# asupersync — RULEBOOK v1.0 Assessment Packet v6

**Repository:** `Dicklesworthstone/asupersync` · **Language:** Rust (edition 2024, pinned nightly toolchain) [Code-verified, High] · **Pinned commit:** `768595203e194573bb713158b5963f55861dfe2d` (2026-09-22 11:31:19 -0400 / 15:31:19 UTC — "test(remote): verify native client V3 attempt timeout fails closed without replay" [Git-observed, High]) · **Last push:** 2026-09-22T15:31:27Z — the pin is the latest push, i.e. HEAD at assessment time [External + Git-observed, High] · **Scope:** the pinned commit only. Repo created 2026-01-16 [External, High].

**Method (analyst):** fresh shallow clone (`--depth 1`) of HEAD at the pin to `~/workspace/_scratch/asupersync-fresh-verify` (19,241 files [Git-observed, High], verified non-empty). Read: root `Cargo.toml` (workspace members, 66 root `[dependencies]` entries including first-party path deps, publish includes/excludes, license SPDX, optional tokio/rdkafka features), `rust-toolchain.toml` (pinned `nightly-2026-08-31` with rustfmt+clippy components [Code-verified, High]), `src/lib.rs` header (unsafe gate), README.md (all 2,626 lines [Counted, High] — TL;DR guarantees table, tokio mapping, scheduler/reactor sections, benchmark-gate table, honest-status/current-state table, contributing policy, license badge), LICENSE (verbatim, 73 lines), CHANGELOG.md head (version timeline), `src/runtime/scheduler/three_lane.rs` header (fairness contract), `docs/benchmarking.md` head, `artifacts/baseline.json` (schema + row count + notes), `SYNC_CONFORMANCE_REPORT.md` head. Counted: `.rs` files/lines by tree area and subsystem (`src/`, `tests/`, `benches/`, `conformance/`, workspace members), in-`src` test files, `#[allow(unsafe_code)]` files, `pub mod`/`pub use` lines in `src/lib.rs`. GitHub REST API: repo metadata, releases (20), workflows (11), workflow runs (latest + `head_sha=<pin>` filter + per-job conclusions for the two latest failed runs). crates.io API (User-Agent header required; bare requests 403): `asupersync` + `franken-kernel` metadata and the full reverse-dependency list (78 crate versions returned). GitHub REST API observed 2026-09-22: 278 stars, 28 forks, created 2026-01-16 [External, High]. FrankenSuite dependency map: verified frankensqlite (`Cargo.toml`/`Cargo.lock`) and franken_networkx (`crates/fnx-runtime/Cargo.toml`, `Cargo.lock`) and frankensearch (root `Cargo.toml`) manifests directly in sibling verify-clones; sibling-packet findings cited as [External, Medium] for the rest. Web-searched for independent coverage (glommio/monoio facts verified via docs.rs). **Not done:** nothing was compiled (no Rust toolchain in this environment — compile state could not be re-verified), no test suite or bench was executed, no benchmark was reproduced, the `methodology_baselines` gate was read, not run; unsafe-island audit covered sampled files only (47 `allow` files counted, not all reviewed); commit velocity and authorship were not analyzed (shallow clone); the ATP/QUIC/HTTP-3/database-client subsystems were inventoried, not exercised; the WASM demo page was not loaded in a browser. Assessment date: 2026-09-22.

**Tier legend (Rulebook §1):** **[Verified]** direct inspection of the pinned clone or a live page read by the analyst — flavors **[Counted]** (I ran the count), **[Git-observed]** (git metadata), **[Code-verified]** (source read); **[CI-observed]** is Tier 2 (seen executing on live CI pages — attests the suite *runs*, not that it is green); **[Maintainer claim]** asserted in README/docs, not independently executed; **[External]** independent sources (APIs, sibling-packet findings, docs.rs); **[Inference]** analyst judgment, always labeled. Confidence: **High** / **Medium** / **Low**.

**Cold-reader note on this repo's role:** asupersync is not a "franken"-named rewrite; it is the async runtime substrate the FrankenSuite constellation builds on. §4.6 and the claim inventory map the dependency/rejection relationships manifest-by-manifest. "DSR" below is the maintainer's private release/build orchestration — the name is never expanded in-repo.

---

## Hook

asupersync is the FrankenSuite's load-bearing foundation — a spec-first, cancel-correct async runtime with 318,241 crates.io downloads and 78 reverse-dep crate versions (hereafter "reverse deps") [External, High], a 2,626-line README [Counted, High] that is unusually honest about what it *cannot* prove, and a benchmark-gate culture with an explicit no-skip-CI waiver [Maintainer claim, High]. The key negative finding: the ecosystem's own tagline for it ("zero-copy DMA and RDMA support," "work-conserving packet-aware scheduler," "epoll/uring/netlink") does not survive contact with the tree — RDMA appears nowhere in 3,864,420 lines of Rust, netlink nowhere in `src/`, `docs/`, or the README, "packet-aware" never in the maintainer's words [Verified absence, High]. The packet's verdict is **Pilot**: the only FrankenSuite project with registry-scale distribution, real downstream workloads, and signed release artifacts — held out of Invest by single-maintainer governance, a non-OSI rider that bars the AI labs from even benchmarking it, and CI that has never once run against the assessed commit.

## TL;DR

- **What it is:** A from-scratch async runtime for Rust (not a tokio fork): region-owned tasks that close to quiescence, an explicit request → drain → finalize cancellation protocol, capability-gated effects (`Cx`), a three-lane (cancel > timed > ready) work-stealing scheduler, epoll with optional io_uring on Linux, and a deterministic lab runtime for replayable testing. Plus an entire ecosystem in-tree: TCP, HTTP/1.1, HTTP/2, partial HTTP/3, TLS, WebSocket, QUIC-native transport, SQLite/PostgreSQL/MySQL clients, Kafka, actor supervision, a tokio-compat bridge crate, and a WASM browser edition.
- **Strongest evidence:** crates.io `asupersync` 0.5.0: 318,241 total downloads, 166,388 in the trailing 90 days, 78 reverse-dep crate versions returned by the endpoint [External, High — the strongest third-party distribution signal in the FrankenSuite]; 20 GitHub releases (v0.5.0, 2026-09-12, 11 assets incl. signed multi-platform builds published via the maintainer's DSR pipeline) [External, High on releases; Maintainer claim, High on DSR]; 3,864,420 lines of Rust across 4,709 files [Counted, High] with a `deny(unsafe_code)` root and 47 named `allow` islands [Code-verified, High]; sibling projects genuinely depend on it — frankensqlite runs storage I/O on 0.5.0 with `Cx` in its public APIs, frankensearch mandates it and forbids tokio ("Async runtime (structured concurrency, NO tokio)" — root Cargo.toml comment) [Code-verified in manifests, High].
- **Strongest doubts:** zero workflow runs exist at the pinned commit and the most recent runs (2026-09-07, older commits) show failures — the tokio-parity gate failed at its drift-detection step, the Benchmarks workflow had 1 of 4 jobs fail [CI-observed, High] — so every behavioral claim about the assessed tree rests on maintainer-run DSR gates, unobservable externally; bus factor 1 with outside contributions explicitly refused (README L2620) [Maintainer claim, High]; the license rider names OpenAI and Anthropic and withholds even *benchmarking/analyzing* rights from them [Code-verified (license text), High]; the scope is sprawling (a runtime that also ships DB clients, Kafka, QUIC, HTTP/3) — each sub-lane thinner than its standalone competitor [Inference, Medium]; and the honest README is itself a drift vector: 2,626 lines of carefully scoped claims that rot fast at this velocity [Inference, Medium].
- **NODUS ring: Pilot** [Inference, Medium] (TRL 6 — see §4.9). Release artifacts plus bounded, real downstream workloads satisfy the Pilot bar; independent (outside-constellation) validation is absent, which rules out Invest. The methodology machinery (claim-discipline, CI-blocking baseline gates, honest-status tables) is the exportable artifact even if the runtime itself is never adopted outside the constellation.

