Ferralloy · Open-source fleet layer · Pure Rust
Most update systems verify that an update arrived intact. Ferralloy verifies that it still does exactly what its author proved it does: a pack carries signed eval vectors, input → expected output digest, and a device accepts it only after re-running them in a deterministic sandbox and byte-comparing the results. Signature, digests, then behavior, or the pack is refused, with the differing digests named.
On crates.io: cargo install ferralloy, the whole stack is published (CLI, agent ferralloyd, fleet server, and the ferralloy-pack/-bridge/-runtime libraries). The GPU cross-fabric engine runs on stock wgpu, no toolchain forks, so it's deterministic out of the box.
The accept gate
ed25519 over the stored manifest, which carries the sha256 of every payload file, so the whole pack is transitively signed. Allowlist or trust-on-first-use with the signer reported.
Every payload file byte-checked against the signed manifest. One flipped byte → refused, offending digest named.
The pack is staged to disk first; verification runs from the staged bytes, never from the parse buffer.
The author's signed eval vectors re-run in the device's deny-by-default sandbox. Output digests must match bit-for-bit. Only then: an atomic swap to live.
Determinism is structural, not hopeful: the sandbox has no clock, no randomness, no filesystem, no network unless the manifest grants them, a policy that requests nothing has no way to behave differently on the device than it did on the author's machine.
Receipts · 2026-07-22
| Claim | Result |
|---|---|
| Cross-architecture, control policy signed on an Apple-silicon Mac, deployed over the network to an x86-64 Linux box | all vectors bit-exact; live run burned the exact instruction count the vectors predicted |
| Tamper, one byte flipped deep in the payload | refused (HTTP 400), offending digest named, behavior never executed |
| Behavioral drift, payload swapped for one that runs fine but acts differently | refused, bytes verified, behavior didn't |
| Cross-fabric, GPU compute pack vectored on Apple Metal (M5 Max), verified on NVIDIA Vulkan (RTX 4050) | bit-exact, two GPU vendors, two drivers, identical floats |
| A full transformer (attention, softmax, RoPE, RMSNorm) vectored on Metal, deployed to the Vulkan device | accepted, bit-exact. Earlier the same day the gate had correctly refused this pack: the fabrics genuinely diverged until Ferric's kernels were made strict-IEEE. The gate found real divergence, then certified the fix. |
| Wire-byte pinning, a pack that drives servo hardware signs the exact bus bytes; goldens captured from the browser implementation | browser sim and Rust device byte-identical; same vectors against re-wired servo IDs refused, bus wiring is behavior too |
The inner loop
# one keypair, one identity devices can pin ferralloy keygen # build + sign a pack; eval vectors are RECORDED by running your payload # in the same sandbox the device will use ferralloy build ./policy --name pd-hover --entry pd-hover.wasm \ --vec-str "0.0,0.0,1.0" --vec-str "2.5,-0.4,1.2" ferralloy discover # mDNS: agents announce themselves ferralloy deploy pd-hover.fpack --to jetson-hub:7266 → "behavior": "verified (2 vectors, bit-exact)" ferralloy start pd-hover --to jetson-hub:7266 --input "0.0,0.0,1.0"
The device agent, ferrited, is one static binary: mDNS advertisement, the accept gate, wasmtime execution with capability grants from the manifest, log streaming, and a built-in browser ops page. Packs survive agent restarts; swaps are atomic.
The foundation
A behavioral signature is only as strong as the runtime's determinism. For GPU-verified model packs that determinism comes from Ferric, whose kernels evaluate as-written IEEE on every fabric using deterministic transcendentals and an address-space discipline built into the shader source itself, no toolchain fork required. The per-kernel probe (matmul, RMSNorm, sqrt, RoPE, attention, sigmoid, and a complete transformer forward) reads identical output hashes in Chrome’s WebGPU, on Apple Metal, and on NVIDIA Vulkan, on stock wgpu, the same signature in the browser where a policy is trained and on the devices it ships to, with the sqrt kernel verified exact against a plain-IEEE CPU replica on all three. Accuracy cost against the CPU references: 10⁻⁸-scale. Determinism cost: zero claims, receipts only.
Technical Report TR-2026-23, "One Digest" documents the full campaign: the divergence mechanisms, the pin hierarchy, the six-substrate results, the NPU oracle contract, and the measured price, with the reproduction commands.
The fleet plane
The whole field ships an open device agent and gates the fleet server behind a paid cloud. Ferralloy's fleet server is open too, a self-hostable binary, no feature gate. A channel (stable, beta) holds a current release; devices subscribe, pull their target, and run it through the same on-device accept gate before it goes live, the server never pushes, so a device behind NAT still updates.
Canary rollouts gated on verified behavior. Stage a release to a fraction of a channel, ferralloy release policy.fpack --channel stable --canary 20, and 20% of the devices (chosen by a stable hash) pull it while the rest hold the current release. The dashboard reports the canary's verified-pass rate, how many canary devices re-ran the signed eval vectors and matched bit-for-bit, and only then do you promote. "Rolled out" means behavior verified across a slice of the real fleet, not bytes delivered. abort reverts the canary devices to the current release on their next poll.
Status · v0.2
Real and verified: the pack format, the accept gate, cross-arch and cross-fabric verification, wire-codec pinning for 12 protocols × 17 hardware targets, the browser ops page, native-payload sandboxing (landlock + seccomp), and the open fleet plane with behavior-gated canary rollouts, all on crates.io. Compiles but not yet hardware-verified: the live serial output path (a byte-exact capture file stands in until a physical bus run). Planned: OS A/B updates via Rugix, USB-C device networking, a TUF root of trust, and an MCU-class runtime, no feature gates, ever.
MIT OR Apache-2.0, free for anyone to use, study, and build on, that is the point. Part of the open ecosystem alongside Ferric (AI compute) and Ferromotion (kinematics & dynamics).