{"block_close_oss.c33fd1fe9c":"Community and ecosystem","open-source-selvedge.hero-broker.no":"No","open-source-selvedge.a5e3c573e9":"Compile Kera BNN workloads for Selvedge runtime.","open-source-selvedge.d5f412e831":"Kera","open-source-selvedge.fe0a091fdb":"Products","open-source-selvedge.7dfa2cfe61":"Hash-chained event provenance for system events.","open-source-selvedge.1aa2f31ee7":"Ledger","open-source-selvedge.6cc3364a24":"Execution evidence","open-source-selvedge.ff130daae8":"Reasoning proof certificates, not execution transcripts.","open-source-selvedge.df84637182":"AION","open-source-selvedge.d5d6e83bf2":"Continue exploring","open-source-selvedge.75e393a1ac":"Explore the project","open-source-selvedge.f9743247fa":"Read the documentation","open-source-selvedge.ef0fd4ccef":"Inspect the execution record","open-source-selvedge.e971b9cac2":"Selvedge publishes in the fourth round of the foundation release programme, after Knot and Ledger. Once it does, sandbox a WASM module and replay the proof envelope yourself.","open-source-selvedge.aa91c05f23":"Verify the result, not the code","open-source-selvedge.90e40d5043":"Get started","open-source-selvedge.de6848949f":"Selvedge","open-source-selvedge.650fabe787":"Open Source","open-source-selvedge.0a2d263d08":"OSS / Selvedge","open-source-selvedge.9e2fe6d1ab":"Default-deny sandbox","open-source-selvedge.6b5eb5323e":"Default deny","open-source-selvedge.9940fac0fc":"Model Context Protocol tool execution surface.","open-source-selvedge.d19313d340":"Agent server","open-source-selvedge.bb1d021694":"Ed25519 sealed, SHA3-256 transcript, offline verify.","open-source-selvedge.1ee471ad95":"Proof envelope","open-source-selvedge.7e4e340a74":"Graph IR binary neural networks, JIT and interpreter.","open-source-selvedge.0743169b8b":"Kera engine","open-source-selvedge.90ba359bc5":"Component model runtime, WASI 0.2 Preview 2 host.","open-source-selvedge.90aecd8ec1":"Wasmtime engine","open-source-selvedge.ed07ad60bf":"Verified surface","open-source-selvedge.8ec9f20dc2":"WHAT SHIPS","open-source-selvedge.efe0c41bcb":"KERA","open-source-selvedge.4e946026a7":"WASM","open-source-selvedge.8e4939f0ca":"RUST 2024","open-source-selvedge.c968638a6e":"SEALED TRANSCRIPT","open-source-selvedge.201a4da5a0":"Selvedge runs untrusted code inside a capability-limited sandbox and records the execution in a sealed transcript. Containment limits what the code can touch; the transcript shows what actually happened and can be replayed for review.","open-source-selvedge.3ca6c6a37b":"Default-deterministic","open-source-selvedge.a55e5a1229":"Capability limited","open-source-selvedge.fca77b7e3a":"The sealed execution path","open-source-selvedge.8faedce292":"Four runtimes","open-source-selvedge.2adb968c4a":"Same envelope","open-source-selvedge.0bf361df63":"Model Context Protocol server for agent tools.","open-source-selvedge.21593b807a":"MCP","open-source-selvedge.1df8dd458e":"Long-running agent runtime with a queue.","open-source-selvedge.329cb8b6ba":"Service","open-source-selvedge.8b3b7e65eb":"build, verify, run, replay. CI-friendly.","open-source-selvedge.700b401ca5":"CLI","open-source-selvedge.fb075836bd":"Linked into your application as a crate.","open-source-selvedge.0fd17b94c9":"Embedded","open-source-selvedge.3512486e9f":"Where Selvedge runs","open-source-selvedge.d53f3da0a7":"POSTURE","open-source-selvedge.f28d7de3d9":"REGULATED","open-source-selvedge.a21096cb07":"BNN RUNTIME","open-source-selvedge.0fcaf629eb":"PLUGINS","open-source-selvedge.32e4cd84f3":"AGENT TOOLS","open-source-selvedge.78a8dfaf02":"Agent tools, third-party plugins, Kera BNN inference, and regulated data work all enter through the same controlled boundary. Each runtime produces the same sealed evidence envelope, so deployment changes do not change the audit story.","open-source-selvedge.e9f7d0cf54":"meets regulated workloads","open-source-selvedge.8d5a043fd8":"Where untrusted code","open-source-selvedge.14a29ba383":"Use cases","open-source-selvedge.f86aae8de8":"Hot path stays with vanilla","open-source-selvedge.224a8949e8":"Cold start, the headline win","open-source-selvedge.36998c51d5":"Transcript hashing, SIMD.","open-source-selvedge.41366a8f09":"1 to 3 us","open-source-selvedge.01dbc6d47c":"SHA3-256, 1 KB","open-source-selvedge.bd0fbf08cc":"Ed25519 sign 5-15 us, verify 15-30 us.","open-source-selvedge.1f3e8a79be":"10 to 20 us","open-source-selvedge.671d8813b1":"AION proof create","open-source-selvedge.9f10fa1bbe":"Process startup included, 8-9x faster.","open-source-selvedge.4258dd2386":"1.58 to 1.70 ms","open-source-selvedge.919b634e80":"CLI cold, Kera JIT","open-source-selvedge.2d3bb21f5e":"Compute module, vs 1187-1494 us vanilla.","open-source-selvedge.bd8403776f":"15 to 21 us","open-source-selvedge.cbb71692d2":"Cold start, API","open-source-selvedge.6cd2cd614d":"From BENCHMARKS.md","open-source-selvedge.48109cc196":"SELVEDGE BENCHES","open-source-selvedge.d9074c5c77":"CRITERION","open-source-selvedge.7084ceb2f1":"AION 10-1000x","open-source-selvedge.b0437f28f6":"KERA JIT WARM 2x","open-source-selvedge.65e2c56be9":"COLD 62-243x","open-source-selvedge.928af32bc7":"Selvedge Wasmtime starts 62 to 243x faster than vanilla Wasmtime at the API level. The honest trade is the hot path: vanilla holds the 22 ns repeated call, and the component model that produces the transcript runs slower there. Kera JIT is 2x faster warm for graph work. Figures are from the repository BENCHMARKS.md.","open-source-selvedge.da589b16da":"Pick the runtime for the workload","open-source-selvedge.c296a030fe":"Cold start is the win","open-source-selvedge.63c9045599":"Performance","open-source-selvedge.7b63c4cb70":"Granted per call","open-source-selvedge.abf0c49614":"Default deny","open-source-selvedge.cce9f81b05":"Every gate decision recorded and hashed.","open-source-selvedge.5bcd602254":"Transcript","open-source-selvedge.7dc2595377":"max_execution_time_ns, separate from fuel.","open-source-selvedge.e909add520":"Wall-clock cap","open-source-selvedge.214f86c442":"max_memory_bytes, 256 MiB default, 4 GiB ceiling.","open-source-selvedge.89095dddd2":"RAM cap","open-source-selvedge.0f69ea8c8d":"max_instructions, exhaustion halts the workload cleanly.","open-source-selvedge.7171161439":"Compute budget","open-source-selvedge.71f2051042":"Clock, random, filesystem, network, environment, stdio, process, custom. Default deny.","open-source-selvedge.ca09c54bff":"Capabilities","open-source-selvedge.f767a4311b":"Per-run guards","open-source-selvedge.369abb529c":"POLICY TIERS","open-source-selvedge.64269f9bd2":"TIME","open-source-selvedge.f4b1c471ce":"MEMORY","open-source-selvedge.d8a8b58d7f":"FUEL","open-source-selvedge.1a8d3ca502":"A default-deny capability set gates every host call across eight WASI domains. Resource caps on memory, fuel, and time bound runaway behaviour. Every gate decision and resource read is in the transcript.","open-source-selvedge.770a668e0e":"Resource caps. Audit","open-source-selvedge.8a54e91228":"Capabilities","open-source-selvedge.bb9cf14180":"Policy","open-source-selvedge.26fe8fb85c":"Receipts over assertions","open-source-selvedge.e08283960c":"Verify, do not trust","open-source-selvedge.82de28b689":"You need cryptographic evidence of what the workload did, not confidence in the runtime.","open-source-selvedge.858b0d2d19":"Trust the runtime, not the workload","open-source-selvedge.ba959133c8":"Allow file system, deny network, but no per-call record in the audit trail.","open-source-selvedge.ff6fdd664b":"Coarse allow or deny","open-source-selvedge.f58bb04b13":"FP and wall-clock leak through. Replay produces approximately the same output, not exactly.","open-source-selvedge.a1d55a1dad":"Replay drifts","open-source-selvedge.f7afaaab99":"no receipt","open-source-selvedge.4677f31dd1":"A sandbox stops escape. It does not prove the workload behaved correctly inside.","open-source-selvedge.6f3134b990":"Containment is not correctness","open-source-selvedge.782cef5501":"Four structural gaps","open-source-selvedge.056dcf1841":"WHY SANDBOXES MISS","open-source-selvedge.f1358eac2f":"COARSE POLICY","open-source-selvedge.2bf9ef4df8":"NONDETERMINISTIC","open-source-selvedge.1c613acc7e":"NO PROOF","open-source-selvedge.d38e80798b":"Conventional sandboxes stop bad code from escaping. They do not produce a record of what the code actually did inside. When an auditor asks, the answer is an assertion, not evidence.","open-source-selvedge.61920a517c":"They do not prove","open-source-selvedge.5a88fbb30e":"Sandboxes contain","open-source-selvedge.8a9400005c":"A sandbox does not explain the run","open-source-selvedge.7c46a5978b":"Selvedge captures exactly what executed, input to output, every host call sealed.","open-source-selvedge.3e663e9467":"Selvedge is execution transcript","open-source-selvedge.a5be60731e":"Ledger records what happened in a system. Selvedge records what code ran.","open-source-selvedge.2c3e446b87":"Ledger is event provenance","open-source-selvedge.de792742e8":"AION issues certificates over solver steps, not execution runs.","open-source-selvedge.ced73ef9a5":"AION is reasoning proof","open-source-selvedge.0d9a7a065c":"How Selvedge differs from AION and Ledger","open-source-selvedge.d7ffcdc87b":"Same inputs plus same envelope means same output, always.","open-source-selvedge.7d8134cc1f":"Byte-identical replay","open-source-selvedge.75fcf02b02":"A fixed epoch and a seeded ChaCha20 PRNG replace host time and entropy.","open-source-selvedge.92a47286b6":"Virtual clock, seeded RNG","open-source-selvedge.13c1f9cde6":"Internal computation, storage and accumulation use binary, integer, fixed-point or adaptive integer/fixed-point representations. Floating point is accepted only at a declared external boundary and is explicitly converted before internal work begins; there is no internal floating-point fallback. The virtual clock remains fixed, so replay produces the same bytes.","open-source-selvedge.a33c607874":"No internal floats, no clocks","open-source-selvedge.81ec58648a":"Default-deterministic execution","open-source-selvedge.4b447f3a6e":"Verifier replays offline with module bytes and envelope alone.","open-source-selvedge.17d120d8bb":"Replayable","open-source-selvedge.6e95469aa0":"ed25519 signature over the envelope root. Not prose.","open-source-selvedge.6e3665d85f":"Signed","open-source-selvedge.bc61f0c3fe":"Every host call hashed into the chain. Edits break the chain.","open-source-selvedge.aa5cba1a92":"Hash-chained","open-source-selvedge.04c7525615":"Why the transcript is different from a log","open-source-selvedge.6db180787e":"Same flow on every execution. Replay is mechanical.","open-source-selvedge.69aca853c2":"AION proof","open-source-selvedge.ff8fc1c58a":"Seal","open-source-selvedge.0ae62541bc":"SHA3 chain","open-source-selvedge.873507a022":"Hash","open-source-selvedge.b1b392607d":"Run","open-source-selvedge.3e3f943d84":"caps pinned","open-source-selvedge.ddcb77ff76":"Load","open-source-selvedge.71faf343ce":"Execution transcript","open-source-selvedge.952be7ff16":"AION proof issued, ed25519 signed, envelope ready to ship.","open-source-selvedge.be1a4b336f":"Every host call and result hashed into a SHA3-256 chain.","open-source-selvedge.83dcc459e8":"Wasmtime or Kera executes inside the default-deny sandbox.","open-source-selvedge.1a5c8788b4":"Module loaded, capabilities pinned, resource caps applied.","open-source-selvedge.25ec589727":"Selvedge runs WASM or Kera code inside a default-deny sandbox, hashes every host call into a SHA3-256 transcript chain, and wraps the result in a signed AION proof envelope. The envelope replays without the original sandbox.","open-source-selvedge.fa84feaccb":"One sealed transcript","open-source-selvedge.62ee5ca76d":"Four stages","open-source-selvedge.a5a88d36d1":"What Selvedge produces","open-source-selvedge.db2f804f0c":"Data leaves Europe","open-source-selvedge.8799dc7cf1":"Computers you own","open-source-selvedge.1d197d39c5":"Where it