## Quick Links

All fetched 2026-09-22; HTTP status via curl shown. Pin-relative blob links preferred (the Actions web UI 404s to non-browser clients; workflow *files* at the pin return 200):

1. [Repository](https://github.com/Dicklesworthstone/asupersync) — 200
2. [README](https://github.com/Dicklesworthstone/asupersync/blob/768595203e194573bb713158b5963f55861dfe2d/README.md) — 200
3. [License (MIT + OpenAI/Anthropic rider)](https://github.com/Dicklesworthstone/asupersync/blob/768595203e194573bb713158b5963f55861dfe2d/LICENSE) — 200
4. [Changelog](https://github.com/Dicklesworthstone/asupersync/blob/768595203e194573bb713158b5963f55861dfe2d/CHANGELOG.md) — 200
5. Workflow files at pin ([ci.yml](https://github.com/Dicklesworthstone/asupersync/blob/768595203e194573bb713158b5963f55861dfe2d/.github/workflows/ci.yml), [methodology-gates.yml](https://github.com/Dicklesworthstone/asupersync/blob/768595203e194573bb713158b5963f55861dfe2d/.github/workflows/methodology-gates.yml), [tokio_parity_dashboard_drift.yml](https://github.com/Dicklesworthstone/asupersync/blob/768595203e194573bb713158b5963f55861dfe2d/.github/workflows/tokio_parity_dashboard_drift.yml)) — all 200 (12 workflow files in tree; 11 active per API)
6. [Releases](https://github.com/Dicklesworthstone/asupersync/releases) — 200 (20 releases)
7. [docs.rs: asupersync](https://docs.rs/asupersync) — 200 (canonical resolving docs page; crates.io metadata for the 0.5.0 crate — 318,241 downloads, 78 reverse-dep crate versions — observed via the crates.io API, whose web page 404s for non-browser clients)
8. [Live WASM demo](https://dicklesworthstone.github.io/asupersync/asupersync_web_demo.html) — 200

## Did You Know

The project's own tagline in the assessment brief — "zero-copy DMA and RDMA support" — is disproven by the tree. A case-insensitive grep for `rdma` over all 3,864,420 lines of Rust returns hits only inside the word "wildca**rdma**tching" in two test files; `netlink` returns zero hits in `src/`, `docs/`, and the README; "packet-aware" never appears in the maintainer's prose at all [Verified absence, High]. The maintainer's actual reactor claim is narrower and carefully scoped: "Treat Linux `epoll` plus optional `io_uring` as the primary production path, with BSD and Windows reactors available but intentionally narrower today" (README L644) [Maintainer claim, High]. The gap between the ecosystem's marketing shorthand and the maintainer's documented scope is itself a governance signal — and this packet sides with the maintainer's version.

## Franken-worthy next steps

1. **Extract the honesty machinery as a standalone lint.** The README's non-claim boundaries ("The bundle is not a performance benchmark, not a release publish proof…"), the reactor export contract ("Historical files such as `src/runtime/reactor/uring.rs` … are not part of the live export graph"), and the scoped guarantee table are a *genre* of claim-discipline no other runtime publishes. Extract the pattern into a checkable schema (claim text → code artifact → status row, machine-verified in CI) and adopt it as the FrankenSuite's claim-governance standard. *Done when:* one other constellation project runs the check in CI and it catches one stale claim. [Inference, High — process proposal]
2. **Commission the independent benchmark the rider discourages.** The baseline gate (`artifacts/baseline.json`, 105 rows at the pin, CI-blocking, fail above max(5%, ci95 envelope, +0.6ns), no skip-ci waiver) is maintainer-run on maintainer hardware via DSR. Fund a third-party lab to re-run `methodology_baselines` on independent hardware against the published 0.5.0 crate and publish the delta. *Done when:* an independent party's numbers are committed next to the maintainer's, or a discrepancy is published. **Falsification:** if independent numbers diverge beyond the gate's own noise allowance, the gate measures the host, not the runtime. [Inference, High]
3. **Run the e-process oracle machinery against a second system.** The lab runtime's anytime-valid invariant monitoring (e-processes, Ville's inequality, `src/lab/oracle/eprocess.rs`) is the most novel statistical artifact in the tree. Extract `frankenlab` as a standalone crate and apply its deterministic-schedule + oracle pipeline to a *different* concurrent system (e.g., one of the sibling clean-room reimplementations). *Done when:* the machinery finds one real race in a system it wasn't built for, or a published negative result explains why not. [Inference, Medium]
4. **Settle the io_uring question empirically.** The README treats "epoll plus optional io_uring" as the primary production path, but io_uring is feature-gated and the benchmarks attributing the `set_interest`-per-poll cost as "negligible compared to syscall overhead" are maintainer-internal — while glommio and monoio (thread-per-core io_uring runtimes with production users at DataDog and ByteDance-adjacent shops [External, Medium — docs.rs]) own the io_uring performance lane. Publish an epoll-vs-io_uring head-to-head on the checked-in TCP workload with the same A/A-null discipline the baseline gate demands, and let the loser change the README's "primary path" sentence. *Done when:* the head-to-head exists in `benches/` with dated results, whichever way it lands. [Inference, High]
5. **Prove the tokio-compat bridge on a real migration.** `asupersync-tokio-compat` (hyper/tower bridges, blocking, io, cancel, runtime shims) is the adoption wedge for a runtime whose API is deliberately not tokio's. Migrate one non-trivial sibling service surface onto the bridge and publish the behavioral-parity evidence the tokio-parity drift gate is supposed to enforce. *Done when:* a sibling crate's tokio dependency is removed in favor of the bridge with the drift gate green — or the attempt's failure modes are documented. [Inference, Medium]
6. **Reconstruct why frankenredis walked away.** The sibling flagship evaluated asupersync and rejected it as an architectural rewrite (2026-04-21/22) — the single highest-information unknown in this packet. Recover the evaluation: latency, API shape, or control? Re-run the decision with today's 0.6.0 tree and publish the verdict either way. *Done when:* a dated note records the rejection reasons and whether they still hold. **Falsification:** if the reasons were performance-thin, the "not a latency substrate" ceiling hardens; if they were API-thin, the tokio-compat bridge may already address them. [Inference, High]

---

## 4.1 Why it exists — the market problem

**The problem, as the maintainer frames it:** conventional executor APIs leave lifecycle contracts to composition and discipline — cancellation can abandon partial effects, detached tasks outlive their owners, cleanup is best-effort, and schedule-dependent failures are hard to reproduce (README TL;DR) [Maintainer claim, High]. The bet is that making task-ownership and runtime-tracked effect contracts *structural* — regions that close to quiescence, an explicit cancel protocol, capability-gated effects — removes whole classes of async bugs by construction rather than by convention [Maintainer claim, Medium].

