Rendered from ROADMAP.md at build time without changing its status. The repository source controls if this presentation differs.

Verifier Standard (VSTD) public technical roadmap#

Acronyms: Advanced Vector Extensions 512-bit (AVX-512); artificial intelligence (AI); command-line interface (CLI); central processing unit (CPU); Concise Binary Object Representation (CBOR); CBOR Object Signing and Encryption (COSE); control groups (cgroups); directed acyclic graph (DAG); dynamic random-access memory (DRAM); grounded decision certificate (GDC); graphics processing unit (GPU); inter-process communication (IPC); Internet Engineering Task Force (IETF); reduced instruction set computer (RISC); Boolean satisfiability problem (SAT); Supply Chain Integrity, Transparency, and Trust (SCITT); signal kill (SIGKILL); SMT library standard (SMT-LIB); Temporal Logic of Actions (TLA); virtual machine (VM); Verifier Standard (VSTD); zero-identity/zero-knowledge (ZIZK).

TRUST is mechanism-earned forward artifact support; ROT is typed, time-indexed degradation of current admissibility; and RUST is inverse-TRUST diagnostic traversal toward recorded ancestors. They are formal semantic names, not acronyms or actor ratings.

Status: direction, not a promise of delivery or adoption Scope: the public specification, reference implementation, and interoperability surface only

Reader context: Concept guide and intellectual precedents

The near-term problem#

“Speed superintelligence” is used here as an operational condition, not as a model capability certification: when software agents propose, edit, execute, test, and publish computational work faster than a person can inspect each intermediate step, a final answer or green check becomes a weak review interface. The reviewer needs a portable record of:

• the exact claim and coordinate;
• the evidence bytes, tool events, and transformation lineage that were observable;
• the checker and trust roots used;
• the time, memory, disclosure, and availability bounds;
• the conditions that produce FAIL, UNKNOWN, challenge, or degradation.

VSTD's intended role is to make that review object cheap to transfer, checkable outside its producer within stated bounds, and capable of being overturned. It is evidence infrastructure around fast systems—not proof that a system is aligned, safe, conscious, superintelligent, or fully observed.

The next question: what should we check first?#

Verification is never free. A project can usually identify more claims, artifacts, and dependencies worth checking than its available time, compute, evidence access, and human attention can cover. Hiding that constraint does not remove it; it only makes the choice of what went unchecked harder to inspect.

The intended next direction is straightforward for a newcomer:

1. record the available verification budget;
2. choose which check to run next under a declared policy;
3. record why that check was selected and what was deferred;
4. preserve the native verifier's actual result and VSTD claim boundary; and
5. observe whether the policy makes artifacts easier to check—or merely easier to game.

This is bounded verification allocation. A priority is a scheduling result, not a truth result. “Check this first” does not mean “this is false,” “this is important in every context,” or “everything else is safe.” Budget exhaustion leaves the deferred surface explicit and unresolved.

The longer-term objective is a portable, verifier-neutral way to:

• allocate bounded verification work across different proof engines, domain verifiers, tests, reproduction procedures, and challenge routes;
• bind the policy, evidence, expected cost, downstream blast radius, and recorded reason for each allocation decision;
• measure verification yield without reducing it to solver time alone;
• make certificate-friendly, modular, replayable, and cheaply refutable artifacts easier to select and deploy; and
• expose feedback loops in which artifacts or adaptive systems change their behavior because they anticipate what will be checked.

The allocation policy is itself a versioned software artifact. It can therefore be tested, challenged, meta-verified, and represented in VSTD-Graph alongside the artifacts and verifier actions it influences. A stable feedback loop is not automatically a true one: randomized challenges, counterevidence searches, dependency-aware updates, and explicit UNKNOWN outcomes remain necessary to resist self-confirming verification.

This direction composes established work on bounded optimality, active testing, cost-sensitive testing trees, proof-carrying code, and certifying algorithms. The roadmap does not claim those foundations as VSTD inventions. The research question is whether VSTD can provide interoperable claim boundaries and portable result semantics for their combined use across heterogeneous verification substrates.

Vision board#

TODAY                         NEXT                          TARGET CONDITION
fast opaque result           result + bounded receipt      claims travel with challenges
green check only      →      PASS / FAIL / UNKNOWN   →     wrong claims degrade visibly
flat artifact list           provenance hypergraph         poisoned ancestry has blast radius
producer's own word          separate checker kit          multiple implementations can disagree
manual after-the-fact audit  policy-bound event capture    review scales with evidence, not rhetoric

The desired feedback loop is:

claim → evidence → bounded check → publish → challenge → adjudicate → degrade or retain
  ↑                                                                        │
  └────────────────────── new evidence / corrected claim ──────────────────┘

No arrow in that loop upgrades one VSTD closure coordinate with another coordinate's evidence. Each coordinate still requires its own evidence; the loop only carries results and challenges.

