Substrate
VELMA-S · proof of correctness
The forge for VELMA architecture. A two-layer system that resolves the tension between what is provably valid and what keeps the lab running — by refusing to unify them.
| Dimension | VELMA-S | VELMA-D |
|---|---|---|
| 01Determinism | Strict; type-enforced | Adaptive-bounded; stochastic interior |
| 02Assistant separation | Hard walls; typed channels only | Permeable; provenance preserved |
| 03Build reproducibility | Protocol-anchored | State-anchored (snapshot replay) |
| 04Kernel lanes | Haskell · Fortran · COBOL | Python · Rust · TypeScript |
| 05Security model | Type system (compile-time) | Six-layer defense + capture (runtime) |
| 06Recovery model | Roll back to last typed state | Replay smallest delta vs. S anchor |
| 07Workspace persistence | Immutable, append-only | Mutable, with S-anchored provenance |
The architecture above was extracted via a structured competitive exercise across two AI systems with deliberately different briefs: one given strict defense, one given aggressive defense and capture. The aggressive brief produced a security-coherent architecture with a real capture mechanism. The strict-defense brief produced a competent OS prototype with the security dimension essentially absent.
The finding is structural: the brief mattered more than the system. Precise, game-theoretically coherent briefs extract coherent architectures. Vague briefs extract generic ones. Brief design is a primary lever on output quality.
When VELMA-D produces an output that VELMA-S needs to absorb — what does verification look like, and who initiates it?
The recovery model depends on D-layer mutations being traceable to S-layer anchors. The mechanism by which D output is validated against S constraints — and the question of whether D pushes the validation or S pulls it — determines the failure modes of the whole system. Identifying the gap is the prerequisite to filling it correctly.
The seven-dimension matrix was not built to be a deliverable. It was built to surface the rows that were missing — the decisions that had not yet been made explicit. The matrix made them visible.
Telling a system it is playing a game with a winner and a payout activates different reasoning than asking it to design a security layer. The former requires a theory of winning; the latter can be satisfied by a checklist.
Hold each system accountable to its own brief, not to a universal standard. A system that correctly follows a conservative brief should not be penalized for not exhibiting the characteristics of an aggressive one — or vice versa.
An unfound gap is more dangerous than a found one. Logging the open question is the prerequisite to filling it correctly. Memory and provenance infrastructure exist precisely to ensure that found gaps travel with the work.
The work documented at velmaforge was produced by a human coordinating Quiet Forge (Claude), Claude Code, and Copilot as parallel evaluation nodes — each receiving a calibrated brief, each producing output evaluated against its own brief. The coordination and evaluation were human. The architectures were AI. The integration of the two is the methodology.