# FrankenJAX — RULEBOOK v1.0 Assessment Packet v5 (final)

**Repository:** `Dicklesworthstone/frankenjax` · **Language:** Rust (edition 2024, nightly) [Code-verified, High] · **Pinned commit:** `3e22ef6c0ba2effaeca4295cf1d4af9695c2eabe` (2026-09-21 10:05:52 -0400, [Git-observed, High]) · **Last push:** 2026-09-21T14:05:54Z (pin date; the pin is the latest push confirmed in this assessment) [External (GitHub API), High] · **Scope:** the pinned commit only, not HEAD. No tags, no GitHub Releases [External, High]. *Cold-reader note: "v2" below = the second draft of this packet (rewrite-loop round 2). Key terms: **RCH** = Remote Compilation Helper, the maintainer's fleet of remote build workers that offloads `cargo` commands; **bead** = the repo's in-issue-tracker work unit (`.beads/issues.jsonl`); **V1** = the project's declared scope — CPU-only execution, no XLA lowering, pmap collectives fail closed; **x64 mode** = JAX's 64-bit precision flag (`JAX_ENABLE_X64=1`).*

**Method (analyst):** shallow clone checked out at the pin under `/tmp/frankenjax-verify` (verified non-empty); history deepening was not possible (fetch failed on config lock), so commit-window authorship analysis used the GitHub commits API (the 100 most recent commits) instead. Read: root `Cargo.toml`, all 17 crate manifests, `Cargo.lock`, `LICENSE` (verbatim), README (all 1,214 lines), `CHANGELOG.md` (head + scope window), `docs/NEGATIVE_EVIDENCE.md` (head), `docs/planning/FEATURE_PARITY.md` (head), `benchmarks/PERFORMANCE_COMPARISON.md` (full), the TTL struct in `fj-core`, the VJP/JVP dispatch tables in `fj-ad`, the unsafe census in `fj-ffi`, the `fj-backend-gpu` stub, the cache-key scheme in `fj-cache`, the `DType` enum, and the beads tracker. Counted: `.rs` files/lines (total, code-only, non-test), `#[test]`/proptest markers, `Primitive` enum variants (162), `DType` variants (11), VJP/JVP match arms, `rewrite!` sites excluding test modules (99), oracle fixture cases per family (861), open/closed beads (12 / 2,035), agent co-authorship trailers. **Not done:** the workspace was never compiled, nothing was executed, no test suite was run, no benchmark was reproduced, no GitHub Actions state exists to observe (the repo has zero workflows). Assessment date: 2026-09-22.

**Tier legend (Rulebook §1):** **[Verified]** direct inspection of the pinned clone or a live page read by the analyst — with flavors **[Counted]** (I ran the count), **[Git-observed]** (git metadata), **[Code-verified]** (source read); **[CI-observed]** is Tier 2 (seen executing on live CI pages — attests the suite *runs*, not that it is green); **[Maintainer claim]** asserted in README/docs, not independently executed; **[External]** independent sources; **[Inference]** analyst judgment, always labeled. Confidence: **High** (multiple converging sources or direct inspection) / **Medium** (single solid source, plausible) / **Low** (thin evidence, extrapolation).

---

## Hook

A 459,703-line [Counted, High], single-maintainer, clean-room Rust reimplementation of JAX's transform semantics (`jit`, `grad`, `vmap`) that ships a property test proving its `jit` is a no-op [Code-verified, High] — because V1 has no compiler, only an interpreter, and the maintainer tests the transparency instead of hiding it. Around that sits a heavily instrumented AD stack: VJP+JVP dispatch for 157 primitives checked against 861 counted JAX-oracle fixtures [Counted, High on the fixtures], a Trace Transform Ledger that turns every transform composition into an auditable proof artifact [Code-verified, High], and a 6,109-line ledger of the project's own optimization failures [Counted, High]. The structural facts: zero public CI (no GitHub Actions workflows exist [External, High]), no release artifact, documentation stale by 3x on its own line count [Counted, High], and a license naming OpenAI and Anthropic as forbidden parties — while 52 of the 100 most recent commits were co-authored by Anthropic's models (plus one by Grok) [External, High].