runs","open-source-selvedge.79073eaaf2":"The Netherlands","open-source-selvedge.44ab85a252":"Origin","open-source-selvedge.f1be77358f":"Evidence, not a promise","open-source-selvedge.df5248d3cd":"The audit answer","open-source-selvedge.6eef664840":"None","open-source-selvedge.a95380913a":"External service required","open-source-selvedge.eba5db6f23":"Vendor lock in","open-source-selvedge.4ce8c39ddd":"Where to find it","open-source-selvedge.3229609e15":"Execution model","open-source-selvedge.cba0624eb5":"Procurement sheet","open-source-selvedge.101226ec7a":"What it saves and de-risks","open-source-selvedge.7a0848ede3":"See the execution boundary","open-source-selvedge.c01c519a99":"Selvedge is a deterministic WebAssembly sandbox for untrusted code. Its permission manifest and sealed transcript run on hardware you control, so a counterparty can replay the record on its own machine and a dispute becomes a lookup rather than an assurance request.","open-source-selvedge.27e446d5a9":"Keep a sealed transcript","open-source-selvedge.e1cb220703":"Run untrusted code","open-source-selvedge.6ec18dcb30":"Selvedge","open-source-selvedge.993a665d35":"In charge","open-source-selvedge.c1df7f8f11":"You stay","open-source-selvedge.f3101e3bb1":"On a computer at home","open-source-selvedge.7cb07d3c00":"Can run","open-source-selvedge.576347ec82":"Europe","open-source-selvedge.15edfb4da4":"Made in","open-source-selvedge.dd80c16201":"Same answer, every time","open-source-selvedge.d7e70b6e08":"Same question","open-source-selvedge.12fee4f639":"So nothing can be faked","open-source-selvedge.4c10b31d42":"It seals","open-source-selvedge.dcd11694fe":"A receipt of every step","open-source-selvedge.2ab05d7411":"It writes","open-source-selvedge.527d86ed84":"Keeps work in a safe corner","open-source-selvedge.ca032b5844":"Keep code in bounds, keep the record","open-source-selvedge.ce2cddc0bb":"A careful helper","open-source-selvedge.f8c94a3b4b":"What it is","open-source-selvedge.704869f20f":"In plain words","open-source-selvedge.21e83f6c44":"Read the small story","open-source-selvedge.06c805023d":"See what the code did","open-source-selvedge.d346a6159d":"Selvedge puts a program you did not choose in a room with no internet, no route to your files and nothing to learn about your machine. It leaves a receipt saying what came back and what the program was allowed to do, so you can check a later claim instead of taking somebody's word for it.","open-source-selvedge.a1301435db":" writes down everything it does","open-source-selvedge.5bd50e406e":"A careful helper that","open-source-selvedge.279245bb2e":"AION-style, ed25519 sealed","open-source-selvedge.5f174de1cc":"Proof","open-source-selvedge.ff5b90620f":"SHA3-256 per host call","open-source-selvedge.98e2d78aaa":"Default, not opt-in","open-source-selvedge.2956ef9ad6":"Determinism","open-source-selvedge.cd95bf50b6":"Wasmtime component host","open-source-selvedge.b3776d63ad":"Backends","open-source-selvedge.2da600bf94":"Version","open-source-selvedge.f187484f8c":"Rust (Edition 2024)","open-source-selvedge.89b86ab0e6":"Language","open-source-selvedge.942587e61e":"Project sheet","open-source-selvedge.d4a74b503a":"Read the docs","open-source-selvedge.a42a770d90":"Selvedge runs code you did not write in a WebAssembly component host with no network, filesystem, environment or moving clock. Every completed run returns a record another party can replay, and an execution report stating what the code was allowed to do. Published under Apache 2.0.","open-source-selvedge.92ec8c4f54":"safe accountability","open-source-selvedge.722d7084a5":"Untrusted code","open-source-selvedge.3b6a6a049d":"sandboxed","open-source-selvedge.7d5b92b8a7":"CAP-SET","open-source-selvedge.0e2f3c1696":"FUEL","open-source-selvedge.a266fe9c4d":"MEMORY","open-source-selvedge.5888675d99":"TIME","open-source-selvedge.7dd251bbda":"AUDIT","open-source-selvedge.76b5a35739":"lib","open-source-selvedge.99bb884017":"cli","open-source-selvedge.348c658682":"svc","open-source-selvedge.10182ab855":"mcp","open-source-selvedge.4bec5a51a3":"WASM","open-source-selvedge.a21dedb8ad":"KERA","open-source-selvedge.37c66a2cfc":"AION","open-source-selvedge.53f13ae99e":"MCP","open-source-selvedge.5d0b2f6bd4":"OBSERVED","open-source-selvedge.35e0d0360a":"LIVE","open-source-selvedge.0f4b423c4b":"MEASURED","open-source-selvedge.6e10953f3e":"OPEN","open-source-selvedge.rebuild-h1-lead":"Run code you did not write.","open-source-selvedge.rebuild-h1-accent":"A room with a receipt.","open-source-selvedge.rebuild-business-h1-lead":"Run untrusted code on hardware you control.","open-source-selvedge.rebuild-business-h1-accent":"A deterministic WebAssembly sandbox.","open-source-selvedge.close.github":"Ask about the release","open-source-selvedge.source.access":"Publishes in round four","open-source-selvedge.close.title":"Verify the result","open-source-selvedge.close.titleAccent":"not the code","open-source-selvedge.close.panel.title":"What you can check yourself","open-source-selvedge.close.panel.tag":"RUNTIME","open-source-selvedge.close.panel.row.0.label":"Licence","open-source-selvedge.close.panel.row.0.value":"Apache 2.0","open-source-selvedge.close.panel.row.1.label":"Execution","open-source-selvedge.close.panel.row.1.value":"Default deny","open-source-selvedge.close.panel.row.2.label":"Determinism","open-source-selvedge.close.panel.row.2.value":"Default, not opt-in","open-source-selvedge.close.panel.row.3.label":"Transcript","open-source-selvedge.close.panel.row.3.value":"SHA3-256 per host call","open-source-selvedge.close.panel.foot":"Publication is planned in fortnightly rounds. The repository and its documentation go live together.","oss-selvedge-business-glyph.fef8e889dc":"Execution policy","oss-selvedge-business-glyph.6b5eb5323e":"Default deny","oss-selvedge-business-glyph.4ce8c39ddd":"Where to find it","oss-selvedge-business-glyph.eba5db6f23":"Vendor lock in","oss-selvedge-business-glyph.6eef664840":"None","oss-selvedge-business-glyph.a95380913a":"External service","oss-selvedge-business-glyph.a92831c31f":"Built in the Netherlands","oss-selvedge-business-glyph.47deeb13b4":"Runs on computers you own","oss-selvedge-business-glyph.71aec0536c":"Data stays in Europe","oss-selvedge-business-glyph.8ac7aa173f":"What you get","oss-selvedge-business-glyph.5c75fc26b6":"Control and evidence","oss-selvedge-business-glyph.df5248d3cd":"The audit answer","oss-selvedge-business-glyph.74f39697ac":"Before","oss-selvedge-business-glyph.b407dd020f":"A promise on a page","oss-selvedge-business-glyph.4f1d10b8b9":"With Selvedge","oss-selvedge-business-glyph.62d62865a8":"Sealed evidence","oss-selvedge-consumer-glyph.088aa1c6a5":"Stayed in the safe corner","oss-selvedge-consumer-glyph.cc8e3cba23":"Did only what you asked","oss-selvedge-consumer-glyph.f87dcfd005":"Wrote down every step","oss-selvedge-consumer-glyph.ce2cddc0bb":"A careful helper","oss-selvedge-consumer-glyph.0b5703d2a7":"The safe corner","oss-selvedge-consumer-glyph.135207e95b":"It does one small job, here, and nowhere else.","oss-selvedge-consumer-glyph.0ed7e2fe52":"What it did, written down","oss-selvedge-consumer-glyph.2b11f0b541":"Sealed, so nothing can be changed","oss-selvedge-hero-glyph.85be9bda9e":"AION verification PASSED.","oss-selvedge-hero-glyph.8fff039853":"YES","oss-selvedge-hero-glyph.c5616cf985":"Signature valid:","oss-selvedge-hero-glyph.9e84fd1870":"Digest matches:","oss-selvedge-hero-glyph.ae05be9259":"Transcript saved to:","oss-selvedge-hero-glyph.7d1f8eca4c":"Instructions:","oss-selvedge-hero-glyph.1611baddbd":"2 097 152 bytes","oss-selvedge-hero-glyph.b6d31df01c":"Memory:","oss-selvedge-hero-glyph.d1fd5a4123":"Resource usage:","oss-selvedge-hero-glyph.80e5667a3d":"Execution completed successfully in 18.4ms","oss-selvedge-hero-glyph.ebece295c6":"transcript chain, sha3-256","oss-selvedge-hero-glyph.859e2c0cd0":"time 5000 ms","oss-selvedge-hero-glyph.6137065f69":"fuel 50 M","oss-selvedge-hero-glyph.489a5f61f6":"mem 256 MiB","oss-selvedge-hero-glyph.70049344a2":"policy: default-deny","oss-selvedge-hero-glyph.9b97280973":"Deterministic:","oss-selvedge-hero-glyph.0642f22885":"Engine:","oss-selvedge-hero-glyph.8116c74b17":"Running artifact:","oss-selvedge-hero-glyph.9f85876f55":"Wasmtime, component model","page-breadcrumb.c766e66518":"Breadcrumb","page-toc.7e439c353e":"On this page","section_st_a1_display-split.7c9a7c0610":"Detail","section_st_f1_cta-dark.90e40d5043":"Get started","selvedge-rebuild.why":"Why","selvedge-rebuild.state.depth-3":"Depth 3","selvedge-rebuild.state.depth-1":"Depth 1","selvedge-rebuild.state.leaf":"Leaf","selvedge-rebuild.state.path":"Path","selvedge-rebuild.state.root":"Root","selvedge-rebuild.state.proof":"Proof","selvedge-rebuild.instrument.first-check":"First check","selvedge-rebuild.instrument.last-check":"Last check","selvedge-rebuild.e4117a549a":"The room, the receipt and the list are the whole promise.","selvedge-rebuild.e04c2bbabb":"A list, not an estimate.","selvedge-rebuild.f4a910b306":"Find and fix","selvedge-rebuild.d7231e00d3":"The code is carried with each run.","selvedge-rebuild.de97a98b3b":"Every receipt","selvedge-rebuild.4fb8981886":"One digest names the build.","selvedge-rebuild.280587dbfc":"Exact artefact","selvedge-rebuild.94bce13433":"from a receipt to every job","selvedge-rebuild.d8ad44b2fd":"The trail back","selvedge-rebuild.66d0398793":"FOUND, NOT GUESSED","selvedge-rebuild.f64f81f133":"EVERY JOB","selvedge-rebuild.cd30789775":"ONE CODE","selvedge-rebuild.36d917a683":"Here it arrives as a list. Each job that used the faulty program names it by code, date and a short permission list, so you can see what was affected and how far it could have gone. If the people who made it are no longer trusted, withdrawal takes effect on a set refresh interval rather than whenever a certificate expires. The software is published under the Apache 2.0 licence.","selvedge-rebuild.12399078d5":"The usual version of this conversation is an estimate. Somebody works out which release was probably running, on which days, for which people, and the answer arrives as a range with a caveat on it. That leaves the facts needed to scope a correction as a reconstruction rather than a record. The correction begins with a list that can be checked.","selvedge-rebuild.0ccfcd0de4":"What changes","selvedge-rebuild.664ca13427":"Every job records a short code for the exact program that did the work. Not its name, not its version number, the program itself, so two builds that share a name still have different codes. If that program later turns out to be faulty, the code is how every job it touched gets found.","selvedge-rebuild.7e5bd67fe6":"and every job it touched","selvedge-rebuild.b27d103669":"One code names the program","selvedge-rebuild.332f693bb9":"When something turns out wrong","selvedge-rebuild.e7dceacc68":"When something turns out wrong, one code names the program.","selvedge-rebuild.9c9d8ebf4c":"Starts from the same clean shape.","selvedge-rebuild.363b82b08d":"Job two","selvedge-rebuild.5e92b89d0f":"Nothing carried in.","selvedge-rebuild.747a74c704":"New room","selvedge-rebuild.bbd11eef60":"Closed with its record.","selvedge-rebuild.e429b951d7":"Job one","selvedge-rebuild.129567cb21":"before, during and after","selvedge-rebuild.456de19ceb":"Three rooms","selvedge-rebuild.164f8ae614":"NOTHING SHARED","selvedge-rebuild.16d6f8e910":"EACH TIME","selvedge-rebuild.09d2a97782":"NEW ROOM","selvedge-rebuild.fb65ff4141":"The program itself is loaded fresh each time from its own code, and the receipt carries a code for that code, so the thing that ran today is provably the thing that ran last month. Nothing accumulates in between for anybody to worry about later.","selvedge-rebuild.b0f5fcfbc7":"A new Selvedge room costs so little that one per job is affordable, so nothing has to be shared. If something genuinely needs to carry across, it is handed over on purpose and it appears on the record as something that was handed