# franken_ocr — Technical Due-Diligence Assessment

**The hook:** A pure-Rust, CPU-only OCR engine that runs a 3B MoE vision-language model with no Python at inference, no CUDA, and no ML framework — and documents, in committed ledgers, exactly where it loses.

**Tier legend (Rulebook §1):** **[Verified]** direct inspection of the pinned clone or a live page read by the analyst — flavors **[Counted]** (I ran the count), **[Git-observed]** (git metadata), **[Code-verified]** (source read). **[CI-observed]** is Tier 2 (seen executing on live CI pages — attests the suite *runs*, not that it is green). **[Maintainer claim]** asserted in README/docs, not independently executed. **[External]** independent sources. **[Inference]** analyst judgment, always labeled. Confidence: **High** / **Medium** / **Low**.

## TL;DR

franken_ocr is a genuine, large-scale clean-room pure-Rust reimplementation of the Baidu Unlimited-OCR inference stack (a DeepSeek-OCR-derived 3B MoE VLM): one library crate of 105,330 Rust lines plus a five-model zoo (Unlimited-OCR, GOT-OCR2, SmolVLM2, OneChart, Polyphonic-TrOMR), model-specific int8 kernels with bit-identical scalar oracles, a custom `.focrq` quantized artifact format, tagged binary releases for six platforms with SHA256 sidecars, an installer, a Homebrew tap, a crates.io publication (API-confirmed; the web page currently 404s — see claim 19), and a browser/WASM playground — all from a single maintainer who explicitly accepts no outside contributions. Its most original contribution is not the engine but the **evidence apparatus**: a Phase −1 "truth pack" pinning the exact model source commit and fixture hashes, an L0–L5 parity ladder with skip-honest no-weights mode, a performance ledger that records losing rows, a negative-evidence ledger, a discrepancies ledger, and a three-pillar release-certification gauntlet whose finalizer refuses to claim a three-party OpenPGP certificate the release process cannot produce.

**TRL 6. NODUS ring: Pilot.** Strongest strength: the honesty machinery — measured parity receipts, published losses (including a hard-page CER tail of 0.6165), and disavowals of certificates it doesn't hold. Strongest ceiling: bus factor 1 with an explicit no-contributions policy, zero independent validation of any kind, a non-OSI MIT+OpenAI/Anthropic-rider license that excludes the frontier AI labs from even benchmarking it, and a governance decay signal — the CI workflows were deleted from the tree at HEAD and the last runs (2026-09-03) failed, while the docs still describe CI as the release gate.

## Quick Links

- Repository: https://github.com/Dicklesworthstone/franken_ocr
- README: https://github.com/Dicklesworthstone/franken_ocr/blob/HEAD/README.md
- License (MIT + OpenAI/Anthropic rider, read verbatim): https://github.com/Dicklesworthstone/franken_ocr/blob/HEAD/LICENSE
- Changelog: https://github.com/Dicklesworthstone/franken_ocr/blob/HEAD/CHANGELOG.md
- Releases (binaries + model artifacts): https://github.com/Dicklesworthstone/franken_ocr/releases
- Latest release v0.9.0 (12 assets, 6 platforms): https://github.com/Dicklesworthstone/franken_ocr/releases/tag/v0.9.0
- v0.6.0 release notes (headline 2.8–3.4x end-to-end claims, 13/13 gauntlet): https://github.com/Dicklesworthstone/franken_ocr/releases/tag/v0.6.0
- Negative-evidence ledger: https://github.com/Dicklesworthstone/franken_ocr/blob/HEAD/docs/NEGATIVE_EVIDENCE.md
- Performance ledger: https://github.com/Dicklesworthstone/franken_ocr/blob/HEAD/docs/PERF_LEDGER.md
- Truth-pack pinned sources: https://github.com/Dicklesworthstone/franken_ocr/blob/HEAD/docs/truth-pack/PINNED_SOURCES.md
- CI history (1,006 runs; workflow files absent from tree at HEAD — see §4.8): https://github.com/Dicklesworthstone/franken_ocr/actions
- Model weights (Hugging Face): https://huggingface.co/Dicklesworthstone/franken_ocr-weights
- NOT linked: `https://crates.io/crates/franken_ocr` returns **404** on the web frontend even though the crates.io API reports the crate (0.9.0, 44 downloads) — a live discrepancy, see claim 19.

## Did you know?

On Apple Silicon, franken_ocr ships hand-written SDOT and SMMLA (i8mm) int8 intrinsics — and then **deliberately doesn't use them by default**: interleaved real-decode measurements showed the LLVM-autovectorized scalar loop beating forced SDOT, with forced SMMLA slower still, so the runtime dispatches to the autovec path and keeps the intrinsics as forced parity/benchmark sweeps (`FOCR_FORCE_ARCH=sdot|smmla|scalar focr robot selftest`) [Maintainer claim on the measurements, Medium; dispatch code and the `robot selftest`/`backends` surface verified in the clone, High]. The engineering doctrine generalizes the lesson: "NEVER hand-roll wide-SIMD over scalar inner loops — it measured ~5× SLOWER than LLVM autovectorization in the sibling repos."

## Franken-worthy next steps

These are research directions, not engineering tickets: each is novel, specific, falsifiable, and backed by rigor this project has already demonstrated.

1. **Export the certification gauntlet as a method.** The truth-pack + L0–L5 parity ladder + artifact-graph ledgers + conformal ratchet + three-pillar release certification is the most transferable artifact in the repo — a "release certification for numeric software." **Falsification:** apply the harness to a *different* numeric port (a frankentorch kernel family, or an independent small-model port) and publish the parity receipt; if the ladder, ledgers, and finalizer cannot be decoupled from franken_ocr's model-specific fixtures within one focused workstream, it is product scaffolding, not a method.
2. **Independent rerun of the zoo gauntlet rows.** The headline numbers (3.37x GOT-OCR2, 2.58x OneChart, 1.67x SmolVLM2 decode-per-token vs Hugging Face CPU; 2.8–3.4x end-to-end vs torch bf16 in the v0.6.0 notes) all rest on the maintainer's hardware with maintainer-applied fairness controls. **Falsification:** a third party replays `docs/PERF_LEDGER.md`'s protocol on quiet hardware with the pinned oracle stack (`torch==2.10.0`, `transformers==4.57.1`); ratios reproducing within the ledger's own confidence intervals confirm the thesis, a collapse of the end-to-end rows (where artifact load and vision attention dominate) kills the "certified faster" framing while leaving the decode-kernel story intact.
3. **Stress the WASM/browser lane against its own release.** `models-unlimited-wasm-v1` already ships a wasm-int4 browser artifact, `focr-wasm` exists, and `site/` carries a committed playground — the lane is built but its parity story is the thinnest in the zoo. **Falsification:** run the committed 20-page corpus through the browser build and publish CER-vs-native and wall-time ratios; if CER exceeds the 0.25 aggregate budget or the lane only works on the demo page, it is a demo, not a product — and the project must say so with the same honesty it applies to page0590.
4. **Certify or kill int4 on the MoE expert bulk.** int4 is "gated and unvalidated" by the project's own admission, yet the doctrine names the int4 bandwidth win on the expert bulk as the next lever. **Falsification:** quantize the 2,148 validated int8 FFN/expert tensors to int4, run the full L0–L5 ladder plus the 20-page corpus; if aggregate normalized CER stays within the 0.25 budget and no page exceeds the hard-page kill-switch, int4 graduates from the gate — if page0590's tail (already 0.6165 at int8) blows out, the ledger records the kill and the doctrine's "correctness outranks speed" rule is demonstrated, not just stated.
5. **Make `.focrq` provenance verifiable offline.** `focr convert` already stamps the source safetensors SHA256 into the artifact header, and `focr pull` verifies part hashes against a committed manifest — the write-time origin binding exists but is not tamper-evident end to end. **Falsification:** extend the header into a hash-chained, recipe-bound provenance record (source SHA256 + exact quant recipe + converter version) that `focr doctor` verifies without network; then attempt to ship a forged-recipe artifact (e.g., int8-attn weights under the conservative recipe name) through `focr pull`/`doctor` — if the verifier accepts it, the provenance claim fails and the ledger records the bypass.