---

## TL;DR

- **What it is:** A from-scratch Rust reimplementation of JAX's transform semantics — not JAX the ML framework, but its mathematical core: a canonical JAXPR-like IR (`fj-core`), tracing from Rust closures (`fj-trace`), order-sensitive `jit`/`grad`/`vmap` composition (`fj-dispatch`), tape-based reverse-mode and forward-mode AD for 157 primitives (`fj-ad`), an e-graph optimizer (`fj-egraph`), and a differential conformance harness against real JAX oracle fixtures (`fj-conformance`) — 459,703 first-party lines across 17 crates at the pin [Counted, High].
- **Strongest evidence:** 861 JAX-oracle fixture cases counted exactly per family (613 transforms + 25 RNG + 46 linalg/FFT + 15 composition + 162 dtype-promotion) [Counted, High]; the VJP/JVP dispatch tables read in source (134 explicit VJP arms incl. grouped zero-gradient and fail-closed pmap arms + fallback; 123 JVP arms + 6 multi-output rules + fallback) [Code-verified, High]; unsafe code contained to the single FFI call boundary in `fj-ffi` (16 crates `forbid(unsafe_code)`) [Code-verified, High]; a 12-case TTL semantic proof matrix, all passing [Counted, High]; and the negative-evidence perf ledger recording measured wins *and* rejections with criterion CIs [Code-verified, High]. The *discipline* is verified; the *results* (greenness) are maintainer-asserted — see below.
- **Strongest doubts:** No third party can observe any test passing — zero GitHub Actions workflows exist, so every "green" claim executes on the maintainer's local RCH fleet and is attested only by checked-in artifact JSON [External + Inference, High]. The README contradicts itself and the code on the most basic facts (118 vs 162 primitives, 15 vs 17 crates, 162,733 vs 459,703 lines) [Counted, High]. `jit` is semantically transparent (a verified no-op) — the "compiler" is an interpreter, so the XLA-compilation half of JAX semantics is explicitly not reimplemented [Code-verified, High]. One human maintainer with an explicit no-outside-contributions policy [Maintainer claim, High]. And the license rider bars OpenAI/Anthropic and their agents from even *analyzing* the code — the same labs whose models co-authored 53% of recent commits [External, High].
- **NODUS ring: Explore** [Inference, Medium] (TRL 4 — see §4.9). Substantive-but-unproven is the textbook Explore case; the rider is the advancement blocker (Explore-with-a-ceiling). The evidence machinery (TTL, gate scripts, e2e forensic logs, negative-evidence ledger) is worth tracking as a *methodology* exemplar; the software itself is currently un-advanceable while the rider stands.

---

## Quick Links

Pin-relative links (`blob/3e22ef6c0ba2effaeca4295cf1d4af9695c2eabe`); verified resolving 2026-09-22 (HTTP 200 each) [Verified, High]:

1. [Repository](https://github.com/Dicklesworthstone/frankenjax)
2. [README](https://github.com/Dicklesworthstone/frankenjax/blob/3e22ef6c0ba2effaeca4295cf1d4af9695c2eabe/README.md)
3. [License (with AI-lab rider)](https://github.com/Dicklesworthstone/frankenjax/blob/3e22ef6c0ba2effaeca4295cf1d4af9695c2eabe/LICENSE)
4. [Changelog](https://github.com/Dicklesworthstone/frankenjax/blob/3e22ef6c0ba2effaeca4295cf1d4af9695c2eabe/CHANGELOG.md) — scope window ends 2026-08-19; "HEAD" pointer is stale (see claim 13)
5. [Negative-evidence doc](https://github.com/Dicklesworthstone/frankenjax/blob/3e22ef6c0ba2effaeca4295cf1d4af9695c2eabe/docs/NEGATIVE_EVIDENCE.md) — points to the canonical `evidence/perf/negative_evidence_ledger.md`
6. [Feature-parity audit](https://github.com/Dicklesworthstone/frankenjax/blob/3e22ef6c0ba2effaeca4295cf1d4af9695c2eabe/docs/planning/FEATURE_PARITY.md) — 2026-05-01 audit, refreshed 2026-05-12
7. [JAX performance comparison](https://github.com/Dicklesworthstone/frankenjax/blob/3e22ef6c0ba2effaeca4295cf1d4af9695c2eabe/benchmarks/PERFORMANCE_COMPARISON.md) — vs JAX 0.10.1 CPU, 2026-05-25
8. [TTL semantic proof matrix](https://github.com/Dicklesworthstone/frankenjax/blob/3e22ef6c0ba2effaeca4295cf1d4af9695c2eabe/artifacts/conformance/ttl_semantic_proof_matrix.v1.json) — 12/12 cases pass at the pin
9. [Actions page](https://github.com/Dicklesworthstone/frankenjax/actions) — zero workflows; there is no CI to link to (a finding, not an omission)

