Ferralloy · Open-source fleet layer · Pure Rust
Most update systems verify that an update arrived intact. Ferralloy verifies that it still does exactly what its author proved it does: a pack carries signed eval vectors — input → expected output digest — and a device accepts it only after re-running them in a deterministic sandbox and byte-comparing the results. Signature, digests, then behavior — or the pack is refused, with the differing digests named.
On crates.io: cargo install ferralloy — the whole stack is published (CLI, agent ferralloyd, fleet server, and the ferralloy-pack/-bridge/-runtime libraries). The GPU cross-fabric engine runs on stock wgpu — no toolchain forks — so it's deterministic out of the box.
The accept gate
ed25519 over the stored manifest — which carries the sha256 of every payload file, so the whole pack is transitively signed. Allowlist or trust-on-first-use with the signer reported.
Every payload file byte-checked against the signed manifest. One flipped byte → refused, offending digest named.
The pack is staged to disk first; verification runs from the staged bytes — never from the parse buffer.
The author's signed eval vectors re-run in the device's deny-by-default sandbox. Output digests must match bit-for-bit. Only then: an atomic swap to live.
Determinism is structural, not hopeful: the sandbox has no clock, no randomness, no filesystem, no network unless the manifest grants them — a policy that requests nothing has no way to behave differently on the device than it did on the author's machine.
Receipts · 2026-07-22
| Claim | Result |
|---|---|
| Cross-architecture — control policy signed on an Apple-silicon Mac, deployed over the network to an x86-64 Linux box | all vectors bit-exact; live run burned the exact instruction count the vectors predicted |
| Tamper — one byte flipped deep in the payload | refused (HTTP 400), offending digest named, behavior never executed |
| Behavioral drift — payload swapped for one that runs fine but acts differently | refused — bytes verified, behavior didn't |
| Cross-fabric — GPU compute pack vectored on Apple Metal (M5 Max), verified on NVIDIA Vulkan (RTX 4050) | bit-exact — two GPU vendors, two drivers, identical floats |
| A full transformer — attention, softmax, RoPE, RMSNorm — vectored on Metal, deployed to the Vulkan device | accepted, bit-exact. Earlier the same day the gate had correctly refused this pack: the fabrics genuinely diverged until Ferric's kernels were made strict-IEEE. The gate found real divergence, then certified the fix. |
| Wire-byte pinning — a pack that drives servo hardware signs the exact bus bytes; goldens captured from the browser implementation | browser sim and Rust device byte-identical; same vectors against re-wired servo IDs refused — bus wiring is behavior too |
The inner loop
# one keypair, one identity devices can pin ferralloy keygen # build + sign a pack; eval vectors are RECORDED by running your payload # in the same sandbox the device will use ferralloy build ./policy --name pd-hover --entry pd-hover.wasm \ --vec-str "0.0,0.0,1.0" --vec-str "2.5,-0.4,1.2" ferralloy discover # mDNS: agents announce themselves ferralloy deploy pd-hover.fpack --to jetson-hub:7266 → "behavior": "verified (2 vectors, bit-exact)" ferralloy start pd-hover --to jetson-hub:7266 --input "0.0,0.0,1.0"
The device agent, ferrited, is one static binary: mDNS advertisement, the accept gate, wasmtime execution with capability grants from the manifest, log streaming, and a built-in browser ops page. Packs survive agent restarts; swaps are atomic.
The foundation
A behavioral signature is only as strong as the runtime's determinism. For GPU-verified model packs that determinism comes from Ferric, whose kernels evaluate as-written IEEE on every fabric using deterministic transcendentals and an address-space discipline built into the shader source itself — no toolchain fork required. The per-kernel probe — matmul, RMSNorm, sqrt, RoPE, attention, sigmoid, and a complete transformer forward — reads identical output hashes in Chrome’s WebGPU, on Apple Metal, and on NVIDIA Vulkan, on stock wgpu — the same signature in the browser where a policy is trained and on the devices it ships to — with the sqrt kernel verified exact against a plain-IEEE CPU replica on all three. Accuracy cost against the CPU references: 10⁻⁸-scale. Determinism cost: zero claims, receipts only.
Technical Report TR-2026-23 — "One Digest" documents the full campaign: the divergence mechanisms, the pin hierarchy, the six-substrate results, the NPU oracle contract, and the measured price — with the reproduction commands.
The fleet plane
The whole field ships an open device agent and gates the fleet server behind a paid cloud. Ferralloy's fleet server is open too — a self-hostable binary, no feature gate. A channel (stable, beta) holds a current release; devices subscribe, pull their target, and run it through the same on-device accept gate before it goes live — the server never pushes, so a device behind NAT still updates.
Canary rollouts gated on verified behavior. Stage a release to a fraction of a channel — ferralloy release policy.fpack --channel stable --canary 20 — and 20% of the devices (chosen by a stable hash) pull it while the rest hold the current release. The dashboard reports the canary's verified-pass rate — how many canary devices re-ran the signed eval vectors and matched bit-for-bit — and only then do you promote. "Rolled out" means behavior verified across a slice of the real fleet, not bytes delivered. abort reverts the canary devices to the current release on their next poll.
Status · v0.2
Real and verified: the pack format, the accept gate, cross-arch and cross-fabric verification, wire-codec pinning for 12 protocols × 17 hardware targets, the browser ops page, native-payload sandboxing (landlock + seccomp), and the open fleet plane with behavior-gated canary rollouts — all on crates.io. Compiles but not yet hardware-verified: the live serial output path (a byte-exact capture file stands in until a physical bus run). Planned: OS A/B updates via Rugix, USB-C device networking, a TUF root of trust, and an MCU-class runtime — no feature gates, ever.
MIT OR Apache-2.0, free for anyone to use, study, and build on — that is the point. Part of the open ecosystem alongside Ferric (AI compute) and Ferromotion (kinematics & dynamics).