---
## 4.1 Header

| Field | Value |
|---|---|
| Repository | https://github.com/Dicklesworthstone/franken_ocr |
| Pinned revision | `5847deef58de77150889990dfefa2e70c0bb8678` — 2026-09-22 04:30:16 UTC [Verified, High] |
| Assessment date | 2026-09-22 |
| Language / toolchain | Rust, edition 2024, pinned `nightly-2026-08-25` (`rust-toolchain.toml`) — nightly required for `stdarch` i8mm/dotprod intrinsics and `portable_simd` [Verified, High] |
| License | MIT License **with OpenAI/Anthropic Rider** — NOT OSI open source; full text read verbatim, rider scope quoted in §4.8; model weights under separate Baidu MIT notice reproduced in LICENSE [Verified, High] |
| Scale | One lib crate (75 src files, 105,330 Rust lines) + workspace members `focr-wasm` (666 lines) and `focr-ios` (1,534 lines); 29 test files (18,490 lines); 5 bench files (3,940); 4 fuzz targets + committed corpus; 5 examples (546) [Verified, High] |
| Stars / forks | 328 stars / 39 forks (GitHub API) [Verified, High] |
| Releases / tags | Tags v0.1.0–v0.9.0 plus model-artifact tags (`models-unlimited-wasm-v1`, `models-tromr-v1`, …); binary releases v0.5.0–v0.9.0 with 10–15 assets each; latest v0.9.0 published 2026-08-23 [Verified via API, High] |
| Last push | HEAD commit 2026-09-22 04:30:16 UTC [Verified, High] |
| Maintainer | Single: Dicklesworthstone (Jeffrey Emanuel, per LICENSE copyright) — bus factor 1, and the README's contribution section explicitly declines all outside contributions [Verified, High] |
| Inception | 2026-06-24 per CHANGELOG ("planning and scaffolding"; first working end-to-end engine 2026-06-29) [Maintainer claim, High] |

**Analyst method.** Fresh shallow clone of HEAD to `~/workspace/.scratch/franken_ocr-verify/`. Read: README (994 lines, in full), LICENSE (verbatim, both the rider and the Baidu weights notice), CHANGELOG (scope window + release sections), `AGENTS.md` (engineering doctrine), `Cargo.toml` (deps, features, profiles), `docs/NEGATIVE_EVIDENCE.md` (ledger contract + truth-pack section), `docs/PERF_LEDGER.md` (measurement protocol), `docs/DECODER_E2E_PARITY_RESULTS.md` (ladder table), `docs/FEATURE_PARITY.md` (scoring contract), `docs/gauntlet/RELEASE_READINESS.json` (committed scorecard). Grep-verified: Rust line/file counts by tree area, `unsafe` census with per-site classification (SIMD islands vs string literals vs comments), `deny`/`forbid`/`allow` gate distribution, `asupersync` usage (4 files, 22 mentions), absence of `build.rs`, absence of CUDA/WGPU/Metal in `src/`, the 2,148-tensor recipe assertion in `src/quant/convert.rs`, manifest-v2 model entries, and the Apple-QoS FFI island. Fetched: GitHub API (repo, releases, tags, assets, Actions runs, crates.io API), all Quick Links (HTTP status checked). Web-searched for independent coverage (benchmarks, reviews, production use). **Not done:** did not compile the workspace, run any test, execute `focr`, reproduce any benchmark, run the parity ladder, or download model weights — all behavioral and performance claims rest on maintainer evidence plus revision-bound documentation. Shallow clone only (no history beyond HEAD). CI per-run greenness beyond the latest runs' recorded conclusions was not scraped. Star/fork counts from the API; download counts per asset from the API.

## 4.2 Executive verdict

franken_ocr is a **substantive, self-critical clean-room pure-Rust reimplementation of the Baidu Unlimited-OCR inference stack** [Inference, High] — not vaporware: a shallow clone of HEAD confirms 105,330 lines of first-party Rust in one library crate [Verified, High], a complete wired forward (preprocess → SAM-ViT-B → 16x conv compressor → CLIP-L/14 → projector → 12-layer DeepSeek-V2 MoE decoder with R-SWA → lm_head → sampler) [Verified module topology, High; numeric parity Maintainer claim, Medium], four additional zoo models with runtime arms (GOT-OCR2, SmolVLM2, OneChart, TrOMR) [Verified modules + manifest entries, High], a 2,148-tensor int8 recipe assertion enforced in code [Verified, High], tagged binary releases for six platforms with SHA256 sidecars [Verified via API, High], and a conformance apparatus (truth pack, L0–L5 ladder, three-pillar gauntlet) that refuses to certify what it cannot prove [Verified docs + scripts exist, High]. Its most original contribution is the **evidence methodology** — artifact-graph ledgers with hash-pinned provenance, skip-honest no-weights mode, published losing rows, and an explicit refusal to claim the unavailable three-party OpenPGP signing certificate [Verified, High]. **But:** it is bus factor 1 with an explicit no-outside-contributions policy [Verified, High]; zero independent validation of any kind was found [External, High within recall]; the CI workflows that the release certification depends on have been deleted from the tree at HEAD and the last runs (2026-09-03) failed [Verified, High]; README-vs-code drift is measurable (v0.8.0 badges vs v0.9.0 reality, "13–17 MB" binaries that are 20.6–28.5 MB, `#![forbid]` claimed vs `#![deny]` shipped, CHANGELOG scope window a month stale) [Verified, High]; the headline speedups rest on maintainer hardware [Maintainer claim, Medium]; and the MIT+OpenAI/Anthropic-rider license withholds all rights — including benchmarking and analysis — from OpenAI, Anthropic, their affiliates, and anyone acting for them [Verified, High], which is **not OSI open source** and sits in direct tension with the project's "agent-first" positioning. **NODUS: Pilot** — release artifacts exist and the bounded workload (offline CPU OCR where no GPU exists: CI runners, agent hosts, edge boxes) is real and documented — but the dead CI and the doc drift are the revisit triggers that would ring it back down to Explore. **Wardley: custom-built inference engine approaching product, with the certification methodology as the most transferable component.**

## 4.3 Claim inventory: demonstrated vs aspirational

Status values: *demonstrated* / *partially demonstrated* / *aspirational* / *disproven* / *stale*.