over.","selvedge-rebuild.46cfb3934a":"In practice","selvedge-rebuild.ff26c0ce98":"Each job gets a new room. Nothing from the last one is in it: no leftover notes, no half-finished work, no memory of who asked. That sounds obvious and it usually is not true, because keeping a room standing is cheaper than building a new one, so most systems keep the room and reuse it.","selvedge-rebuild.7f6bde3487":"for the next job to find","selvedge-rebuild.0813f2a065":"Nothing is left behind","selvedge-rebuild.e0a28255b6":"Between one job and the next","selvedge-rebuild.ddf86350ec":"A new room is ready for the next job.","selvedge-rebuild.47d52db543":"Policy digest and date.","selvedge-rebuild.d8c67f88b7":"Named capability list.","selvedge-rebuild.8d71e4a6c8":"What was allowed","selvedge-rebuild.1be6bb3160":"Output, result and resource use.","selvedge-rebuild.7661e6591f":"What happened","selvedge-rebuild.5354effb89":"one receipt, two questions","selvedge-rebuild.bf7aa926cc":"Two halves","selvedge-rebuild.8719258390":"WRITTEN DOWN","selvedge-rebuild.d45d38b1c1":"WHAT IT COULD","selvedge-rebuild.103f9176a0":"WHAT IT DID","selvedge-rebuild.fc09104420":"Finding nothing is weak evidence, because it depends on how hard somebody looked and how long they had before the meeting. A list of two permissions is strong evidence, because there was nothing else there to find.","selvedge-rebuild.e7e3ece016":"It changes what happens when you ask a question later. Instead of somebody going through what the program did and reporting back that they found nothing worrying, the permission list is right there, and it is short.","selvedge-rebuild.74365019ac":"Most records tell you what a program did. A Selvedge receipt also says what it was permitted to do, which is a different and more useful thing. A program that was never allowed near your files cannot have been near your files, and that is on the record whether or not anybody happened to be watching at the time.","selvedge-rebuild.b418919876":"what it did and what it could","selvedge-rebuild.f0ba8e6e92":"Every receipt has two halves","selvedge-rebuild.a9fe3bc508":"Permission, written down","selvedge-rebuild.76194111ba":"A code is not a copy of the program; it names the exact thing that ran.","selvedge-rebuild.17cabedb50":"The list names where.","selvedge-rebuild.67452c68d0":"Codes differ","selvedge-rebuild.c1c7f44d1c":"The behaviour repeated.","selvedge-rebuild.0407e20f79":"Codes agree","selvedge-rebuild.90586d801f":"Same settings and artefact.","selvedge-rebuild.dba9e64b97":"Run tomorrow","selvedge-rebuild.bd7b414b53":"Input, room and receipt.","selvedge-rebuild.c941dde6f2":"Run today","selvedge-rebuild.7b1c52fa95":"what the second run tells you","selvedge-rebuild.bebe96c4de":"One test, two outcomes","selvedge-rebuild.e1c7f38f86":"YOU CAN CHECK","selvedge-rebuild.b00a146670":"SAME ANSWER","selvedge-rebuild.64ee12f3fd":"SAME MOMENT","selvedge-rebuild.698a936171":"It also closes a small trick. A program that can read the clock can behave one way before a deadline and another way after it, and nobody would ever see the difference. A clock that never moves cannot be watched, so there is nothing to behave differently about.","selvedge-rebuild.d722dbffa2":"It hands you a test you can run yourself. If something looks wrong, run it again with the same input. If the answer is the same, the program is behaving and the problem is somewhere else. If it is different, something changed, and the comparison says which part.","selvedge-rebuild.750c2096f3":"Why it matters","selvedge-rebuild.7768a95a4a":"Most programs give slightly different answers each time, because they look at the clock, use a bit of chance, or notice how busy the machine is. A program running in Selvedge can do none of that. The clock inside is fixed and never moves, and anything random starts from the same number on every run. Ask twice, get the same answer.","selvedge-rebuild.00bc249842":"and see if it still agrees","selvedge-rebuild.1797b92182":"Run it again tomorrow","selvedge-rebuild.0d971150f5":"The same answer twice","selvedge-rebuild.0ce33bc17c":"Run it again tomorrow and see if it still agrees.","selvedge-rebuild.780591dd40":"The work folded together.","selvedge-rebuild.b454191161":"Run code","selvedge-rebuild.0d36ec2dc8":"Captured and fingerprinted.","selvedge-rebuild.c35f4d270f":"Returned answer","selvedge-rebuild.12f6bce42d":"Printed output","selvedge-rebuild.e45f48ada6":"and a code for each","selvedge-rebuild.96a145870f":"Two things","selvedge-rebuild.4056de166c":"BOTH FINGERPRINTED","selvedge-rebuild.3736161d33":"RETURNED","selvedge-rebuild.07d3782dee":"PRINTED","selvedge-rebuild.7362fe572e":"It is the same idea as a seal on an envelope, and it does more. A seal tells you the letter was opened. This tells you which page changed, and it still works when the letter has been copied a dozen times since. Each reader gets the same answer from the copied record.","selvedge-rebuild.7ffcd03942":"That code is what makes a later argument short. If somebody shows you an answer a program gave last March and you want to know whether it is the answer that actually came out, you compare the codes. They match or they do not, and there is nothing in between to discuss.","selvedge-rebuild.940394c7d2":"When the job is done, two things leave the room: anything the program printed as it worked, and the answer it worked out. Nothing else. Both are fingerprinted on the way out, which means a short code is made from them, and the code changes completely if a single letter changes.","selvedge-rebuild.690d8dd7a6":"and both are fingerprinted","selvedge-rebuild.72f4db7882":"Two things come back","selvedge-rebuild.1251cc0dd7":"What comes back","selvedge-rebuild.8d77e5771a":"The next useful question is what comes back.","selvedge-rebuild.ec6f32ee39":"No environment.","selvedge-rebuild.a6252b6690":"Your details","selvedge-rebuild.fb9f6423d9":"No directory.","selvedge-rebuild.f1096a5b4c":"Your files","selvedge-rebuild.4c4c583f2e":"No connection.","selvedge-rebuild.66c06c11d1":"Internet","selvedge-rebuild.ac8e062358":"One slot, one job.","selvedge-rebuild.bb7841ee3e":"Your program","selvedge-rebuild.8b493952a7":"and what is not","selvedge-rebuild.4d26f69b94":"What is in the room","selvedge-rebuild.660cea3ce9":"ONE SLOT","selvedge-rebuild.f1818b9fef":"NOTHING TO READ","selvedge-rebuild.98a2180aec":"NO WAY OUT","selvedge-rebuild.663ab35faf":"So you are not relying on somebody having thought of everything in advance. That is the part which usually fails, and it fails quietly, months later, in a way nobody notices until somebody else points it out. A short explicit list makes a missing permission visible before it becomes a problem.","selvedge-rebuild.0e9905b668":"The reason it helps is not that the program is being watched carefully. It is that there is nothing in the room to go wrong with. A program cannot send your details anywhere if there is no way out to send them, and it cannot read your photos if the door to them was never built.","selvedge-rebuild.22ccf30775":"Programs you did not write end up running on your computer all the time: an add-on, a plug-in, something an assistant decided to use to answer your question. Selvedge puts that program in a room of its own. From inside it there is no internet, no way through to your files, and nothing to learn about your machine.","selvedge-rebuild.9e56594623":"and nothing else at all","selvedge-rebuild.6b5631ed3a":"A room with one slot in it","selvedge-rebuild.704869f20f":"In plain words","selvedge-rebuild.160543d3ec":"A room can be explained in plain words too.","selvedge-rebuild.6e66049bd0":"Decision chain and five operations.","selvedge-rebuild.140855a7dd":"Audit and agent path","selvedge-rebuild.be90f07014":"Proof outside the operator.","selvedge-rebuild.c3f6368941":"Transparency log","selvedge-rebuild.4402f8d6f4":"Admission and content address.","selvedge-rebuild.1fd6a805da":"Registry","selvedge-rebuild.943a71d70f":"Containment and deterministic run.","selvedge-rebuild.0a771c36be":"Sandbox","selvedge-rebuild.493bbfc72f":"the boundary, the evidence, the handover","selvedge-rebuild.6311787659":"What the set contains","selvedge-rebuild.c968638a6e":"APACHE 2.0","selvedge-rebuild.d0158524ed":"YOUR HARDWARE","selvedge-rebuild.cfd1b83141":"ONE COMPONENT SET","selvedge-rebuild.2c4db760cf":"The rest of the cost is the one procurement usually forgets, which is what happens when a supplier changes terms or goes quiet. The component set is published under Apache 2.0, the artefacts are content-addressed files, the records are files, and verification runs on the other party's machine, so an exit is a copy rather than a migration.","selvedge-rebuild.c69320538d":"The recurring cost of a run is measured rather than quoted: 5.26 to 6.06 microseconds per call through the boundary and well under a millisecond to stand up a fresh instance, on an Intel i9-13900KF with a release build, fat link-time optimisation and Rust 1.85.0. That is the whole of what the record costs at run time.","selvedge-rebuild.59bd1ff6f9":"What it costs","selvedge-rebuild.662cd46273":"Selvedge is one component set covering the sandbox runtime, the artefact registry, the transparency log, the hash-chained audit trail and the interface an agent uses to reach a tool. It runs on hardware you control. Nothing external sits on the path of a run: no account, no key held by a vendor, no service that has to answer for a job to finish.","selvedge-rebuild.9ce257fa8d":"and it runs on your hardware","selvedge-rebuild.b1c3183260":"One toolchain, not four","selvedge-rebuild.dea6811b37":"What it replaces","selvedge-rebuild.86c78780e9":"One toolchain, on hardware you own, is the commercial close.","selvedge-rebuild.b742347ca6":"Stop or show its history.","selvedge-rebuild.80b0178666":"Cancel / provenance","selvedge-rebuild.2976625857":"Run inside the room.","selvedge-rebuild.c65605adf5":"Invoke","selvedge-rebuild.084d82061e":"Admit the artefact.","selvedge-rebuild.fd6c3ebf7b":"Install","selvedge-rebuild.820fa7ff41":"Find a named capability.","selvedge-rebuild.4827ea2271":"Discover","selvedge-rebuild.38025e67e1":"one doorway for agent tools","selvedge-rebuild.41cb4bf6dc":"Five operations","selvedge-rebuild.3501cb4872":"NO APPROVALS","selvedge-rebuild.9054eecb7b":"PROVENANCE ON ASK","selvedge-rebuild.0cd0da7fef":"ONE DOORWAY","selvedge-rebuild.e088784883":"Afterwards the provenance of what ran can be asked for, and that is the part worth designing a process around: the artefact's own address, whether its signature holds, the certificate presented with it, the policy it ran under, and where it has been executed before. Those facts stay available when a run must be checked later. They can be checked without trusting the person who ran it.","selvedge-rebuild.c3c0f81705":"The controls here are not approvals, because an approval needs somebody awake. They are the shape of the doorway. A tool is discovered, installed and invoked through one interface of five operations, so every arrival is the same kind of event, and the check that refuses a capability is the one every other run goes through rather than a second mechanism written specially for agents.","selvedge-rebuild.896b2f37be":"The mechanism","selvedge-rebuild.122ebb7a98":"An assistant working on a task can decide it needs a capability it does not have, find one, and start using it inside a single piece of work nobody is watching. There was no procurement step and no review, because there was no moment to put either in. Selvedge is the boundary the assistant has to come through, and the report at the end names which tool arrived, what it was permitted, and what it did.","selvedge-rebuild.deeaa912ba":"and it is already inside","selvedge-rebuild.767c396612":"Nobody chose this tool","selvedge-rebuild.d368c82df4":"When the caller is a model","selvedge-rebuild.ee26c4f440":"When the caller is a model, one doorway keeps arrival legible.","selvedge-rebuild.9faf774569":"Apply the