the project · questeria · trust chain closed 2026-06-07

Built in the open. Closed with proof.

Helix is a source-available, fully auditable, from-scratch self-hosting language and compiler for ML and high-certainty systems work. The whole toolchain rebuilds from a 299-byte hand-authored root with no trusted pre-built compiler — and the trust chain was declared closed on 2026-06-07, at tag v1.3-release, after a live joint reproduction witnessed by the project owner.

What this project is

A toolchain you can audit instead of trust.

Every rung of the ladder is built only by the rung before it. The only thing you take on faith is 299 bytes you can read by hand.

The ladder runs nine rungs — hex0 → hex1 → hex2 → catm → M0 → cc_amd64 → M2-Planet → seed → kovc — from raw hand-typed binary up to kovc, the Helix compiler written in Helix. The seed is a C-subset bootstrap compiler (sha 9837db12…); the self-host fixpoint is byte-identical across generations, K2 == K3 == K4 (sha 0992dddd…).

The toolchain is Python-free: the repository carries exactly one committed .py file, a fenced numpy verification oracle that is never on the compile or run path. Every kovc build passes the universal gate, scripts/gate_kovc.sh — the self-host fixpoint, a 109-program feature corpus, 4 negative-diagnostic checks, and a PTX regression.

On top of that core sit the verified-execution legs: GPT-2 124M and GPT-2-XL 1.5B — 2019 base completion models, unchanged public weights — and SmolLM2-135M, a 2024 Llama-architecture model (GQA + RoPE + SwiGLU + RMSNorm, 30 layers), all running token-for-token-identical (25/25 greedy ids) to an independent numpy oracle on kovc-emitted GPU kernels. The honest edges are stated, not buried: verified to PTX, not SASS; fp32; a single sm_86 GPU; live XL at roughly 10 s/token today, by design — trust first, with performance an active roadmap focus that will improve as Helix develops.

trust root 299 bytes ladder 9 rungs fixpoint K2 == K3 == K4 committed python 1 fenced oracle SmolLM2 logit diff ≤ 4.9e-05 over 49,152 logits
Status

Every date below has a record behind it.

The byte-stable core came first; the trust chain closed on it; the model legs were layered on top, outside the self-host fixpoint.

Date Milestone What it means
2026-06-05 Trust core v1.3 byte-stable The self-hosting core reaches its byte-identical fixpoint and stays there.
2026-06-07 Trust chain declared closed · tag v1.3-release A live joint reproduction witnessed by the project owner; owner attestation; residuals disclosed in docs/TRUST_CHAIN_CLOSED.md.
2026-06 GPT-2 verified-execution demo layers 124M MVP, then the Large 774M and XL 1.5B scale legs — added on top of the closed core, outside the self-host fixpoint.
2026-06-09 SmolLM2-135M Llama-architecture leg gated G-L1/G-L2 PASS, 25/25 greedy ids against the independent oracle — a 2024 architecture (GQA + RoPE + SwiGLU + RMSNorm, 30 layers), not just 2019's.
greedy continuation 25/25 ids · GPT-2 & SmolLM2 SmolLM2 max-abs logit diff 4.9e-05 verified to PTX, not SASS precision fp32 hardware single sm_86 GPU
How it was verified

Four independent ways to catch a lie.

No single check is asked to carry the claim. Each one attacks it from a different angle.

  1. One-command reproduction, on someone else's machine. bash scripts/reproduce_trust.sh — clean checkout, CPU-only, about a minute — runs green in CI on a clean ubuntu-latest runner, a different machine from the author's.
  2. Context-isolated adversarial reproductions. Reproductions run without the author's context, looking for the claim to break rather than to confirm it.
  3. A different-model-lineage read-only review. An independent review with no write access examined the chain; its findings were remediated.
  4. A live joint reproduction. The closure itself: the chain rebuilt live, witnessed by the project owner, with the attestation and residuals committed to the trust record.

The open increment, stated honestly

Reproduction by a party with no connection to the author remains the open increment. It is now push-button: fork the repo or run the CI workflow, and the same one-command reproduction either goes green for you or it doesn't.

Don't take our word for it

The whole point is that you can check.

One committed command rebuilds the compiler from 299 hand-authored bytes and proves the fixpoint. The verified model runs are gated against an independent oracle. Start anywhere.