| # | Claim | Status | Evidence |
|---|---|---|---|
| 1 | Pure-Rust, CPU-only OCR engine for Baidu Unlimited-OCR, no ML framework | **Demonstrated** | [Verified, High] — 105,330 Rust lines; no `build.rs`; no `tch`/`burn`/`ort`/CUDA in `src` (grep-clean); compute comes from hand-written kernels plus the sibling `frankentorch` kernel crate (path dep) |
| 2 | Five-model zoo (Unlimited-OCR, GOT-OCR2, SmolVLM2, OneChart, TrOMR), all pullable via `focr pull` | **Demonstrated** | [Verified, High] — runtime arms in `src/native_engine/` (`got.rs`, `smolvlm2.rs`, `onechart.rs`, `tromr.rs`); `models/manifest-v2.json` (embedded in the binary) lists all five with byte sizes and SHA256 part hashes: unlimited-ocr 4.157 GB, got-ocr2 814 MB, smolvlm2 1.087 GB, onechart 363 MB, tromr 61 MB int8 / 86 MB f32 |
| 3 | "No Python" | **Partially demonstrated** (true of inference; false of the repo) | [Verified, High] — the inference path is Rust-only, but the release-certification and oracle harness are Python (`scripts/gauntlet_cert.py`, `gen_reference_fixtures*.py`, `bench_guardrail.py`); unqualified readings of the tagline overstate it |
| 4 | "No FFI at inference" | **Partially demonstrated** — one narrow contradiction | [Verified, High] — no C++ ML FFI anywhere; but `src/lib.rs`'s `apple_qos` island calls `libc::pthread_set_qos_class_self_np` on kernel worker threads, i.e. FFI executes on the Apple inference path. The honest reading is "no ML-framework FFI," not zero FFI |
| 5 | `#![forbid(unsafe_code)]` "everywhere except small audited islands" | **Partially demonstrated** (wording drift) | [Verified, High] — the lib crate root is `#![deny(unsafe_code)]`, not `forbid` (the two `[[bin]]` shims are `forbid`); the islands are real and audited: 4 SIMD modules (x86 30, arm 25, wasm128 7, int4 5 unsafe-leading lines, each with `// SAFETY:` notes and bit-identical scalar fallbacks), the Apple-QoS island (1 call), and the opt-in read-only mmap island (1 call). Every other `unsafe`-word hit is a string literal or comment |
| 6 | Conservative int8 recipe: exactly 2,148 FFN/expert tensors int8; 48 attention projections + `lm_head` high precision | **Demonstrated** | [Verified, High] — `src/quant/convert.rs` test `unlimited_ocr_validated_recipe_has_exactly_2148_int8_tensors` asserts `quantized == 2148` and `names.len() - quantized == 49` ("48 attention + one lm_head") |
| 7 | Headline speedups: 3.37x/2.58x/1.67x zoo decode-per-token vs HF CPU; 2.8–3.4x end-to-end vs torch bf16 (v0.6.0 notes) | **Partially demonstrated** | [Maintainer claim, Medium] — ledgered in `docs/PERF_LEDGER.md` with a real measurement protocol (pinned oracle `torch==2.10.0`/`transformers==4.57.1`, fairness columns, artifact-graph provenance); losing rows are also published. No independent rerun exists |
| 8 | Accuracy: historical CER 0.0094 single page; v0.7.0 artifact 20/20 pages at aggregate CER 0.19307925 (budget 0.25); page0590 tail 0.6164886 | **Partially demonstrated** | [Maintainer claim, Medium] — the README itself hedges the 0.0094 row as "historical… not a release-wide certificate," and publishes the page0590 tail as a limitation. Parity receipts (`docs/DECODER_E2E_PARITY_RESULTS.md`: cosine 0.9999+ per stage, exact first-token argmax) are maintainer-produced, not independently reproduced |
| 9 | "Current release assets are about 13 to 17 MB" | **Disproven** | [Verified, High] — v0.8.0 assets measure 20.6–28.5 MB, v0.9.0 21.3–30.5 MB (GitHub API). Off by ~1.6x |
| 10 | "Current Release v0.8.0" / badges pinned to v0.8.0 | **Stale** | [Verified, High] — v0.9.0 released 2026-08-23 (12 assets); `Cargo.toml` is 0.9.0; CHANGELOG has a 0.9.0 section. README and badges still say v0.8.0 |
| 11 | "CI exists and invokes `scripts/check.sh` as its single test step" (AGENTS.md) | **Disproven at HEAD** | [Verified, High] — no `.github/` directory in the tree; the Actions API lists 1,006 historic runs but zero current workflows; the latest runs (2026-09-03, commits `8a685213`/`f3cefd26`) completed **failure** / cancelled. No CI has run in ~3 weeks while commits continued |
| 12 | `focr robot selftest` proves int8 GEMM bit-identical to the scalar oracle incl. K=6848 worst case | **Partially demonstrated** | [Verified code exists, High] + [Maintainer claim on behavior, Medium] — `tests/int32_overflow_proof.rs`, `tests/property_suite.rs`, and the `selftest` subcommand exist; not executed by the analyst |
| 13 | asupersync-integrated runtime | **Demonstrated** | [Verified, High] — real optional dependency (v0.5.0, `[patch.crates-io]` to the sibling checkout); used in 4 files / 22 mentions (`cli.rs`, `dist.rs`, `lib.rs`, `storage.rs`) for orchestration, cancellation, and the pull HTTP stack (rustls + webpki-roots). The sibling constellation is embraced here, unlike FrankenRedis which evaluated and rejected it |
| 14 | Offline at inference; network only for explicit `focr pull` | **Partially demonstrated** | [Maintainer claim, Medium] — the pull path is the only network surface in the described architecture (asupersync HTTP); inference code paths show no network use, but the analyst did not trace every call path |
| 15 | int4 support | **Aspirational** (honestly labeled) | [Verified disclosure, High] — README: "Int4 remains gated and unvalidated"; doctrine keeps it behind the CER kill-switch. Not claimed as shipped |
| 16 | CUDA backend | **Aspirational** (honestly labeled) | [Verified disclosure, High] — "CUDA is a deferred stretch goal… no timeline," FAQ: "Can it use my GPU? No." |
| 17 | The strict three-party OpenPGP release certificate | **Disavowed by the maintainer** | [Verified, High] — README (twice): "The release does not claim the strict three-party OpenPGP certificate"; the gauntlet finalizer "exits 1 until fresh CI artifacts and three trusted signers finalize it." A non-claim, reported as a governance positive |
| 18 | TrOMR artifacts: 61 MB int8 / 86 MB f32 | **Demonstrated** | [Verified via release API, High] — `models-tromr-v1` assets: `tromr.int8.focrq` 61.1 MB, `tromr.focrq` 86.2 MB |
| 19 | Published on crates.io | **Partially demonstrated** (live discrepancy) | [External, Medium] — crates.io API reports `franken_ocr` 0.9.0 (44 downloads, published 2026-08-23), but the canonical web page `https://crates.io/crates/franken_ocr` returns **404**. Unresolved whether this is an indexing quirk or a real publication problem |
| 20 | Resident warm-model daemon (v0.8.0) keeps weights in RAM between invocations | **Partially demonstrated** | [Verified code exists, High] — `src/resident.rs` (45 KB); behavior [Maintainer claim, Medium], not executed |
| 21 | "13/13 release-readiness gate" passed (README; v0.6.0 notes: "the release-certification gauntlet closed 13/13") | **Partially demonstrated** (stale at HEAD) | [Verified artifact exists, High] + [Maintainer claim on the pass, Medium] — `docs/gauntlet/RELEASE_READINESS.json` is committed with 10 blocking cells and per-cell evidence paths; but the gate's CI/dist inputs no longer exist at HEAD (claim 11), so the pass cannot be current |