**Who feels the pain:** authors of long-lived async services who have debugged leaked tasks, half-cancelled shutdowns, or Heisenbugs that only reproduce under one schedule [Inference, Medium]. The agent-workload angle is concrete: franken_ocr (orchestration/cancellation in 4 files, 22 mentions), frankensearch's core (tokio forbidden), and franken_whisper's pipeline orchestrator all run on it [External, Medium — sibling-packet findings] — agent-adjacent workloads where task-lifecycle bugs are cost or safety bugs.

**Why now:** the maintainer's private DSR pipeline plus agent-assisted development velocity make a from-scratch runtime feasible for one person; the constellation's growth (78 reverse deps) creates captive demand that justifies the investment [Inference, Medium]. Whether *external* demand exists for a non-tokio runtime is unproven — all observed adoption is constellation-internal [External, High on the reverse-dep list; the demand inference is Medium].

**Why a rewrite, not a tokio fork:** the API is intentionally different — "trades implicit convenience for explicit cancel-correctness" — and the maintainer states it is "not a drop-in replacement for other runtimes: different API, different guarantees" (README, "What Asupersync Doesn't Do") [Maintainer claim, High]. A fork couldn't deliver the structural guarantees; the cost is that every adopter rewrites.

**Adjacent context:** one entry in the solo-maintainer FrankenSuite program, but unlike the reimplementation repos it is the *substrate*: 78 crates.io reverse deps, the most-downloaded artifact in the constellation by two orders of magnitude, and the runtime several siblings evaluated against — frankensqlite adopted it (Cx in public APIs), frankenredis evaluated and rejected it (2026-04-21/22) [External, Medium — via the frankenredis packet's UPGRADE_LOG reading; corroborated by asupersync's absence from frankenredis's Cargo.lock as reported there].

## 4.2 What it is — repo TL;DR

A 10-member Cargo workspace (root crate `asupersync` 0.6.0 at HEAD; `asupersync-macros`, `asupersync-browser-core`, `asupersync-tokio-compat`, `conformance`, `franken_kernel`, `franken_evidence`, `franken_decision`, `frankenlab`, `drop_unwrap_finder`) [Code-verified, High] implementing a full async runtime plus a sprawling in-tree ecosystem: 1,668 files / 2,269,316 lines in `src/`, 2,003 files / 1,048,673 lines in `tests/`, 51 bench files, 96 conformance files [all Counted, High]. Note that 533 files with `test` in the name physically live in `src/` (the `real_*_e2e_tests.rs` family, metamorphic suites, conformance tests), so the "2.27M-line runtime" figure overstates the shipped library; the publish `include` list strips `**/*tests.rs`, `**/*_test.rs`, snapshots, and metamorphic suites to stay under crates.io's 10 MiB cap [Code-verified, High]. Subsystem sizes are broken out in §4.4; the short version is that six subsystems (`net`, `runtime`, `observability`, `lab`, `atp`, `messaging`) each exceed 100,000 lines. The core loop: region-owned tasks, three-lane work-stealing scheduler (cancel > timed > ready), epoll/io_uring reactor, capability-gated effects — with a deterministic lab runtime and e-process oracles for testing. Around it: TCP, HTTP/1.1, HTTP/2 (via `src/http/h2`), partial HTTP/3, TLS, WebSocket, a QUIC-native transport (the ATP stack), SQLite/PostgreSQL/MySQL clients, Kafka (optional `rdkafka`), GenServer-style actor supervision, RaptorQ fountain coding, TLA+/Lean formal artifacts, and a browser/WASM edition.

One-line verdict: **the only FrankenSuite project with genuine registry-scale distribution and real downstream workloads — a cancel-correct async runtime whose honest-scope documentation culture is its most exportable asset — governed by one person, unobservable CI at the assessed commit, and a license that bars the AI labs from evaluating it.** (NODUS: Pilot — see §4.9.)

## 4.3 Repo facts (claim inventory)

Every claim below was verified against the pinned commit on 2026-09-22.

