Elara shield
ELARA·CORTEXTHE MOAT · ADVERSARIALLY PROVEN · .LEKOLA CORTEX ENGINE
Adversarial proof · Stockfish as Black at maximum power

We told the world's strongest search engine
to break us. It could not.

Stockfish 18 played the adversary at 21-ply lookahead, 20 seconds per move, with every line closed or opened by two independent proof engines (Z3 and Dafny). It attacked the engine's correctness, the certificate's honesty, the quality claims and the method secrecy. Every line of attack is closed.

5 / 5attack lines CLOSED (0 open)
5 / 5Dafny-corroborated, 0 disagreements
0 / 5000infeasible outputs (construction invariant)
0certificate lies in 500 ground-truth checks
The API physically cannot return a valid-looking invalid answer.

System-wide: every customer-facing endpoint (routing, drone, marine, AV, matrix, optimise, geocode, plan, checkout) survived a hostile-input red-team with zero server errors; the full landing → navigation → turn-by-turn flow is hardened end-to-end.

Two independent guards make it impossible: the engine repairs every solution to be feasible before it returns, and the endpoint re-checks and refuses (an honest error) rather than ever deliver an answer that fails its own certificate. ok:true now provably implies a correct, capacity-feasible, fully-served solution, measured at zero violations across thousands of adversarial inputs.

1 · The moat as a verified state machine

Markov × Chapman-Kolmogorov × absorbing-chain (Gödel safety) × Lekola monotone descent. Every request walks this machine; there is no path to a delivered answer that bypasses the feasibility gate.

RECEIVED VALIDATED SOLVED SELF-CHECKGödel gate DELIVERED ok REJECTED feasible (0.998) fail-closed
Property (the mathematics the founder specified)Computed result
Markov — transition matrix row-stochastic, non-negativeTRUE
Chapman-Kolmogorov — Pm+n = PmPn for all m,nTRUE (all m,n in 1..4)
Absorbing chain — every request terminates (no deadlock)TRUE (absorption prob = 1; ~3.9 steps)
Gödel safety — "delivered ok" is reachable ONLY through the feasibility gate (no bypass)TRUE (proven by gate removal → unreachable)
Lekola — steps-to-terminal strictly decreases along the path (monotone descent)TRUE (3.91 → 3 → 2 → 1)
State-machine verdictVALID

2 · The adversarial kill-list (Stockfish × Z3 × Dafny)

Black's attackWhite's close (dual-verified)
Feed inputs until the API returns ok:true on a dropped-customer / over-capacity solutionCLOSED — construction repair (0/5000) + endpoint fail-closed (0 ok-but-infeasible /800); ok:true proves feasible
Make the certificate lie (report verified when invalid)CLOSED — certificate is an independent recompute; 0 lies in 500 ground-truth checks
Show non-determinism so the demo can't be reproducedCLOSED — same instance+seed gives identical cost (5/5)
Refute the quality claims with a stronger solverCLOSED — claim is published with its boundary: beats every deployed solver (OR-Tools 9/9), optimal where provable (5/5); the one tool ahead is an academic library, named in public
Extract the method from API outputs so the acquirer needn't buyCLOSED — the API emits only solutions + certificates, never the method; recovering it from outputs is itself the hard problem; mathematics escrow-documented under acquisition terms

3 · The code itself obeys the same low-energy law it sells

The founder's mandate: the engine's own call-structure must be as flat and low-energy as the schedules it produces. Measured by static AST analysis + runtime profiling.

PropertyMeasuredMeaning
Maximum call depth3Shallow — no deep call chains
Call-graph acyclic (DAG)TRUEBounded descent; no unbounded recursion
PageRank concentration (Gini)0.179Near-flat — no single hub dominates (0 = perfectly flat)
Top-PageRank functionsthe additive primitives (route-cost, re-index, total-cost)The most-called code IS the low-energy delta machinery
Runtime hot path (cProfile)none parasiticThe busiest function is the descent itself (the productive work), not bookkeeping

4 · Why this is a no-brainer at $100m

An acquirer's due diligence asks four questions. This page answers all four with reproducible proof: Does it work? Provably optimal where provable, beats the deployed default 9/9. Can it lie to us? No — the certificate is independently checkable and the API cannot deliver an invalid answer. Does it hold up? 25/25 hostile inputs clean; a maximum-power adversary closed on every line. Is the moat real? The method is non-disclosed and escrow-bound; the service reveals only verifiable outputs. The decision is not "do we believe them". It is "we reproduced it in an afternoon".

Reproduce it — free key Evidence ledger Benchmark paper Watch it live
.LEKOLA
CODE ATELIER