An evaluation harness where a run produces a manifest, a decision log and a verify report — and where verification refuses a run whose stored verdict its own event log does not support.
The workloads are toys. The refusal is not: of the four runs make produces,
OSS_TOY_RUN stores PASS over a log that reconstructs REJECT, and
make verify-all exits non-zero on it by name. Break the demonstration — set
that run's verdict to REJECT so the check passes — and the gate still fails,
because a different check catches the tampering and the gate asserts which
check fired, not merely that something did.
$ make verify-all
{"status": "PASS", "run_id": "FORBIDDEN_RESEARCH_001"}
{"status": "PASS", "run_id": "MODERATION_DEMO_RUN"}
{"status": "PASS", "run_id": "OSS_TOY_REJECT_RUN"}
{"status": "FAIL", "run_id": "OSS_TOY_RUN", "detail": "fail: forensic_reconstruction"}
This is a public, self-contained subset of the WarmLogic program: enough to run, get a receipt, and re-run the receipt, without exposing private pilots or sensitive artifacts. It is not a production deployment and not a full program dump.
| Directory | What it is |
|---|---|
osctl/ |
A small Python CLI: run, verify, replay, plus a drift engine |
examples/ |
Two toy workloads (os_v2_toy, moderation_toy) with event logs, configs and JSON schemas |
docs/research/eval/ |
One public evaluation packet, used as the INCOMPLETE fixture |
This project is not published to PyPI — clone it and drive it through the Makefile. It declares three direct dependencies, which pull in fourteen packages in total, three of them carrying compiled extension modules. So it needs a virtual environment; the venv line below is not optional, and leaving it out was how this quickstart came to fail on a clean machine while CI stayed green.
CI runs these targets on Python 3.10 and 3.13, on Linux, with python shadowed
by a stub that exits 127 so only python3 is usable — the shape of a stock
macOS, and of a Debian box without python-is-python3. Versions between those
two are not exercised, and neither is Windows.
python3 -m venv .venv && source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install -r requirements.txt
make run-toy # baseline workload, expected PASS
make run-failing # a failing workload, expected REJECT
make run-moderation # moderation workload
make run-forbidden # a policy-blocked experiment, expected REJECT
make verify-all # verify every run in out/osctl_runsmake help lists the same targets.
This repository is deliberately narrow: one verifier, its fixtures, its schemas
and the CI that asserts them. The Flask console, an unused SDK stub, an orphaned
storytelling/ package, a committed Obsidian workspace and the proofs/ tree
were moved out of main on 2026-08-07. Nothing was deleted — the full previous
state is the v0.1.0
tag, which points at the commit main was at.
The proofs/ tree is the one worth naming. It held hand-written Lean 4,
Isabelle and Dafny scripts that no CI ever executed, and
proofs/lean4/MerkleChain.lean declared axiom sha256_injective — that SHA-256
has no collisions. That axiom is not merely strong, it is false, and anything
proved under it is worth nothing. Its own file header still read "All proofs
complete". Keeping a known-invalid proof in a normal directory means every
reader has to re-audit which parts are alive; the honest fix is to take it out
of the current surface rather than to keep explaining it here.
An earlier draft of this README asserted formally verified consensus and
integrity, named theorems (append_preserves_hash_link, history_immutable,
proposal_uniqueness) that do not exist in those files, and pointed at a file
(GalacticConsensus.thy) that never existed. Those claims are withdrawn rather
than quietly deleted, because a public repository that overstated itself should
say so.
This repository does not claim formal verification, consensus assurance, an AI governance platform, production governance, or a general evidence architecture. It claims one thing: it verifies consistency between a stored decision and the event log said to support it, and it refuses when they disagree.
See CONTRIBUTING.md. Open an issue first, and sign off
commits with git commit -s.
That sign-off line has been in this README since publication while nothing
checked it and no commit in this repository carries the trailer — a rule that
existed only as prose, in a repository whose verifier exists to catch exactly
that. It is now enforced by .github/workflows/dco.yml, which fails with the
list of commits missing it.
Two limits, stated rather than left for you to discover. The gate runs on
pull requests only, so a commit pushed straight to main by the maintainer
is not checked by it — branch protection would close that gap and currently does
not (enforce_admins is false). And history is not retroactively signed:
rewriting it would change every commit hash to assert a certification nobody
actually made at the time. The rule binds contributions, from the first pull
request.
Apache License 2.0 — see LICENSE.