| # | Claim | Status | Evidence | Tier, Confidence |
|---|-------|--------|----------|------------------|
| 1 | Region-owned tasks: every task owned by a region; region close drains to quiescence | demonstrated (structure; drain behavior not executed) | `src/runtime/` region machinery; README guarantee table; `#[main]` drains root region with `drain_ms` default 2000 | [Code-verified, High on structure; behavior Maintainer claim, Medium] |
| 2 | Cancellation as explicit request → drain → finalize with budgeted bounds | demonstrated (protocol + bounds exist; bounds are sufficient-conditions-only, explicitly scoped) | README: "Budgets are sufficient conditions only where a concrete responsiveness bound is published; non-cooperative work can still delay quiescence indefinitely" | [Maintainer claim + Code-verified, High] |
| 3 | Three-lane work-stealing scheduler (cancel > timed > ready), multi-worker | demonstrated | `src/runtime/scheduler/three_lane.rs`; fairness contract documented as worker-local and dispatch-step based, "not wall-clock latency claims" | [Code-verified, High] |
| 4 | Linux reactor: epoll primary, optional io_uring (kernel 5.1+); kqueue/IOCP/browser/lab reactors narrower | demonstrated (code + export contract) | README L642–644 export contract: historical `uring.rs`/`macos.rs` not in live graph; `IoUringReactor` real with `io-uring`, intentional `Unsupported` without | [Maintainer claim + Code-verified, High] |
| 5 | "Zero-copy DMA and RDMA support" (brief's tagline) | disproven (as a maintainer claim) | `rdma` absent from README/docs; in src only inside "wildca**rdma**tching" in 2 test files; `netlink` zero hits in the searched scopes (`src/`, `docs/`, README); "packet-aware" never in maintainer prose | [Verified absence, High] |
| 6 | Deterministic lab runtime: virtual time, deterministic scheduling, trace replay | demonstrated (existence; replay not executed) | `src/lab/` (82 files, 105,646 lines); `frankenlab` workspace member (3 files, 2,132 lines); e-process oracle `src/lab/oracle/eprocess.rs` | [Code-verified, High] |
| 7 | Capability-secure effects: runtime effect APIs flow through explicit `Cx`/capability tokens | demonstrated (structure) | README guarantee table; `src/cx/` (32 files, 33,060 lines); named host-boundary/test-only exceptions | [Code-verified, High] |
| 8 | CI-blocking benchmark gate: p50 vs `artifacts/baseline.json`, fail above max(5%, ci95 envelope, +0.6ns); flamegraph artifacts; no `[skip ci]` waiver | demonstrated (config + docs; gates run on maintainer DSR, not observable) | README L2434–2489; `.github/workflows/methodology-gates.yml`, `benchmarks.yml`, `perf-pr-check.yml` exist; `artifacts/baseline.json` has 105 rows at the pin | [Maintainer claim, High] |
| 9 | Unsafe posture: `deny(unsafe_code)` at crate root; 47 files with `#[allow(unsafe_code)]` islands | demonstrated | `src/lib.rs:54`; sampled islands: `libc::fallocate` probes (`src/atp/journal/platform_caps.rs`), x86_64 `__cpuid` (`src/atp/timing_security.rs`) | [Code-verified, High] |
| 10 | crates.io `asupersync` 0.5.0: 318,241 total downloads, 166,388 in trailing 90 days; 78 reverse-dep crate versions | demonstrated | crates.io API (UA header required; bare 403) | [External, High] |
| 11 | 20 GitHub releases; v0.5.0 (2026-09-12) with 11 assets; releases published via DSR, not GitHub Actions | demonstrated | GitHub Releases API; CHANGELOG: "signed Linux, macOS, and Windows assets through DSR without GitHub Actions" | [External, High] on releases; [Maintainer claim, High] on DSR |
| 12 | tokio-compat bridge crate (hyper/tower bridges, blocking, io, cancel shims) | demonstrated | `asupersync-tokio-compat/` (9 files, 0.6.0, path-dep on root crate) | [Code-verified, High] |
| 13 | Tokio parity dashboard drift gate | partially demonstrated | Workflow `tokio_parity_dashboard_drift.yml` exists; latest run (2026-09-07, commit 87856556) failed at the "Hard-fail if dashboard artifacts drift" step — i.e. the gate fired on drifted artifacts, which is the gate working as designed; downstream steps skipped | [CI-observed, High] |
| 14 | Formal methods: TLA+ export + Lean-checked model-invariant coverage | partially demonstrated | README current-state: "⚠️ Partial implementation (Lean checks six abstract-m[odules])"; `formal/lean`, `formal/tla` dirs exist | [Maintainer claim, High] |
| 15 | Database clients (SQLite, PostgreSQL, MySQL) implemented | partially demonstrated | README current-state ✅; `src/database/` (12 files, 51,987 lines); behavior not executed | [Code-verified, High on existence; behavior Maintainer claim, Medium] |
| 16 | HTTP/3 (native core, static-only QPACK default) | partially demonstrated | README: "⚠️ Partial implementation"; `src/net/quic*`, `src/http/h2` present | [Maintainer claim, High] |
| 17 | franken_kernel / franken_evidence / franken_decision evidence crates; `franken-kernel` 0.5.0 on crates.io (339,863 downloads) | demonstrated | Workspace members (1–4 files each, ~7,576 lines combined); crates.io API | [Code-verified + External, High] |
| 18 | License: MIT with OpenAI/Anthropic rider; `LicenseRef-MIT-OpenAI-Anthropic-Rider` in Cargo.toml | demonstrated | LICENSE read verbatim (73 lines); rider scope quoted in §4.8 | [Code-verified (license text), High] |
| 19 | Zero workflow runs at the pinned commit; latest runs (2026-09-07) show failures | demonstrated | Actions API: `head_sha=<pin>` → 0 runs; per-job conclusions: Benchmarks workflow 1/4 jobs failed ("Performance Benchmarks"), 2 succeeded, 1 skipped; Tokio Parity gate failed at drift-detection | [CI-observed, High] |
| 20 | frankensqlite depends on asupersync 0.5.0 (crates.io), `Cx` in public APIs | demonstrated | frankensqlite-clone `Cargo.toml:213` + `Cargo.lock` (registry source, checksum); comment: "The 0.4 engine line uses Asupersync 0.5 throughout" | [Code-verified, High] |
| 21 | franken_networkx: `fnx-runtime` optional asupersync `>=0.3.4, <0.6` behind `asupersync-integration` feature | demonstrated | networkx-verify `crates/fnx-runtime/Cargo.toml:11,18`; `Cargo.lock` registry 0.5.0 | [Code-verified, High] |
| 22 | frankensearch depends on asupersync 0.5.0 (`proc-macros`), tokio forbidden | demonstrated | `.scratch/frankensearch-verify/Cargo.toml:70`: `asupersync = { version = "0.5.0", default-features = false, features = ["proc-macros"] }`; comment "Async runtime (structured concurrency, NO tokio)" + a documented `test-internals` feature-unification incident (HFDT gate RED, cf. frankensqlite #104) | [Code-verified, High] |
| 23 | frankenredis evaluated and rejected asupersync (2026-04-21/22) | demonstrated | frankenredis UPGRADE_LOG (per frankenredis packet) + asupersync absent from frankenredis Cargo.lock (per that packet) | [External, Medium] |
| 24 | Outside contributions refused; bus factor 1 | demonstrated | README L2620 verbatim policy; all visible authorship is the maintainer | [Maintainer claim, High] |

**README-vs-code drift audit (explicit):** the current-state ✅/⚠️ table was spot-checked on four rows — three-lane scheduler ✅ (`src/runtime/scheduler/three_lane.rs` present), single-thread kernel ✅ (`src/runtime/current_thread.rs` present), TLS ✅ (`src/tls/` present), HTTP/2 ✅ (`src/http/h2` present) — all hold [Code-verified, High]. The README's named bench files (`benches/scheduler_benchmark.rs`, `reactor_benchmark.rs`, `timer_wheel.rs`, `cancel_drain_bench.rs`, `tracing_overhead.rs`) all exist [Code-verified, High]. Two drift instances found: (a) the brief's tagline ("zero-copy DMA and RDMA," "netlink," "packet-aware") is disproven as a maintainer claim (claim 5) — ecosystem marketing outrunning the maintainer; (b) `artifacts/baseline.json`'s top-level `timestamp` field reads 2026-02-13 while its own `note` fields record re-recordings on 2026-07-27, 2026-08-02, and 2026-08-03 — a stale metadata field inside the project's most important evidence artifact [Code-verified, High]. No drift found in the status table rows checked.

**What the inventory says in aggregate:** claims about *distribution* (downloads, releases, reverse deps) and *structure* (scheduler, reactor, unsafe posture, gates) verify at High confidence; claims about *behavior* (drain bounds, determinism, benchmark outcomes) are maintainer-asserted with unusually explicit scope limits; the brief's own tagline is the one thing *disproven*. Zero CI runs at the pin means no third-party-executed evidence exists for the assessed tree.

## 4.4 Codebase tour

**Workspace topology (10 members [Code-verified, High]):** root `asupersync` (0.6.0), `asupersync-macros` (attribute macros: `#[main]`, `#[test]`), `asupersync-browser-core`, `asupersync-tokio-compat` (0.6.0), `conformance`, `franken_kernel`, `franken_evidence`, `franken_decision`, `frankenlab`, `drop_unwrap_finder`. Excluded from the workspace: `fuzz/`, `asupersync-wasm` [Code-verified, High].

**Size, stated honestly:** 4,709 `.rs` files / 3,864,420 lines total [Counted, High]. `src/` alone is 1,668 files / 2,269,316 lines — but 533 of those files have `test` in the name and physically live in `src/` (the `real_*_e2e_tests.rs` family, metamorphic suites, conformance tests), so the "2.27M-line runtime" figure overstates the shipped library; the publish `include` list strips `**/*tests.rs`, `**/*_test.rs`, snapshots, and metamorphic suites to stay under crates.io's 10 MiB cap [Code-verified, High]. `tests/`: 2,003 files / 1,048,673 lines. `src/lib.rs` re-exports 138 `pub mod`/`pub use` lines [Counted, High] — a very wide public surface for a runtime.