## 4.4 Architecture (reconstructed, not summarized)

[Verified from the clone; README diagrams treated as claims where noted]

**Crate topology:** a single library crate (`franken_ocr` 0.9.0) plus two thin `[[bin]]` shims (`src/main.rs`, `src/bin/focr.rs` — one line each, calling the shared `cli_main()`), with workspace members `focr-wasm` (browser build, 666 lines) and `focr-ios` (1,534 lines). This is *not* a workspace of small focused crates — it is one 105,330-line crate organized by module directory, with genuine monoliths: `src/music_input.rs` (6,621 lines), `src/native_engine/mod.rs` (6,088), and `src/native_engine/decoder.rs` (5,314) [Verified, High].

**Module topology:** `native_engine/` (the forward: `decoder.rs`, `decoder_qwen2.rs`, `moe.rs`, `sampler.rs`, `vision_sam.rs`, `vision_clip.rs`, `vision_siglip.rs`, `vision_bridge.rs`, `connector.rs`, `weights.rs`, `tensor.rs`, `nn.rs`, `rswa.rs`, `token_compress.rs`, plus zoo arms `got.rs`, `onechart.rs`, `smolvlm2.rs`, `tromr.rs`, `tromr_lineage.rs`, `unlimited_ocr_census.rs`, `spec.rs`, `model_arch.rs`, `calib.rs`, `postprocess.rs`, `batch_scheduler.rs`, `progress.rs`); `quant/` (the `.focrq` converter, incl. `convert.rs` with the 2,148-tensor recipe assertion, `bit_allocator.rs`); `simd/` (x86, arm, wasm128, int4 islands + scalar fallbacks); `preprocess/` (image ingest, PIL-exact resample, staff detection for the music lane); `pdf.rs` + `pdf_text.rs` + `pdf_vector.rs` (pure-Rust PDF rasterization over `lopdf`, with a bounded-zlib-inflate guard against zip-bomb FlateDecode streams); `tokenizer/`; `adaptive/` (conformal, tail-risk, USL fits — the "alien artifact" decision-theory machinery); `cli.rs`, `robot.rs`, `doctor.rs`, `dist.rs` (pull/install), `resident.rs` (warm-model daemon), `storage.rs` (fsqlite run telemetry), `conformance.rs` (ratchet machinery), `music_*` (diagnostics/execution/input for the TrOMR lane).

**Data flow:** image/PDF → `preprocess` (decode, deskew, tile) → vision tower (SAM-ViT-B → 16x conv token compressor → CLIP-L/14, features concatenated to 2048 dims) → linear projector (2048→1280) → DeepSeek-V2 MoE decoder (12 layers: layer 0 dense MLP, layers 1–11 MoE with 64 routed experts top-6 + 2 shared, all attention replaced by R-SWA with a 128-token generated-KV ring) → `lm_head` (1280→129280) → sampler → Markdown/JSON/MusicXML/NDJSON. No `tokio` in the data path; the owned asupersync runtime handles orchestration/cancellation/IO only, and the public `OcrEngine` API is synchronous and blocking.

**The model being run** (AGENTS.md §"What this model is"): Unlimited-OCR is an end-to-end VLM — DeepEncoder (SAM-ViT-B → 16× conv token-compressor → CLIP-L/14) → single linear projector (2048→1280) → DeepSeek-V2 MoE decoder (12 layers, hidden 1280, 10 MHA heads, `use_mla=false`, 64 routed + 2 shared experts, top-6, vocab 129280) with attention replaced by R-SWA (window 128); bf16, 6.67 GB single safetensors shard, MIT-licensed Baidu weights [Maintainer claim, High — corroborated by the pinned truth-pack sources].

**Dependency posture:** thin where it matters, constellation-coupled where it hurts. Direct deps: `clap`, `serde`, `thiserror`, `anyhow`, `image` (png+jpeg core), `lopdf` + `fax` + `flate2` (PDF), `half`, `bytemuck`, `rayon`, `sha2`, `num_cpus`, optional `memmap2`, `ctrlc`, `uuid`. The heavy compute comes from **path dependencies on sibling checkouts**: `ft-kernel-cpu` + `ft-core` from `../frankentorch`, `fsqlite` + `fsqlite-types` from `../frankensqlite`, and `[patch.crates-io] asupersync = { path = "../asupersync" }`. Consequence: **a fresh clone cannot build** [Inference, High — path deps verified in `Cargo.toml`, and the README states the sibling-checkout requirement explicitly] — the source build requires the three sibling repositories laid out beside it. The "portable single binary" story is therefore binary-distribution-only; the source story is constellation-distribution [Inference, High]. This is the inverse of FrankenRedis's self-contained tree, and it is the project's largest structural coupling.

**Memory-safety posture** [Verified, High]: lib root `#![deny(unsafe_code)]` (README says `forbid` — drift), both bin shims `#![forbid(unsafe_code)]`, `[lints.rust] unsafe_code = "deny"`. Effective first-party `unsafe` is confined to six audited sites: four SIMD modules (x86 30 / arm 25 / wasm128 7 / int4 5 unsafe-leading lines, each with `// SAFETY:` notes and bit-identical scalar fallbacks exercised by `robot selftest`), one Apple QoS `pthread` call, and one `memmap2::Mmap::map` call behind the `FOCR_MMAP=1` opt-in. No `build.rs`, no C/C++ FFI in the inference numerics.

**Distribution surface:** `install.sh`/`install.ps1` (SHA256-verified), Homebrew tap (`dicklesworthstone/tap/focr`, maintainer-claimed), `dist-v0.3.0/` (historical binaries committed in-tree — the Cargo.toml notes the tracked repo is ~180 MB), `site/` (committed WASM playground with `pkg/`), model weights on Hugging Face (`Dicklesworthstone/franken_ocr-weights`).

**README-vs-code drift (governance signal):** badges + "Current Release" say v0.8.0 (v0.9.0 is the release); "13 to 17 MB" binaries are 20.6–28.5 MB; `#![forbid(unsafe_code)]` claimed, `#![deny]` shipped; CHANGELOG scope window ends 2026-08-22 at a 2026-09-22 HEAD with an empty Unreleased section; AGENTS.md's "CI exists" vs no `.github/` at HEAD. Each instance is small; the pattern — docs lagging a fast tree, then the CI deletion — is the governance signal the Rulebook asks for.

