---
version: 0.2.0
date: 2026-06-17
headline: "A real model fused into the kernel (proven-correct, now parity-fast), a kernel-authored security substrate (IFC/provenance/plan-CFI/witness), and a non-Go gateway."
themes: ["model-fusion", "security-substrate", "gateway", "context-syscalls"]
highlights:
  - "Pure-Go SmolLM2-135M forward pass fused INTO the kernel, witnessed bit-for-bit vs HuggingFace."
  - "Parity lane: parallel matmul + batched prefill GEMM — fak now decodes faster than same-precision HF f32."
  - "Information-flow control: source-stamped taint, sink-gated tainted->sink flows, kernel-authored trust."
  - "plan-CFI adjudicator + in-process witness (dos_verify) backing a require-witness gate."
  - "`fak serve` — OpenAI-compatible HTTP + MCP wire so any-language agents route through the kernel."
---

**TL;DR** — v0.2.0 turns the v0.1 "in-process tool-call syscall" skeleton into a kernel with three new organs: a **real model fused into it** (a pure-Go forward pass proven correct against HuggingFace and now made parity-fast without touching the proven numerics), a **kernel-authored security substrate** (information-flow control, a trust/provenance classifier, plan-CFI, and an effect-verifying witness gate — the kernel stops believing the model's self-reports), and a **gateway** (`fak serve`) that fronts the syscall boundary over OpenAI-compatible HTTP + MCP so a non-Go agent gets the same adjudication. 29 commits since v0.1.0.

## Model fusion — a real model, proven-correct then parity-fast

- **A real LLM runs INSIDE the kernel.** Pure-Go SmolLM2-135M forward pass + kernel-owned KV cache, every rung oracle-witnessed bit-for-bit against HuggingFace.
  - *Why:* the kernel can only adjudicate context it actually owns; fusing the model makes the KV cache and forward pass first-class kernel state.
  - *How:* `fak/internal/model` (`forward.go`, `kv.go`); R14 real KV-prefix reuse, bit-identical to recompute.
- **Parity lane — the naive core made fast, still bit-identical.** Parallel matmul across output rows, batched prefill GEMM, and an 8-accumulator inner product (`fdot`).
  - *Why:* v0.1's core was explicitly "correct, not fast" (single-thread, GEMV-per-token). This closes the measured tax.
  - *How:* `parallel.go`, `prefill_batch.go`; `TestParallelMatchesSerial` / `TestPrefillBatchedMatchesSerial` pin every output to the serial reference bit-for-bit (`math.Float32bits` equality). fak now decodes faster than same-precision HF f32 and cuts the prefill gap ~16×. Numbers in `MODEL-BASELINE-RESULTS.md`, recomputed from raw JSON, survived a 4-skeptic adversarial pass.

## Security substrate — the kernel stops believing the model

- **Information-flow control.** `Ref.Taint` is source-stamped and tainted→sink flows are sink-gated at adjudication time.
  - *How:* `fak/internal/ifc`; the canonicalization leaf (`internal/canon`) de-obfuscates once and is reused on the recall re-screen.
- **Kernel-authored trust / provenance.** A trust classifier takes authorship of trust away from the model, with a hardened sink classifier (3 red-team fixes).
  - *How:* `fak/internal/provenance`.
- **plan-CFI + harvest.** A plan control-flow-integrity adjudicator with a `RequireApproval` verdict and `LabelRow` harvest.
  - *How:* `fak/internal/plancfi`.
- **Effect-verifying witness gate.** An in-process `dos_verify` effect-verify backs a `require-witness` gate — a claim must be corroborated, not just asserted.
  - *How:* `fak/internal/witness`; the gate fails closed when unwitnessed.
- **Dynamic attack battery.** A dynamic ASR-gated AgentDojo attack battery replaces the static poison fixture.
  - *How:* `fak/internal/agentdojo`.

## Gateway — kernel adjudication for any-language agents

- **`fak serve`.** An OpenAI-compatible HTTP surface (`/v1/chat/completions` adjudication proxy, `/v1/fak/{syscall,adjudicate}`, `/v1/models`, `/healthz`) plus MCP over stdio/HTTP, so an agent in any language routes its tool calls through the in-process syscall boundary without writing Go.
  - *Why:* in-direction (the typed Go core does the deciding); only the non-Go client lives in the adopter's repo.
  - *How:* `fak/internal/gateway`; a wire client never supplies an `abi.Ref` — the gateway mints a tainted, agent-scoped Ref from raw bytes, so the IFC/secret/self-modify rungs stay armed. Optional bearer auth; fails loud if the ABI isn't wired.

## Context syscalls + deployment

- **Context/security syscalls.** canon, normgate, recall, cdb, kvmmu — the context-MMU admission path that pages poisoned results out before the agent sees them.
- **Capability-floor manifest.** A deployable manifest where every deny cites a closed-vocabulary reason; the CLI entrypoint is now tracked.
- **ABI freeze + CI.** Apache-2.0 LICENSE, a Linux CI workflow, and the WSL test-runner infra (`fak/test.sh`) that makes the suite reproducible off this host's Application-Control policy.

## Operational tooling

- **Fleet session-triage + watchdogs.** `tools/fleet_sessions.py`, `peek_session.py`, `stopped_sessions.py` plus scheduled-task watchdogs keep the headless worker fleet alive and triageable; their machine-local runtime state is gitignored.