---

## Did You Know

The `jit` transform in FrankenJAX is a *verified no-op* — and the project tests the fact rather than hiding it. In V1 there is no compiler: `jit` is "semantically transparent," the dispatcher explicitly "strips leading `jit`" as a pass-through, and a metamorphic property test (`metamorphic_jit_transparent`) asserts `jit(f)(x) == f(x)` to 1e-14 across random inputs — i.e., the test suite proves the flagship transform does nothing [Code-verified, High]. This is the honest shape of the project's actual scope: it reimplements JAX's *transform composition semantics* (what `grad(vmap(f))` means), not JAX's *compilation pipeline* (XLA lowering is explicitly out of scope). A JAX reimplementation that proves its `jit` is identity is either a confession or a flex — here it reads as both [Inference, Medium].

---

## Franken-worthy next steps

1. **Extract the Trace Transform Ledger as a standalone, versioned crate with a frozen schema.** The TTL — `{root_jaxpr, transform_stack, transform_evidence}` plus `composition_signature()` — is the project's most novel artifact: an auditable proof object for transform composition that JAX itself does not produce. *Done when:* `fj-ledger`'s TTL is published as a versioned crate with a frozen JSON schema, and a *second* implementation (e.g., a Python shim emitting TTLs for real JAX traces) produces artifacts this repo's verifier accepts. Falsifies the "TTL is portable evidence" claim on first cross-implementation rejection. [Inference, High — process proposal]
2. **Replace fixed fixtures with a continuous randomized differential fuzzer against live JAX.** The 861 fixtures are fixed cases; the repo already has `proptest` strategies for generating Jaxprs (`fj-core/src/proptest_strategies.rs`), though their IR-surface coverage is itself unverified. Wire them into a differential gate that generates random programs, runs them against live JAX, and reports the divergence rate. *Done when:* a scheduled gate runs ≥10k random programs and publishes the divergence count; the first divergence falsifies a "semantic fidelity" claim the fixed fixtures cannot. [Inference, High]
3. **Audit the 50 zero-gradient VJP arms and convert placeholders into rules or typed errors.** This round's arm-parser re-examination corrected v2: there are no wildcard fallbacks — both AD dispatchers are exhaustive by construction — but 50 VJP primitives sit behind zero-gradient rules, and a visible subset (`Ldexp`, `CopySign`, `Select`, `OneHot`, `Cummax`/`Cummin`, `Qr`, `Svd`, `Eigh`, …) are differentiable primitives where zero is a placeholder, not a derivation. For each of the 50, either derive the real rule or return a typed `Unsupported` error so the match distinguishes "gradient is truly zero" from "not yet derived." *Done when:* no zero-gradient arm covers a differentiable primitive without a cited justification comment, and the placeholder count is zero. Falsifies "157/157 hand-derived" in its current form on first audit. [Inference, High]
4. **Re-pin the toolchain and re-run the gate suite from a clean checkout.** `rust-toolchain.toml` is 0 bytes at the pin while the README points at it as the toolchain pin — every reproducibility claim in the evidence machinery rests on a foundation that currently says nothing. *Done when:* the file pins a real nightly, a fresh-clone `cargo test --workspace` passes against it, and the gate artifacts are regenerated and committed. Falsifies "the evidence is reproducible" on first red gate. [Inference, High]
5. **Audit asupersync as shared supply-chain surface across the Suite.** FrankenJAX is the first repo found *depending* on asupersync (0.5.0, non-optional in `fj-conformance` for the durability encoding pipeline; optional feature-gated async bridge in `fj-runtime`) where frankenredis evaluated and rejected it. *Done when:* the program records asupersync's actual API surface used per repo, its version pins, and whether the "evaluated-and-rejected" verdict in one repo contradicts the "adopted" verdict in another. [Inference, High]
6. **Adopt the negative-evidence perf ledger as the program's optimization-evidence template.** The `evidence/perf/negative_evidence_ledger.md` pattern — per-optimization entries with agent attribution, same-worker/same-binary criterion rows with CIs, and explicit rejections — is stronger than generic "benchmark better" guidance and directly complements frankenredis's loss ledger. *Done when:* the ledger schema is extracted and written into the program's assessment protocol with a named owner. [Inference, High]

---

## 4.1 Why it exists — the market problem

**The problem, as the maintainer frames it:** JAX's transform semantics — the compositional meaning of `jit`, `grad`, `vmap` and their interactions — are deeply entangled with Python and XLA. There is no standalone, portable, verifiable implementation of the mathematical core: no way to embed JAX-style AD in a Rust application without Python, no reference implementation a verification engineer can audit, and no canonical artifact that says "this is what `grad(vmap(f))` means" outside the JAX codebase itself [Maintainer claim, Medium].

