Built in the open. Closed with proof.
Helix is a source-available, fully auditable, from-scratch self-hosting language and compiler for ML and high-certainty systems work. The whole toolchain rebuilds from a 299-byte hand-authored root with no trusted pre-built compiler — and the trust chain was declared closed on 2026-06-07, at tag v1.3-release, after a live joint reproduction witnessed by the project owner.
A toolchain you can audit instead of trust.
Every rung of the ladder is built only by the rung before it. The only thing you take on faith is 299 bytes you can read by hand.
The ladder runs nine rungs — hex0 → hex1 → hex2 → catm → M0 → cc_amd64 → M2-Planet → seed → kovc — from raw hand-typed binary up to kovc, the Helix compiler written in Helix. The seed is a C-subset bootstrap compiler (sha 9837db12…); the self-host fixpoint is byte-identical across generations, K2 == K3 == K4 (sha 0992dddd…).
The toolchain is Python-free: the repository carries exactly one committed .py file, a fenced numpy verification oracle that is never on the compile or run path. Every kovc build passes the universal gate, scripts/gate_kovc.sh — the self-host fixpoint, a 109-program feature corpus, 4 negative-diagnostic checks, and a PTX regression.
On top of that core sit the verified-execution legs: GPT-2 124M and GPT-2-XL 1.5B — 2019 base completion models, unchanged public weights — and SmolLM2-135M, a 2024 Llama-architecture model (GQA + RoPE + SwiGLU + RMSNorm, 30 layers), all running token-for-token-identical (25/25 greedy ids) to an independent numpy oracle on kovc-emitted GPU kernels. The honest edges are stated, not buried: verified to PTX, not SASS; fp32; a single sm_86 GPU; live XL at roughly 10 s/token today, by design — trust first, with performance an active roadmap focus that will improve as Helix develops.
Every date below has a record behind it.
The byte-stable core came first; the trust chain closed on it; the model legs were layered on top, outside the self-host fixpoint.
| Date | Milestone | What it means |
|---|---|---|
| 2026-06-05 | Trust core v1.3 byte-stable | The self-hosting core reaches its byte-identical fixpoint and stays there. |
| 2026-06-07 | Trust chain declared closed · tag v1.3-release | A live joint reproduction witnessed by the project owner; owner attestation; residuals disclosed in docs/TRUST_CHAIN_CLOSED.md. |
| 2026-06 | GPT-2 verified-execution demo layers | 124M MVP, then the Large 774M and XL 1.5B scale legs — added on top of the closed core, outside the self-host fixpoint. |
| 2026-06-09 | SmolLM2-135M Llama-architecture leg gated | G-L1/G-L2 PASS, 25/25 greedy ids against the independent oracle — a 2024 architecture (GQA + RoPE + SwiGLU + RMSNorm, 30 layers), not just 2019's. |
Four independent ways to catch a lie.
No single check is asked to carry the claim. Each one attacks it from a different angle.
- One-command reproduction, on someone else's machine.
bash scripts/reproduce_trust.sh— clean checkout, CPU-only, about a minute — runs green in CI on a clean ubuntu-latest runner, a different machine from the author's. - Context-isolated adversarial reproductions. Reproductions run without the author's context, looking for the claim to break rather than to confirm it.
- A different-model-lineage read-only review. An independent review with no write access examined the chain; its findings were remediated.
- A live joint reproduction. The closure itself: the chain rebuilt live, witnessed by the project owner, with the attestation and residuals committed to the trust record.
The open increment, stated honestly
Reproduction by a party with no connection to the author remains the open increment. It is now push-button: fork the repo or run the CI workflow, and the same one-command reproduction either goes green for you or it doesn't.
What the owner intends to build next.
From the trust record's Phase 2 plan. None of this is claimed done — that distinction is the whole point of this website.
Beyond a single sm_86 GPU
Parameterize the PTX target for sm_80/sm_90, validate across architectures, optimize for absolute throughput, and bring the verified path to A100/H100-class hardware — the same verified stack, made faster.
trust record → Roadmap · second backendA genuinely separate AMD/ROCm backend
Currently unimplemented, and labeled as such. A second, independent GPU backend rather than a port of the first.
trust record → Roadmap · broader DDCDiverse double-compile, wider
Broaden the diverse-double-compile coverage to the v1.1 language surface, extending the independent-auditor check across more of the language.
trust record → Roadmap · stretch goalbf16 tensor cores
The bf16 tensor-core path is a stretch goal — explicitly not claimed done, and it will not be claimed until it is gated like everything else.
trust record →One owner, one repo, two authoritative records.
Helix is built by Questeria (Anthony DeMarco). Reach him at [email protected] or on LinkedIn — all routes are on the contact page.
The repository
Every byte of the toolchain, the gates, the records, and the issue tracker for technical reports — github.com/Questeria/helix.
github.com/Questeria/helix → Authoritative recordThe trust record
The closure declaration: what was reproduced, who witnessed it, and the residuals — disclosed, not hidden.
docs/TRUST_CHAIN_CLOSED.md → Authoritative recordClean reproduction
The exact steps to rebuild everything from a clean checkout and compare hashes — the same steps CI runs.
docs/CLEAN_REPRODUCTION.md → LicensingCommercial licensing
Helix is source-available and free for non-commercial use; commercial use needs a separate license — a restriction intended to be temporary as the project secures funding. Start with the license page, then reach out via the contact page.
/license/ →The rule this site runs on
Every number on this site traces to a committed file, a gate output, or a trust record. The site runs nothing live — the demo pages are committed replays of real captured runs, and they say so on every screen.
The whole point is that you can check.
One committed command rebuilds the compiler from 299 hand-authored bytes and proves the fixpoint. The verified model runs are gated against an independent oracle. Start anywhere.