FrankenSuite research program · A shareable brief

FrankenNetworkX Rewriting Python's Favorite Graph Library in Rust

A shareable brief from the FrankenSuite research program. Every claim below traces to the assessed repository; sources are linked at the end. Assessment pinned September 22, 2026.

Assessment pinned September 22, 2026 (the assessed commit)·~1,445 words·5 sections·Every claim traceable to a source
Six definitions. NODUS is the program’s four-ring verdict scale (Invest, Pilot, Explore, Monitor) assigned per assessment packet. TRL is technology readiness level, scored 1 to 9 per packet. CI is continuous integration: the project’s automated test runs. The pin is the exact commit the assessment froze on; every claim is evaluated at the pin, not at HEAD. The rider is the license clause withholding all rights, including benchmarking and analysis, from OpenAI, Anthropic, their affiliates, and anyone acting for them. Bus factor is how many people can leave before the project stalls; it is 1 for every repo here.

01 · What it is

What NetworkX is, and why it matters

NetworkX is the standard Python library for working with graphs: networks of nodes connected by edges. That sounds abstract until you realize how much of the world is a graph: social networks, road and flight networks, supply chains, dependency trees, recommendation systems. NetworkX is how a generation of data scientists learned to ask "what's the shortest path between these two?" and get an answer in four lines of Python.

It matters for three reasons. First, ubiquity: it's the library everyone reaches for first, and a huge body of existing code is written against its API. Second, pedagogical gravity: tutorials, textbooks, and Stack Overflow answers all speak NetworkX. Third, and this is the opening: it's pure Python. Python is wonderful for expressing algorithms and poor at executing them: per-object bookkeeping, Python-level inner loops, and dictionary lookups per edge mean analytics over hundred-thousand-to-million-node graphs turn into multi-minute affairs. The maintainer's README puts it plainly: NetworkX is "rich, correct, comprehensive, and slow on anything that isn't toy-sized."

That speed gap is real and universally complained about. But every existing faster alternative asks you to pay in compatibility: a different API, different tie-breaking when two answers are equally good, lost attribute fidelity, dropped algorithm families. This project's promise: the speed of a Rust rewrite, without making anyone rewrite their NetworkX code.

02 · Why build it

Why rewrite it in Rust?

The maintainer's stated bet is that observable behavior is a hard contract. It's not enough to compute the right answer; you have to compute it in the right order, with the right tie-break choices, the right exception classes, even the right error wording. Downstream code depends on all of it, and silent behavioral drift is the failure mode that kills library replacements. So the project ports the algorithms to Rust but measures every public path against a vendored copy of NetworkX 3.6.1, demanding identical observable behavior.

The distribution strategy is the clever part. It ships two ways: a standalone Python package (franken_networkx, built with PyO3, installable from PyPI; 0.2.1 is live, verified) and a NetworkX backend-protocol plugin. NetworkX's own backend-dispatch protocol lets you write nx.shortest_path(G, 0, 7, backend="franken_networkx") and have the call dispatch into Rust with zero changes at the call site. source 313 algorithms are registered. The user never rewrites; the call just goes faster.

The engineering case: Rust gives memory safety without a garbage collector, deterministic data structures instead of hash-ordered dicts, and real parallelism: 744 sites where the binding layer releases Python's global interpreter lock on heavy paths. The auditability mechanism is CGSE, a "canonical graph semantics engine" that pins tie-breaking to a 13-variant policy enum and attaches a Blake3 decision-path receipt to every algorithm execution, recording which tie-breaks were taken. Machine-checkable provenance on correctness choices. Nothing else in this lane does it.

The counter-argument: NetworkX has an official answer: nx-parallel, which parallelizes selected algorithms within the NetworkX API with the project's imprimatur and zero behavioral risk. It contests the exact same pitch ("my NetworkX code, faster, no rewrite") without asking anyone to trust a third-party parity claim, and its coverage grows with every NetworkX release while FrankenNetworkX's parity target stays pinned at 3.6.1. The counter-pitch is breadth (313 algorithms vs a selected set) and the determinism story nobody else tells. A defensible bet, not a proven one.