**Who feels the pain:** compiler researchers studying transform composition, Rust developers who need AD without a Python runtime, verification engineers who want auditable evidence that a transform pipeline did what it claimed, and educators teaching AD/IR design (the README's stated audiences) [Maintainer claim, Medium]. Note the honest scoping sentence in the README's comparison table: "FrankenJAX is not a replacement for JAX in production ML training" [Maintainer claim, High] — the project positions itself as a *reference implementation*, which bounds the addressable pain to research/verification/education rather than production ML.

**Why now:** the honest answer may be "the maintainer's program, not a market moment" [Inference, Low]. The Rust numerical ecosystem (`half`, `rayon`, `egg`, `proptest`, `criterion`) is mature enough to attempt a from-scratch AD engine [Inference, Medium], and the project's own velocity shows the agent-assisted loop makes a 460k-line solo codebase tractable — though that loop's output share is unmeasured (53% of *recent commits* carry agent trailers; line-level share is unknown), so the tractability inference is thin [Inference, Low]. Whether "now" reflects real demand is unproven — no production users, no downstream dependents, no release artifact, zero independent coverage found [External, High within recall caveats].

**Why a reimplementation, not a binding:** stated implicitly throughout — JAX cannot be used without Python+XLA; only a clean-room re-derivation yields a dependency-free artifact (the comparison table's "Runtime dependency: None (standalone)" row) [Maintainer claim, Medium]. The tradeoff is explicit in the architecture: no XLA lowering (interpretation instead), no device placement (CPU only), no SPMD — the reimplementation keeps the *semantics* and drops the *compilation pipeline* [Maintainer claim, High].

**Demand-side check:** a web search for independent coverage of FrankenJAX (production users, third-party reviews, downstream forks, citations) returned nothing beyond the repository itself on 2026-09-22 [External, High within recall caveats]. The 11 stars / 4 forks [External, High] are consistent with a project in the reference-implementation stage. Unlike frankenredis's lane (where Valkey demonstrably occupies the "open Redis" window), the "standalone JAX transform semantics" lane has no occupant at all — but also no demonstrated demand: it is an unoccupied lane because nobody has shown up, not because competitors were beaten [Inference, Medium].

**What would create demand:** the lane is empty because nobody has shown up, but demand is imaginable — a JAX governance or licensing shock that makes a non-Google-controlled semantics layer valuable; an export-format war where `jax.export`'s StableHLO proves insufficient for auditability and a proof-carrying alternative (the TTL) becomes the differentiator; or regulated-industry pressure (finance, medical devices) for verified differentiable pipelines where "the transform composition is provably correct" is a compliance artifact. None of these are visible today; all are speculative [Inference, Low]. The honest demand-side summary: this is a supply-side project (a maintainer building the reference implementation they wish existed) waiting for a demand shock, and the packet prices it accordingly.

**Adjacent context:** one entry in the solo-maintainer FrankenSuite program of clean-room Rust reimplementations. The asupersync relationship here is adoption, not rejection: `fj-conformance` depends on asupersync 0.5.0 (non-optional) as the encoding substrate for the RaptorQ-branded durability sidecars, and `fj-runtime` carries an optional, feature-gated (`asupersync-integration`, default off) async bridge [Code-verified, High] — the opposite posture from frankenredis's evaluated-and-rejected, and the reason next step 5 exists.
## 4.2 Project scope and maturity signals

**One-line verdict:** Scope is enormous and documented; maturity is *claimed* at 113/113 gates while the project's own stale README understates the codebase by 3×.

**Stats** (all counted at the pin): 17 crates, 310 `.rs` files, 459,703 total lines, ~393,827 code lines excluding comments/blanks, ~254,881 rough non-test code lines (excludes `//`-comments, `/* */`-blocks, doc comments, and blank lines; an approximation, not a compiler count), 9,354 `#[test]` markers, 23 `proptest!` blocks [Counted, High]. The README claims 15 crates / 162,733 lines / 4,416 test+proptest markers — stale by roughly 2.7–2.9× on lines and 2.1× on test markers [Counted, High]. The feature-parity doc (2026-05-01 audit, refreshed 2026-05-12) says the "audit was performed on the HEAD commit" — the line counts it cites (167,676 lines in `crates/*`, 28,860 in benchmarks/examples) match neither the current pin nor any cited commit, so its quantitative claims are audit-dated to May [Maintainer claim, Medium — explicitly time-bounded].

