swarm-orchestrator

14.0.2/npm install -g swarm-orchestrator

The model can say whatever it likes. It cannot make a gate pass, it cannot mark a claim verified, and it cannot change a record after the fact.

Those are the harness's to decide. A run exports a signed, hash-chained bundle that anybody can check without installing this tool.

One claim, twice refused, on a real run

claim

facts.exitCode == 0 && facts.stdout.includes("8 harness(es), 84 seed(s) total")

verdict

UNVERIFIED predicate-unparseable: expected one of == != >= <= > < after "facts.stdout.includes"

then

the model wrote a predicate the harness could evaluate, and that one resolved.

Across the ten tasks of that run the harness rendered 11 claims verified and refused 42, in four distinct ways. None aborted a run. docs/evidence/2026-08-18/shakedown/results.md

Every claim this project makesand the committed thing that backs it

This list is generated from docs/claims.md. Nothing reaches this page that is not a row of that table, which is the point: a claim without an artifact does not get made, and a page written by hand is where that rule quietly stops applying.

A one-byte change to a ledger record is caught

backing1 artifact

docs/evidence/2026-08-18/tamper-demo/README.md: the same bundle verified and tampered, exit 0 and exit 1, with flip-one-byte.mjs to reproduce it from the committed bundle

A bundle carries its own verifier and needs nothing from this repo, including on a machine that has never seen it

backing2 artifacts

docs/evidence/2026-08-23/clean-container-verification.md: the committed live-frontier bundle copied into a node:24 container with no network and no mount of this repository, verified there (exit 0), and the same bundle one byte later refused there (exit 1), with the image digest and both transcripts. docs/evidence/2026-08-18/live-tasks.md is the weaker earlier statement, from outside the repository on the machine that built it

Bundles are signed with a key from the OS keychain, and say so when they were not

backing5 artifacts

both manifests in docs/evidence/2026-08-18/live-tasks.md carry &quot;keySource&quot;: &quot;keychain&quot; and both verifier transcripts there report ed25519, keychain key. Where the keychain holds no usable key the run signs with a per-run key, prints which of the three keychain failures happened, and the manifest records keySource: ephemeral: docs/evidence/2026-08-23/installed-package-run.md and docs/evidence/2026-08-23/calibration-report.md are both from a machine whose entry is not a key, and both say so. src/evidence/signing.ts with src/evidence/signing.test.ts

A run draws a live screen a person can drive, and a keystroke has no route to a verdict

backing6 artifacts

src/tui/view-state.ts and src/tui/session-view.ts are separate types with separate reducers, and src/tui/view-state.test.ts asserts across every view action that no field of the first shares a name with a field of the second and that no value it can produce reads as a verdict. docs/evidence/2026-08-23/interface.md for the screen, the keymap and the config surface, with the captured frames in docs/evidence/2026-08-23/interface-frames.txt and a playable recording in docs/evidence/2026-08-23/interface.cast

A confirmation answered on the screen reaches the chokepoint intact

backing1 artifact

src/tui/confirmation-path.test.ts drives a keystroke through the dispatcher and the queue into createToolChokepoint, in both directions, and asserts the tool ran or did not

The evidence panel opens a harness-computed path, by argv, and says verified only where the verifier ran

backing3 artifacts

src/tui/open-path.ts and src/tui/evidence-panel.ts, with src/tui/evidence-panel.test.ts: a path tagged anything but harness raises, a hostile path travels as one argument with no shell, the opener environment carries no name that decides what a process loads, and the panel reads "not verified in this run" with the command unless the embedded verifier exited 0 here

Local model selection is measured on the machine it runs on

backing6 artifacts

docs/evidence/2026-08-18/hardware-select.md for the probe, and docs/evidence/2026-09-02/calibration-report.md with the four bundles under docs/evidence/2026-09-02/calibration/ for 300 runs of four models on two backends, every repeat executed, read as distributions and compared with the August sweep distribution against distribution. docs/evidence/2026-08-23/calibration-report.md with docs/evidence/2026-08-23/calibration/ is the 180-run August measurement it supersedes, and docs/evidence/2026-08-18/calibration-report.md the one before that: both are left in place under a dated header saying they predate the empty-turn fix and that their numbers are not to be cited, and the 09-02 comparison re-reads the 08-23 records rather than those figures

Known limitations are documented rather than hidden

backing1 artifact

build-guide.md section 7.1 for the six residuals, the null results in security-coverage.md, and the NOT-RUN entries in docs/evidence/2026-08-18/run-report.md