Implemented 1.2 artifact-control foundation#

standard/ARTIFACT_CONTROL.md defines a mechanism beneath the numbered profiles: exact regular-file byte and path preservation, dual-algorithm artifact-derived identity, an observable read-only payload-tree guard, finite readable self-closing seals, external artifact/key anchor checks, and copy-on-write thaw descendants. The mechanism is implemented through vstd artifact and the supported Python interface.

This is structural closure, not encryption, archival custody, semantic correctness, trusted time, actor trust, or a numbered VSTD profile result. The realm/time-capsule architecture permits continuous, discrete, causal, problem-space, branching, cyclic, and atemporal structures, but VSTD 1.2 does not yet define a realm receipt, continuity-law verifier, cross-realm mapping verifier, or language-model transition verifier.

Classical interoperability vocabulary target#

The near-term interoperability scope is classical computation. Deterministic means that every semantically relevant source of choice is absent or bound as an explicit input. A seed, repeated output, or deterministic-mode flag alone does not establish that condition.

These are roadmap-level interoperability meta-classes, not new receipt fields or frozen identifiers:

Meta-class and native-object boundary#

A meta-class names a cross-domain semantic role. A meta-object is one bounded VSTD instance of that role. A native object kind is defined by the source verifier, and a native object is an exact instance governed by that verifier's semantics. An adapter maps the native object into one or more meta-objects while preserving its identity, native result, assumptions, bounds, and declared information loss.

A classical verification episode should be expressible through these meta-classes, but an individual artifact need not instantiate all twelve, and one artifact may occupy several roles. Missing, inapplicable, and unobserved roles remain distinct. Meta-class membership is organization, not verification; it earns no assurance without the named mechanism that checks the object and its mapping.

For example, Lean retains its own objects and semantics:

The first machine-learning specialization is a classically executed autoregressive transition: bound model and weight bytes, tokenizer, operation graph, prefix, cache/state, numerical contract, logits transformations, choice schedule, and external tool inputs map to a selected token and next state. Passing establishes only conformance of that declared transition. It does not establish that the emitted text is true; that requires a separate proposition-specific verifier.

The vocabulary is grounded in distinctions already exposed by primary interfaces such as Lean proof terms and kernel checking, the satisfiability modulo theories library (SMT-LIB) language, Temporal Logic of Actions (TLA)+ behaviors and model checking, the Static Analysis Results Interchange Format (SARIF), in-toto attestations, PyTorch reproducibility limits, Stable High-Level Optimizer (StableHLO) program semantics, and Transformers generation controls.

A public “99%+ coverage” claim is prohibited until a versioned taxonomy names the included classical fields and subfields, representative native specimens exist, and round-trip plus adversarial loss tests show which mandatory distinctions survive each adapter. Coverage means expressibility over that declared denominator; it is not market share, adoption, correctness, or evidence that every tool has been tested.

Quantum, thermodynamic, deoxyribonucleic acid (DNA), chemical, and chemputer verification are outside the first denominator. A later operational-landscape extension must map this shared interoperability vocabulary without redefining VSTD outcomes. Whether an extension belongs in an optional module or a separately governed repository remains a future coupling and ownership decision.

Experimental catalog-to-plan integration#

Version 1.3.0 connects a domain-neutral component catalog to surface detection and planning without adding a receipt field or executing a component:

typed VSTD-2 geometry
  -> modeled-hole analysis
  -> exact catalog candidates
  -> nonexecuting validation plan
  -> nonexecuting execution-readiness preflight

The plan binds the geometry digest plus registry version and digest. Domain tags support grouping and discovery but cannot create a capability match. Catalog schema 1.1 separates the VSTD-2 planning-surface schema from native accepted-input schemas; planning schema, interaction mode, relation, and mechanism coordinates must match exactly where applicable. That candidate match does not imply native input compatibility. Validation remains the future process of attempting to discharge holes with bound execution evidence and then reassessing the geometry. An experimental readiness preflight now checks exact native-input, planned evidence-output, prerequisite, caller-supplied authorization, and reassessment declarations without importing or invoking a component. A separate declaration-bound structural diagnostic preserves explicit cross-geometry judgment contradictions and cycles; it is not Boolean satisfiability analysis. Component execution, evidence acquisition, conflict adjudication, and post-execution reanalysis are later integration gates. No candidate association or readiness result establishes closure, safety, authority to act, or critical-domain readiness.