**Velocity:** the CHANGELOG records 4,200 non-merge commits in March–August 2026 (4,420 total) [Maintainer claim, Medium], but the changelog's scope window *ends* 2026-08-19 and its "HEAD" pointer names commit `658740e0e6` — neither the pin nor any verifiable anchor [Git-observed, High — the pin was confirmed 2026-09-21 via API]. The 100 most recent commits (all 2026-09-17…21 via the GitHub commits API) are dominated by JSON evidence-regeneration commits ("auto-format + validate", "TTL ledger refresh", "Evidence regeneration for …") — style/hygiene work, not feature work [External, High]. The September pin commit itself touched 27 files and 36k lines: 35,991 insertions vs 19 deletions across 25 JSON artifacts plus one `Cargo.lock` change — an evidence-regeneration commit [External, High]. Velocity pattern: feature development through August, then a consolidation/hygiene phase [Inference, Medium].

**Docs quality:** exceptional for prose, poor for self-consistency. The README (1,214 lines) includes a full JAX comparison table, architecture diagrams, a feature-parity narrative, and a security section; the negative-evidence docs are book-length [Code-verified, High]. But the internal contradictions are basic: the feature badge says "113/113 AD primitives" [Maintainer claim, Medium — dated, stale], the architecture section says 118 [Maintainer claim, Medium], the code has 162 [Counted, High]; the crate/line counts disagree with the tree; the README's "Security posture: all crates forbid unsafe" contradicts `fj-ffi`'s actual `deny(unsafe_code)` [Code-verified, High]; and `rust-toolchain.toml` is 0 bytes at the pin while the README tells readers to consult it [Git-observed, High]. A cold reader trusting the README alone would understate the codebase by 3× [Inference, High].

**Authorship signals:** of the 100 most recent commits, 53 carry agent Co-Authored-By trailers: 52 Claude-family (48 "Claude Opus 4.8 (1M context)," 3 "Claude," 1 "Claude Opus 4.8") and 1 Grok [External, High]. No GitHub `Co-authored-by` convention issue here — the trailers are explicit. One human committer overall, per the commit list [External, High].

**Dependency posture:** 42 external dependencies in `Cargo.lock`; the Cargo.toml union shows `asupersync 0.5.0` (encoding substrate for durability sidecars; required by fj-conformance), `egg 0.10` (e-graph engine), `ndarray 0.16`, `proptest 1.5`, `criterion 0.5`, `rayon`, `nalgebra 0.34`, `thiserror`, `serde`, `clap 4.5`, `num-traits`, `half`, `rug 1.27` (multi-precision floats), `fftw 0.9`, `statrs`, `rustfft 6.3`, `rand` family, `mimalloc` (optional), `tokio` (in dev-dependencies only), `tempfile`, `blake3`, `camino`, `ftui 0.2.1` (feature-gated frankentui integration), `tracing`, `rayon`, `serde_json` [Code-verified, High]. 42 deps across 17 crates [Git-observed, High]. Vendoring: no vendored sources observed [Code-verified, Medium — shallow tree, `.cargo` not checked]. No known-CVE audit was performed; a lockfile scan would be cheap and is absent as an artifact [Inference, High — no such artifact found].

## 4.3 Core architecture — the actual claims, checked

**Subsystem map with verified sizes:**

| Crate | First-party code lines (excl. comments/blanks) | Role |
|---|---|---|
| fj-lax | 157,397 | Primitive *evaluation*: the 157 primitives' actual kernels (tensor_ops, reduction, threefry RNG, simd_exp, type_promotion, tensor_contraction…) — the largest crate, and the one the AD rules differentiate |
| fj-interpreters | 36,594 | Staging + partial evaluation + the tree-walking `eval_jaxpr` interpreter (`CompiledJaxpr` for repeated eval) |
| fj-ad | 29,038 | Dual AD engines: tape-based VJP + forward-mode JVP (the dispatch tables live here) |
| fj-conformance | 24,559 | Differential harness vs JAX oracles; RaptorQ-branded durability sidecars (asupersync substrate) |
| fj-dispatch | 20,747 | Transform stack (`jit`, `grad`, `vmap`, order-sensitive), 5 orderings validated by property tests |
| fj-core | 11,026 | The IR: `Primitive` enum (162 variants counted), `DType` enum (11 variants counted), cache keying, error types |
| fj-trace | 10,527 | Tracing Rust closures into Jaxpr; the Tracer model |
| fj-egraph | 8,991 | E-graph optimizer: `egg` wrapper, rewrite-rule sets, extraction |
| fj-py | 5,197 | pyo3 Python bindings exposing Jaxpr to Python |
| fj-cache | 4,424 | Program identity: blake3 cache keys over canonical JSON (`CacheKey::from_jaxpr`) |
| fj-api | 3,751 | Public Rust API surface |
| fj-backend-cpu | 2,874 | CPU executor |
| fj-ffi | 2,818 | Foreign-function invocation + the project's single production unsafe block |
| fj-runtime | 1,494 | Backend/device/buffer traits + `RuntimeAdmissionModel` + optional asupersync/frankentui bridges |
| fj-ledger | 1,297 | Trace Transform Ledger schema + semantic proof matrix + conformance scoring |
| fj-backend-gpu | 227 | Stub: CUDA PTX/CUTLASS *planning documents*, not code |
| fj-test-utils | 217 | Shared test-fixture scaffold |