**Subsystem sizes inside `src/`** (the sprawl, quantified): `net/` 273,902 lines (197 files), `runtime/` 196,555 (108), `observability/` 174,326 (120), `lab/` 105,646 (82), `atp/` 104,167 (111), `messaging/` 101,458 (37), `trace/` 55,654 (45), `database/` 51,987 (12), `sync/` 48,427 (28), `channel/` 45,207 (33), `io/` 34,377 (62), `cx/` 33,060 (32) [all Counted, High]. Six subsystems exceed 100K lines; the single largest files are `src/supervision.rs` (6,859 lines) and `src/actor.rs` (3,858 lines) [Counted, High].

**Data flow, end to end:**

- **Entry — `asupersync-macros`:** `#[main]` builds and drives the production runtime (multi-thread scheduler, on-demand blocking pool) and drains the root region on return (`drain_ms` default 2000; tasks outliving `main` are protocol-cancelled) [Maintainer claim, High].
- **Scheduling — `src/runtime/scheduler/`:** the three-lane scheduler (`three_lane.rs`) with strict cancel > timed > ready priority, per-worker local queues plus work stealing (`stealing.rs`, `global_queue.rs`, `local_queue.rs`), an adaptive discounted-UCB1 governor tuning cancel-streak limits over {4, 8, 16, 32, 64}, wake-dedup via an `Idle → Polling → Notified` state machine, and an explicit fairness contract: worker-local, dispatch-step based, *not* wall-clock latency claims [Code-verified, High on the header contract]. Intrusive timer wheel (`intrusive.rs`, `intrusive_heap.rs`) with a documented ~27x cancel-path advantage over `BTreeMap` on a 2026-06-01 corpus [Maintainer claim, Medium].
- **I/O — `src/runtime/reactor/`:** `EpollReactor` (edge-triggered + edge-oneshot, explicit PRIORITY/HUP/ERROR propagation, stale-fd cleanup), `IoUringReactor` (Linux, `io-uring` feature; poll-timeout expiry as timeout-not-failure; stale-completion filtering), plus kqueue/IOCP/browser/lab reactors with narrower interest support [Maintainer claim, High]. The oneshot waker semantics: reactor disarms interest after each readiness event; streams re-arm explicitly [Maintainer claim, Medium].
- **Effects — `src/cx/`:** capability context threaded through task factories (`cx.spawn(|cx| …)`); runtime-managed effects require capabilities; host-boundary and test-only exceptions named and scoped [Maintainer claim, High].
- **Cancellation — `src/cancel/`:** request → drain → finalize; drain progress certificates with Azuma/Freedman range-bounded candidates — wired today only to HTTP/1-2 listener graceful-drain and the opt-in scheduler governor; region close and `Runtime::shutdown_timeout` do *not* consult them (README L282 — the honesty is the point) [Maintainer claim, High].
- **Determinism — `src/lab/`:** virtual time, deterministic scheduling, trace replay; oracles re-runnable mid-execution with e-process anytime-validity (Ville's inequality); DPOR-style race-guided seed exploration as trace analysis [Maintainer claim, High].
- **Ecosystem — `src/net/`** (TCP/UDP, HTTP/1.1 + HTTP/2, TLS, WebSocket, QUIC-native + HTTP/3 partial, the ATP transport stack with journaling/RaptorQ), **`src/database/`** (SQLite/PostgreSQL/MySQL clients), **`src/fs/`**, **`src/actor.rs`** (GenServer supervision, links/monitors), **`src/messaging/`** (incl. Kafka), **`src/trace/`**, **`src/observability/`** (metrics + optional OTLP). The breadth is the review: this is several projects wearing one crate name.

**Dependency posture (the Rulebook's 30-second survey):** 66 entries in root `[dependencies]`, including first-party path deps [Counted, High] — notably broad for a runtime (rustls, rusqlite, rdkafka, sqlparser, prost, opentelemetry, tower, nkeys among them), reflecting the in-tree ecosystem strategy. Corrections to v1: **tokio is an optional root dependency** (`tokio = { version = "1.0", features = ["rt", "fs", "process"], optional = true }`, "Tokio async runtime for benchmark execution") — used in ATP benchmark adapters and benches, *not* in the default feature graph; the runtime proper is tokio-free [Code-verified, High]. `rdkafka` is optional behind the `kafka` feature. The workspace is otherwise self-contained (no workspace-level `[dependencies]` table at all).

## 4.5 The maintainer's stated case

**The pitch, in the maintainer's own structure:**

1. **Structural correctness:** region ownership, cancel-correctness, scoped cleanup bounds, no silent drops (two-phase reserve/commit), deterministic testing, capability security — the nine-row "Why Asupersync?" table (README L40–58). Every row carries its own scope limiter in the surrounding prose [Maintainer claim, High].
2. **Benchmark discipline, not benchmark numbers:** the repo publishes almost no headline speedup claims — instead it publishes the *gate*: every substantive direct-main change runs `methodology_baselines`; a row fails only above max(5%, its recorded ci95 envelope, +0.6ns absolute) vs `artifacts/baseline.json` (105 rows at the pin, with per-row environment tagging and layout-hypersensitivity notes — e.g. the ovh-a host re-recording saga of 2026-08-03); flamegraphs required for scheduler-adjacent changes; golden checksums; and "The infrastructure intentionally has no `[skip ci]`-style waiver" (README L2489) [Maintainer claim, High]. `docs/benchmarking.md` documents the Criterion.rs + golden-output methodology [Code-verified, High on existence]. This is the inverse of frankenredis's disavowed benchmark table: asupersync's numbers are gated but unpublished; frankenredis's are published but disavowed.
3. **Honest-status accounting:** the current-state table marks HTTP/3, WebSocket conformance, DPOR, formal methods, and the browser edition as partial/⚠️ with prose explaining exactly what is missing [Maintainer claim, High].
4. **Ecosystem gravity:** 78 reverse deps, 318K downloads, the tokio-compat bridge, the WASM live demo — the "it runs real workloads" case is made by the constellation's manifests, not by prose [External, High].

**Benchmark audit tables:**

*Maintainer-produced numbers*

| Number | Methodology doc | Controls | Independent-rerun survival |
|---|---|---|---|
| Baseline gate: p50 vs `artifacts/baseline.json` (105 rows), fail > max(5%, ci95 envelope, +0.6ns) | `docs/benchmarking.md` + README L2434; rows carry host-class tags | A/A-null discipline implied by ci95 envelopes; environment-tagged gating; layout-artifact re-record policy documented | The *deltas* would survive (method committed, artifacts in-tree); absolute values are host-bound by the project's own notes |
| Timer wheel ~27x cancel-path advantage over `BTreeMap` (2026-06-01 corpus) | `benches/timer_wheel.rs` | Corpus-dated; single-corpus figure | Unlikely to be load-bearing; dated and narrow |
| "set_interest per poll negligible vs syscall overhead" | `benches/reactor_benchmark.rs` | Maintainer-internal | Would need the independent re-run (next step #4) |

*Independent numbers*

| Source | Number |
|---|---|
| None found | — [External, High within recall caveats] |

**Benchmark reproduction cost:** reproducing the baseline gate requires the ~19K-file checkout at the pin, the pinned nightly toolchain (`rust-toolchain.toml`), and a quiet host able to run the `methodology_baselines` signoff contract; all evidence artifacts are committed (`artifacts/baseline.json`, `artifacts/flamegraphs/`) [Maintainer claim, Medium]. No independent reproduction is known to exist [External, High within recall caveats]. Note the tension: the gates that make the methodology credible run on the maintainer's DSR — the same hosts whose ambient noise the gate's +0.6ns floor is calibrated against — so the discipline is self-hosted end to end [Inference, High].

