Synthetic request comparisons
Including 64 seeded generated histories. No user history or credentials.
Finite reference kernel · Lean 4 · MIT
A trace
worth trusting.
Make the connection between a tool call, its policy decision, and the next request explicit.
CORDIS Lean carries evidence through a finite, modeled harness. Its types connect exact requests, results, and session endpoints. The boundary of each claim stays visible.
Explore a synthetic traceTHE REFERENCE BOUNDARY01 / 03
01
Exact-subject policy
Same call. Same decision. Same result.
02
Certified session replay
Physical log → model-facing surface.
03
Typed request encoding
A body tied to its typed source.
Proof-carrying local values. Explicit runtime obligations.
01 / Interactive notebook
From events to a request
Step through an invented log. Watch the visible messages change, then inspect an illustrative request body.
Teaching model, not a proof checker. This original JavaScript illustration does not run Lean, replay upstream logs, call a provider, or execute a tool. The replay and serializer examples are separate illustrations, not a claimed end-to-end equivalence theorem.
Physical log
Log-only events never add a model-facing message.
Model-facing surface
Replacement changes the surface while retaining the physical log.
Illustrated compatibility adapter
Serialized request
Model notes: SessionValidation.lean checks typed events after payload parsing. DeepSeekHarnessCompatibility.lean defines the separate serializer adapter.
02 / Before dispatch
The subject stays the same
A modeled policy decision and a matching lease are both required. A rejected call cannot take the dispatch transition.
01
Propose
Keep the exact subject and call identifier.
02
Decide
An allow state may proceed; a non-allow state may terminate as rejected.
03
Dispatch
Consume the lease belonging to that same call.
04
Settle
Retain a result indexed by the original subject.
At-most-once is local. The result applies to one explicitly threaded pure trace. Lean values can be duplicated. This does not establish authenticated approval, cross-process exclusion, or exactly-once external effects. Read the policy boundary
03 / Pinned integration evidence
Compare the entire request
The public integration loop calls the actual pinned DeepSeek Harness TypeScript serializer and compares complete JSON values against the Lean adapter.
Deliberate drift controls
Missing usage, Boolean-to-number drift, reversed messages, schema corruption, a missing case, and a duplicate ID.
Unsupported-setting cases
Response format, tool choice, conflicting thinking/effort, and each explicit strict flag value.
What equality means here
Object member order is irrelevant. Array order, absent versus null fields, strings, and Boolean versus numeric values remain observable. Differences are not normalized away.
What these tests establish
Finite executable compatibility evidence at one upstream revision. They do not prove TypeScript semantics, provider behavior, upstream session reconstruction, asynchronous scheduling, or deployed equivalence.
04 / Trust, explicitly scoped
Evidence has an edge
Proofs are only as broad as the modeled values, assumptions, and interfaces they describe.
INSIDE THE MODELED DOMAIN
Finite, local certificates
- Exact-subject policy states and matching lease consumption
- Typed session-event validation, provenance, and surface transitions
- Relationships between typed request sources and encoded bodies
- Explicit successful, rejected, and unsupported outcomes
OUTSIDE THESE CLAIMS
The external runtime
- Live provider behavior, identity, and credential validity
- Authenticated human approval and trusted real-world tools
- Global exactly-once effects across duplicated runners
- Filesystem durability, fsync, crash atomicity, and stable media
Local process or loopback fixtures elsewhere in the repository are evidence about those fixtures. They do not remove the runtime boundary. Read the repository's trust notes