## 4.5 Benchmark and conformance audit

### Maintainer-produced numbers

| Workload | Claimed result | Method controls (as documented) | Would it survive independent rerun? |
|---|---|---|---|
| Unlimited-OCR end-to-end vs torch bf16 (v0.6.0 release notes) | **2.8–3.4x** (page_0009: 8.6s vs 28.9s = 3.34x; page_0014: 14.7s vs 41.3s = 2.81x) | Same machine, same pages, matched thread budgets, "full fairness controls (thread parity, allocator parity, precision annotated, hash-anchored evidence)"; **comparison asymmetry:** "model load included on the focr side" — the notes do not state whether the torch side's load is included, so the end-to-end ratio flatters focr by an unstated constant | The load-bearing headline. Method is described seriously (PERF_LEDGER §9.3 fairness columns), but it is maintainer hardware, maintainer harness, no third-party rerun, and the load-accounting asymmetry is undisclosed. Provisional until independently reproduced |
| Zoo decode-per-token vs Hugging Face CPU (README, current) | **3.37x** GOT-OCR2, **2.58x** OneChart, **1.67x** SmolVLM2 | "aarch64 host with NEON dotprod at eight threads"; paired reference rows in `docs/PERF_LEDGER.md` | Same caveat; decode-only (excludes artifact load and vision). The ledger also keeps full end-to-end rows "including the current artifact-load tax" — the honest framing |
| Zoo decode-per-token vs HF f32 (v0.6.0 notes) | 3.05x / 2.25x / 1.50x | Matched threads | Superseded by the current README rows; shows the numbers move between rounds — healthy sign, not cherry-picking |
| TrOMR int8 vs f32 | int8 default "accepted with a ledgered discrepancy on one degraded Spohr page" | Real-scan music gate, frozen MusicXML anchors | The published loss inside a win — credible precisely because it is disclosed |
| Historical single-page CER | 0.0094, decode within one token of reference | Real page vs Baidu reference | Explicitly hedged by the README as "not a release-wide certificate" — do not cite without the hedge |
| v0.7.0 20-page corpus | 20/20 within budget, aggregate normalized CER **0.19307925** (budget 0.25); page0590 tail **0.6164886** | Hard-page termination gate, corpus budget | The tail is the honest number; the budget pass is the release claim |
| Fuzz sweep | 3.65M cases, zero crashes across 4 targets | Committed corpus under `fuzz/corpus/` | Execution claim; corpus exists [Verified, High], the 3.65M figure [Maintainer claim, Medium] |

**What the project disavows (quoted):** "The release does not claim the strict three-party OpenPGP certificate: the committed fail-closed finalizer requires three independently controlled registry-pinned signers and production audit receipts, which are not available in this release process." And on the 0.0094 row: "that single row is not a release-wide certificate." A packet must never cite the 3.34x or the 0.0094 without these sentences attached.

**Ledger volume note:** `docs/PERF_LEDGER.md` is 171 lines / 44 table rows — real but compact; the heavy evidence mass sits in `NEGATIVE_EVIDENCE.md` (1,343 lines), `DISCREPANCIES.md` (591), and `docs/gauntlet/METHODOLOGY.md` (664) [Verified, High]. The performance ledger's brevity is itself a finding: the project's measurement culture is wide (many ledgers) but the head-to-head row count is small.

**Reproduction cost (honest):** a fresh clone cannot build without the sibling checkouts (`../frankentorch`, `../frankensqlite`, `../asupersync`) plus pinned `nightly-2026-08-25`; the supported path is the prebuilt binary plus a 4.16 GB weight download (`focr pull` verifies SHA256 part-hashes). An independent rerun of the ledger needs the pinned oracle stack (`torch==2.10.0`, `transformers==4.57.1`, CUDA for the bf16 reference) and equivalent pinned-thread hardware. Expect hours, not minutes — and the 6.67 GB bf16 source checkpoint must be fetched out-of-band.

### Conformance evidence

- **Parity ladder L0–L5** (`docs/DECODER_E2E_PARITY_RESULTS.md`): on a real scanned page, preprocess cosine 0.99891, SAM 0.99992, CLIP 0.99921, projector/bridge 0.99964, decoder hidden 0.99995, lm_head logits 0.99990, first-token argmax **exact** (128818 == 128818), top-5 logit set identical [Maintainer claim, Medium — the doc is detailed and stage-isolated via hooked fixtures, but not independently reproduced].
- **FeatureUniverse/SurfaceMatrix** (`docs/FEATURE_PARITY.md`): every modeling feature, op, CLI surface, robot event, and parity gate enumerated as `present | partial | missing | n/a | excluded`, with "`partial` never rounds up" and `excluded` counted as coverage debt; `tests/surface_matrix.rs` fails if a live surface is missing from the ledger [Verified ledger + test exist, High].
- **Release certification** (`scripts/gauntlet_cert.py`, `docs/gauntlet/`): three-pillar scorecard, conformal ratchet (Jeffreys-posterior/Hoeffding lower bounds), Ville e-process invariant monitors, convergence gate (≥10 rounds), capacity certificate (bounded-stream soak, deadlock watchdog) [Verified machinery exists, High; gate outcomes Maintainer claim, Medium].
- **Property tests** (29 test files, 18,490 lines): SIMD-vs-scalar identity, K=6848 i32-accumulation proof, `.focrq` parser totality under byte mutation, tokenizer round-trip, batch byte-identity, `many_pages_without_deadlock` [Verified exist, High].
- **CI:** 1,006 historic runs, but the workflows are deleted from the tree and the last runs (2026-09-03) failed — the certification machinery's "download the exact CI artifacts for this HEAD" step currently has no CI to download from [Verified, High].

### Independent numbers

**None found.** Web search returns only the repository itself, its release notes, its docs, and fork copies (michelabboud, vladimirvalcourt, dmaharana, prajwal369 — bare forks, no independent work visible) [External, High within recall caveats]. No third-party benchmark, code review, or production deployment found. crates.io shows 64 total downloads; release assets show 2–81 downloads per binary. **Independent validation: zero.**

## 4.6 Comparison: who owns the lane

**The incumbent** is the official Baidu Unlimited-OCR stack — Python + Hugging Face `transformers` + CUDA. It owns the "run this model" lane outright: it is the reference implementation, it runs on GPU at far higher throughput, and it inherits the entire HF ecosystem (tokenizers, pipelines, serving). **Why the incumbent wins today, in one paragraph:** for anyone with a GPU, the official stack is faster per page, zero-porting-risk, and maintained by the model publisher; franken_ocr's reason to exist only activates where the incumbent cannot go — hosts with no usable GPU, no Python, or no CUDA — and even there it competes against generic CPU runtimes, not against Baidu.

**Adjacent lanes:** **llama.cpp** (owns the generic local-inference lane; K-quants, `mmproj` vision, GGUF ecosystem — but vision encoders are second-class and per-model tuning is generic); **ONNX Runtime / MLAS** (owns the portable-CPU lane via MLAS kernels; requires an export step and keeps framework generality); **PaddleOCR / MinerU / GOT-OCR2-official** (own specific OCR-model lanes, not this model); **Tesseract** (owns the commodity-OCR lane, far weaker models). The README's own comparison table concedes the point: franken_ocr is "the only one of these built for a fixed, hand-tuned set of models on CPU."

**The genuinely unoccupied lane [Inference, Medium]:** a *certified* fixed-model CPU inference runtime — hand-ported models with pinned-source truth packs, per-stage parity receipts, a no-green-without-weights skip-honest harness, and an agent-first contract (versioned NDJSON robot mode, `robot selftest` kernel proofs, `doctor` self-repair). Nobody owns it: llama.cpp optimizes for breadth, ONNX for generality, and the "evidence-graded release" discipline appears in no other competitor the packet audited. The lane is narrow — it only matters to operators who need *this* model's output on CPU-only hosts and care about provenance — but it is real, and franken_ocr is alone in it [Inference, Medium].