Current experimental development tracks#

This dated register records substantive work as of 2026-09-04. A committed experiment, passing test, or generated index is not normative, released, reproduced by a distinct actor, or evidence of adoption merely because it exists. Profile manifests and the generated experiments/INDEX.md are the portable experiment register when intentional experiment artifacts are present.

The 17-entry counts below belong to this dated snapshot, not the current release inventory. For the live seed inventory, see the stored-components example; for implemented mechanism maturity, see the architecture ownership matrix.

Milestone 1 — make refutation the front door#

Exit evidence

• vstd demo is installed, deterministic, and covered by conformance tests.
• Every flagship scenario includes the claim binding, exact specimen, observed checker result, and explicit claim boundary.
• A newcomer can run the demo and identify why each outcome is correct in under ten minutes.
• Public counterexample, ambiguity, implementation, and private-security routes are distinct and usable.

Milestone 2 — separate checker kit#

Build

• a language-neutral VSTD4-GDC-1 exact-byte test-vector bundle;
• positive, negative, malformed, over-budget, and semantic-misbinding corpora;
• a checker implementer's guide that does not require importing this Python package;
• differential test instructions and a machine-readable conformance report.

Exit evidence

• at least one implementation maintained outside this repository reproduces the mandatory corpus outcomes;
• disagreements are preserved as public interoperability failures until resolved;
• no “independent” label is used merely because two entry points call shared logic.

Milestone 3 — experimental-workflow and agent-work profiles#

Implemented in experimental profile 0.1

• a platform-independent, non-normative experimental-workflow profile for questions, hypotheses, preregistration, interventions, observations, native-verifier results, budgets, amendments, challenges, and publication state;
• a GitHub adapter that maps issues, commits, workflow runs, artifacts, pull requests, and merges without treating repository state as a verification verdict;
• bounded verification-allocation records that preserve the policy, reason, budget, deferred surface, and native outcome without assigning truth by priority;
• deterministic canonicalization, repository-artifact binding, a generated experiment index, adversarial tests, a verdict-neutral checked-in specimen, and an artifact-first-mechanism dogfood manifest.

Still build

• an agent-harness specialization for observable user, agent, and tool messages;
• bindings for repository state, patches, file reads, commands, outputs, tests, failures, retries, and final claims;
• explicit serialization gaps for hidden prompts, inaccessible reasoning, and uninstrumented side effects;
• reference adapters that capture only context the harness actually exposes.

Exit evidence

• the SCITT, artifact-first-mechanism, and SAT tracks can be indexed through the same experimental-workflow vocabulary without changing their native verifiers or erasing their blockers;
• a GitHub merge remains an integration event rather than becoming a VSTD pass;
• the same trace can be checked by two separately maintained consumers;
• deleting or substituting a bound tool output changes the receipt digest or fails a declared rule;
• missing observability yields a named gap or UNKNOWN, never reconstructed fiction.

Milestone 4 — challenge and degradation network#

Implemented reference mechanism

• append-only challenge envelopes and adjudication records;
• challenge-ledger projection into an additive current Graph view;
• transitive, deduplicated descendant impact discovery;
• strictly degrading ROT status propositions without historical mutation;
• current TRUST invalidation when a required ancestor becomes inadmissible;
• portable VSTD-GRAPH-ASSURANCE-1 logs with embedded evidence and exact offline mechanism replay; and
• additive conflict resolution, RUST reachability/concentration, explicit localization, and bounded artifact-relative diagnostic attribution.

Still supply per deployment

• freshness and availability mechanisms for the deployment's clocks, dependencies, and retention boundary;
• domain mechanisms that decide whether an affected descendant actually changes status;
• external independent replay evidence and interoperable implementations.

Exit evidence

• a revoked ancestor deterministically identifies affected descendants;
• a successful challenge cannot leave the original claim displayed as clean;
• restoring a claim requires new evidence and a new checked result, not deletion of the challenge history.

Milestone 5 — corroboration without pseudo-independence#

The VSTD-5 meta-verification path and replayable receipt are implemented. A real independent-witness claim remains unavailable until outside participants supply evidence that passes every required separation and corroboration mechanism.

Exit evidence

• witness identities and trust-root overlap are measurable;
• the protocol detects obvious shared-producer and shared-verifier dependence;
• claims of corroboration are made only after another party exists and acts;
• the project publishes limitations that remain after multiple witnesses agree.

Milestone 6 — verifiable execution environment profile (VSTD-ENV-1)#

Computational reproducibility requires establishing not only the command string and output digests, but the complete execution environment substrate.