## 4.6 Competitors

The incumbent wins on ecosystem, hiring pool, and the "nobody got fired for choosing tokio" default; asupersync's only uncontested edge is structural cancel-correctness with machine-checked evidence discipline — which no competitor bothers with because no buyer currently selects a runtime on cancellation semantics [Inference, Medium].

- **Tokio:** the incumbent. Massive ecosystem (hyper, axum, tower, tracing), years of production hardening, the default for every Rust async tutorial. Wins on network effects and talent availability [External, High]. asupersync's answer is the tokio-compat bridge crate — an explicit admission that the ecosystem moat must be crossed, not ignored [Inference, Medium].
- **async-std / smol:** the "simpler runtime" lane; effectively ceded to tokio by 2024 [External, Medium]. Not a live competitor, but proof that non-tokio runtimes struggle for oxygen.
- **glommio:** thread-per-core io_uring runtime (DataDog; Linux-only, kernel ≥5.8) [External, Medium — docs.rs]. Owns the io_uring-native performance lane asupersync only gestures at (io_uring optional, head-to-head unpublished) [Inference, Medium].
- **monoio:** thread-per-core io_uring/epoll/kqueue runtime (ByteDance-linked) with published better-than-tokio benchmark claims for its use cases [External, Medium — docs.rs]. Same lane as glommio: if io_uring throughput is the buyer's criterion, these are the incumbents, not asupersync.
- **Embassy:** the embedded async lane (no-std, static). Uncontested by asupersync [External, Medium].
- **The constellation's own alternatives:** frankenredis evaluated asupersync and rejected it as an architectural rewrite (2026-04-21/22), choosing a hand-rolled mio loop [External, Medium] — the most damning data point, from inside the family: the runtime's own sibling judged it the wrong substrate for a latency-sensitive server.
- **Unoccupied lane:** a *cancel-correct-by-construction* runtime with deterministic replay testing and anytime-valid oracles has no direct occupant — tokio documents cancellation hazards rather than structuring them away [Inference, Medium]. Whether any buyer selects on this axis is the unproven bet.

## 4.7 Skeptic's take

Weaknesses (each substantive — capable of killing the project on its own):

1. **[HIGH] No CI evidence exists for the assessed commit — and recent CI is red.** The Actions API returns zero runs for `head_sha` = pin; the latest runs (2026-09-07, commit 87856556) show the tokio-parity gate failing at drift-detection and the Benchmarks workflow with 1 of 4 jobs failed [CI-observed, High]. Every behavioral and benchmark claim about the assessed tree therefore rests on maintainer-run DSR gates whose execution is unobservable externally. For a project whose pitch is *evidence*, the evidence for this commit is take-my-word.
2. **[HIGH] Bus factor 1, contributions explicitly refused.** README L2620: "I do not accept outside contributions for any of my projects… it's my name on the thing" [Maintainer claim, High]. 278 stars and 78 reverse deps depend on one person's continued weekends. The rider compounds it: the downstream constellation is itself single-maintainer, so the dependency graph is a one-node cut set.
3. **[HIGH] The rider bars the natural evaluators.** The license withholds *use, benchmarking, testing, analyzing, indexing* from OpenAI, Anthropic, affiliates, and anyone acting for them [Code-verified, High]. For a runtime whose most plausible agent-era users are AI labs and agent frameworks, the license pre-emptively excludes the demand side. The irony the packet inherits from the frankenredis exemplar: this ecosystem is substantially agent-built, and the rider's "analyzing" prong arguably covers independent assessment itself.
4. **[MEDIUM] Deliberately not a drop-in.** "Not a drop-in replacement for other runtimes: different API, different guarantees" [Maintainer claim, High]. Every adoption is a rewrite, and the tokio-compat bridge is itself new, unproven surface. The 318K downloads measure constellation-internal consumption, not market conversion.
5. **[MEDIUM] Scope sprawl.** One crate ships a scheduler, reactors, TCP/HTTP/1–3/TLS/WebSocket, QUIC, DB clients, Kafka, actor supervision, RaptorQ, formal methods, and a browser edition — 66 dependencies to feed it. Each sub-lane (HTTP/3, QUIC, MySQL client) is thinner than its standalone competitor and maintained by the same single person. The honest-status table admits the partialness; the question is whether the breadth is ambition or dilution [Inference, Medium].
6. **[MEDIUM] The unsafe islands are named but numerous.** `deny(unsafe_code)` at the root is real, but 47 files carry `#[allow(unsafe_code)]` — platform probes via `libc::fallocate`, x86_64 `__cpuid`, and others sampled, not all audited in this pass [Code-verified, High on the count; Medium on the audit]. "Deny with 47 islands" is a weaker posture than the root attribute suggests at a glance.
7. **[MEDIUM] The brief's tagline is disproven — and it isn't the maintainer's.** "Zero-copy DMA and RDMA," "netlink," "packet-aware scheduler" appear nowhere in the maintainer's 2,626-line README [Verified absence, High]. The ecosystem's internal marketing outruns its most careful writer. If the constellation can't keep its own descriptions honest, the honest-status culture may be one person's discipline, not an institutional one [Inference, Medium].

**Bear-case steelman (strongest counter-case):** asupersync is a single-maintainer science project about *how* to build a runtime, not a runtime the market asked for. Tokio owns the lane with a decade of hardening and an ecosystem no bridge crate can replicate; the API is deliberately incompatible so adoption means rewriting; all 318,241 downloads are constellation-internal — self-dealing demand from the maintainer's own constellation (78 reverse deps), several of which exist to demonstrate the runtime rather than need it; the most recent CI runs are red and no CI has ever executed against the assessed commit; the sibling flagship (frankenredis) evaluated the runtime and walked away; and the license forbids the AI labs — the exact customers for an agent-era async runtime — from even benchmarking it. The rational market response is to mine it for methodology (claim-discipline, baseline gates, e-process oracles) and keep shipping tokio. Its most likely end state is a well-documented monument inside a one-person constellation [Inference, Medium — deliberately uncharitable; the counter-evidence is the download count, the 20 releases, and the fact that frankensqlite's storage I/O genuinely runs on it].

## 4.8 Maintenance & succession

**Bus factor: 1.** One human maintainer (Jeffrey Emanuel / Dicklesworthstone); outside contributions explicitly refused (README L2620, quoted in claim 24) [Maintainer claim, High]. No succession plan, no second committer, no foundation [Inference, Medium — absence of evidence across assessed materials]. If the maintainer stops, 78 reverse deps lose their substrate's steward on the same day [Inference, High].