The packaged tool installs from its tarball and runs a task end to end, with nothing of this repository beside it

backing3 artifacts

docs/evidence/2026-08-23/installed-package-run.md: the 13.1.0 tarball installed into an empty directory, two tasks against a workspace it had never seen, recorded in docs/evidence/2026-08-23/live-task.cast and docs/evidence/2026-08-23/open-evidence.cast. One goes green and one escalates at the file-set gate citing its ledger record; both bundles verify from outside both directories, and the panel reports open exited 0 rather than reporting that it opened something

The package on the registry is the artifact this repository built, and carries a signed statement saying so

backing1 artifact

docs/evidence/2026-08-24/registry-publish.md: npm install -g swarm-orchestrator serves 13.1.3, published by CI run 32751820534 from tag v13.1.3. The shasum the registry serves is the one that run's npm pack --dry-run printed before the publish step, and npm audit signatures reports the SLSA provenance attestation verified from a clean install. It ties the tarball to this repository, this commit and that run, and it says nothing about whether the code is correct

The project page cannot state a claim this table does not make

backing3 artifacts

scripts/build-site.mjs generates the page from this file: the claims come from the rows above, the struck-through list comes from the section below, and the version comes from package.json. scripts/build-site.test.mjs asserts every row reaches the page, that every forbidden phrase reaches it too, that a path the repository does not track is left as text rather than linked to a 404, and that the only verdict the page renders is the refusal it quotes

A session runs several tasks against one workspace, and each turn is measured on its own

backing4 artifacts

docs/evidence/2026-08-24/session.md: three tasks typed one after another in one process and one ledger, each turn changing two files and each turn's gates measuring exactly those two, with test counts rising 2, 4, 5 and never falling. The bundle in docs/evidence/2026-08-24/session/ verifies from outside the workspace, 119 records, 3 claims verified and 2 refused. A turn ends by recording where it left the tree, src/gates/turn-baseline.ts, and changes are measured through a scratch index rather than the person's, src/gates/scratch-index.ts, without which the second turn reports its own edits as deletions

The review page says what the run was asked to do, what it decided, and what it changed

backing3 artifacts

src/evidence/review-page.ts with src/evidence/review-page.test.ts: the header carries the tasks, the model, whether the loop completed, the duration and the cost; the gate table is rendered into the bundle rather than printed only to a terminal; and the patch the task produced is recorded as a ledger record and shown. A screenshot of a real one is docs/evidence/2026-08-24/review-page.png

Workers coordinate by reading each other's ledgers, and nothing they read can render a verdict

backing4 artifacts

src/workers/trail.ts with src/workers/trail.test.ts: every signal is derived from a ledger record rather than from model text, no signal kind reports a success, a peer's raw runner output never travels, and a worker is handed neither its own chain nor the other attempts at its own task. src/workers/trail-tool.ts puts the read through the existing chokepoint, so what comes back is tagged tool output. src/workers/boundary.test.ts proves the loop, the tools, the gates and the run assembly import none of it, and proves its own detector catches a crossing

A choice between competing attempts is made from measured numbers, and the working is on the chain

backing3 artifacts

docs/evidence/2026-08-24/swarm.md for a run of one task tried three ways: three green attempts, coverage measured rather than abstained on, the third ranked last on a dimension that saw it wrote one test fewer, and the top two tied so the earliest won, which the report says in those words. The record is swarm/redundancy/, 27 coordinator records, and it verifies from where it sits. src/workers/attempt-selector.ts with src/workers/attempt-universe.ts for the comparator and the universe fixed across attempts before anything is counted

Opening a large test file gains an attempt nothing

backing2 artifacts

src/workers/attempt-universe.test.ts and src/workers/attempt-selector.test.ts: an attempt that touches a fifty-test file without adding to it loses to one that wrote two real tests, because every attempt is counted over the same file universe and an untouched file counts at its base content

The tool breaks a goal into tasks itself, declares the graph before it runs anything, and says what it cannot check

backing1 artifact

docs/evidence/2026-08-24/swarm.md for a --goal run: the planner declared three nodes on a chain of its own, the task-graph record precedes every worker-started, two nodes landed and one did not, and the outcome claim nodes == 3 &amp;&amp; landed == 3 renders UNVERIFIED with both literals taken from the declaration. The record is swarm/decomposition/, 37 coordinator records, and it verifies. That same run is the honest limit: every structural check passed on a decomposition that could not work, because the planner left out a dependency, and no check here reads meaning