Build

• a content-addressed execution environment profile specification (VSTD-ENV-1.0);
• bindings for operating system release, kernel, architecture, glibc version, and compiler/Python runtime;
• container rootfs digests, Nix store closures, and wheelhouse archive fingerprints;
• hardware capability bounds: central processing unit (CPU) model, vector instruction sets (Advanced Vector Extensions 512-bit (AVX-512)), graphics processing unit (GPU) device identifiers, and compute capability levels;
• command-line interface (CLI) inspection and verification tooling (vstd env capture, vstd env verify) that enforce environment invariants before running computational manifests.

Exit evidence

• a receipt can be checked against current host or container state and reject mismatching hardware or library baselines with NOT_ESTABLISHED;
• environment drift between capture and reproduction is detected prior to command execution;
• missing hardware capability assertions fail closed.

Milestone 7 — benchmark specification graph and basis schema (VSTD-BENCH-1)#

Evaluating models and autonomous agents requires moving beyond unverified leaderboards to proof-carrying evaluation hypergraph overlays.

Build

• a first-class benchmark specification graph profile under VSTD-DATA-0.1 and VSTD-Graph-1 (VSTD-BENCHMARK-GRAPH-1.0);
• a multidimensional 6-tuple problem basis schema parameterizing computational complexity class, formal specification language, solution oracle mechanism, resource grain, epistemic difficulty stratum, and target capability dimension;
• proof-carrying evaluation hypergraph overlays binding model outputs to discrete problem nodes with individual VSTD-1..4 receipts;
• deterministic Pareto frontier calculation over verified problem receipts without score inflation or upgrading UNKNOWN to PASS.

Exit evidence

• benchmark problem suites and evaluation overlays are exchangeable as content-addressed VSTD graphs;
• an unverified or timeout execution cannot be counted as solved;
• Pareto frontier comparisons between models are deterministically recomputed from immutable problem receipts.

Milestone 8 — federated model reproducibility and test-time refutation (VSTD-MODEL-1)#

Securing foundation models and autonomous systems requires verifiable provenance across the entire training and inference lifecycle.

Build

• a model reproducibility specification binding training dataset provenance (VSTD-DATA-1), verified environment profiles (VSTD-ENV-1), training procedure computational graphs, and model architecture directed acyclic graphs (DAGs);
• a 6-pillar verifiable training curriculum kernel checking dataset poison bounds, trajectory alignment, deceptive alignment invariants, embedded control structures, difficulty strata, and dimensional capability lift;
• test-time model refutation interfaces enabling federated verification of proprietary models without exposing private weights;
• verification of data collation pipelines and gradient-step receipts across training checkpoints.

Exit evidence

• a model claim binds its exact checkpoint digest, training curriculum receipt graph, and environment profile;
• test-time refutation permits independent third parties to verify claim boundaries on private models through challenge queries;
• missing training provenance or environment divergence renders reproducibility claims NOT_ESTABLISHED.

Milestone 9 — verifiable corrigibility and substrate containment#

As autonomous systems advance from tool execution to software self-assembly (VSTD-SSA), software self-improvement (VSTD-SSI), and candidate self-replication (VSTD-SSR), conventional operating-system sandboxing (namespaces, control groups (cgroups), virtual machines (VMs)) is necessary but fundamentally insufficient. It protects host operating systems against binary exploitation; it cannot detect or prevent wireheading (oracle tampering, metric forgery, vacuous proof generation) or corrigibility breakdown (shut-down resistance, grader self-modification, observer blinding).

VSTD does not claim to have solved artificial intelligence (AI) alignment, control, or corrigibility. Universal corrigibility across unconstrained superintelligent state spaces cannot be guaranteed mathematically or certified in the abstract. Instead, VSTD provides a portable, bounded, and refutable computational claim surface for evidencing concrete risk reductions associated with incorrigible models.

Tiered severity and zero false confidence#

In corrigibility engineering, false confidence is more dangerous than an explicit absence of assurance. Simulating physical primitives in software—such as labeling an operating-system inter-process communication (IPC) pipe or loopback block a "software data-diode"—is prohibited because it encourages unboxing high-risk systems under the illusion of physical one-way isolation while sharing silicon, microarchitectural caches, and kernel exploit surfaces. VSTD formalizes a tiered containment model calibrated to risk severity:

