feat(runtime): evolve Sofia Engine to 3.0.0a1 scientific runtime by rootcastleco · Pull Request #2 · rootcastleco/sofia-ai

rootcastleco · 2026-09-22T00:07:58Z

Implement formal runtime contracts, quality levels (DEGRADED, SATURATED), and schema v3.0
Add golden vectors for DSP correctness (Parseval conservation, exact amplitude recovery)
Add DiagnosticEvidence, evidence chains, and uncertainty bands in HealthScore
Harden Sofia Assembly VM with bounds checks, opcode decoding, and cycle budgets
Implement analytical backpropagation, numerical gradient checks, and safe model manifest
Verify C99 microcontroller conformance (zero-allocation, fixed-point Q16.16)
Align TypeScript SDK and ensure cross-language conformance
Redesign provider adapters with explicit capabilities and honest dry-run execution
Harden security with strict DENY posture, replay guard, and secret redaction
Add automated performance benchmarks with real hardware timing baselines
Complete full specifications, verification matrix, and documentation synchronization

- Implement formal runtime contracts, quality levels (DEGRADED, SATURATED), and schema v3.0 - Add golden vectors for DSP correctness (Parseval conservation, exact amplitude recovery) - Add DiagnosticEvidence, evidence chains, and uncertainty bands in HealthScore - Harden Sofia Assembly VM with bounds checks, opcode decoding, and cycle budgets - Implement analytical backpropagation, numerical gradient checks, and safe model manifest - Verify C99 microcontroller conformance (zero-allocation, fixed-point Q16.16) - Align TypeScript SDK and ensure cross-language conformance - Redesign provider adapters with explicit capabilities and honest dry-run execution - Harden security with strict DENY posture, replay guard, and secret redaction - Add automated performance benchmarks with real hardware timing baselines - Complete full specifications, verification matrix, and documentation synchronization

Copilot

Copilot review overview

🟡 Changes recommended

Critical and moderate review findings remain unresolved across package loading, VM handling, HTTPS enforcement, manifests, and verification evidence.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 9 · 21 · 3

Open (33)

ESM build is incorrectly advertised for require · New
JMP permits targets beyond program bounds · New
Memory limit uses removable assert · New
Valid NOP and GRAD_SIGMOID opcodes are rejected · New
HTTP URLs can transmit bearer credentials · New
Fine-tune creation permits insecure HTTP · New
Cancellation permits insecure HTTP credentials · New
Status polling permits insecure HTTP credentials · New
Model name enables path traversal · New
Benchmark budgets are unmet but not explicitly reported · New
Unused imports fail Ruff lint · New
InferenceRequest mismatches Python contract · New
VM silently ignores memory and register faults · New
Enum uses OUT_OF_RANGE instead of OUT_OF_BOUNDS · New
DSP verification matrix claims untested requirements · New
Embedded results are marked verified without C execution · New
SignalFrame samples remain mutable · New
Invalid uncertainty length is silently discarded · New
Request IDs are nondeterministic · New
New quality states are absent from quality ordering · New

And 13 more that still need to be addressed.

What changed in this PR

This pull request evolves Sofia Engine to the 3.0.0a1 scientific runtime with new contracts, diagnostics, VM/ML hardening, security controls, and cross-language verification.

Changes:

Adds v3 contracts, quality states, evidence, uncertainty, and DSP vectors.
Hardens VM execution, neural training, manifests, providers, and embedded support.
Updates SDKs, benchmarks, specifications, documentation, and package metadata.