rate policy.","selvedge-rebuild.ee1acfa55e":"Authentication","selvedge-rebuild.9bbe32214f":"Inspect the run record.","selvedge-rebuild.78590ea6e5":"Resource limit","selvedge-rebuild.ed9390115c":"Retry with the stated backoff.","selvedge-rebuild.f4544d56bb":"Fetch failure","selvedge-rebuild.1455a7acb3":"Open the circuit.","selvedge-rebuild.f06cb33ba6":"Digest mismatch","selvedge-rebuild.1be73b4878":"recovery travels with failure","selvedge-rebuild.5dacd1167d":"One code, one next move","selvedge-rebuild.3ac9292cf3":"NO LOG SCRAPING","selvedge-rebuild.93aaff4907":"RECOVERY STATED","selvedge-rebuild.dbba85fbb0":"STABLE CODES","selvedge-rebuild.3b6e2d01ab":"Where a capability is refused the message lists the kinds that would have been valid, which is the difference between an afternoon of guessing and a one-line change. An error that names its own fix is the cheapest documentation anybody ever wrote. The correction is then explicit.","selvedge-rebuild.1fb184edcf":"The recovery strategy is what separates cases that look identical on a dashboard at two in the morning. A digest that does not match is not transient, so retrying is wasted time, and the strategy attached to it says open the circuit rather than try again. A failed fetch is transient and says retry.","selvedge-rebuild.2f6a307ba7":"For operators","selvedge-rebuild.0a5279b594":"Operational documentation fails when it has to be written against log text, because log text changes without anybody calling it a change. Selvedge failures carry a stable code instead, and a runbook that names the code stays correct across an upgrade that rewords every message on the way past. Where the code carries a recovery strategy, the runbook does not have to guess at one.","selvedge-rebuild.664b90089f":"is an error with a runbook","selvedge-rebuild.c69f009f72":"An error with a code","selvedge-rebuild.d8bf8f167e":"Operability","selvedge-rebuild.b4986d7d25":"A fresh room each time is what makes this evidence affordable.","selvedge-rebuild.05f9859c50":"Routine deletion, no surprise script.","selvedge-rebuild.9e0dece16b":"Far end","selvedge-rebuild.7ba8dfa987":"Fixed depth behind the current one.","selvedge-rebuild.b850e7b847":"Older files","selvedge-rebuild.e4eb2b5e27":"Last hash carried forward.","selvedge-rebuild.55e313d20f":"Seam","selvedge-rebuild.4e5fd99150":"One object per line.","selvedge-rebuild.2c44db0063":"Current file","selvedge-rebuild.8dae783204":"when a file turns over","selvedge-rebuild.888fb4bc11":"What stays and what moves","selvedge-rebuild.1191de056a":"BACKOFF","selvedge-rebuild.d47c87e179":"TOKENS HASHED","selvedge-rebuild.eac901cef2":"ROTATION HOLDS","selvedge-rebuild.f7e2e2ba8c":"Failed attempts are capped at five a minute and slowed on a doubling delay of one, two, four and eight seconds, and a client that fails twenty times inside ten minutes is blocked rather than slowed. That turns a guessing attack into a rate rather than an outcome, and it turns an incident report into a graph nobody has to interpret.","selvedge-rebuild.6736e35335":"The other quiet failure is credentials sitting in a backup. Authentication tokens are hashed with argon2id before they are stored, so a copied file or a captured memory image contains nothing that can be presented as a token. The backup can be reviewed or restored without becoming a credential leak.","selvedge-rebuild.cac3da045e":"How it holds","selvedge-rebuild.652f961a36":"Volume is managed by Selvedge rather than by a script somebody remembers to write. The log rolls over when the file passes a size, a fixed depth of older files sits behind it, and each rollover deletes the one at the far end. Here what is left still verifies from its own anchor, and what went is visible as a break.","selvedge-rebuild.62615faf30":"and the chain survives it","selvedge-rebuild.d4854c73b7":"Rotation keeps the evidence","selvedge-rebuild.d821e71a5b":"Retention and access","selvedge-rebuild.5dee0013ab":"Retention is a policy, but the chain must survive it.","selvedge-rebuild.8d847cbbe6":"The log still contains the old tree.","selvedge-rebuild.0ea7b95eab":"Consistency","selvedge-rebuild.526411c35f":"The root and tree size.","selvedge-rebuild.8639df5c74":"Signed tree head","selvedge-rebuild.b67622bea2":"The inclusion route.","selvedge-rebuild.61922ee14e":"Sibling hashes","selvedge-rebuild.11deeeb03e":"The thing that was admitted.","selvedge-rebuild.2df596d9d9":"Artefact digest","selvedge-rebuild.26ef63813e":"after an artefact arrives","selvedge-rebuild.e33d42e6b6":"What a client keeps","selvedge-rebuild.da6c5f785f":"ONE ADDRESS","selvedge-rebuild.50419b986e":"PROVABLE OUTSIDE","selvedge-rebuild.80e513b0ff":"APPEND ONLY","selvedge-rebuild.82c17b3462":"The other half needs no decision at all. One content address identifies an artefact from build through the registry to the run, which is what turns a recall into something you carry out rather than announce, and a withdrawn signer takes effect on a refresh interval rather than on an expiry date.","selvedge-rebuild.0e322153c8":"Publishing the log is a decision you make once, and where you have made it your cooperation is not part of anybody's check. They verify presence and growth against a root you published, on their own machine, at a time of their choosing. The original root remains the public reference point.","selvedge-rebuild.fab7e71c01":"The guarantee","selvedge-rebuild.7b85ff0b6e":"The weakness in every record an organisation keeps about itself is that the organisation keeps it. The Selvedge transparency log removes that objection for one narrow question, which is what entered. A client can be handed a proof that a specific artefact is in the log, and a proof that the log has only grown since they last looked. Inclusion and append-only integrity are therefore checkable without trusting the operator.","selvedge-rebuild.66229e2d58":"without being taken on trust","selvedge-rebuild.2cc484ffbc":"Proving what you admitted","selvedge-rebuild.4f9007e629":"Evidence you do not own","selvedge-rebuild.cdcfb6c3c1":"The registry says what arrived. The transparency log lets somebody else verify it.","selvedge-rebuild.2a95479d68":"Carried with the artefact.","selvedge-rebuild.5f174de1cc":"Proof","selvedge-rebuild.f1f0ddab0b":"Eligible for the kind.","selvedge-rebuild.0449e1003d":"Namespace","selvedge-rebuild.2e26c5d52d":"Magic bytes, not a label.","selvedge-rebuild.e00ac23f2a":"Kind","selvedge-rebuild.54e0cdb26f":"Right length, hex and present.","selvedge-rebuild.47fdd58bee":"Digest","selvedge-rebuild.409fa246aa":"and one answer on every pull","selvedge-rebuild.112b824580":"Four checks at the door","selvedge-rebuild.1858ed0f91":"OCI DIGESTS","selvedge-rebuild.0a6780b777":"TOKENS REQUIRED","selvedge-rebuild.67bf2475b1":"Access is a list of tokens you issue and withdraw, held hashed with argon2id so a copied file or a memory image contains nothing presentable. Failed attempts are capped at five a minute on a doubling delay, and a client failing twenty times inside ten minutes is blocked outright. The limit remains visible in the record of the attempt.","selvedge-rebuild.86269212e3":"One content address identifies an artefact from publication through pull to the run record. That address makes its provenance answerable: which build, when it was admitted, under which namespace, which deployment pulled it, and how many times it ran. The same address answers each of those later, with no second index to keep in step.","selvedge-rebuild.3d5033cca6":"Selvedge ships a registry server, so the place third-party artefacts land is a service on your own hardware rather than an account with somebody else. It listens on a public address only when token authentication is on, checks four things about every push, and answers pulls in the SHA-256 digests the wider ecosystem already speaks while storing everything internally under SHA3-256.","selvedge-rebuild.224f72415e":"a registry you operate","selvedge-rebuild.bbd6ef38ef":"Suppliers publish into","selvedge-rebuild.a0a03c8fd1":"Where artefacts arrive","selvedge-rebuild.d1e24e5a34":"A result is easier to defend when the place it entered is yours.","selvedge-rebuild.1111b73a8f":"Ask what input the guest saw.","selvedge-rebuild.4bed336194":"Output","selvedge-rebuild.d7f27a4216":"Inspect code path or host build.","selvedge-rebuild.0b645d1b65":"Fuel","selvedge-rebuild.de86466d91":"Same deterministic profile.","selvedge-rebuild.c7f73bb54d":"Settings","selvedge-rebuild.36ffeb1c8a":"Same code means a meaningful comparison.","selvedge-rebuild.c6fe330e04":"Artefact","selvedge-rebuild.02be99bd8d":"and what it means next","selvedge-rebuild.a53a08f8c4":"What moved","selvedge-rebuild.bc2cb603df":"OR THE FIELD","selvedge-rebuild.4b885b786e":"SAME RECORD","selvedge-rebuild.ba9ebe1f95":"SAME INPUT","selvedge-rebuild.50479df67b":"With two records the answer arrives the same afternoon and it names a field rather than a party, so being wrong costs what it should and being right costs almost nothing. That belongs in the contract before the first dispute rather than being discovered during one. Both sides can repeat that check without another meeting.","selvedge-rebuild.db0ac7feb8":"A mechanical answer moves who carries the cost of the argument. A disputed figure today spends a week of two teams comparing systems that were never comparable, and it tends to end in a goodwill credit, because nobody can show which side was wrong and somebody has to close the ticket. Neither team can produce a figure the other side is obliged to accept.","selvedge-rebuild.8134cbe2c9":"A counterparty says the figure they were given is wrong. You have your run and they have theirs. Comparing the two Selvedge records is mechanical: the comparison walks the fields and reports each difference with what was expected and what arrived, so the conversation opens on which field differs rather than on whose system is at fault.","selvedge-rebuild.415a27590d":"field by field not argued over","selvedge-rebuild.651b2f8627":"Two records compared","selvedge-rebuild.a9cce5b9fe":"A disputed result","selvedge-rebuild.7c918d0343":"A disputed result is next: two records, compared field by field.","selvedge-rebuild.b457d4d9d3":"Peak memory, time and instructions.","selvedge-rebuild.1e23ac57dd":"Resource figures","selvedge-rebuild.f6c680ffb5":"The configuration in force.","selvedge-rebuild.b44f987ea4":"Engine hash","selvedge-rebuild.ca1f09eab2":"The policy that granted them.","selvedge-rebuild.945db98b77":"Policy digest","selvedge-rebuild.be7bd7e933":"Capabilities named by the run.","selvedge-rebuild.f761a72878":"Granted list","selvedge-rebuild.8be583ccfd":"answered from one document","selvedge-rebuild.abfa32a842":"Four questions","selvedge-rebuild.80935eb972":"DATED","selvedge-rebuild.c3cb9355f8":"POLICY ON THE RUN","selvedge-rebuild.506221fd52":"GRANTED, LISTED","selvedge-rebuild.4d5c5b7775":"The same report carries the digests of the certificates that were verified and what the run consumed in peak memory, processor time and instructions. The follow-up question is always what it actually used, and that answer is already on the page rather than with a second team working to a different clock and definition of the incident. It supports a direct answer while the evidence is still fresh.","selvedge-rebuild.06d0c87ca8":"That turns an argument into a lookup. A regulator asking whether a component could have reached customer records gets an answer with a date on it rather than an assurance about intent. It answers a specific historical question: did this named component, on this run, have a route to those records? The answer does not depend on anyone remembering the supplier's intention later.","selvedge-rebuild.5c82441a97":"The record","selvedge-rebuild.6cdd02da63":"The awkward question after an incident is rarely what the software did. It is what the software was permitted to do, and in most estates that answer is assembled from configuration files, deployment history and somebody's