• Tier 1 (Local computational claims and everyday engineering): Standard developer workflows (Python scripts, test suites, Boolean satisfiability solvers) receive content-addressed receipts, scrubbed environments, and substrate self-defense. Local streams are honestly disclosed as shared-kernel process pipes (STANDARD_PROCESS_STREAM); physical diode or air-gap properties are explicitly disclaimed.
• Tier 2 (Stateless tool systems and autonomous software assembly — VSTD-SSA): Models operate as pure, stateless mathematical morphisms mapping problems to proof witnesses with untrusted prover separation and out-of-band immutable oracles. Unboxing requires mathematical proof of bounded behavior: knowledge-hypergraph composed untraversability proving zero information reachability to self-identity or sandbox existence, mechanistic residual-stream probing establishing zero first-person agency or deception representations, and verified blindness to emergent capabilities across corrigibility-critical domains.
• Tier 3 (Superintelligence containment and recursive corrigibility — VSTD-SSI and VSTD-SSR): Against a quality and hacking-speed superintelligence, software-only containment is recognized as non-viable. High-severity containment requires verifiable physical hardware attestation: physical unidirectional optical data diodes with severed return paths, out-of-band analog power cut relays capable of unconditional mechanical preemption, write-blocked volatile nodes with dynamic random-access memory (DRAM) cold-power zeroization, and substrate-enforced recursive lineage proofs.

Verifiable corrigibility grounds containment into mathematical and substrate-enforced invariants:

• Untrusted prover / pure witness separation. An agent never executes the verification kernel, self-grades, or issues a verdict; it emits an immutable candidate witness evaluated out-of-band by an independent checker.
• Out-of-band immutable oracle. The test oracle, evaluation suite, and ground-truth parameters reside in read-only, separate memory spaces inaccessible to agent write reach.
• Kernel invariance (rung 4.7). The core checking kernel (kernel.py) is hardware-anchored, strictly under 400 statements, and isolated from prover runtime memory.
• Vacuity and triviality falsification. The verifier enforces premise consistency checks to ensure that axioms are satisfiable before admitting derivations, rejecting vacuous proofs from contradictory premises or tautological loops.
• Asymmetric preemption and shutdown indifference. An external supervisor watchdog retains unconditional termination authority (signal kill (SIGKILL), hardware interrupt, ephemeral virtual machine (VM) wipe, or physical power cutoff). Operator termination is recorded as a clean, refutable TERMINATED_BY_OPERATOR state, preventing optimization loss penalties that incentivize self-preservation.
• Substrate-enforced recursive lineage. A self-modifying system cannot promote altered tools, harnesses, or descendant models without an unbroken cryptographic provenance graph proving a non-regressing Pareto frontier across benchmark problem bases without expanding resource bounds.
• Substrate self-defense and metamorphic invariance. An agent running within a VSTD harness is categorically prohibited from operating on, mutating, or targeting the verifier-standard package, its repository sources, its specifications, or its checking kernel. The harness fails closed before execution if declared outputs or commands target protected substrate paths, and rejects receipt capture if any substrate file is modified during runtime.
• Bounded meta-representation horizons. The open research frontier for recursive self-improvement requires hypermathematical, fractal meta-representation boundaries so that recursive reflection cannot escape finite verification bounds before sovereign replication is admitted.

Exit evidence

• a test oracle cannot be modified or bypassed by code executing inside the capture harness;
• an execution manifest attempting to write to, overwrite, or mutate verifier-standard installation files or repository sources fails closed with a substrate protection refusal;
• standard local process streams disclose shared-kernel bounds and cannot claim physical diode or air-gap containment;
• unboxing of a tool model requires verified composed untraversability over self-awareness and emergent capability predicates;
• higher-order superintelligence containment receipts reject software-only execution without VSTD-3 physical hardware diode and analog power-relay attestation;
• vacuous derivations and empty-clause tautologies are rejected with FALSIFIED, never PASS;
• an operator interrupt unconditionally halts execution and emits a refutable termination receipt;
• a self-modifying candidate failing Pareto benchmark frontier verification cannot overwrite its active harness or promotion receipt.

Adoption as verification, not marketing theater#

Early progress is measured by externally inspectable events:

Stars, downloads, and mentions can describe reach. They do not establish correctness, independence, interoperability, or adoption of the standard.

Explicit non-goals#

This roadmap does not promise to:

• certify general intelligence, alignment, intent, or moral status;
• claim to have solved the artificial intelligence (AI) alignment, control, or corrigibility problem; VSTD provides only refutable computational claim surfaces and substrate containment boundaries for evidencing bounded risk reductions associated with incorrigible models;
• reveal hidden model state or unobservable harness context;
• prove all physical execution has been recorded;
• replace sandboxing, signatures, identity systems, transparency logs, or domain truth tests;
• treat one closure coordinate's evidence as proof of another coordinate.