Ferrite · Open-source fleet layer · Pure Rust
Every fleet platform verifies that an update arrived intact. Ferrite verifies that it still does exactly what its author proved it does: a pack carries signed eval vectors — input → expected output digest — and a device accepts it only after re-running them in a deterministic sandbox and byte-comparing the results. Signature, digests, then behavior — or the pack is refused, with the differing digests named.
The accept gate
ed25519 over the stored manifest — which carries the sha256 of every payload file, so the whole pack is transitively signed. Allowlist or trust-on-first-use with the signer reported.
Every payload file byte-checked against the signed manifest. One flipped byte → refused, offending digest named.
The pack is staged to disk first; verification runs from the staged bytes — never from the parse buffer.
The author's signed eval vectors re-run in the device's deny-by-default sandbox. Output digests must match bit-for-bit. Only then: an atomic swap to live.
Determinism is structural, not hopeful: the sandbox has no clock, no randomness, no filesystem, no network unless the manifest grants them — a policy that requests nothing has no way to behave differently on the device than it did on the author's machine.
Receipts · 2026-07-22
| Claim | Result |
|---|---|
| Cross-architecture — control policy signed on an Apple-silicon Mac, deployed over the network to an x86-64 Linux box | all vectors bit-exact; live run burned the exact instruction count the vectors predicted |
| Tamper — one byte flipped deep in the payload | refused (HTTP 400), offending digest named, behavior never executed |
| Behavioral drift — payload swapped for one that runs fine but acts differently | refused — bytes verified, behavior didn't |
| Cross-fabric — GPU compute pack vectored on Apple Metal (M5 Max), verified on NVIDIA Vulkan (RTX 4050) | bit-exact — two GPU vendors, two drivers, identical floats |
| A full transformer — attention, softmax, RoPE, RMSNorm — vectored on Metal, deployed to the Vulkan device | accepted, bit-exact. Earlier the same day the gate had correctly refused this pack: the fabrics genuinely diverged until Ferric's kernels were made strict-IEEE. The gate found real divergence, then certified the fix. |
| Wire-byte pinning — a pack that drives servo hardware signs the exact bus bytes; goldens captured from the browser implementation | browser sim and Rust device byte-identical; same vectors against re-wired servo IDs refused — bus wiring is behavior too |
The inner loop
# one keypair, one identity devices can pin ferrite keygen # build + sign a pack; eval vectors are RECORDED by running your payload # in the same sandbox the device will use ferrite build ./policy --name pd-hover --entry pd-hover.wasm \ --vec-str "0.0,0.0,1.0" --vec-str "2.5,-0.4,1.2" ferrite discover # mDNS: agents announce themselves ferrite deploy pd-hover.fpack --to jetson-hub:7266 → "behavior": "verified (2 vectors, bit-exact)" ferrite start pd-hover --to jetson-hub:7266 --input "0.0,0.0,1.0"
The device agent, ferrited, is one static binary: mDNS advertisement, the accept gate, wasmtime execution with capability grants from the manifest, log streaming, and a built-in browser ops page. Packs survive agent restarts; swaps are atomic.
Why the moat holds
A behavioral signature is only as strong as the runtime's determinism. For GPU-verified model packs that determinism comes from Ferric, whose kernels now evaluate as-written IEEE on every fabric: deterministic transcendentals built from correctly-rounded operations only, strict-math shader compilation on Metal, and no-contraction float ops on Vulkan. The per-kernel probe — matmul, RMSNorm, sqrt, RoPE, attention, sigmoid, and a complete transformer forward — reads identical output hashes on Apple Metal and NVIDIA Vulkan, with the sqrt kernel verified exact against a plain-IEEE CPU replica on both. Accuracy cost against the CPU references: 10⁻⁸-scale. Determinism cost: zero claims, receipts only.
Status · v0.2
Real and verified: the pack format, the accept gate, cross-arch and cross-fabric verification, wire-codec pinning for 12 protocols × 17 hardware targets, the browser ops page. Compiles but not yet hardware-verified: the live serial output path (a byte-exact capture file stands in until a physical bus run). Planned: OS A/B updates via Rugix, USB-C device networking, a TUF root of trust, an MCU-class runtime, and an open self-hostable fleet plane — no feature gates, ever.
MIT OR Apache-2.0 · part of the open ecosystem alongside Ferric (AI compute) and Ferromotion (kinematics & dynamics).