*17 crates total; line counts are total `.rs` lines per crate `src/` dir, one consistent method [Counted, High]. (Correction: v3's table used inconsistent methods and named crates that do not exist — `fj-gnn`, `fj-scipy`, `fj-frontend`, `fj-benchmarks`, `fj-kernels` — and invented a TypeScript parser; there are no `.ts` files in the tree. The table above was rebuilt from the workspace manifest.)*

The data flows as follows: a user writes a Rust closure (or drives Jaxpr from Python via `fj-py`'s pyo3 bindings); `fj-trace` traces it into a canonical Jaxpr-like IR in `fj-core` [Maintainer claim, Medium — docs describe this, tracing code was spot-read, not executed]. Transforms compose through `fj-dispatch`'s order-sensitive transform stack (five orderings — `jit(grad(f))`, `grad(jit(f))`, etc. — each with dedicated property tests) [Code-verified, High]. Differentiation splits two ways: reverse-mode VJP uses a tape-based engine (`TapeWengertList`; the code names Athena/Wengert/DAG-rewriter strategies for VJP computation) and forward-mode JVP uses linear-tangent propagation [Code-verified, High]. The primitives those rules differentiate are *evaluated* by `fj-lax` — 157,397 lines of kernel implementations (tensor ops, reductions, threefry RNG, SIMD exp, type promotion), the largest crate and the one the packet's earlier drafts under-described [Code-verified, High]. Staging and partial evaluation live in `fj-interpreters` (36,594 lines; `staging.rs`, `partial_eval.rs`, and the tree-walking `eval_jaxpr` interpreter with a `CompiledJaxpr` fast path for repeated eval) [Code-verified, High]. Optimization runs through `fj-egraph`'s e-graph with rewrite-rule sets (99 `rewrite!` macro sites counted in non-test code across 23 files; the README claims 86 *distinct rules* — 99 is invocation sites, not the distinct-rule inventory, so neither number disproves the other) [Counted, High — method stated]. Execution is by interpretation against backend traits — there is no lowering stage. Program identity and reproducibility rest on cache keys: every transform result keys on `(jaxpr_hash, transform, params)` via blake3 (`fj-cache`, `CacheKey::from_jaxpr` verified in source) [Code-verified, High].