**Why the lane stays empty [Inference, Medium]:** entering it requires doing what each incumbent's strategy forbids. llama.cpp would have to hand-port one model and certify it stage-by-stage — anti-strategic for a project whose value is model breadth. ONNX would have to abandon framework generality for model-specific kernels. Baidu would have to maintain a Rust CPU port it doesn't need. The certified-fixed-model lane is therefore protected less by technology than by *strategy mismatch* — the moat is that nobody else wants to do this work, which is also why the lane is small.

## 4.7 Technical merit and adversarial review

**Strengths:**
1. **Evidence discipline without peer in this program.** The Phase −1 truth pack (pinned model commit `3a7f4dbb`, per-source SHA256s, pinned oracle stack), artifact-graph ledgers (PERF, NEGATIVE_EVIDENCE, DISCREPANCIES, hypothesis ledgers), the L0–L5 ladder with skip-honest mode, the conformal ratchet, and the fail-closed release finalizer that refuses the unclaimable OpenPGP certificate — this is the methodology-export lens made concrete: if the engine fails, the certification apparatus survives as a transferable artifact [Verified, High].
2. **Real implementation volume in the right places.** 105,330 lines with the mass in the forward (`native_engine/`), the quantizer, the PDF rasterizer, and the CLI/robot surfaces; five zoo models with real runtime arms; the 2,148-tensor recipe enforced by a code assertion; 18,490 lines of tests including overflow proofs and deadlock watchdogs [Verified volume, High; behavior Maintainer claim, Medium].
3. **Honest scope, stated plainly.** "A few models, not any model" is a deliberate non-goal; int4 is "gated and unvalidated"; CUDA is deferred with "no timeline"; the page0590 CER tail (0.6165) is published as a limitation; born-digital vector PDF pages and JPX/JBIG2 codecs surface precise errors instead of silent garbage [Verified disclosures, High].
4. **Distribution maturity unusual for a solo project.** Tagged releases with 6-platform binaries and SHA256 sidecars, a verifying installer, a Homebrew tap, a crates.io publication (page currently 404s — the discrepancy is in the claim inventory), an embedded SHA256-pinned pull manifest, and a committed browser/WASM playground [Verified, High].
5. **Agent-first ergonomics as a designed surface.** Versioned NDJSON robot mode with a frozen schema fixture and contract test, `robot selftest` (kernel-vs-oracle proofs on the user's own CPU), `robot triage`, `doctor` with reversible repairs, stable exit codes, deterministic output under fixed sampling, and a resident warm-model daemon — the operator experience is built for automation, not demoed for it [Verified surface exists, High].

**Weaknesses:**
1. **Bus factor 1 with an explicit no-contributions policy.** The README's contribution section declines all outside contributions ("I simply don't have the mental bandwidth to review anything"). There is no succession path, no second reviewer, and velocity is whatever one human plus agents can sustain [Verified, High].
2. **Zero independent validation of any kind.** No third-party benchmark, code review, production deployment, or external contributor found. Every number that matters was measured by the maintainer on the maintainer's hardware [Verified/External, High].
3. **The CI the certification depends on is gone.** The gauntlet's release finalizer is specified to "live-replay one exact-HEAD run of CI, dist, Model Parity, and Performance Gauntlet" — but `.github/` is absent from the tree at HEAD, the Actions API lists zero current workflows, and the last runs (2026-09-03) failed. A certification machine whose CI input no longer exists is a promise without a producer [Verified, High].
4. **Source builds require the sibling constellation.** `../frankentorch`, `../frankensqlite`, `../asupersync` must sit beside the checkout (path deps + `[patch.crates-io]`), so the "pure-Rust portable" story is binary-only. Anyone who needs to build from source — auditors, distro packagers, the labs the rider already excludes — inherits a four-repo checkout [Verified, High].
5. **Docs chronically lag the tree, and one headline number is wrong.** v0.8.0 badges vs v0.9.0 reality, "13–17 MB" vs measured 20.6–28.5 MB, `forbid` vs `deny`, a month-stale CHANGELOG window, "CI exists" vs deleted workflows. Each is minor; the pattern is the governance signal [Verified, High].
6. **The license is a strategic own-goal for the stated mission.** The rider withholds *all* rights — including benchmarking, testing, and analyzing — from OpenAI, Anthropic, affiliates, and anyone acting for them. The product is marketed "agent-first," but the excluded parties *are* the frontier agent-platform builders, and the rider's breadth (even benchmarking is forbidden) chills the independent validation the project most needs [Verified, High].
7. **Physics of the workload.** The default artifact is 4.16 GB, inference "peaks well above that," and the README's own checklist says a 3B VLM on CPU is "minutes-per-page territory on ordinary hardware, not seconds." The addressable market is hosts that need OCR but have no GPU — real, but bounded [Verified disclosure, High].

**Steelman of the bear case:** franken_ocr is a monumentally over-engineered answer to a question the market answers with a GPU or an API. Anyone who needs Unlimited-OCR output at volume buys CUDA time and runs the official stack; anyone who needs casual CPU OCR uses a smaller model in llama.cpp or a commodity cloud OCR API at a fraction of the operational cost. The fixed-model strategy — the project's core bet — is also its ceiling: five hand-ported models can never cover the long tail, and each new model is a fresh multi-month porting effort for one human who accepts no help. The certification machinery is admirable but self-graded: without CI, without a second party, and with a license that legally bars the labs most able to validate it, the ledgers are a diary, not an audit. The most likely terminal state is a well-documented, bit-rotting monument to one engineer's rigor — 105,330 lines on a pinned nightly, uninstallable from source without three sibling checkouts, whose binaries stop being rebuilt when the maintainer's attention moves on. Methodologies don't get paged at 3 AM, and neither will this.

**Hook audit (the packet grades its own hook):** "A pure-Rust, CPU-only OCR engine that runs a 3B MoE vision-language model with no Python at inference, no CUDA, and no ML framework — and documents, in committed ledgers, exactly where it loses." Every clause is verified or hedged: pure-Rust/CPU-only [Verified], 3B MoE VLM [Verified architecture], no CUDA [Verified grep-clean], no ML framework [Verified], "no Python at inference" with the repo-level Python harness qualification handled in the claim inventory, and "documents exactly where it loses" verified by PERF_LEDGER's losing rows, the page0590 tail, and the disavowed certificate. The hook survives.

## 4.8 License and governance (material, not boilerplate)

**License text, read verbatim** [Verified, High]: `LICENSE` is the MIT License **with an "ADDITIONAL RIDER / RESTRICTION (OpenAI / Anthropic)"** that is "part of the 'conditions' of this License" and "controls" in any conflict. Quoted scope: *"Restricted Parties" means OpenAI, L.L.C.; Anthropic, PBC; any of their respective Affiliates; and any person or entity acting directly or indirectly on behalf of, for the benefit of, or under the direction of any of the foregoing (including any officer, director, employee, contractor, agent, consultant, service provider, or representative).* *"Notwithstanding any other provision of this License, no rights are granted to any Restricted Party."* Disclosure/hosting/distribution to them is forbidden. *"Use" includes, without limitation: copying, modifying, … benchmarking, testing, analyzing, indexing, or incorporating the Software or any Derivative Works into any dataset, training corpus, evaluation harness, or pipeline for machine learning or other automated systems.* Breach terminates all permissions automatically; injunctive relief and attorneys' fees reserved to Jeffrey Emanuel (copyright holder, 2026). **Classification: NOT OSI open source** — named-party discrimination with a use-restriction covering even benchmarking and analysis. The LICENSE additionally reproduces the Baidu MIT notice for the model weights (Copyright (c) 2026 Baidu), which covers the weights and any quantized derivative the project distributes — that part *is* a clean MIT grant. This is source-available with a targeted exclusion.