03 · What was built

What the project actually built

The scale: a 12-crate Cargo workspace, ~278,000 lines of Rust, the four NetworkX graph classes re-derived with deterministic insertion-ordered adjacency, 25+ algorithm families, a 1,092-file Python parity suite, 2,046 Rust tests, 34 fuzz targets, and a conformance harness comparing against a vendored NetworkX oracle in-tree. Unsafe census: exactly two unsafe blocks in the whole workspace, both CPython garbage-collector pointer management at the FFI boundary. The unsafe surface of a quarter-million-line project fits in one paragraph.

More important is the evidence machinery: an unusually honest self-scrutiny culture:

  • Machine-checked surface coverage: an auto-generated matrix reporting 4,129 of 4,129 applicable API paths "strictly present" against fingerprinted NetworkX 3.6.1: 100.0%, verified by independent recount. (The project's own caveat: "present" means import/signature parity, not behavioral conformance.)
  • A 37,116-line ledger of its own losses, with an enforced verdict contract: self-speedups (a change that makes the code faster relative to its own past) "must not use a WIN heading or support a competitive claim." Internal improvement is maintenance, not victory.
  • A self-authored claim-coverage audit (July 2026) grading the project's own performance ledger: of 591 performance claims, only 12 carried a ratio measured against NetworkX live in the same invocation. 2.0% attested. It exists in the tree, reproducible with one script.
  • A design doc that refutes its own headline. A campaign measured a "77,795× zero-copy" speedup; the doc then writes that "it is not a cross-language zero-copy result. The bytes never crossed the PyO3 boundary. The magnitude does not transfer," and ships a cost model so sibling projects don't inherit the false premise.

The Gauntlet head-to-head (July 2026) is the verified core of the performance story: vs unpatched NetworkX 3.6.1 with same-invocation null controls and binary-hash pinning: clustering 36.1×, triangles 14.3×, dijkstra 7.6×, pagerank 2.6×. Strong methodology. Also two months stale and maintainer-run.

The uncomfortable findings

Uncomfortable finding

The 2.0% audit means 98% of the performance story is self-measured, and the README's "5×–250×" framing leans on the unattested base, which the project's own contract says can't support a competitive claim. The README drifts on every hand-typed number the auto-generated ledgers already know correctly — a governance liability in a project whose pitch is auditability. 181 functions openly delegate to NetworkX, and 24 more are wrapper-patched because the raw Rust kernel disagrees with the incumbent. The drop-in surface is substantially NetworkX running under the hood. The fine-grained mutation paths that define interactive NetworkX use are slower than the incumbent (node removal at 0.0037× on a 25k-node graph; the README says below ~100 nodes, marshaling cost exceeds algorithm cost). source SECURITY.md supports version "1.x" while the project ships 0.2.2. Read literally, no released version gets security updates. PyPI serves 0.2.1 while GitHub released 0.2.2, and no tag points at the assessed commit, so nothing ships the assessed tree. And the license is MIT plus a rider barring OpenAI, Anthropic, their affiliates, and anyone acting for them from even benchmarking or analyzing the code. The project whose moat is evidence forbids evidence-gathering by the best-equipped evaluators.

04 · Where it stands

Where it stands

In our program's terms: TRL 6, NODUS ring Explore. In plain English: a working, shipped prototype: signed releases, PyPI wheels, differential conformance against a vendored oracle, a backend plugin executing live NetworkX workloads. It clears a higher bar than most of the suite. But: no independent validation, no known production users, mostly self-measured benchmarks, one maintainer, and a license rider that is an advancement blocker.

Technology readiness

TRL 6 on a 1-to-9 scale.

NODUS ring

MonitorExplorePilotInvest

The program’s adoption ring for this project.

Verdict key

NODUS ring
Explore: The default for substantive-but-unproven work.
TRL
Technology Readiness Level, a 1-to-9 scale of how proven a technology is. This brief rates the project at TRL 6.
CI
Continuous integration: the project’s automated checks, run on every change.
The pin
The exact commit the assessment was pinned to. “At the pin” means as of that commit.

