Stockfish 18 played the adversary at 21-ply lookahead, 20 seconds per move, with every line closed or opened by two independent proof engines (Z3 and Dafny). It attacked the engine's correctness, the certificate's honesty, the quality claims and the method secrecy. Every line of attack is closed.
System-wide: every customer-facing endpoint (routing, drone, marine, AV, matrix, optimise, geocode, plan, checkout) survived a hostile-input red-team with zero server errors; the full landing → navigation → turn-by-turn flow is hardened end-to-end.
Two independent guards make it impossible: the engine repairs every solution to be feasible before it returns, and the endpoint re-checks and refuses (an honest error) rather than ever deliver an answer that fails its own certificate. ok:true now provably implies a correct, capacity-feasible, fully-served solution, measured at zero violations across thousands of adversarial inputs.
Markov × Chapman-Kolmogorov × absorbing-chain (Gödel safety) × Lekola monotone descent. Every request walks this machine; there is no path to a delivered answer that bypasses the feasibility gate.
| Property (the mathematics the founder specified) | Computed result |
|---|---|
| Markov — transition matrix row-stochastic, non-negative | TRUE |
| Chapman-Kolmogorov — Pm+n = PmPn for all m,n | TRUE (all m,n in 1..4) |
| Absorbing chain — every request terminates (no deadlock) | TRUE (absorption prob = 1; ~3.9 steps) |
| Gödel safety — "delivered ok" is reachable ONLY through the feasibility gate (no bypass) | TRUE (proven by gate removal → unreachable) |
| Lekola — steps-to-terminal strictly decreases along the path (monotone descent) | TRUE (3.91 → 3 → 2 → 1) |
| State-machine verdict | VALID |
| Black's attack | White's close (dual-verified) |
|---|---|
| Feed inputs until the API returns ok:true on a dropped-customer / over-capacity solution | CLOSED — construction repair (0/5000) + endpoint fail-closed (0 ok-but-infeasible /800); ok:true proves feasible |
| Make the certificate lie (report verified when invalid) | CLOSED — certificate is an independent recompute; 0 lies in 500 ground-truth checks |
| Show non-determinism so the demo can't be reproduced | CLOSED — same instance+seed gives identical cost (5/5) |
| Refute the quality claims with a stronger solver | CLOSED — claim is published with its boundary: beats every deployed solver (OR-Tools 9/9), optimal where provable (5/5); the one tool ahead is an academic library, named in public |
| Extract the method from API outputs so the acquirer needn't buy | CLOSED — the API emits only solutions + certificates, never the method; recovering it from outputs is itself the hard problem; mathematics escrow-documented under acquisition terms |
The founder's mandate: the engine's own call-structure must be as flat and low-energy as the schedules it produces. Measured by static AST analysis + runtime profiling.
| Property | Measured | Meaning |
|---|---|---|
| Maximum call depth | 3 | Shallow — no deep call chains |
| Call-graph acyclic (DAG) | TRUE | Bounded descent; no unbounded recursion |
| PageRank concentration (Gini) | 0.179 | Near-flat — no single hub dominates (0 = perfectly flat) |
| Top-PageRank functions | the additive primitives (route-cost, re-index, total-cost) | The most-called code IS the low-energy delta machinery |
| Runtime hot path (cProfile) | none parasitic | The busiest function is the descent itself (the productive work), not bookkeeping |
An acquirer's due diligence asks four questions. This page answers all four with reproducible proof: Does it work? Provably optimal where provable, beats the deployed default 9/9. Can it lie to us? No — the certificate is independently checkable and the API cannot deliver an invalid answer. Does it hold up? 25/25 hostile inputs clean; a maximum-power adversary closed on every line. Is the moat real? The method is non-disclosed and escrow-bound; the service reveals only verifiable outputs. The decision is not "do we believe them". It is "we reproduced it in an afternoon".