**The rider as strategy:** it serves a defensive mission (preventing the two leading labs from absorbing the work into training corpora or evaluation harnesses without permission) but sabotages the project's most credible adoption path: the product is explicitly "agent-first" (robot NDJSON, `robot triage`, resident daemon), and the excluded parties are the frontier agent-infrastructure builders. The breadth is the tell — forbidding even *benchmarking and analysis* doesn't just block free-riding, it blocks the independent validation the project's own evidence culture needs. No third party can publish a benchmark without lawyering the rider first, which helps explain why independent validation is zero [Inference, Medium]. The README's License section does name the rider ("MIT License with an OpenAI/Anthropic Rider"), so the disclosure is better than a bare MIT badge — but the badge itself still reads "MIT".

**Governance:** owner-directed single maintainer; **no outside contributions accepted** (explicit policy, quoted in §4.7); zero open GitHub issues (API: `open_issues_count: 0` — issues are effectively off, with `.beads/` as the internal tracker); commit velocity high through 2026-09-22. Bus factor 1 [Verified, High]. **What breaks first if velocity decays:** the certification story — it already has: CI deleted, CHANGELOG a month stale, badges a release behind. Next is the pinned-nightly + sibling-constellation build, which no second party understands end to end; bit-rot within quarters, not years [Inference, Medium].

## 4.9 NODUS factsheet

| Criterion | Score | One-line justification |
|---|---|---|
| Technology readiness (TRL 1–9) | **6** | Tagged releases, trace download uptake (2–81 per binary, 64 crates.io), measured parity receipts — demonstrated in relevant environments; not 7 (no evidence of operational use beyond downloads) and not 8 (no production deployment found) |
| Strategic relevance (1–5) | **3** | Memory-safe, offline, CPU-only model inference is a real strategic gap for agent hosts and edge; capped by fixed-model scope and the rider |
| Impact potential (1–5) | **3** (4 if the certification methodology is exported) | The engine's market is bounded (no-GPU OCR); the gauntlet-as-method could outlive the engine |
| Implementation feasibility (1–5) | **4** | The core is built and shipping; remaining work (int4, WASM parity, docs/CI repair) is bounded and specified |
| Time to mainstream (1–5) | **2** | Needs independent validation, CI restoration, and a license a platform company can sign — years, if ever |
| Collaboration potential (1–5) | **1** | Source-available; contributions explicitly refused; rider blocks the two most likely AI-lab collaborators; bus factor 1 |

**Ring: Pilot.** The ring rules are mechanical: a release artifact exists (v0.9.0, six platforms, SHA256 sidecars, installer) and the bounded real-workload fit is genuine (offline CPU document OCR on hosts where the incumbent cannot run — CI runners, agent hosts, edge boxes — with real, if modest, download uptake). That clears the Pilot bar. The counter-case — dead CI, doc drift, zero independent validation — is recorded as the revisit trigger that rings it back down to Explore, not as a reason to deny what the artifacts prove.

## 4.10 Wardley placement

- **Document OCR as a capability:** Commodity — Tesseract, cloud APIs, and the official model stacks own it; franken_ocr adds no leverage here.
- **Fixed-model CPU inference engine (kernels, `.focrq`, runtime):** Custom-built → early Product — ships, runs, measured against oracles; moves to Product with independent validation and a restored CI; moves left toward legacy if the nightly pin and sibling constellation rot. Commodity pressure comes from the generic lane: if llama.cpp's vision support ever becomes first-class, the engine's only remaining defense is the certification discipline, not the kernels.
- **Release-certification methodology (truth pack, L0–L5 ladder, artifact-graph ledgers, conformal ratchet, gauntlet):** Custom-built, bordering on a publishable method — novel as a packaged discipline and the most transferable component; moves toward Product the moment a second project adopts it (see next step 1); moves toward irrelevance if it stays single-project scaffolding — a method nobody reuses is just documentation.
- **Agent-first operator surface (robot NDJSON, selftest, doctor, resident daemon):** Custom-built — no local-inference incumbent ships this combination; moves right if agent hosts standardize on it.
- **WASM/browser OCR lane:** Genesis — built (wasm-int4 artifact released, playground committed) but its parity story is the thinnest; moves right on a published CER-vs-native stress test or left into demo-ware.

**The decoupling lens:** franken_ocr represents *engine-from-framework* (model-specific kernels instead of a general runtime — the generality tax made visible and refused), advances *distribution-from-source* (binary-first with hash-pinned manifests; the source build is constellation-coupled), and *inference-from-network* (offline by construction). Its most interesting decoupling is *certification-from-developer*: the gauntlet attempts to separate "the evidence the release carries" from "the developer's word," which is the direction the whole FrankenSuite's methodology-export lens points.

## 4.11 Trajectory (12 / 24 / 60 months) — [Inference]

- **12 months:** the binary keeps shipping on the maintainer's cadence; int4 either graduates through the CER kill-switch or is ledgered dead; the WASM lane gets its stress test or stays a demo; either CI is restored (and the certification story becomes quotable again) or the docs keep drifting and the "certified" framing hollows out. Stays in Pilot only if the CI/docs decay reverses.
- **24 months:** bifurcation. **Upside:** an independent benchmark reproduces the zoo gauntlet rows, the certification method is adopted by a second project, and a narrow institutional user (an agent-platform company that can live with the rider, or a post-rider relicense) puts it in production — Pilot holds, with a path to a niche product. **Decay:** velocity slows with no successor (contributions are refused by policy, so there is no on-ramp); the pinned nightly ages; the sibling constellation drifts; the tree becomes uninstallable-from-source and the binaries stop being rebuilt — drifts to Monitor as a research artifact whose methodology outlives its product.
- **60 months:** binary. Either a niche-but-real artifact (the certified, memory-safe, offline OCR substrate embedded in agent/edge infrastructure — the "runs where ort/CUDA cannot build" lane, still unbuilt by anyone else), or superseded: llama.cpp or ONNX absorbs the fixed-model tuning lessons, Baidu's successors change the model, and the general "local VLM inference" lane consolidates around whichever runtime ships the evidence culture first. The verification methodology is the more likely survivor either way.

**Revisit triggers (concrete, observable):** CI workflows restored to the tree with green runs; first release cut after v0.9.0; any independent benchmark, code review, or production deployment; a second human contributor (requires a policy reversal); any change to the license rider; the crates.io 404 resolving or the crate being pulled; int4 graduating or being killed in the ledger.