The audit chain is proven on a schedule, from a clean clone, in both directions

backing4 artifacts

.github/workflows/nightly-proof.yml runs the suite, the fuzz smoke, and scripts/prove-bundle.mjs over the committed docs/evidence/2026-08-18/live-frontier/ bundle: verified as committed, then refused one byte later with the broken link named, and the prover itself fails if the tampered copy verifies, which scripts/prove-bundle.test.mjs shows by handing it a verifier that says yes to everything. First observed passing as run 33675596249 on 2026-09-02, transcript uploaded as its artifact

One real task runs through the whole pipeline on a hosted runner every week, and the bundle is judged, never the task

backing3 artifacts

.github/workflows/weekly-evidence.yml installs a pinned Ollama, serves a small model, seeds the workspace scripts/seed-proof-workspace.mjs writes, runs one task through the built CLI, and verifies the fresh bundle in the same job. First observed passing as run 33675598963 on 2026-09-02: the model failed the task, the tests gate escalated, and the 47-record bundle verified, which is the thesis and is why the task outcome is recorded rather than judged. docs/evidence/2026-09-02/run-report.md

The criteria are sealed before the loop, every pass is bonded, and a bundle re-derives its own verdicts

backing7 artifacts

src/gates/gate-set-seal.ts, src/gates/bonds.ts and src/gates/bond-runner.ts with their tests, and src/evidence/verifier/rederive.mjs held to the parsers by src/evidence/rederive.test.ts. Shown on a real run in docs/evidence/2026-09-02/gates-bonded/: nine gates sealed at record 1, the tests, placeholder, secret-scan and diff-budget bonds held, the behaviour probe recorded as not bonded rather than as held, verify.mjs exit 0 with the seal and the bonds recomputed, and rederive.mjs agreeing on all seventeen verdicts with none it could not re-derive. src/gates/bond-runner.test.ts shows the other direction: a runner that passes over a bond it collected is recorded vacuous, and src/evidence/rederive.test.ts hands the re-deriver a bundle that lies about a status and asserts it disagrees

The tool was measured on fifty repositories in five languages, each seeded with one defect its own suite catches, under criteria sealed before any repository was looked at, and every bundle of the corpus verifies

backing5 artifacts

campaign/criteria.md and campaign/methodology.md, both committed before what they govern; campaign/seeds/manifest.json, committed before any arm ran; campaign/results/report.md, generated from the result records alone: 43 of 43 executed bundles verify on local-mlx and 50 of 50 on local-ollama, with the frontier arm carried at zero runs. The bundles are under campaign/corpus/ with their own verifiers

`swarm ci` refuses to certify on an oracle that never ran the change, and says which lines

backing5 artifacts

src/gates/oracle-reach.ts with src/gates/oracle-reach.test.ts for the rule, src/gates/v8-coverage.ts with src/gates/v8-coverage.test.ts for the reader, which is checked line by line against node's own lcov report of the same run, and src/gates/independent-verification.test.ts for both directions end to end: an oracle that takes a branch reads reached and one that does not reads unreached with the line named. Measured on the mined corpus: koa#1946 is refused for lines 270 to 273 of the file it certified, and dayjs#3181 for the d.tz branch its held-back case breaks on

`swarm ci` asks whether the oracle asserted anything about the lines the patch added, and says what showed the mutant changed the program

backing7 artifacts

src/gates/oracle-mutants.ts with src/gates/oracle-mutants.test.ts for the eight operators, read off the language's statement productions and derived in oracle-bond-operators.md before any of them was implemented; src/gates/mutant-parse.ts with src/gates/mutant-parse.test.ts, which runs each dialect rather than asserting which ones node --check reads; src/gates/mutant-witness.ts and src/gates/oracle-bond-run.ts with their tests for the two detectors and the order they are spent in; and src/gates/independent-verification.test.ts for all of it end to end, including a patch whose accepted mutant coverage shows changed what ran, and one whose accepted mutant neither detector can witness. Measured over the corpus: all eight operators fire, the three general ones account for 25 of the 34 mutants built, and node scripts/bond-cost.mjs prints what requiring a witness costs against recording it

And the sentences this project will not writekept verbatim, because each was tempting once

Check it yourselfthe bundle carries its own verifier

npm install -g swarm-orchestrator
swarm "make the parser trim before it splits"
node <bundle>/verify.mjs <bundle>
exit 0
on the committed bundle
exit 1
on the same bundle, one byte later

The verifier reads the manifest, walks the hash chain, checks the signature over the chain head, checks every blob against its content address, and recomputes every claim verdict. It needs nothing installed and nothing from this repository. Those two exit codes are from a node:24 container with no network and no mount of the source. docs/evidence/2026-08-23/clean-container-verification.md

A signature does not make the machine honest. It proves the bundle was not altered after it left the machine that produced it. Gates prove mechanical quality, not design quality, and a passing run does not mean the change is good.