenario and person; suite and load history; engine disagreements; CSV export of every verdict.
- Sign-in with local accounts, OpenID Connect (Entra ID, Okta, Google, Keycloak) or SAML 2.0; roles viewer, operator, admin; sessions that survive a restart.
- HTTPS only, HSTS, same-origin writes, PBKDF2 password hashes, session tokens never stored.
- The reference manual is served by the binary at
/manual, with reference chapters generated from the code itself.
 The proof. A host accepted €150.00 against €142.00. The graph, the certificate and the second engine all say why that fails. |
 The dashboard. Verdicts, latency and the most recent runs, each one a click from its proof. |
 Reports. Every verdict from the database, by day, target, protocol, scenario and person, with CSV export. |
 Suites. Eleven packs across the three protocols, and load tests, each scenario linked to its proof. |
 Sign-in. Local accounts, OpenID Connect and SAML; here, the public demonstration's account. |
 The manual. Served by the binary, numbered, printable to PDF, with reference chapters generated from the code. |
./prova
That serves https://localhost:8443. The first start prints the admin password once, and runs twenty scenarios at
the built-in simulators so every screen has real verdicts on it. Then:
prova user add alice operator # a colleague; prints her password once
prova -tls-cert cert.pem -tls-key key.pem # a real certificate for a shared server
prova -public-url https://prova.example.com:8443 \
-oidc-issuer https://login.microsoftonline.com/TENANT/v2.0 -oidc-client-id ID \
-oidc-client-secret-file /etc/prova/oidc-secret # single sign-on (or -saml-idp-metadata URL)
In CI:
prova run --suite regression-iso20022 --junit results.xml
prova run --scenario fix-over-limit --target fix-venue-bug # exits 1: defect caught
prova run --suite controls-iso20022 --record cassette.jsonl
prova run --replay cassette.jsonl # re-prove offline
Everything else — every option, every API endpoint, every shipped scenario and suite — is in the
manual, which every running prova also serves at /manual.
A public demonstration runs at https://prova.perfuse.health:9443 against prova's simulated targets only: sign in as
demo with try-prova-now (a viewer: it can look at everything and change nothing). A shipped scenario runs every
fifteen minutes, so the dashboard and reports stay current. Open a failed run and read its proof; compare the
second engine's verdict; download the CSV. How it is run is in deploy/demo/.
The established tools — jPOS and its client simulator, Paragon FASTest, Greenline VeriFIX, FIXSIM, X9Ware, Trace Financial, AskISO — between them cover thirteen kinds of capability. prova has something in each, and adds the one none of them has: a verdict that is a machine-checked proof. Breadth is a different matter, and is stated plainly here.
| Capability | prova today | Where the established tools go further |
|---|---|---|
| Simulated counterparties | an ISO 20022 host, ISO 8583 switch and FIX venue, each compliant and defective | scheme-specific hosts and dialects |
| Message coverage | 7 ISO 20022 messages (incl. pain.001/002), 4 ISO 8583 MTIs, FIX 4.4 and 5.0 SP2 with 4 request types | hundreds of MX messages (camt.053/054 statements, pacs.003/010 …); Visa, Mastercard and other ISO 8583 dialects; FIX 4.2 |
| Field validation | ISO 4217, decimals, BIC, IBAN, Luhn checks | — |
| Schema & profile validation | full ISO 20022 XSD validation (cross-checked vs libxml2) + CBPR+ address/UETR/LEI rules, SARIF output | SEPA and FedNow profiles, MyStandards usage guidelines, more message sets |
| Scenario library | 75 scenarios, 13 suites | libraries of hundreds to thousands of cases |
| Certification packs | prova's own CBPR+ readiness pack | official card-scheme certification test cases |
| Card security | PIN-block, MAC and EMV chip-data (ARQC) format checks | PIN/MAC cryptographic verification, full EMV kernel and HSM integration |
| Load testing | throughput and percentiles, every request judged | larger-scale replay of production traffic |
| Negative testing | controls that prove a rejection was right, with the right reason | |
| CI/CD | prova run, JUnit and JSON, non-zero exit on failure |
|
| Synthetic data | Luhn PANs, IBANs, BICs, amounts, ids; seeded and reproducible | |
| Auditable evidence | every verdict a cited proof with a certificate, stored and exportable; findings as SARIF | |
| MT ↔ MX | MT103 ↔ pacs.008, then drive and prove the migrated message | more MT and MX message pairs |
| FIX session testing | Logon, heartbeats, TestRequest, sequence numbers, BodyLength, CheckSum, ResendRequest and SequenceReset gap-fill, partial fills | FIX 4.2, richer recovery edge cases |
| Capture and replay | JSONL cassettes, re-proved offline |
The right-hand column is drawn from the vendors' public material and is the roadmap; see docs/comparison.md.