**Cross-project dependency hygiene (a bright spot):** frankensearch's root Cargo.toml documents a `test-internals` feature leak into downstream production graphs via Cargo feature unification (HFDT gate RED, fixed as in frankensqlite #104) [Code-verified, High] — single-maintainer does not mean undisciplined.

**License and governance (material):** LICENSE (73 lines, read verbatim [Code-verified, High]) is the FrankenSuite standard rider, identical in structure to frankenredis's:

- *"Restricted Parties" means OpenAI, L.L.C.; Anthropic, PBC; any of their respective Affiliates; and any person or entity acting directly or indirectly on behalf of, for the benefit of, or under the direction of any of the foregoing (including any officer, director, employee, contractor, agent, consultant, service provider, or representative).*
- *"Notwithstanding any other provision of this License, no rights are granted to any Restricted Party. Any purported license, sublicense, assignment, transfer, or other permission to any Restricted Party is null and void absent the express prior written permission of Jeffrey Emanuel.*
- *"You may not provide, disclose, distribute, sublicense, sell, lease, lend, host, make available, or otherwise permit access to the Software or any derivative work … to or for any Restricted Party."*
- *"For purposes of this rider, 'use' includes, without limitation: copying, modifying, merging, publishing, distributing, sublicensing, selling, transferring, making available, hosting, deploying, executing, benchmarking, testing, analyzing, indexing, or incorporating the Software or any Derivative Works into any dataset, training corpus, evaluation harness, or pipeline for machine learning or other automated systems."*
- *Breach "automatically and immediately terminates" the license; "irreparable harm" and injunctive relief; prevailing-party attorneys' fees. "Affiliate" = >50% voting control.*

**OSI status: non-OSI, non-open-source by the Open Source Definition** (discrimination against persons/groups + field-of-endeavor restriction) [Inference, High — legal classification, not legal advice]. The crates.io SPDX field says `LicenseRef-MIT-OpenAI-Anthropic-Rider` and the README badge reads "MIT+Rider" — the rider is disclosed, not hidden [Code-verified, High].

**The license as strategy (see deepening question 6):** the rider excludes exactly the two labs building the agent infrastructure this runtime is best suited for. As strategy it reads as defensive moat-building around training-data incorporation; as ecosystem strategy it is self-sabotage — the labs that could validate, harden, and distribute a cancel-correct runtime may not touch it. The cost is unmeasurable but directional: every downstream constellation crate inherits the same ceiling [Inference, Medium].

**Governance path:** there is none stated — no foundation track, no contributor ladder (contributions refused), no escrow. The credible route to an institution runs through the evidence artifacts (baseline gates, honest-status tables) being adopted as standards elsewhere, not through the codebase changing hands [Inference, Medium].

## 4.9 NODUS factsheet

| Criterion | Score | Justification (one line) |
|---|---|---|
| Technology readiness | TRL 6 | Ships as 0.5.0 on crates.io with 20 GitHub releases and runs real downstream workloads (frankensqlite storage I/O, frankensearch core) — demonstrated in a relevant environment, but no independent qualification exists |
| Strategic relevance | 4/5 | Async runtime is load-bearing infrastructure for the entire FrankenSuite; cancel-correctness is a genuine unsolved axis |
| Impact potential | 3/5 | If the cancel-correctness thesis lands, it reshapes async API design; if not, it remains a constellation-internal substrate |
| Implementation feasibility | 4/5 | It is already implemented and distributed — feasibility is demonstrated, not projected |
| Time to mainstream | 2/5 | Non-tokio API + rider + bus factor 1 = no credible path to mainstream on any horizon |
| Collaboration potential | 2/5 | Contributions refused and the rider bars the AI labs; collaboration is limited to the maintainer's own constellation |

**Ring: Pilot** [Inference, Medium]. The assignment rules require for Pilot "a release artifact plus a bounded, real workload fit" — both hold (crates.io 0.5.0 + GitHub signed releases; frankensqlite's storage I/O and frankensearch's core are bounded, real workloads). Explore would understate the distribution evidence; Invest requires independent validation plus governance, and neither holds (all adoption is constellation-internal; bus factor 1 with contributions refused). Pilot-with-a-ceiling: advancement past Pilot needs outside-constellation adoption and a governance story.

## 4.10 Wardley placement

- **Async task scheduling / reactor I/O:** commodity (tokio owns it) — asupersync's scheduler and reactor are custom-built reimplementations of a solved problem, differentiated only on the cancellation-semantics axis.
- **The cancel-correctness contract machinery** (regions, drain certificates, capability-gated effects): custom-built → early product; no incumbent offers it structurally.
- **The evidence/honesty machinery** (baseline gates, honest-status tables, export contracts, e-process oracles): genesis — novel, uncopied, and the most likely survivor if the runtime fails. [Inference, Medium]
- **What moves each:** a published independent benchmark moves the scheduler from custom-built toward commodity-competitive; one outside-constellation production deployment moves the runtime toward product; extraction of the claim-discipline tooling into a standalone cargo plugin moves the evidence machinery toward commodity.

## 4.11 Trajectory (12 / 24 / 60 months) — [Inference]

**Base case:** the constellation keeps growing around asupersync; downloads climb on the back of sibling releases; the 0.6.0 line ships; the runtime remains the best-documented async runtime nobody outside the constellation uses. CI-at-pin stays unobservable because DSR is the real pipeline and GitHub Actions is the display window.

**Upside bifurcation:** requires (a) one outside-constellation production deployment with published results, (b) the tokio-compat bridge carrying a real migration, or (c) the e-process/claim-discipline machinery extracted and adopted elsewhere. Any one of these moves the ring.

**Decay:** looks like the maintainer's attention shifting — the honest-status table going stale (its own drift unrepaired), the baseline gate's noise floor drifting as hosts change, downstream crates pinning 0.5.0 forever. The single-node-cut-set dependency graph means decay is synchronized, not gradual: one person's context switch freezes the substrate under 78 reverse deps.

**Revisit triggers:** (1) first GitHub Actions run green at a pinned commit, or DSR receipts made externally auditable; (2) one reverse-dependency crate from outside the Dicklesworthstone constellation; (3) an independent benchmark publication; (4) a second committer or a governance document; (5) 0.6.0 published to crates.io with the tokio-compat bridge adopted by a sibling.

## 4.12 Limitations and open questions

**Not done:** the workspace was never compiled (no Rust toolchain in this environment); no test, bench, or example was executed; no benchmark was reproduced; the `methodology_baselines` gate was read, not run; unsafe-island audit covered sampled files only (47 `allow` files counted, not all reviewed); commit velocity and authorship were not analyzed (shallow clone); the full external-dependency union beyond the root crate's 66 was not counted per member; the ATP/QUIC/HTTP-3/database-client subsystems were inventoried, not exercised; web demand-signal search beyond crates.io/GitHub APIs/docs.rs was limited; the WASM demo page was not loaded in a browser.