memory. Every Selvedge run produces a report naming the capabilities it was granted, the policy that granted them, and a hash of the settings in force.","selvedge-rebuild.020ea9fcbe":"and what it was allowed","selvedge-rebuild.cd553c8839":"Every run says what it did","selvedge-rebuild.5e367f020e":"The question after an incident","selvedge-rebuild.f2edf768d8":"A record turns the supplier question into a lookup.","selvedge-rebuild.0c347f9e0f":"No environment or argument block.","selvedge-rebuild.c701ab1556":"Does it inherit our access?","selvedge-rebuild.f2df9d1888":"No directory is opened.","selvedge-rebuild.e98ce49657":"Can it leave a file?","selvedge-rebuild.99436e239e":"No network is present by default.","selvedge-rebuild.1c017e2833":"Can it send data?","selvedge-rebuild.68b0d04e37":"Only declared worlds and named capabilities.","selvedge-rebuild.fd5147edb1":"What can it touch?","selvedge-rebuild.51992f6040":"written out as four answers","selvedge-rebuild.7bcd533661":"The worst case","selvedge-rebuild.80b36fb606":"STATED","selvedge-rebuild.a419f58f13":"WORST CASE SMALL","selvedge-rebuild.be725ffbc0":"NOTHING TO REACH","selvedge-rebuild.eb3afa60c4":"A component that never asked for anything beyond its input and its output is described completely in one line, and nobody has to maintain that line for it to still be true a year from now. That is the part which makes it usable in a document somebody signs.","selvedge-rebuild.86f054031c":"This changes the shape of the supplier conversation. The question stops being whether the supplier's engineering is sound, which you cannot verify and they cannot prove, and becomes what the artefact was granted, which is written on the run.","selvedge-rebuild.1debddb64e":"Code arriving from a supplier or an outside contributor runs in Selvedge with no network connection, no directory opened for it, no environment to read and no arguments. It is not held back from those things by a rule somebody has to maintain. They are not there. The consequence for a risk assessment is that the worst case is small enough to write in a sentence.","selvedge-rebuild.6be7d30a6b":"in a room with nothing in it","selvedge-rebuild.6df473a455":"A bad artefact lands","selvedge-rebuild.e948526d56":"What the worst case is","selvedge-rebuild.0b8ad471af":"The next question is what the worst case can reach.","selvedge-rebuild.a02a250db5":"Selected at the moment of work.","selvedge-rebuild.c257ef4501":"Agent-chosen","selvedge-rebuild.cf63b964fc":"Nobody in the room chose it.","selvedge-rebuild.2054305e05":"Transitive dependency","selvedge-rebuild.cdf3fea97a":"Somebody else owns the release.","selvedge-rebuild.8cbf4d00a5":"Direct dependency","selvedge-rebuild.b71aa2a2b1":"A team can review it.","selvedge-rebuild.1ea8c912d2":"Written here","selvedge-rebuild.332edb5a4d":"and when anyone last read it","selvedge-rebuild.66cd35e493":"Four ways it arrives","selvedge-rebuild.9520a29c14":"A RECORD","selvedge-rebuild.2271914641":"REACH DECIDED FIRST","selvedge-rebuild.e07e85e80d":"NOT REVIEW","selvedge-rebuild.8d05721c00":"Selvedge works on the two things that survive that: the reach decided before the code arrives, and the record held after it leaves. Both are available on the day a supplier ships something nobody in the building has opened. It is evidence someone can keep independently.","selvedge-rebuild.d0d23ca94c":"Every control in this area assumes a moment when a person could have looked. Procurement review assumes it. Code review assumes it. A tool selected by an agent while it is running removes that moment entirely, and it does so for the workloads growing fastest.","selvedge-rebuild.560556f058":"Dependencies nobody has read, plugins from suppliers, integrations that update on their own schedule, and now tools chosen by a model at the moment it runs. Reviewing all of that was never realistic. Selvedge changes the question from whether the code is trustworthy to what the code can reach, and what you can say about it afterwards to somebody outside your building.","selvedge-rebuild.0d07a7b2f6":"and nobody here read it","selvedge-rebuild.546fb9cede":"You did not write most of it","selvedge-rebuild.55874251d8":"The default nobody chose","selvedge-rebuild.82b00203b9":"What the six have in common is that a stranger can check the run they produced.","selvedge-rebuild.8f4639c201":"Sealed unless declared.","selvedge-rebuild.a6a6318544":"GPU","selvedge-rebuild.c99a2bcf3e":"Observe","selvedge-rebuild.316ccc52a4":"Cannot signal another process.","selvedge-rebuild.6f8e6cc6ac":"Its own lifetime","selvedge-rebuild.30fd44bcfe":"The key stays outside.","selvedge-rebuild.a7f47e6eb3":"Operations, not keys","selvedge-rebuild.f685d27aeb":"A window, not a filesystem.","selvedge-rebuild.ff764e20d1":"By prefix","selvedge-rebuild.e160d76fcb":"An unnamed tool does not exist here.","selvedge-rebuild.f1aae84762":"Named calls only","selvedge-rebuild.07e959a70b":"and what asking costs","selvedge-rebuild.665388e0b3":"Six worlds","selvedge-rebuild.06348a4532":"NAMED PER LINE","selvedge-rebuild.afe70011f9":"ASK, NOT REACH","selvedge-rebuild.1013aec36c":"SIX WORLDS","selvedge-rebuild.60562d5b0b":"It also means the record of a run is legible without knowing the component. Every line in it names the world the call went through, so a run that touched two worlds has four that are provably empty, and a reviewer can establish that from the record rather than from the source. All six worlds ship under Apache 2.0, so the boundary a reviewer is relying on is one they can read for themselves.","selvedge-rebuild.63f511d5c2":"A single capability called external would be simpler to implement and useless to reason about, because granting it tells a reviewer nothing. Six worlds means a grant is a sentence somebody can read: this component may call two named tools, read one prefix, and nothing else. It also fixes the limit an operator is allowed to grant. That limit is visible in the receipt.","selvedge-rebuild.819cfda982":"A component's outside access is six named worlds: tool, storage, crypto, process, observe and gpu. Each is declared before start; an undeclared world is absent from the environment. A grant therefore names an operation and its boundary, not a vague promise of external access. The receipt records those grants per line, so a reviewer can see which worlds stayed empty without reading host configuration.","selvedge-rebuild.cd867e3f2c":"and no way to reach past","selvedge-rebuild.06850e8469":"Six worlds to ask from","selvedge-rebuild.09d7280b63":"The whole capability surface","selvedge-rebuild.4e01209ac7":"Which leaves the plainest question: what is a component actually allowed to ask for?","selvedge-rebuild.8539c9a9d8":"i9-13900KF, Rust 1.85.0, fat LTO.","selvedge-rebuild.07dc1b32f0":"Named machine","selvedge-rebuild.04f0c3f5a6":"Well under a millisecond.","selvedge-rebuild.c79e051c62":"Fresh sandbox","selvedge-rebuild.46e30f38ba":"22 to 27 nanoseconds.","selvedge-rebuild.aff4ba3800":"Bare embedding","selvedge-rebuild.7d8c6afdf3":"5.26 to 6.06 microseconds.","selvedge-rebuild.a4d57a9359":"Bounded boundary","selvedge-rebuild.122385cbbe":"measured on one named machine","selvedge-rebuild.224d7c9838":"What it costs and buys","selvedge-rebuild.cc282eac1e":"SUB-MILLISECOND START","selvedge-rebuild.9a1cbd0dc8":"6 MICROSECOND CALL","selvedge-rebuild.66b7fb60dc":"What buys the cost back sits at the other end. A fresh instance stands up in well under a millisecond on that hardware, so one room per request is affordable rather than a luxury kept for batch work. Nothing carries between runs, and the pool that serves them acquires and releases a slot in constant time.","selvedge-rebuild.6d37e34f65":"Measured on an Intel i9-13900KF, release build with fat link-time optimisation, Rust 1.85.0, a hundred samples per figure after a three second warmup. The benchmark suite ships with the project and pins the version of everything it compares against, so the numbers can be taken again on your own machine.","selvedge-rebuild.5b487a198c":"The measurement","selvedge-rebuild.ce2547f5f6":"The bounded in-process call costs 5.26 to 6.06 microseconds. A bare embedding costs 22 to 27 nanoseconds. The difference is the import check, replaced clocks and the receipt, priced per call. Those figures come from a release build after warmup, not a promise about every host. The benchmark suite is version-pinned and ships with the project, so a counterparty can rerun the comparison on its own machine.","selvedge-rebuild.eb0bea042b":"and this is the number","selvedge-rebuild.80244c6031":"The boundary has a price","selvedge-rebuild.59f208dd86":"Measured, with the conditions","selvedge-rebuild.1c554966f5":"All of that is still your own file on your own disk, so hand the check to somebody else.","selvedge-rebuild.1abf201fe1":"What the registry admitted or pulled.","selvedge-rebuild.c4a1e99a74":"Artefact entered or left","selvedge-rebuild.99dc0fd69a":"When a client was turned away.","selvedge-rebuild.14681ed6ee":"Rate or size met","selvedge-rebuild.da84e101f9":"Which limit ended which run.","selvedge-rebuild.c7deb27f03":"Budget exhausted","selvedge-rebuild.dfd95f1763":"Policy, artefact, reason and checks.","selvedge-rebuild.de43b346ca":"Capability refused","selvedge-rebuild.0860379105":"decisions, not calls","selvedge-rebuild.770ce14a0d":"What an entry is about","selvedge-rebuild.d302fd1542":"ROTATION","selvedge-rebuild.736d1d19bd":"CHAIN SURVIVES","selvedge-rebuild.0f26f75355":"ONE LINE, ONE HASH","selvedge-rebuild.4fd6822dee":"That is the kind of record worth the cost of verifying, because it is the kind anybody argues about. Nobody disputes that a function was entered. They dispute whether a component should have been allowed near a customer record in the first place, and that is a line in this file with a hash on either side of it. The decision remains available for a later reviewer.","selvedge-rebuild.52fc58dd92":"Eight kinds of entry go in, and every one of them is a decision rather than a call. A policy enforcement entry carries the policy identifier, the artefact digest, the result, the reason for a denial, and the list of capabilities checked to reach it. Admission, execution started, execution completed, resource limit violation, rate limit, size limit and artefact pull make up the rest.","selvedge-rebuild.dc375c42ba":"The audit file is one object per line. Each line hashes its own contents together with the hash before it; remove one and every later hash stops matching. Rotation carries the last hash into the next file as an anchor. The entries describe decisions such as policy enforcement, admission, execution completion, rate or size limits, and an artefact pull. A later reviewer can therefore ask why a run was refused, not merely whether a call occurred.","selvedge-rebuild.dfc80074cc":"so a deletion shows up","selvedge-rebuild.69fcfe76f1":"Each line holds the last","selvedge-rebuild.aee1333814":"The audit file","selvedge-rebuild.5a622af936":"The same discipline, applied to the decisions somebody will later dispute.","selvedge-rebuild.fb3c095122":"A root at a past size.","selvedge-rebuild.a6b6f9fa4d":"What was the root?","selvedge-rebuild.9410fb5d00":"A signed tree head.","selvedge-rebuild.25c2799dca":"What is the root?","selvedge-rebuild.37a62a6d90":"A consistency proof between tree sizes.","selvedge-rebuild.39a9a225ab":"Has it changed?","selvedge-rebuild.13d3c8a85e":"A short path from artefact to root.","selvedge-rebuild.0791d2b497":"Is it in there?","selvedge-rebuild.7729d17652":"without trusting its operator","selvedge-rebuild.12b003c6ac":"Four questions it answers","selvedge-rebuild.e533871af4":"SIGNED HEAD","selvedge-rebuild.e9912b4293":"CONSISTENCY","selvedge-rebuild.830294fe4a":"INCLUSION PROOF","selvedge-rebuild.15627b2116":"Removal is what the shape makes expensive. Take an entry out and every proof anybody holds over that part of the tree stops verifying, on their machine, without anyone