Evidence tiers

  1. Tier 1 · Verified — Confirmed by direct inspection of a fresh clone, an API response, or a live page read by the analyst.
  2. Tier 2 · CI-observed — Observed executing on live CI pages. Attests the suite runs, not that it is green, unless pass/fail is legible.
  3. Tier 3 · Maintainer claim — Asserted in README or docs by the maintainer; not independently executed or reproduced.
  4. Tier 4 · External — Independent sources: APIs, papers, press, third-party benchmarks. Absence of coverage is reported as a finding.
  5. Tier 5 · Inference — The analyst’s judgment. Always labeled; never presented as fact.

What this verdict rests on. Tier labels are the assessment packet’s own annotations.

  • Tier 1 · Verified: Counts from the clone; the vendored NetworkX oracle inventoried.
  • Tier: unassessed in packet: CI greenness at the pin: the last CI run predates the pin by 13 days, so pin greenness is unestablished.
  • Tier 3 · Maintainer claim: Nothing was compiled or executed; the KEEP audit is 2026-07-31.
  • Tier 4 · External: No independent validation, no known production users; PyPI stats unobtainable.
  • Tier 5 · Inference: The Explore ring at TRL 6.

Should you use it?

Not yet.

Compute-heavy families (clustering, shortest paths on large graphs) show strong Gauntlet numbers; fine-grained interactive mutation is measurably slower; and either way you'd depend on one person whose license excludes the AI supply chain. source

Should you learn from it?

Emphatically yes.

The methodology is worth importing regardless of the software's fate: claim-coverage audits, the raw-vs-public audit (which found 24 functions where only the Python wrapper restores parity), the negative-evidence taxonomy, tie-break pinning. The machine is the product; the library is the demo.

What would change the verdict, in order

  1. an independent benchmark reproducing any Gauntlet row
  2. the incumbent-attested claim fraction rising meaningfully above 2%
  3. a second maintainer with merge rights
  4. PyPI serving the current release
  5. the rider narrowed or removed.

Until then, nx-parallel wins on trust and rustworkx wins on maturity. FrankenNetworkX wins on auditability alone, which no buyer is currently paying for.

05 · What it teaches

What this teaches about building with agents

The transferable lesson is the claim-coverage audit — a portable self-audit practice worth stealing.

Here's the trap it catches: you have a ledger of 591 performance claims. They all have numbers, they're all written down, they all feel rigorous. And 98% were never measured against the incumbent. The project was getting faster relative to its own past, dressed up as competitive evidence. Nobody would have noticed without the audit, because the ledger existed and looked complete. The audit's rule is the export: classify every claim by its comparison class, and forbid self-comparisons from supporting competitive claims. A benchmark that can't name its baseline is marketing; a ledger that distinguishes incumbent-class from self-speedup is evidence.

The deeper point: the project with the strictest self-scrutiny rules is the one that failed its own audit most visibly. That's not hypocrisy — it's the machinery working. The 2.0% number only exists because the project built the audit. Every other project also has unattested claims; they just never counted them. The lesson for anyone building with agents: don't grade your evidence by how many numbers you have. Grade it by what fraction were measured against the thing you're actually claiming to beat.

Evidence

This page cites selected evidence. The full claim-by-claim audit is in the assessment packet.

Open a panel to see what each source evidences. Full claim-by-claim audit.

Full claim-by-claim audit with evidence tiers lives in the program's assessment packet.

The repositorygithub.com/Dicklesworthstone/franken_networkx

the repository (github.com/Dicklesworthstone/franken_networkx) at the assessed commit 841a711

READMEREADME
LICENSELICENSE
CHANGELOGCHANGELOG
coverage.mdcoverage.md
upstream_divergence_ledger.mdupstream_divergence_ledger.md
delegation_ledger.mddelegation_ledger.md
NEGATIVE_EVIDENCE.mdNEGATIVE_EVIDENCE.md
CLAIM_COVERAGE_AUDIT.mdCLAIM_COVERAGE_AUDIT.md
GAUNTLET_RELEASE_SCORECARD.mdGAUNTLET_RELEASE_SCORECARD.md
ZERO_COPY_VIEW_PRIMITIVE.mdZERO_COPY_VIEW_PRIMITIVE.md
franken-networkx

PyPI project page for franken-networkx (0.2.1, 6 wheels — verified September 2026).