**Open questions that would most change the verdict:**
1. Do the DSR gates actually execute at the pin, and would their receipts survive external audit? (Would move TRL and the CI weakness.)
2. What fraction of the 318K downloads is CI/dependency-resolution churn vs. real use? (Would sharpen or blunt the adoption claim.)
3. Why did frankenredis's evaluation conclude asupersync was the wrong substrate — latency, API, or control? (The sibling rejection is currently a one-line log entry.)
4. Is there any outside-constellation user? The reverse-dep list says no, but download logs would be definitive.
5. Can the tokio-compat bridge carry a real migration, or does the API gap make it a demo?

---

## The eight deepening questions

**1. Provenance.** The repo records provenance unusually well for code and unusually poorly for process. Code artifacts carry bead IDs, commit SHAs, and evidence receipts (`artifacts/`, `audit_index.jsonl`, `provider_audit_log.md`); releases are signed multi-platform builds with SHA-pinned baselines. But the gates that produce those receipts run on DSR — the maintainer's private orchestration, never expanded in-repo, unobservable externally — so the provenance chain terminates at "trust the maintainer's hosts." Portable attestation would require the DSR receipts to be reproducible by a third party: publish the DSR runner (or its equivalent), the host specs, and the raw gate logs, so a verifier can re-execute rather than re-trust [Inference, Medium].

**2. The embeddable unit.** The smallest useful piece is the `franken-kernel` / `franken-evidence` / `franken-decision` trio — the evidence/tracing kernel already extracted as workspace members and published as `franken-kernel` 0.5.0 on crates.io (339,863 downloads) [Code-verified + External, High]. Adoption cost: the crates carry the same rider, so any adopter inherits the non-OSI ceiling; technically they are small (1,801 + 3,475 + 2,300 lines) and dependency-light. The runtime itself is not meaningfully embeddable piecemeal — 138 public modules with the scheduler, reactor, and `Cx` types entangled by design.

**3. Unexercised option value.** The lab runtime's deterministic scheduling + e-process oracles are built for testing asupersync itself but are workload-agnostic — the same machinery could deterministically test *any* concurrent system (`frankenlab` exists as a workspace member: 3 files, 2,132 lines, but not yet a standalone story). The WASM browser edition is a second option: a cancel-correct runtime compiling to WASM is scarce. The tokio-compat bridge is a third: it could become the migration path not just for siblings but for any tower/hyper service. What unlocks each is the same thing: extraction from the monorepo into independently versioned, independently documented crates [Inference, Medium].

**4. Benchmark honesty.** The repo's benchmark posture is gates-without-headlines: the baseline gate (105 rows, max(5%, ci95, +0.6ns), no waivers) is the strongest *process* in the program — but the numbers it guards are maintainer-measured on maintainer hardware, and the README publishes almost no comparative figures (the ~27x timer-wheel cancel-path figure is dated 2026-06-01 and corpus-specific). The numbers that would survive an independent rerun are the *gate deltas* (did this commit regress vs. baseline?), because the methodology is committed and the artifacts are in-tree. The numbers load-bearing for the thesis — "cancel-correctness costs X" — are never stated as such, which is honest but leaves the thesis's price tag unknown [Inference, Medium].

**5. The governance path.** There is no credible route from one maintainer to an institution under current policy: contributions are refused, the rider poisons institutional adoption, and DSR is private. What breaks first if velocity decays is the synchronized dependency graph — 78 reverse deps pinning a substrate whose steward has moved on, with no fork path that doesn't inherit the rider. The only governance asset is the evidence machinery: if the baseline-gate and claim-discipline patterns are adopted elsewhere, the *methodology* gets institutionalized even as the codebase stays personal [Inference, Medium].

**6. The license as strategy.** The rider excludes OpenAI, Anthropic, their affiliates (>50% control), and anyone acting for them — from use, benchmarking, testing, analyzing, indexing, and training-data incorporation, with automatic termination and injunctive relief [Code-verified, High]. For a runtime whose natural agent-era users are AI labs and agent frameworks, the exclusion is strategically self-defeating: it trades unmeasurable training-data protection for the certain loss of the most capable potential validators and distributors. It serves the stated mission (protecting the work from uncompensated model ingestion) only if the mission is understood as *authorship protection*, not *adoption*; on an adoption reading, it sabotages the mission [Inference, Medium].

**7. Agent-era fit.** The concrete workload that would pick asupersync over tokio is an agent harness or long-lived agent service where cancellation correctness is load-bearing: thousands of spawned sub-tasks with structured teardown, where a leaked task is a security or cost bug, and where deterministic replay of a failure schedule is worth more than ecosystem familiarity. The sibling evidence points this way — franken_ocr's orchestration (4 files, 22 mentions), frankensearch's core, franken_whisper's pipeline. What would have to become true first: the tokio-compat bridge proven on a real migration, one independent benchmark, and license terms an AI lab can sign [Inference, Medium].

**8. The kill test.** The single experiment that would falsify the core thesis: take a real agent-harness workload with cancellation bugs, implement it on asupersync and on tokio with equivalent effort, and measure (a) whether the asupersync version exhibits fewer cancellation defects under a fault-injection campaign, and (b) what the throughput/latency cost of the structural guarantees is. If the defect rates are indistinguishable — or if the cost exceeds what any operator will pay — the "correctness should be structural" thesis fails as engineering, whatever its elegance. The repo's own lab machinery (deterministic schedules, fault injection, e-process oracles) is exactly the apparatus such a test needs; the fact that it hasn't been run against tokio is the gap [Inference, Medium].

---

## Cross-cutting lenses

- **The decoupling lens.** asupersync represents the decoupling of *correctness evidence from the runtime itself*: the baseline gates, honest-status tables, and export contracts are a separable evidence layer that could outlive any particular scheduler. It also decouples *cancellation semantics from programmer discipline* — the project's core bet.
- **The methodology-export lens.** If the runtime fails, the exportable survivors are: the CI-blocking baseline-gate pattern (max(5%, ci95, +0.6ns), no waivers), the honest-status table genre, the reactor export-contract pattern, and the e-process anytime-valid oracle machinery. The `franken-kernel`/`franken-evidence` crates (already published, 339K downloads) are the methodology half-extracted.
- **The asupersync question (for this packet: the self-question).** Verified manifest-by-manifest: frankensqlite *depends* (0.5.0, Cx in public APIs); frankensearch *depends and mandates* (0.5.0 + proc-macros, tokio forbidden); franken_networkx *optionally depends* (fnx-runtime feature); franken_ocr, franken_whisper, franken_tui, franken_threed, frankenfs, franken_manim, franken_snowflake, franken_tts, franken_markdown *depend* (per sibling packets, [External, Medium]); frankenlibc *dev-only*; frankengit *references* (integration profile doc); frankenredis *evaluated and rejected* (2026-04-21/22); frankenmermaid *no reference*. The map is: adopted widely inside the constellation, rejected once on architectural grounds, never independently evaluated.
- **The rider question.** Quoted verbatim in §4.8. It excludes OpenAI/Anthropic + affiliates + agents from all rights including benchmarking and analysis. As strategy it protects authorship at the cost of adoption — and for infrastructure, adoption *is* the mission, so the rider reads as a ceiling the maintainer chose deliberately.

---

Packet v6 — 2026-09-22. Final production packet: v5 with version bump only. Stop condition met after 5 full grade→revise rounds (QA 13/13, all sections ≥9, both graders PASS).