HTTPS only (TLS 1.2+, HSTS). Every API call needs a session; writes need the operator role and must be JSON from prova's own origin. Passwords are generated, shown once and stored as PBKDF2-SHA256 hashes; session tokens are never stored, only their hashes; the database is readable by its owner only. Scenario scripts run sandboxed with no file, network or process access. prova sends nothing anywhere but to the targets you point it at and your identity provider. The Security chapter of the manual has the detail.
Report a vulnerability privately through this repository's Security tab ("Report a vulnerability"), not in a public issue.
Go 1.26 or newer; Node 20 and pnpm only to rebuild the interface, which is committed prebuilt.
make build # bin/prova
make test # go test ./...
make web # rebuild the interface into internal/web/dist
make proof # the C++ prova-proof companion (with CaDiCaL if ~/cadical is built)
make manual # docs/manual/prova-manual.html and .pdf
make release # per-platform archives in dist/release
The layout is described in docs/architecture.md.
Is the verdict produced by an AI model?
No. Verdicts come from explicit rules applied to the evidence under grounded argumentation semantics. The same exchange always gives the same verdict, and the proof shows which rule and which evidence decided it.
What does "indeterminate" mean?
That the evidence does not decide it — for example, a host accepted a payment over the balance and the scenario says an overdraft might cover it. prova names the evidence that would settle it rather than guessing.
Do I need the C++ companion?
No. Without prova-proof, prova performs the same checks in-process and says so on every certificate. With it, the
re-check is done by a separate program with a SAT solver, which is the stronger statement to give an auditor.
Can it test my real host?
Yes: point a scenario or a suite at your target's address. The simulated targets exist so that prova is useful the moment it starts and so you can see it catch a defect you know is there.
Where is my data kept?
In one SQLite file, prova.db, in the data directory (-data). Back it up by copying it while prova is stopped.
prova is developed and maintained by BioDream LLC. Pull requests will not be reviewed or merged. A verdict is only worth what its rules are worth, and keeping every rule proved, tested on every combination and cited is a discipline easier to keep in one place.
Bug reports are wanted. Open an issue with the output of
prova -version and, where a message is involved, a synthetic one. Never post real card numbers, account numbers or
customer data.
PolyForm Small Business License 1.0.0. Copyright 2026 BioDream LLC. See NOTICE.
A company with fewer than 100 people and less than USD 1 million in annual revenue may use prova freely. Larger companies need a commercial licence from BioDream LLC.
prova includes code from Perfuse, a separate BioDream project under the Apache License 2.0, whose licence and notice are in licenses/. ISO 20022, ISO 8583, FIX and SWIFT are named only to say what prova reads and writes; prova is not affiliated with or endorsed by ISO, the FIX Trading Community, SWIFT or any vendor named here.
Keywords
Payments: ISO 20022 testing · pacs.008 · pacs.009 · pacs.004 · camt.056 · camt.029 · pacs.028 · pain.001 · pacs.002 · XSD validation · CBPR+ · SARIF · IBAN validation · CBPR+ · SWIFT MX · MT103 to pacs.008 · MT to MX migration · payment host testing · payment simulator · reason codes AM04 AM05 DT01
Cards: ISO 8583 testing · card switch simulator · authorisation testing · 0100 0200 0400 0800 · reversals · DE39 · issuer host testing
Trading: FIX protocol testing · FIX 4.4 · FIX simulator · FIX 4.4 & 5.0 SP2 testing · NewOrderSingle · OrderCancelRequest · OrderCancelReplaceRequest · ExecutionReport · OMS EMS testing
Proof: formal verification · argumentation · grounded semantics · SAT solver · CaDiCaL · explainable verdicts · audit evidence · PCI DSS · SOX · regression testing · load testing · single binary · Go · OpenID Connect · SAML