having to be watching. That property is what a client is buying when they ask for an inclusion proof rather than a screenshot.","selvedge-rebuild.0986321b82":"A client keeps the root they were handed, and every later claim about the log has to agree with the root already in their hands. Nothing in that check involves whoever runs the log. The client holds that evidence independently, so the check remains possible even when the operator has nothing to add.","selvedge-rebuild.af125678b5":"Every admitted artefact is appended to a Merkle tree: leaves use prefix 0x00 and internal nodes 0x01. Inclusion in a million-entry log takes twenty hashes, so a client can check it on their own machine. A signed tree head fixes the root at a size, while consistency proofs show that later roots extend it rather than replace it. The operator supplies evidence; the client performs the check.","selvedge-rebuild.85aa50a3b8":"to somebody outside it","selvedge-rebuild.6f39cde263":"The log proves itself","selvedge-rebuild.0a295dee94":"The append-only log","selvedge-rebuild.e77dce4f9b":"Admitting an artefact is one thing. Proving later that you admitted it is another.","selvedge-rebuild.86aa1f5eed":"Comes with the artefact and is replayed at verification.","selvedge-rebuild.343cb675ac":"Namespace eligible for this kind.","selvedge-rebuild.709a23220f":"Name","selvedge-rebuild.f8123c295a":"First four bytes, never a filename.","selvedge-rebuild.fc92e820c6":"Right length, hexadecimal and present.","selvedge-rebuild.6e105ad7a3":"and where the proof is read","selvedge-rebuild.1618f58781":"What a push is checked for","selvedge-rebuild.e185f9f7d4":"PROOF PRESENT","selvedge-rebuild.e4360fc330":"MAGIC BYTES","selvedge-rebuild.6d4b74c092":"LOOPBACK OR TOKENS","selvedge-rebuild.33e95b7d0e":"The proof itself is replayed where the artefact is verified, which keeps the door quick and puts the kernel where it has time to work. The door decides identity and eligibility in constant work per push; the kernel decides truth. A slow proof therefore cannot become a reason to admit an artefact before it has been checked.","selvedge-rebuild.175ed9b192":"Start the registry on anything other than a loopback address with token authentication switched off and it refuses to start. Switch authentication on with an empty token list and it refuses that too. The unsafe deployment is unavailable rather than discouraged, so a configuration mistake surfaces as a startup error immediately.","selvedge-rebuild.fc1d256e62":"The registry decides kind from an artefact's first four bytes, not its extension or manifest. Its digest must be valid and present, its namespace must fit that kind, and a proof must accompany it. The service also refuses an unsafe non-loopback start without token authentication, and it rejects an empty token list when authentication is enabled. Identity, shape and proof are checked before anything is stored.","selvedge-rebuild.027f67dd55":"before anything is stored","selvedge-rebuild.3d6b6cb540":"A push is checked four ways","selvedge-rebuild.583ed36f97":"Admission control","selvedge-rebuild.1914cd4ce8":"The door decides what enters; the kernel decides what is true.","selvedge-rebuild.b69c347e7f":"Each step receives a verdict.","selvedge-rebuild.c0f85d6679":"Replay","selvedge-rebuild.f97399239c":"Parsed into the kernel.","selvedge-rebuild.cdde4f20ba":"Steps","selvedge-rebuild.c318427ef6":"Parsed only after it fits.","selvedge-rebuild.6f95f40eae":"Clause file","selvedge-rebuild.1e9e6eecd0":"Compared with the ceiling before parsing.","selvedge-rebuild.a97f5adbde":"Declared size","selvedge-rebuild.1f9c89d51e":"each checked, none assumed","selvedge-rebuild.e619c9a6b2":"Four things around a proof","selvedge-rebuild.7fa302aed3":"SIZE FIRST","selvedge-rebuild.8a20135ce2":"REPLAYED","selvedge-rebuild.24704c8edc":"LRAT AND ALETHE","selvedge-rebuild.29f977d6d0":"The work went into what sits around it. Trust roots are held explicitly rather than inherited from whatever store the machine happens to have, revocation carries a refresh interval so a withdrawal lands without waiting on an expiry date, and a timestamp token has its own signature checked before its time is believed. Cosign signatures verify against a base64 key and signature, so artefacts signed in the wider ecosystem arrive already checkable.","selvedge-rebuild.f0f219cc1b":"A Selvedge certificate is deliberately small. It is an Ed25519 signature over a public key, an issuer, a subject and the two ends of a validity window, so there is nothing in it that has to be parsed out of a format somebody else controls. Its job stays narrow: say which issuer signed which subject for which period, without asking a verifier to unpack a broad document first. It remains legible to an independent verifier. Its scope is not left to inference.","selvedge-rebuild.f626b7a7da":"Under the surface","selvedge-rebuild.776d70676a":"A proof attached to an artefact is a claim until Selvedge replays it. LRAT and Alethe proofs are parsed and checked step by step through a proof kernel, with a size ceiling applied before parsing starts. Trust roots, revocation refresh and timestamp signatures are checked around that kernel, while Cosign signatures are verified against their supplied key and signature. The boundary stays small enough for an independent verifier to inspect.","selvedge-rebuild.438689443c":"and replayed step by step","selvedge-rebuild.1ed9eb8043":"The proof gets re-checked","selvedge-rebuild.77b6e89fee":"Proofs and certificates","selvedge-rebuild.36ad1e8721":"The argument is about the right-hand document far more often, and both come from one run.","selvedge-rebuild.36c042f601":"Output, error and returned value complete the record.","selvedge-rebuild.43708b1ad0":"Captured streams","selvedge-rebuild.ae61a28e3a":"How much work was consumed.","selvedge-rebuild.ed58f29743":"Instructions","selvedge-rebuild.918feb5b79":"Which deterministic profile applied.","selvedge-rebuild.e5b7649e03":"Which exact component ran.","selvedge-rebuild.60697a86b4":"Artefact bytes","selvedge-rebuild.a49fe57a20":"and what each is taken over","selvedge-rebuild.aeb0956f38":"Four of the seven","selvedge-rebuild.07519769df":"CONSTANT SIZE","selvedge-rebuild.f9c0b723ec":"HASHES, NOT LOGS","selvedge-rebuild.7531a92ec1":"SEVEN FIELDS","selvedge-rebuild.c35ff8c3a0":"The execution report settles what the run was permitted. It names the capabilities granted, the policy that granted them, the certificates that were verified, a hash of the settings in force, and what the run consumed in peak memory, processor time and instructions. Those two questions always arrive together after an incident, and Selvedge answers them with two documents rather than one asked to do both jobs.","selvedge-rebuild.b0b2377aff":"The record settles whether this happened again, and it is the document people expect to be arguing about. In practice they are arguing about the other one. It lets a later reader ask whether the same artefact, inputs and settings produced the result again. That is a historical question about the event. The execution report answers the other question: what the run was allowed to do when it happened.","selvedge-rebuild.e88ce1c6ea":"Seven fields come back from a completed run and none is prose: artefact and settings digests, instructions consumed, output and returned-value digests, and a store fingerprint folding work with captured streams. It stays small whether output is one line or a gigabyte. The companion execution report records capabilities, policy, certificates, settings and peak resource use, so the same run answers both what happened and what it was allowed to do.","selvedge-rebuild.a219a2c15d":"and a report proves permission","selvedge-rebuild.7eaab205c1":"A record proves repetition","selvedge-rebuild.13380a7edb":"Two documents per run","selvedge-rebuild.4077f0afa7":"A comparison is only as good as the record behind it, so read what the record holds.","selvedge-rebuild.39f8833993":"Stop reading; the rest is noise.","selvedge-rebuild.c0084eb27a":"Not the same program","selvedge-rebuild.64bc44871e":"The runs were not configured alike.","selvedge-rebuild.36e1b53299":"Not comparable","selvedge-rebuild.9fc1d0cf34":"Same work, different bytes out.","selvedge-rebuild.d136230733":"The result changed","selvedge-rebuild.6aee5fae01":"A different count is a different code path.","selvedge-rebuild.de89199753":"The work changed","selvedge-rebuild.95e99b8668":"by the field it lands in","selvedge-rebuild.1f218ead06":"What a difference tells you","selvedge-rebuild.d5cf7685a8":"NO VERDICT","selvedge-rebuild.d5a9df81ba":"EXPECTED AND GOT","selvedge-rebuild.ed299cc67f":"FIELD BY FIELD","selvedge-rebuild.a526ac7e2e":"Which is why the input is pinned and travels with the artefact. That is one line in a procedure, and it is the line that decides whether a comparison closes an argument or opens a second one. It gives a counterparty the same bytes to run again, without first having to agree which input the comparison meant.","selvedge-rebuild.6615580bdf":"The list names the field that moved, and the field decides the diagnosis. Fuel alone is a different code path. Fuel and output together is a guest that read something the other one did not. A settings digest that differs means the two runs were never comparable, and an artefact digest that differs means they were never the same program.","selvedge-rebuild.8c8effaa95":"Selvedge walks two records field by field and accumulates every difference with expected and actual values. Different fuel and different output are different problems, and the list says which one you have. It does not collapse a mismatch into a pass/fail label: a settings digest identifies different configuration, while an artefact digest identifies different programs. Fuel alone points to a path change; fuel plus output points to a guest that read a different value. The result gives a counterparty a concrete next check instead of an argument over one boolean.","selvedge-rebuild.646770fca0":"of the fields that moved","selvedge-rebuild.e6e4d5cded":"Replay returns a list","selvedge-rebuild.c81ee5ef6b":"Two runs, compared","selvedge-rebuild.66a522b7c5":"Which is why “did it reproduce” gets a better answer than yes.","selvedge-rebuild.d76c40f0ce":"Fast copy-on-write or pinned first touch.","selvedge-rebuild.f2c61a30e9":"Memory initialisation","selvedge-rebuild.c5abd185c9":"Detected for speed or pinned for portability.","selvedge-rebuild.72afcd7b6b":"Vector instruction choice","selvedge-rebuild.12d9267ba1":"Strong and cheap, from one seed.","selvedge-rebuild.de76cb3681":"Both random streams","selvedge-rebuild.aa0c86bf67":"Fixed epoch, the first of January 2024.","selvedge-rebuild.be2bae9c5e":"Wall clock","selvedge-rebuild.76249575a8":"(removed, or decided once)","selvedge-rebuild.32684a6c6c":"Sources of drift","selvedge-rebuild.d5b4ab5d99":"PORTABLE BY CHOICE","selvedge-rebuild.73b7c15756":"ONE SEED","selvedge-rebuild.e5599ca3ea":"FIXED CLOCK","selvedge-rebuild.3228959407":"The determinism configuration carries a check that says which of the two you are holding, so portability is a decision with a printed answer rather than something discovered when a counterparty's replay disagrees. Pinning costs the wider vector units on the machines that have them, and that is the whole of the trade.","selvedge-rebuild.95523f0e77":"Two settings decide whether the same artefact takes the same path through the processor on somebody else's machine: how vector instructions are selected, and how memory is initialised. Detect what the machine has and the run is faster. Pin them both and the run is portable. A later verifier needs that fixed path.","selvedge-rebuild.b679796146":"Selvedge removes sources of variation: a fixed clock at 1 January 2024 and both random streams seeded from one value. The record holds a digest of that configuration, not the values taken out. Vector instructions and memory initialisation are explicit choices too: detect them for speed or pin them for portability. A verifier can read the profile hash and know whether a replay was expected to follow the same machine path before comparing output.","selvedge-rebuild.0a6cfc8fac":"not a setting to turn on","selvedge-rebuild.1fd189502e":"Determinism is subtraction","selvedge-rebuild.a7c3ed1772":"Subtraction, not configuration","selvedge-rebuild.0c47ffb9bb":"An instruction count only means something if the instructions were the same twice.","selvedge-rebuild.adebd97359":"Fuel consumed can be subtracted between runs.","selvedge-rebuild.a2daaab559":"Figure afterwards","selvedge-rebuild.3d67ae7992":"The work, rather than a wall clock, is the bound.","selvedge-rebuild.de6412fbe8":"Budget of zero","selvedge-rebuild.15dcfdda9a":"Load does not move a count.","selvedge-rebuild.2202f5e805":"Same stopping point","selvedge-rebuild.60440bc65a":"Counted as the guest runs; when spent, the run ends.","selvedge-rebuild.63309fc99a":"Instruction budget","selvedge-rebuild.9bb4b0c4cd":"and what counting buys","selvedge-rebuild.4f84d48da3":"One bound","selvedge-rebuild.34b96ad39f":"SAME ON ANY CPU","selvedge-rebuild.c314cfa17b":"NOT SECONDS","selvedge-rebuild.62e2ede50f":"INSTRUCTIONS","selvedge-rebuild.d1536b89dd":"Instructions consumed are a property of the run. The figure sits in the record, it can be subtracted, and a difference of eight in nine billion is the first thing worth looking at when two runs disagree. That is the whole reason to count work rather than time: the number survives the machine it was taken on. A rerun on other hardware returns the same count or names the field that moved.","selvedge-rebuild.7aff67a600":"A count is also a figure two parties can hold against each other. Elapsed time is a property of whichever machine happened to be free, and nothing useful follows from a difference in it. It measures availability on the host, not the work the guest performed. The count instead describes work that can be checked independently.","selvedge-rebuild.72426f8729":"Elapsed time lets the same artefact pass on an idle machine and fail on a busy one. Selvedge bounds a run by the instruction count spent by the guest, so load changes neither the answer nor the point at which it stops. The budget is charged to guest work rather than host scheduling. A timeout can still protect a stuck host call, but it is not the reproducibility signal; the recorded instruction count is.","selvedge-rebuild.8afbc5d594":"and fuel measures the program","selvedge-rebuild.03b2c4da91":"A deadline measures a host","selvedge-rebuild.21a2c5f1aa":"What actually stops a run","selvedge-rebuild.1a78f4b9ca":"A run that asks for nothing can still fail to end, and that needs a different bound.","selvedge-rebuild.4a92056b30":"Only because the wildcard is written down.","selvedge-rebuild.98f3f99f4d":"The same import with wildcard","selvedge-rebuild.aca85a73fa":"Refused rather than assumed harmless.","selvedge-rebuild.e4b5b433a2":"An import nothing classifies","selvedge-rebuild.15c54f0161":"Recognised but absent from policy. Stops here.","selvedge-rebuild.f998b59fb9":"A socket interface","selvedge-rebuild.b0449a2f1e":"Named in policy and provided by the host.","selvedge-rebuild.83ae8486f7":"The standard streams","selvedge-rebuild.a46cc41ece":"one policy, four answers","selvedge-rebuild.161836a8f2":"Four requests","selvedge-rebuild.366a00a60f":"FAILS CLOSED","selvedge-rebuild.4d3b321af0":"CHECKED FIRST","selvedge-rebuild.063d13205c":"DECLARED IMPORTS","selvedge-rebuild.0727104688":"In Selvedge the unknown case fails closed, and the one way to open it is a wildcard that sits in the policy as its own entry. A permission you did not decide on is not available, and a permission you did decide on is legible to whoever reads the policy next year without having to reconstruct the reasoning. That entry is reviewable, and removing it closes the case again.","selvedge-rebuild.4adda50d9a":"The unknown case is where runtimes usually give ground. An unrecognised request gets passed through on the reasoning that it is probably harmless, and that is how a capability arrives that nobody chose, nobody owns and nobody can date. A boundary stays intelligible only when it closes in that precise case.","selvedge-rebuild.2b1f8f5acb":"An artefact that asks Selvedge for the network never starts. Every declared import is walked before instantiation from all three instance constructors; one import outside policy stops the whole thing, and an import no policy can classify fails closed unless a wildcard was granted on purpose. The walk happens before any module constructor runs, so a denied import cannot leak a partial instance. Import policy is therefore a reviewable start condition rather than a best-effort runtime filter.","selvedge-rebuild.c701cfb7bc":"is refused, not passed on","selvedge-rebuild.11f61b8cea":"An import it cannot place","selvedge-rebuild.e8f740737e":"Before instantiation","selvedge-rebuild.dcd4ba984c":"An empty room is half of it. Something also has to refuse before code starts.","selvedge-rebuild.0e3f683921":"No directory, socket, variable or argument.","selvedge-rebuild.b31a999e3e":"Everything else","selvedge-rebuild.b6f2a8aafd":"The caller's bytes, or a closed stream.","selvedge-rebuild.ed8d995cba":"Standard input","selvedge-rebuild.619f80b0f4":"The same treatment. Nothing is written elsewhere.","selvedge-rebuild.be84302eb7":"Standard error","selvedge-rebuild.28c9b400a8":"Captured, digested and handed back with the run.","selvedge-rebuild.f0c190c767":"Standard output","selvedge-rebuild.80384c78ce":"and what is not there to cross","selvedge-rebuild.fbda0b5df6":"What crosses the wall","selvedge-rebuild.f317e1836d":"NO ENV","selvedge-rebuild.772e054092":"NO FILES","selvedge-rebuild.61176d0dd1":"NO NETWORK","selvedge-rebuild.a4a4906f32":"Subtraction holds still. There is no filesystem to grant and no network to withhold, so the worst case rests on the shape of the host rather than on anybody keeping a list correct. A Selvedge policy you construct yourself starts with an empty capability list and determinism required, and the room it describes is the room you get.","selvedge-rebuild.d987579a1c":"A permission list is a thing somebody maintains, and anything maintained drifts. One release opens a directory for a diagnostic, the diagnostic is finished by the summer, the entry outlives it, and two years later nobody can say what depends on it. That history is what a receipt preserves for a later review.","selvedge-rebuild.a97c12e865":"Ask what a component can reach inside Selvedge and the answer is three streams: standard output, standard error, and standard input when the caller supplies one. No directory, socket, environment variable or argument list is opened; the host has no code path that opens one.","selvedge-rebuild.d9a7d95854":"and there is no fourth","selvedge-rebuild.dcfbae366b":"A guest gets three streams","selvedge-rebuild.fbadde4854":"What a guest is handed","selvedge-rebuild.fallback-record":"record","selvedge-rebuild.fallback-check":"check","selvedge-rebuild.illustrative":"ILLUSTRATIVE","selvedge-rebuild.declared":"declared","selvedge-rebuild.recorded":"recorded","selvedge-rebuild.banner.eng-unchecked.kicker":"What a pass means","selvedge-rebuild.banner.eng-unchecked.title":"Every claim gets tested","selvedge-rebuild.banner.eng-unchecked.body":"An artefact can carry claims about itself: a signature digest, a certificate digest, a policy digest. Each is a promise that something was checked, and each needs material before it can be checked at all. Selvedge insists on that material. An artefact referencing a signature digest verifies once the detached signature and key are supplied. One referencing a certificate digest verifies once a chain verifier is there to read it. One referencing a policy digest verifies on the policy-aware path that produced it.","selvedge-rebuild.banner.eng-unchecked.instrument-header":"Verification material","selvedge-rebuild.banner.eng-unchecked.instrument-tag":"Required","selvedge-rebuild.banner.eng-unchecked.verdict-label":"Pass result","selvedge-rebuild.banner.eng-unchecked.item-1-label":"Signature digest","selvedge-rebuild.banner.eng-unchecked.item-1-body":"Detached signature and key.","selvedge-rebuild.banner.eng-unchecked.item-2-label":"Certificate digest","selvedge-rebuild.banner.eng-unchecked.item-2-body":"Chain verifier.","selvedge-rebuild.banner.eng-unchecked.item-3-label":"Policy digest","selvedge-rebuild.banner.eng-unchecked.item-3-body":"Policy-aware path.","selvedge-rebuild.banner.eng-unchecked.item-4-label":"Artefact + settings","selvedge-rebuild.banner.eng-unchecked.item-4-body":"Checked on every run.","selvedge-rebuild.banner.eng-unchecked.verdict":"A pass covers every claim in the artefact.","selvedge-rebuild.banner.eng-unchecked.footline":"Which is why a Selvedge pass means the same thing to the party receiving it.","selvedge-rebuild.banner.eng-handover.kicker":"Who is holding the evidence","selvedge-rebuild.banner.eng-handover.title":"You hand over four things","selvedge-rebuild.banner.eng-handover.body":"A second party checking a Selvedge run needs four things: the artefact bytes, the input those bytes were given, the determinism settings the run used, and the record it produced. All four are files. All four travel by whatever means the two of you already use, and none of them is a credential, a licence or an endpoint.","selvedge-rebuild.banner.eng-handover.instrument-header":"Replay handover","selvedge-rebuild.banner.eng-handover.instrument-tag":"Offline","selvedge-rebuild.banner.eng-handover.verdict-label":"Independent replay","selvedge-rebuild.banner.eng-handover.item-1-label":"Artefact bytes","selvedge-rebuild.banner.eng-handover.item-1-body":"What ran.","selvedge-rebuild.banner.eng-handover.item-2-label":"Input handed in","selvedge-rebuild.banner.eng-handover.item-2-body":"What it ran on.","selvedge-rebuild.banner.eng-handover.item-3-label":"Settings","selvedge-rebuild.banner.eng-handover.item-3-body":"How it ran.","selvedge-rebuild.banner.eng-handover.item-4-label":"Your record","selvedge-rebuild.banner.eng-handover.item-4-body":"What to compare.","selvedge-rebuild.banner.eng-handover.verdict":"Their machine, their comparison, their list.","selvedge-rebuild.banner.eng-handover.footline":"Four files, and the party who doubts you is the party who checks.","selvedge-rebuild.banner.biz-blind.kicker":"Why a test result transfers","selvedge-rebuild.banner.biz-blind.title":"It cannot tell","selvedge-rebuild.banner.biz-blind.body":"Software that can see its surroundings can behave differently in them. A component that reads the date can behave one way before a cut-off and another way after it. One that reads the machine name can be careful in a test environment and careless in production. One that can see how loaded the machine is can take a shortcut only when nobody is likely to be measuring. That is what makes an acceptance test something you passed once rather than something you know.","selvedge-rebuild.banner.biz-blind.instrument-header":"Supplier-neutral boundary","selvedge-rebuild.banner.biz-blind.instrument-tag":"Same conditions","selvedge-rebuild.banner.biz-blind.verdict-label":"Transferable result","selvedge-rebuild.banner.biz-blind.compare-left":"No retained dependency","selvedge-rebuild.banner.biz-blind.compare-right":"Visible boundary","selvedge-rebuild.banner.biz-blind.item-1-label":"No account","selvedge-rebuild.banner.biz-blind.item-1-body":"Runs on your hardware.","selvedge-rebuild.banner.biz-blind.item-2-label":"No vendor key","selvedge-rebuild.banner.biz-blind.item-2-body":"Nothing held for you.","selvedge-rebuild.banner.biz-blind.item-3-label":"No hidden network","selvedge-rebuild.banner.biz-blind.item-3-body":"No path to exfiltrate.","selvedge-rebuild.banner.biz-blind.item-4-label":"A dated report","selvedge-rebuild.banner.biz-blind.item-4-body":"The permission is