Assurance
How we prove it
PolyCap is specified at the byte level and verified by machine. The claim is not “trust us”; it is “check the bytes.”
The oracle. Every module specification ships with a deterministic vector corpus — golden frames, expected error tuples, hash-pinned — generated from enumerated inputs and regenerable on a bare machine. An implementation is conformant when it reproduces every byte and every typed refusal. There is no “close.”
Two implementations, one corpus. The reference implementation is graded against the oracle from its first commit. For every module polyZero implements, a second implementation in a second language reproduces the entire reference corpus hash-for-hash — without reading the first’s output. Agreement is corroboration, not copy.
Typed refusals. 437 error conditions in a closed catalog. A refused action names precisely which authority was missing. Errors are never laundered.
Floors. 154 registered device-level controls — battery, thermal, data caps, retention, revocation coupling — immutable per signed release, breachable by no policy overlay or runtime governor.
Independent scrutiny. Fuzzing on every decoder with every finding pinned as a regression; independent-lineage security review; a human third-party audit before the public verification suites ship.
The conformance program. Partners receive the module specifications, the vector corpora, and the conformance harness today, under the program. Six public verification suites are on the roadmap so that anyone can check the properties we claim without asking us.
Design set complete. polyZero, the reference runtime for N0-class nodes, implements the first three modules; all three independently reproduced. Test net running: polyZero nodes talking to one another through a standard MQTT 5 broker, with real-time OpenTelemetry tracing from the nodes themselves. Walking skeleton and gateway demonstration scheduled.