**Claim inventory** (the project's load-bearing assertions, each checked):

1. *"157/157 local primitives have hand-derived VJP and JVP rules."* **Partially demonstrated — and v2's description of the gap was wrong, corrected here.** An arm-parser re-examination for this round found **no wildcard fallback in either dispatcher**: `vjp()` (lib.rs:3481) has 136 match arms over the `Primitive` enum directly with no `_` arm, and `jvp_rule()` (lib.rs:10265) has 123 arms plus 6 multi-output rules in `jvp_rule_multi()` — all 162 variants are mentioned in each function body, so coverage is exhaustive by construction (Rust requires it) [Code-verified, High]. The real gap is what the arms *contain*: 50 VJP primitives are covered by zero-gradient rules. Many are legitimately zero (integer/bitwise/comparison/predicate ops: `BitwiseAnd`, `Ge`, `IsNan`, `ShiftLeft`, …), but a visible subset are differentiable primitives where zero reads as placeholder rather than derivation — `Ldexp`, `CopySign`, `Select`, `SelectN`, `OneHot`, `Cummax`, `Cummin`, `Nextafter`, `Real`, `Imag`, `Betainc`, `Polygamma`, `Qr`, `Svd`, `Eigh` [Code-verified, High]. 5 pmap collectives are fail-closed by design [Code-verified, High]. One asymmetry worth recording: `Qr`, `Svd`, and `Eigh` have real multi-output JVP rules in `jvp_rule_multi()` but zero-gradient VJP arms — forward-mode knows the derivative, reverse-mode punts [Code-verified, High]. "113/113" (badge) and "118" (architecture text) are stale [Counted, High]. Verdict: dispatch coverage is verified-exhaustive; *hand-derivedness* is not — the honest statement is "exhaustive dispatch over 162 primitives with a mix of derived, zero-gradient, and fail-closed arms, ~50 of the zero arms unexamined."
2. *"861 differential test cases across five fixture families, all green."* **Counted: 861 exactly** (613 transform cases + 25 RNG + 46 linalg/FFT + 15 composition + 162 dtype-promotion) [Counted, High]. *Greenness is maintainer-asserted*: the gate script (`check_conformance_gates.py`) reports local/CI exit codes in prose, but with zero GitHub Actions workflows there is no observable CI run — all green claims execute on the maintainer's local RCH fleet [External + Inference, High].
3. *"Transforms compose in the correct order (five orderings validated)."* Supported: dedicated property tests exist for each ordering (`jit_of_grad_matches_grad_of_jit`, `vmap_of_grad_matches_grad_of_vmap`, `grad_of_jit_matches_jit_of_grad`, `vmap_of_jit_matches_jit_of_vmap`, `jit_of_vmap_matches_vmap_of_jit`) [Code-verified, High].
4. *"jit is semantically transparent (no-op) in V1."* **Verified.** The dispatcher treats jit as a pass-through that "strips leading `jit`," and `metamorphic_jit_transparent` property-tests the identity to 1e-14 [Code-verified, High].
5. *"The Trace Transform Ledger makes transform compositions auditable."* **Verified as mechanism.** `TraceTransformLedger` contains root Jaxpr, transform stack, and transform evidence with `composition_signature()`; a checked-in semantic proof matrix reports 12/12 cases passing (6 accepted, 6 correctly rejected) [Code-verified, High — structure read; 12/12 is a checked-in artifact, not a CI-observed run].
6. *"Zero public CI, but 113/113 conformance gates green."* **Self-contradiction flagged.** The gate script references GitHub Actions paths; no workflows exist. The 113/113 badge (green) is dated — it matches neither the 118 nor 157/162 primitive counts [Counted, High].
7. *"RNG is JAX-compatible."* **Partially demonstrated.** 25 RNG fixture cases counted [Counted, High]; whether JAX's threefry counter semantics are bit-exactly reproduced was not verified (no execution) [Inference, Low — beyond scope].
8. *"The e-graph optimizer applies 86 algebraic rewrite rules."* **Unresolved.** 99 `rewrite!` invocation sites counted in non-test code; the distinct-rule inventory was not performed, so the README's "86" is neither confirmed nor refuted [Counted, High — method stated].
9. *"RaptorQ durability for evidence bundles."* **Verified with precision.** The durability pipeline is RaptorQ-*branded*: the security-adversarial conformance module names a `ff_raptorq_decoder` fuzz family and a `fuzz_targets/raptorq_decoder.rs` target [Code-verified, High]; the encoding substrate is asupersync 0.5.0's encode/decode pipeline (`fj-conformance/src/durability.rs` imports `asupersync::encode::` and `decode::`, and encodes the full 861-fixture bundle at ~3.5x the raw size) [Code-verified, High]. Whether the codec internals are RaptorQ specifically (vs. asupersync's generic fountain coding) was not verified below the API boundary [Inference, Low].
10. *"Safe-Rust posture: all crates forbid unsafe."* **Mostly verified, one documented exception.** 16 crates `forbid(unsafe_code)`; `fj-ffi` uses `deny(unsafe_code)` with scoped allowances — one real production unsafe block: the foreign-function *invocation* in `fj-ffi/src/call.rs` (not just trampoline boilerplate), with a SAFETY explanation covering all three failure modes (signature mismatch → caught by signature hashing, not by the type system) [Code-verified, High]. The README's "all crates forbid" is imprecise but the direction is correct.
11. *"All 11 dtypes are supported."* **Verified as enumeration.** 11 `DType` variants counted in the enum (BF16, F16, F32, F64, I32, I64, U32, U64, Bool, Complex64, Complex128) [Counted, High]; the 162 dtype-promotion fixtures back the claim structurally [Counted, High].
12. *"GPU backend in development."* **Stub only.** `fj-backend-gpu` is 1,096 lines, of which 1,090 are CUDA PTX/CUTLASS *planning documents*, not code [Counted, High]. Correctly flagged as aspiration.
13. *"vmap batching is O(1) (no per-batch-element loops)."* **Verified as design intent.** The JVP batching path documents "O(1) batching rules" meaning vectorized tangent propagation without looping over batch elements [Code-verified, High].
14. *"Deterministic serialization via JSON canonical form."* **Verified as mechanism.** Cache keys use blake3 over canonical JSON; the September pin is itself a JSON-canonicalization commit [Code-verified, High].
15. *"Performance competitive with JAX on CPU."* See §4.5 — maintainer-produced numbers only; the 22x headline is honest but uninteresting (below).
16. *"Special functions are hand-implemented to high accuracy."* Hand-rolled approximations (Lanczos gamma, Cephes erf, AGM elliptic) documented in code with claimed ulp bounds, "verified" against `statrs`/mpmath oracles via numerical tests [Maintainer claim, Medium — spot-checked in code, not executed].
17. *"Negative evidence is recorded, not hidden."* **Verified.** The negative-evidence ledger exists (6,109 lines canonical), records rejections with agent attribution [Code-verified, High].
18. *"Releases tracked in CHANGELOG; HEAD current."* **Stale.** CHANGELOG's scope window ends 2026-08-19; its "HEAD" pointer (`658740e0e6`) predates the pin [Git-observed, High].