File	Description
`tests/unit/test_security_v3.py`	Security and policy tests
`tests/unit/test_quantum_emulator.py`	Quantum emulator import cleanup
`tests/unit/test_quality.py`	Quality-state coverage
`tests/unit/test_neural_gradients.py`	Neural gradient and convergence tests
`tests/unit/test_model_manifest.py`	Model manifest integrity tests
`tests/unit/test_finetune.py`	Fine-tuning behavior tests
`tests/unit/test_finetune_v3.py`	Provider capability tests
`tests/unit/test_embedded_conformance.py`	Embedded conformance tests
`tests/unit/test_electrical.py`	Electrical test cleanup
`tests/unit/test_dsp_golden.py`	DSP golden-vector tests
`tests/unit/test_diagnostics.py`	Diagnostics contract coverage
`tests/unit/test_diagnostics_v3.py`	Evidence and uncertainty tests
`tests/unit/test_contracts.py`	Contract version coverage
`tests/unit/test_contracts_v3.py`	v3 runtime contract tests
`tests/unit/test_config.py`	Configuration metadata tests
`tests/unit/test_cli.py`	CLI version tests
`tests/unit/test_asm_vm_hardening.py`	VM fault and hardening tests
`tests/golden/dsp_golden.json`	DSP golden fixtures
`tests/architecture/test_boundaries.py`	Architecture boundary checks
`src/sofia_ai/signal/acoustic.py`	Acoustic feature cleanup
`src/sofia_ai/quantum/emulator.py`	Quantum emulator import cleanup
`src/sofia_ai/learning/manifest.py`	Model serialization and checksums
`src/sofia_ai/learning/finetune/engine.py`	Fine-tuning providers and dry-run behavior
`src/sofia_ai/learning/finetune/__init__.py`	Provider capability exports
`src/sofia_ai/learning/asm/vm.py`	VM status, bounds, and fault handling
`src/sofia_ai/learning/asm/neural.py`	Analytical neural backpropagation
`src/sofia_ai/features/multidomain.py`	Feature-vector representation
`src/sofia_ai/diagnostics/evidence.py`	Diagnostic evidence alias
`src/sofia_ai/core/quality.py`	Quality states and confidence factors
`src/sofia_ai/core/errors.py`	Unsupported-feature error
`src/sofia_ai/core/contracts.py`	v3 runtime primitives
`src/sofia_ai/copilot/providers.py`	Provider logging and metadata
`src/sofia_ai/copilot/__init__.py`	Provider exports
`src/sofia_ai/__init__.py`	Package version
`specs/sofia-runtime-v3/verification-matrix.md`	Verification tracking
`specs/sofia-runtime-v3/threat-model.md`	Threat model
`specs/sofia-runtime-v3/tasks.md`	Implementation task tracker
`specs/sofia-runtime-v3/specification.md`	Runtime specification
`specs/sofia-runtime-v3/performance-budgets.md`	Performance requirements
`specs/sofia-runtime-v3/constitution.md`	Engineering principles
`specs/sofia-runtime-v3/compatibility.md`	Migration policy
`specs/sofia-runtime-v3/architecture.md`	Runtime architecture
`SECURITY.md`	Security support policy
`README.md`	Repository links
`pyproject.toml`	Version, URLs, and lint configuration
`packages/sofia-engine/src/learning/asm.ts`	TypeScript VM results
`packages/sofia-engine/src/dsp/statistics.ts`	Zero-crossing statistics
`packages/sofia-engine/src/contracts.ts`	TypeScript v3 contracts
`packages/sofia-engine/src/conformance.test.ts`	SDK conformance tests
`packages/sofia-engine/README.md`	SDK documentation links
`packages/sofia-engine/package.json`	Package metadata and module configuration
`packages/sofia-engine/package-lock.json`	Node dependency lockfile
`packages/sofia-engine/NOTICE`	SDK notice
`NOTICE`	Repository notice
`mkdocs.yml`	Documentation site links
`embedded/tests/test_sofia_features.c`	C golden-vector tests
`benchmarks/run_benchmarks.py`	Benchmark runner
`benchmarks/results/baseline_benchmark.json`	Benchmark baseline
`.gitignore`	Node artifact exclusions

Files not reviewed (1)

packages/sofia-engine/package-lock.json: Generated file

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+  "type": "module",
  "exports": {
    ".": {
      "types": "./dist/index.d.ts",
-      "import": "./dist/index.mjs",
+      "import": "./dist/index.js",


+      case OpCode.JMP: {
+        this.pc = Math.floor(imm);
+        return;
+      }


+        self.ADDR_GRAD_B2 = self.ADDR_GRAD_W2 + (output_dim * hidden_dim)
+
+        self.TOTAL_MEMORY_USED = self.ADDR_GRAD_B2 + output_dim
+        assert self.vm.memory_size >= self.TOTAL_MEMORY_USED, "Model exceeds VM memory ceiling"


            else:
-                pc += 1
+                return self._fault(VMStatus.INVALID_OPCODE, pc, f"Unknown opcode: {op}", inst, cycles)


+        if not (url.startswith("https://") or url.startswith("http://")):
+            raise ValueError(f"Insecure or invalid URL scheme: {url}")


+    with np.load(weights_path, allow_pickle=False) as npz:
+        weights = {key: npz[key] for key in npz.files}
+
+    model = AssemblyNeuralNetwork(
+        input_dim=manifest.input_dimension,


+def test_no_prohibited_modules_in_core() -> None:
+    """Ensure that importing core packages does not pull prohibited modules into sys.modules."""
+    # First verify that no prohibited modules are loaded by core imports
+    for prohibited in PROHIBITED_CORE_MODULES:
+        loaded = [m for m in sys.modules if m == prohibited or m.startswith(f"{prohibited}.")]
+        assert not loaded, f"Prohibited module {prohibited!r} was imported by core: {loaded}"


+    weights_path = tmp_path / "tamper_test.weights.npz"
+    # Tamper with the weight file bytes
+    data = bytearray(weights_path.read_bytes())
+    data[-1] ^= 0xFF # Flip last byte


+        input_dim=input_dim,
+        hidden_dim=hidden_dim,
+        output_dim=output_dim,
+        learning_rate=0.0, # Zero learning rate so weights don't change during check


+
+    # Target function: y = 2.0 * x0 - 1.5 * x1
+    x = np.array([0.8, -0.4])
+    y = np.array([2.0 * 0.8 - 1.5 * (-0.4)]) # 1.6 + 0.6 = 2.2


Copilot AI lite review requested due to automatic review settings September 22, 2026 00:07

rootcastleco merged commit f4777e8 into main Sep 22, 2026
1 check failed

Copilot started reviewing on behalf of rootcastleco September 22, 2026 00:08 View session

rootcastleco deleted the feature/sofia-runtime-v3 branch September 22, 2026 00:15

Copilot AI reviewed Sep 22, 2026

View reviewed changes

Navigation Menu

feat(runtime): evolve Sofia Engine to 3.0.0a1 scientific runtime - #2

feat(runtime): evolve Sofia Engine to 3.0.0a1 scientific runtime#2
rootcastleco merged 1 commit into
mainfrom
feature/sofia-runtime-v3

rootcastleco commented Sep 22, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		if not (url.startswith("https://") or url.startswith("http://")):
		raise ValueError(f"Insecure or invalid URL scheme: {url}")

Conversation

rootcastleco commented Sep 22, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants