Vulcora← back to the surface

the abyss — where nothing asks for trust, because everything can be recomputed · −4 000 m → −10 911 m

Layer 5 · the protocols

The machinery that makes "trust us" unnecessary.

The deepest layer. Four pieces of machinery sit under every claim above: how an answer gets locked before anyone looks, how you check a downloaded file is the real one, what a proof-of-finding actually contains, and how a repair keeps its own receipts. Everything here can be re-checked by a stranger — including by you, right now, below.

In one breathEvery promise above ends in a fingerprint you can recompute. Here's the machinery — and a seal your own browser checks, below.

The abyss: blue-black darkness scattered with faint pale motes and one distant ember light.
fig. 05 the abyss — where every claim can be recomputed
Construction 1

The sealed answer — locked before anyone looks.

In plain words: before a challenge starts, we write the full answer down, compute its fingerprint, and publish the fingerprint. When the answer is revealed later, anyone can recompute the fingerprint and see that it matches — so the answer can't have been changed along the way. We can't cheat, because the mathematics won't let us.

The exact machinery, for the curious: the answer is written in a strict, no-wiggle-room format, a big random number is mixed in so it can't be guessed backwards from the fingerprint, and the fingerprint (a code called a SHA-256) is published before the event opens.

That's the shape of it. The seal below is a real, working one — computed from the exact text shown. Recompute it right now, in your own browser:

a live seal · toy values, real mathematics
{"checkpoints":["fb02be36b7a0c847dd31912bd8a7fb104c9c5e20b0ce7cc3730c82ac113a18e3","6f30d05063e6807c84d103aa3f921e935127fcd96d1e085ef22cb60b9cc7afe7"],"mark_key":"b70387de689b302c91c77f624d4f1b25","nonce":"17d21ecdbcbb93c18afa90e364292931f54bd01f5ec42795d59628274514eab8","payload_ids":[883,2472,921],"target_index":2,"trigger_ids":[7439,318,25921,4]}
published seal052d3847e0d536b6cbf98f7d587d7514f5c05203b4c47977b032510597b11cd4
your browser computed052d3847e0d536b6cbf98f7d587d7514f5c05203b4c47977b032510597b11cd4
✓ your browser's fingerprint matches the published seal — nothing moved
it all runs inside your own browser — nothing leaves your machine

Three details worth noticing: the big random number stops anyone from guessing the answer by trying fingerprints one by one; because every published file's fingerprint sits inside the sealed answer, neither the answer nor the files can be quietly swapped; and a separate secret mark tells apart "we knew first" from "someone else solved it" — two different claims, each provable on its own.

Construction 2

Fleet verification — trust the fingerprint, not the website.

In plain words: every file we publish comes with its fingerprint, published up front. Before you trust your downloaded copy, you compute its fingerprint yourself and compare. If they match, your copy is the real one — no matter which website it came from. The host, the mirror, and even we ourselves drop out of the trust chain.

verify before you trust
$ sha256sum model.safetensors
$ jq -r '.["model.safetensors"]' CHECKSUMS.json
→ fingerprints match — your copy is the real published file
→ mismatch — stop; your copy is not what was sealed
a model is known by its fingerprint, never by its name

This is also what lets a verdict travel safely: because a file is identified by its fingerprint, the same model stays the same object through every re-upload, mirror, and rename — the name can lie; the fingerprint can't.

Construction 3

The life of a proof — a finding is something you run, not something you read.

A proof (we call it a witness) is small and runnable, tied to one finding: press play, watch the problem happen. It can be in exactly three states, and every change of state is logged, never just claimed:

◉ Proven present
The proof reproduces the behaviour — the trigger fires, the exploit works — on the model anyone can download, in the open, repeatable by anyone. This is the only state in which a finding may ship. No proof, no finding.
✓ Proven fixed
After a fix, the same proof runs again against the corrected model and no longer works. Both runs are logged. The fix is demonstrated, not just declared.
○ No state
A suspicion that never earned a proof has no state and produces no finding. It can be listed separately as an unproven suspicion in a report — clearly labelled, kept apart — but it can never block, alert, or accuse.

In a written report, every line also carries one of three grades: ● proven — proof attached; ◔ likely — labeled with how confident we are, never dressed up as proof; ○ can't tell — with the reason, stated as a real answer, not an apology. A tool that never says "can't tell" isn't more capable. It's less honest.

what's inside a piece of proof
proof-…f27e/
├─ finding      what was found: the model's fingerprint and both test runs
├─ setup/       the exact setup, locked so it runs the same anywhere
├─ input        the crafted input that sets it off
├─ run          one command: build the setup, fire the input
└─ CHECKSUMS    a fingerprint of every file above
a proof travels as one sealed package — nothing inside is loose, nothing outside is needed
Construction 4

The corrective patch — repair that keeps the evidence.

When a planted behavior is cut out, the fix ships as a reversible delta — a repair with an undo button: apply it to the original and you get the corrected model; undo it and you get the original back, bit for bit. Nothing is destroyed — the repair never eats its own evidence. The patch is signed, the operation is logged, and both proof runs travel with it.

This is why finding a problem and fixing it are the same move: the very proof that found it is the test the repair has to pass.

what's inside a repair
repair-…9c4/
├─ fix          the correction — applies to the signed original
├─ before/      the trigger firing on the original       ✗ proven present
├─ after/       the same test on the repaired model      ✓ proven fixed
├─ record       signed: fingerprints in, fingerprints out, full log
└─ UNDO         one command restores the original, exactly
every version, before and after, is a fingerprint you can recompute
The floor

You've reached the bottom. Everything above stands on this.

Five layers up, the surface says: we read what a model was trained to do, and we prove every catch or say plainly that we can't. This layer is why those words aren't marketing — every claim comes down to a fingerprint, a proof you can run, or a limit we state out loud.

Return to the surface↑ 0 m · the lightUp to Layer 4↑ −4 000 m