verify it yourself

Don't trust us. Rebuild it from 299 bytes.

Helix's whole compiler comes back from 299 hand-typed bytes, with no trusted compiler anywhere in the chain. One command rebuilds it on your machine and checks every byte against the pinned hashes. About five minutes, CPU only, no GPU.

Go to the commands → Browse the repo

the claim

Three things, checked from your own copy.

The reproduction rebuilds the whole ladder from the first byte up, then asserts it didn't drift.

hex0 · 299 B→ hex1→ hex2→ catm→ M0→ cc_amd64→ M2-Planet→ seed→ kovc

Each rung is built only by the rung before it. No pre-built compiler is trusted at any point.

It rebuilds from raw. The ladder is rebuilt starting from hex0 — 299 bytes you could type by hand — and every rung's SHA-256 matches its committed value.
It builds itself, byte for byte. The compiler compiles itself until the output stops changing. K2, K3 and K4 come out identical.
An unrelated compiler agrees. A separate gcc build that shares no ancestry produces the byte-identical seed. gcc only audits here; it's never the shipped root.

Prefer to install nothing?

You don't have to run it at all. The same script runs on a clean ubuntu-latest machine on every push — open the trust-reproduce runs and look for the green checks, or fork the repo and watch your own copy do it.

before you start

A Linux shell and a handful of tools.

The trust core builds real Linux binaries, so it runs on Linux. On Windows, use WSL2 (wsl --install in PowerShell, then open Ubuntu). No GPU. No Python.

install the audit tools · Debian / Ubuntu / WSL

sudo apt-get update
sudo apt-get install -y git xxd binutils gcc file coreutils

On macOS, run it inside a Linux container: docker run -it --rm -v "$PWD":/w -w /w ubuntu:24.04 bash, then the two lines above.

the reproduction

Clone it. Run one command.

Clone anywhere you like — the script adjusts its own paths to wherever you put it.

1 · get the code

git clone https://github.com/Questeria/helix.git
cd helix
git checkout v1.5-complete   # optional: pin to the release. omit for the latest.

2 · rebuild and check · ~1–5 min · no GPU

bash scripts/reproduce_trust.sh

It deletes every pre-built rung, rebuilds the ladder from hex0, runs the self-host fixpoint and the gcc cross-build, and asserts the pinned hashes. It exits non-zero the moment a byte is off. The tail you're waiting for:

what you'll see

[reproduce_trust]     rung hex0 : build + self-verify OK
          hex1 · hex2 · catm · M0 · cc_amd64 · M2-Planet · seed
[reproduce_trust]     GATE_PASS
[reproduce_trust]     fixpoint K2==K3==K4 == pinned (cdcf8673…)
[reproduce_trust]     DDC_ANCHOR_OK
============================================================
REPRODUCE_TRUST: PASS

exit 0 = your machine re-derived the compiler from 299 bytes

REPRODUCE_TRUST: PASS is the whole result. The script pins three hashes and prints them at the top of the run; if any differs, you get a FAIL line naming it.

Anchor	What it is	SHA-256 · v1.5 self-host line
seed	the bootstrap compiler, built from raw `hex0` (stable across releases)	9837db12…b915c9bb
K1	the independent `gcc` cross-build (matches the from-raw build)	6ee5ec2b…9989658c
fixpoint	the self-host result, K2 == K3 == K4	cdcf8673…dc139bdd

The seed hash is stable across releases. K1 and the fixpoint move only when the compiler source intentionally changes (the values above are the v1.5 self-host line), so trust the PASS line over any one number copied off a page.

go further

Past the trust core.

Optional steps past the core. The first is still CPU-only; the others need an NVIDIA GPU — the last runs a billion-parameter model.

still CPU-only

Prove the compiler works

The universal gate runs the self-host fixpoint plus a 113-program feature corpus — integer widths, floats, generics, traits, closures, pattern matching, diagnostics — and a PTX byte-diff. It prints GATE_PASS only when every leg is green.

needs an NVIDIA GPU

Run a real GPT-2 on it

Bring weights from HuggingFace and run an unchanged GPT-2 through Helix-emitted GPU kernels, checked token-for-token against an independent reference. Trust, not speed. It attests the v1.4 release, so run it from that tag.

needs an NVIDIA GPU + a big-model download

Verify a billion-parameter model

v1.6 runs Qwen3-8B (and 32B) on an 8 GB GPU via verified 4-bit NVFP4 quantization, with a reproducible commitment + calibrated-envelope receipt. The greedy next token matches the fp32 reference on decisive prompts — faithful within a calibrated envelope, not token-for-token, and the receipt commits to the run, it does not yet prove execution. The gate re-checks every receipt and rejects tampering by named reason.

deeper checks

bash scripts/gate_kovc.sh          # CPU, on this checkout -> GATE_PASS

# the GPT-2 demo attests the v1.4 release, so run it from that tag
git checkout v1.4
bash scripts/gpt2_demo_attest.sh   # GPU: from-raw rebuild, GPT-2 vs oracle, signed attestation

# v1.6: an 8B (and 32B) model on an 8GB GPU via verified NVFP4 + a calibrated receipt
git checkout v1.6-qwen3-32b-receipt
bash scripts/gpu_qwen3_receipt_check.sh   # -> RECEIPT_GATE_PASS (genuine 8B/32B + named-reject negative controls)

runbook: docs/HELIX_GPT2_DEMO_RUNBOOK.md

said before you ask

What a green run does not claim.

The honesty is the point. These are the limits, stated up front so the claim stays exact.

Complete to PTX, not below. The GPU path is auditable down to PTX text. Below PTX it trusts NVIDIA's closed ptxas, the driver, and the silicon. (As of v1.5, one kernel — vector_add on sm_86 — has its ptxas-emitted machine code independently checked, removing ptxas from the trusted base for that one kernel. A per-compilation witness, not a formal proof.)
Not GPU parity. Kernels run at roughly half to two-thirds of cuBLAS on one RTX 3070 Laptop, fp32. Trust first; speed is on the roadmap.
The CPU chain is the byte-identical part. The broad language surface is cross-checked behaviorally by a zero-ancestry interpreter, not by a second byte-identical compiler — that's impossible to build for it by construction.
One machine, so far. A single sm_86 GPU, fp32. External reproduction on someone else's hardware is the open invitation, not a closed claim.

The full record lives in TRUST_CHAIN_CLOSED.md and CLEAN_REPRODUCTION.md. They're the authority on the exact claims.

if something breaks

The usual snags.

It's crawling on Windows

You cloned into /mnt/c. Building on the Windows-mounted drive is far slower. Clone into your Linux home (~) inside WSL and run it there.

command not found: xxd

Re-run the install line. xxd is in the xxd package, sha256sum is in coreutils.

No such file: scripts/reproduce_trust.sh

You're not in the repo. Run cd helix first.

A hash mismatch, or a *** FAIL line

That's the guard doing its job — a byte differs. Re-clone fresh with no local edits and run again. If a clean clone still fails, that's exactly the kind of thing worth an issue.

all the way down

Audit instead of trust.

The compiler under all of this rebuilds from 299 hand-typed bytes — one command, about a minute, on your machine.

Run it → github.com/Questeria/helix