written.","selvedge-rebuild.banner.biz-blind.verdict":"A test result transfers because the boundary is the same.","selvedge-rebuild.banner.biz-blind.footline":"The evidence is useful to somebody who was not in the room.","selvedge-rebuild.banner.biz-fresh.kicker":"Why isolation is affordable","selvedge-rebuild.banner.biz-fresh.title":"A fresh room each time","selvedge-rebuild.banner.biz-fresh.body":"Isolation is usually rationed. Standing up a clean environment costs enough that it gets reserved for batch work, and everything interactive shares a long-lived process where one job's residue is the next job's starting condition. That is a cost decision, and it is almost always presented as an architecture.","selvedge-rebuild.banner.biz-fresh.instrument-header":"Fresh-room sequence","selvedge-rebuild.banner.biz-fresh.instrument-tag":"Per request","selvedge-rebuild.banner.biz-fresh.verdict-label":"Operating conclusion","selvedge-rebuild.banner.biz-fresh.item-1-label":"Cold start","selvedge-rebuild.banner.biz-fresh.item-1-body":"Sub-millisecond.","selvedge-rebuild.banner.biz-fresh.item-2-label":"One request","selvedge-rebuild.banner.biz-fresh.item-2-body":"One room.","selvedge-rebuild.banner.biz-fresh.item-3-label":"No carry-over","selvedge-rebuild.banner.biz-fresh.item-3-body":"Nothing shared by default.","selvedge-rebuild.banner.biz-fresh.item-4-label":"One record","selvedge-rebuild.banner.biz-fresh.item-4-body":"The handover is explicit.","selvedge-rebuild.banner.biz-fresh.verdict":"Isolation is affordable when the room is cheap.","selvedge-rebuild.banner.biz-fresh.footline":"A supplier cannot inherit yesterday’s room.","selvedge-rebuild.banner.con-code.kicker":"What the receipt holds","selvedge-rebuild.banner.con-code.title":"A code is not a copy","selvedge-rebuild.banner.con-code.body":"A receipt that proved what came out of your letter would have to hold the letter, and that is the part people quite reasonably ask about. Selvedge keeps no copy. What it keeps is a short code worked out from the content, and the working only runs one way.","selvedge-rebuild.banner.con-code.instrument-header":"Receipt ledger","selvedge-rebuild.banner.con-code.instrument-tag":"Replayable","selvedge-rebuild.banner.con-code.verdict-label":"What it proves","selvedge-rebuild.banner.con-code.item-1-label":"The artefact","selvedge-rebuild.banner.con-code.item-1-body":"Which program.","selvedge-rebuild.banner.con-code.item-2-label":"The input","selvedge-rebuild.banner.con-code.item-2-body":"What it saw.","selvedge-rebuild.banner.con-code.item-3-label":"The settings","selvedge-rebuild.banner.con-code.item-3-body":"What was fixed.","selvedge-rebuild.banner.con-code.item-4-label":"The receipt","selvedge-rebuild.banner.con-code.item-4-body":"What to compare.","selvedge-rebuild.banner.con-code.verdict":"A short code names the run; it does not pretend to be the source.","selvedge-rebuild.banner.con-code.footline":"The useful object is small enough to hand over.","selvedge-rebuild.internal-numeric":"Internal computation, storage and accumulation use binary, integer, fixed-point or adaptive integer/fixed-point representations. Floating point is accepted only at a declared external boundary and is explicitly converted before internal work begins. There is no internal floating-point fallback.","selvedge-rebuild.banner.eng-unchecked.title-accent":"before a pass is given","selvedge-rebuild.banner.eng-unchecked.body-second":"Ask Selvedge to verify without the material and the error names exactly what is missing, which turns an unverifiable artefact into a request for the one thing that would settle it. The practical effect is that a green result from Selvedge carries its full meaning wherever it travels: every claim the artefact makes was tested, by the same tooling, against material somebody actually supplied.","selvedge-rebuild.banner.eng-handover.title-accent":"and the check is theirs","selvedge-rebuild.banner.eng-handover.body-second":"They run the replay on their own machine against their own build of the tooling, and what comes back is their list of differing fields rather than your assurance about the run. Nothing on that path needs an account, a key held by us, or a service of ours to be reachable, so the check works during an outage, on an air-gapped network, and years after the run it settles. That is what makes a Selvedge record worth quoting in a contract: the party who distrusts you is the party who verifies it.","selvedge-rebuild.banner.biz-blind.title-accent":"that it is being tested","selvedge-rebuild.banner.biz-blind.body-second":"A component running in Selvedge has nothing to read. The clock it is given never moves off a single fixed instant. There is no environment, no arguments, no network and no directory, so there is no machine name, no deployment label and no way to find out whether this is the fourth run or the first. Behaviour can still depend on the input, which is exactly why the input is the thing you pin and hand across. What it cannot depend on is the date, the host or the occasion, so a run that behaved in acceptance behaves the same way in November on somebody else's hardware.","selvedge-rebuild.banner.biz-fresh.title-accent":"because a room is cheap","selvedge-rebuild.banner.biz-fresh.body-second":"Standing up a fresh Selvedge instance lands well under a millisecond on the machine the project measures on, which puts one per request inside the budget of nearly anything interactive. Nothing carries between them unless it is handed across deliberately, and what is handed across appears on the record as something that was handed across. The commercial version of that sentence is short: one job's mistake is one job's mistake, and the blast radius is a room that no longer exists.","selvedge-rebuild.banner.con-code.title-accent":"of the thing it came from","selvedge-rebuild.banner.con-code.body-second":"The same content always produces the same code, so the code is enough to show that nothing changed. The code cannot be turned back into the content, so it shows nothing about what the content was. A run over a two hundred page report leaves a record the same size as a run over one line, and neither record holds a word of what it was about. You can keep it for a decade, or hand it to somebody who is not allowed to read the document, and give away nothing at all.","selvedge-rebuild.banner.eng-record.kicker":"What remains after the run","selvedge-rebuild.banner.eng-record.title":"The process has stopped","selvedge-rebuild.banner.eng-record.title-accent":"the record still answers","selvedge-rebuild.banner.eng-record.body":"A completed run should leave more than a success flag. Selvedge binds the artefact, input, determinism settings and measured work to the outputs that came back. The record is a set of fields, not a prose account written after the event.","selvedge-rebuild.banner.eng-record.body-second":"A second machine can replay the same material and compare the record field by field. If the artefact, settings, instruction count or output differs, the disagreement has a named place rather than a general claim that the run could not be reproduced.","selvedge-rebuild.banner.eng-record.instrument-header":"Run receipt","selvedge-rebuild.banner.eng-record.instrument-tag":"Field by field","selvedge-rebuild.banner.eng-record.verdict-label":"Replay check","selvedge-rebuild.banner.eng-record.item-1-label":"Artefact + input","selvedge-rebuild.banner.eng-record.item-1-body":"The material that entered.","selvedge-rebuild.banner.eng-record.item-2-label":"Determinism settings","selvedge-rebuild.banner.eng-record.item-2-body":"The conditions fixed for the run.","selvedge-rebuild.banner.eng-record.item-3-label":"Instructions consumed","selvedge-rebuild.banner.eng-record.item-3-body":"The measured work.","selvedge-rebuild.banner.eng-record.item-4-label":"Output digests","selvedge-rebuild.banner.eng-record.item-4-body":"The values to compare.","selvedge-rebuild.banner.eng-record.verdict":"When a replay diverges, the record points to the field where it happened.","selvedge-rebuild.banner.eng-record.footline":"The evidence remains useful after the process that produced it is gone.","selvedge-rebuild.banner.biz-transfer.kicker":"What survives a supplier change","selvedge-rebuild.banner.biz-transfer.title":"Keep the accepted result","selvedge-rebuild.banner.biz-transfer.title-accent":"without keeping the supplier","selvedge-rebuild.banner.biz-transfer.body":"An acceptance result becomes fragile when only the supplier can reproduce it. The account, service and internal test harness then become part of the evidence, even if the contract says the software itself is portable.","selvedge-rebuild.banner.biz-transfer.body-second":"Selvedge makes the handover concrete. Keep the artefact, the allowed capabilities, the fixed run settings and the resulting record. A replacement supplier or independent reviewer can replay those files on their own machine without asking the original supplier to reopen anything.","selvedge-rebuild.banner.biz-transfer.instrument-header":"Independent handover","selvedge-rebuild.banner.biz-transfer.instrument-tag":"No retained service","selvedge-rebuild.banner.biz-transfer.verdict-label":"Commercial boundary","selvedge-rebuild.banner.biz-transfer.item-1-label":"Accepted artefact","selvedge-rebuild.banner.biz-transfer.item-1-body":"The exact bytes that passed.","selvedge-rebuild.banner.biz-transfer.item-2-label":"Permission set","selvedge-rebuild.banner.biz-transfer.item-2-body":"The boundary it ran inside.","selvedge-rebuild.banner.biz-transfer.item-3-label":"Replay package","selvedge-rebuild.banner.biz-transfer.item-3-body":"Files the buyer can retain.","selvedge-rebuild.banner.biz-transfer.item-4-label":"Independent comparison","selvedge-rebuild.banner.biz-transfer.item-4-body":"No supplier account required.","selvedge-rebuild.banner.biz-transfer.verdict":"The evidence changes hands without creating a new dependency.","selvedge-rebuild.banner.biz-transfer.footline":"The party receiving the result also receives the means to check it.","slv-visuals.chrome-meta":"run record","slv-visuals.661f13bc63":"CHECKED","slv-visuals.bd63dd7336":"declared, bounded, recorded","slv-visuals.ac7ff256a6":"SEL","slv-visuals.44fd37f1ed":"This world is sealed because it was not declared.","slv-visuals.74140b3eb3":"The operation crosses the room while the key stays outside.","slv-visuals.a95af2a207":"One path prefix is visible; this is a window, not a filesystem.","slv-visuals.5265953d8b":"Two named tools are present; an unnamed tool has no opening.","slv-visuals.43dd7aa30b":"The granted list is dated on the report, so the review becomes a lookup.","slv-visuals.bcaf2f4bea":"The capability was refused before the run, with a stable code for the runbook.","slv-visuals.f712baba7f":"Fuel and output moved: ask what input the guest actually received.","slv-visuals.f4435747db":"Fuel moved while output held: inspect the host build or the code path.","slv-visuals.e18ddd4366":"No findings. Pinning gives up wider vector units, and portability is now a reading.","slv-visuals.f1a5ccbfac":"Two findings: vector selection and memory initialisation depend on the host.","slv-visuals.interaction.choices":"Selvedge visual choices","slv-visuals.interaction.sequence":"Selvedge sequence","slv-visuals.interaction.worlds":"Selvedge capability worlds","slv-visuals.interaction.tree":"Selvedge inclusion-proof tree","slv-visuals.fallback-hash":"hash","slv-visuals.fallback-fact":"fact","slv-visuals.control.detect":"detect-tuned","slv-visuals.control.pinned":"pinned","slv-visuals.control.fuel":"fuel moved","slv-visuals.control.output":"fuel + output moved","slv-visuals.control.policy":"policy refused","slv-visuals.control.allowed":"policy allowed","slv-visuals.control.tool":"tool","slv-visuals.control.storage":"storage","slv-visuals.control.crypto":"crypto","slv-visuals.control.observe":"observe","toc-rail.f5cbdf6bfb":"Contents"}