## 4.12 Limitations and open questions (mandatory)

**Not done:** did not compile the workspace (would require the sibling checkouts and pinned nightly), run any test, execute `focr`, reproduce any benchmark, run the parity ladder, download model weights, or verify pull/install behavior — all behavioral and performance claims rest on maintainer evidence plus revision-bound documentation. Shallow clone only (no history beyond HEAD; the `.beads/` tracker was not analyzed). CI per-run details beyond the latest recorded conclusions were not scraped. Download counts from the API; the crates.io 404 was not root-caused. Web search for independent coverage carries the usual recall caveats. The Homebrew tap was not verified.

**Open questions that would most change the verdict:** why the CI workflows were deleted from the tree (deliberate retirement or accidental?); whether the crates.io 404 is an indexing quirk or a publication failure; actual ladder/gate outcomes at HEAD (the committed scorecards may predate it); whether any enterprise has evaluated the rider's legal exposure; the maintainer's succession intentions given the no-contributions policy; whether int4 or the WASM lane ever graduates; what the next release contains after a month of unreleased commits.

## The eight deepening questions (one paragraph each)

1. **Provenance.** franken_ocr records more provenance than any sibling assessed so far: `focr convert` stamps the source safetensors SHA256 into the `.focrq` header (`source_sha256`), `focr pull` verifies every part hash against a committed, schema-v2 manifest embedded in the binary, and every ledger row resolves against the Phase −1 truth pack (model commit `3a7f4dbb`, per-source SHA256s, pinned oracle stack) [Verified, High]. What it does not yet have is tamper-evidence end to end: the manifest is a static file, the header stamp is not hash-chained, and nothing stops a forged-recipe artifact from passing as conservative if the manifest itself is subverted — making attestation portable would require chaining the header record (source SHA256 + exact recipe + converter version) and having `focr doctor` verify it offline, which is exactly next step 5 [Inference, Medium].

2. **The embeddable unit.** The smallest useful adoptable piece is the `.focrq` format plus the `OcrEngine` synchronous blocking API — the README documents it as a five-line embed, and the engine owns its async runtime internally so callers thread no async plumbing [Maintainer claim, Medium]. The adoption cost is steep in practice: the crate is published on crates.io (though the web page currently 404s), but a source build demands the pinned nightly *and* the three sibling checkouts (`../frankentorch`, `../frankensqlite`, `../asupersync`) laid out beside it, the default model is a 4.16 GB download, and the license rider follows every derivative — so embedding means vendoring a constellation, not a crate [Verified, High].

3. **Unexercised option value.** The architecture holds at least four unused capabilities: the `focr-wasm` crate plus the committed `site/` playground and the released `models-unlimited-wasm-v1` int4 artifact are a browser OCR product waiting for its parity story; the `adaptive/` modules (conformal prediction, tail-risk, USL fits) are a decision-theoretic controller family the engine does not consult at runtime — a grep for `adaptive::` outside `src/adaptive/` returns zero hits, so they are currently dead code awaiting wiring [Verified, High]; the `doctor` reversible-repair surface is one step away from fleet remediation tooling; and the truth-pack/gauntlet machinery is a general numeric-software certification method currently aimed only at itself [Verified, High]. What unlocks them is, respectively, a published CER-vs-native browser stress test, wiring an adaptive controller behind its required deterministic fallback (the AGENTS.md contract already demands one), a second deployment to remediate, and a documented decoupling of the harness from franken_ocr's fixtures — all product decisions, none blocked on research [Inference, Medium].

4. **Benchmark honesty.** The numbers most likely to survive an independent rerun are the *adverse* ones — the page0590 CER tail of 0.6165, the "minutes-per-page on ordinary hardware" disclosure, the artifact-load tax rows, the TrOMR int8 discrepancy on the degraded Spohr page — because the project publishes its losses with the same ledger discipline as its wins, and nobody publishes losses they can't defend [Inference, Medium]. The load-bearing numbers for the performance thesis are the 2.8–3.4x end-to-end and 3.37x/2.58x/1.67x decode rows: they carry the strongest documented method in the program (pinned oracle, fairness columns, hash-anchored evidence) but they are maintainer-hardware numbers with no third-party rerun, and the end-to-end rows include model load on only one side of the comparison by the project's own description — so the thesis is honest but provisional until next step 2 lands [Verified method docs, High; rerun outcome unknown].

5. **The governance path.** There is no credible route from one maintainer to an institution under the current policy: outside contributions are explicitly refused, issues are effectively off (zero open), and the bus factor is 1 by design, not by accident [Verified, High]. The only paths are a policy reversal (accept contributors, open issues), an acquisition or hire of the maintainer, or a clean-room reimplementation of the methodology by a second party — and the rider's breadth makes the second party's lawyers flinch first [Inference, Medium]. What breaks first if velocity decays is already breaking: CI deleted, CHANGELOG a month stale, badges a release behind — the certification story decays before the code does, because the source tree still stands on its own while the evidence pipeline has no producer [Inference, High].

6. **The license as strategy.** The rider excludes exactly OpenAI, L.L.C., Anthropic, PBC, their affiliates, and anyone acting for, benefiting, or under the direction of them — and it defines "use" to include benchmarking, testing, analyzing, indexing, and training-data incorporation, with automatic termination and injunctive relief reserved to Jeffrey Emanuel [Verified verbatim, High]. As strategy it is coherent defensively (it prevents the two labs best positioned to absorb the work from doing so without permission) and self-sabotaging offensively: the product is marketed agent-first, the excluded parties *are* the frontier agent-platform builders, and the rider's inclusion of benchmarking chills the independent validation the project most needs — a combination that caps the upside at "niche tool for the non-lab world" by construction [Inference, Medium].

7. **Agent-era fit.** The concrete workload that would pick franken_ocr over llama.cpp or the official stack is an offline agent host or CI runner that must OCR scanned documents or PDFs with no GPU, no Python, and no network — a single SHA256-verified binary, `focr pull` once, then `focr ocr --robot` emitting versioned NDJSON with stable exit codes, kernel self-proofs via `robot selftest`, and a resident daemon amortizing the 4 GB load across invocations [Inference, Medium]. What would have to become true first: CI restored so the "certified" claim has a producer, an independent benchmark confirming the end-to-end rows (agents multiply pages; minutes-per-page is the budget that matters), and — unavoidably for lab-adjacent adopters — a license an agent-platform company can actually sign [Inference, Medium].

8. **The kill test.** The single event that would falsify the core thesis — "a fixed-model, hand-tuned CPU runtime beats general frameworks enough to matter" — is an independent, fairness-controlled rerun showing the end-to-end advantage evaporating outside the maintainer's harness: if llama.cpp or ONNX Runtime, given the same int8 recipe and thread discipline, matches franken_ocr within noise on the 20-page corpus, the generality tax the whole project is built to avoid turns out to be small, and 105,330 lines of model-specific kernels buy nothing a config file couldn't [Inference, Medium]. The experimental falsifications are nearly as decisive: a `robot selftest` failure on a new CPU (breaking the bit-identical-oracle contract), or the int4 graduation attempt blowing the corpus CER budget — either would collapse the pillar (measured kernels, honest gates) the thesis stands on [Inference, Medium].

---

**Working notes:** clean shallow clone at `~/workspace/.scratch/franken_ocr-verify/` (HEAD `5847deef`, 2026-09-22). All line counts from `find … -name '*.rs' | wc -l` / `xargs cat | wc -l` on the clone. API reads: GitHub repo/releases/tags/actions, crates.io API. No durable user-facing files created besides this assessment and its versioned intermediates.