## 4.4 Architecture quality — how the data moves

The execution model comes first because everything else follows from it: **there is no compiler.** A traced Jaxpr is *interpreted* against backend traits; `jit` is a pass-through; transforms are stack operations on trace metadata. This is the honest core of the design — the project reimplements the *meaning* of composition, not compilation [Code-verified, High].

The AD design is the technically serious part. Reverse mode runs on a tape (Wengert list with DAG-rewriter strategies named in code), forward mode propagates linear tangents, and the dispatcher handles composition order explicitly — the five ordering property tests are the artifact that makes "correct order" a checkable claim rather than an assertion [Code-verified, High]. `fj-runtime` (1,494 lines) holds the backend/device/buffer traits the interpreter executes against, a `RuntimeAdmissionModel` gating execution modes, and optional (feature-gated, default-off) async and frankentui UI bridges [Code-verified, High]. `fj-test-utils` (217 lines) is the shared fixture scaffold underpinning the conformance tests [Counted, High]. `fj-ledger` (1,297 lines) is the TTL schema plus the semantic proof matrix and conformance scoring [Counted, High].

What reads as genuinely well-engineered: the cache-key discipline (`CacheKey::from_jaxpr` over blake3, JSON canonical form) gives reproducibility a real mechanism; the unsafe census is the tightest seen in the program to date (one real block, at the FFI call boundary, with a written SAFETY argument) [Code-verified, High]. What reads as risk: the two Cholesky AD bugs caught by numerical tests (documented in negative evidence) show the VJP rules are hand-derived and fallible, which is honest but bounds the "hand-derived" confidence — the two bugs found imply an unknown number unfound [Maintainer claim, Medium + Inference, Medium]. And the project's "standalone, without Python" positioning sits next to `fj-py` — 5,197 lines of pyo3 bindings exposing Jaxpr *to* Python: not scope creep so much as a hedge, but a cold reader should know the Python-free story has a Python door [Code-verified, High + Inference, Medium].

**Design-pattern read:** the architecture mirrors JAX's own layering (IR → tracing → transform stack → AD → optimization) with the compilation half deliberately excised and replaced by an interpreter [Inference, High]. The interesting deviation is the evidence layer (TTL, gate scripts, e2e forensic logs, negative-evidence ledger) sitting *beside* the compiler stack rather than inside it — this is an AD engine with a provenance system attached, and that pairing is the project's real novelty [Inference, Medium].
## 4.5 Performance claims — verified honesty, bounded value

**Benchmark table** (Rulebook §4.5: maintainer-produced vs independent, separated):

| Benchmark | Maintainer-produced | Independent | Notes |
|---|---|---|---|
| vmap: fj 0.71ms vs JAX 1.43ms (2.0x) | Yes — `benchmarks/PERFORMANCE_COMPARISON.md`, vs JAX 0.10.1 CPU, 2026-05-25 | None known | [Maintainer claim, Medium] |
| grad(log(exp(x))): fj 1.3µs vs JAX 6.1µs (4.7x) | Yes — same doc | None known | [Maintainer claim, Medium] |
| reduce_sum 1k: fj 2.4µs vs JAX 54.2µs (22x) | Yes — same doc | None known | [Maintainer claim, Medium] |
| Negative-evidence ledger: 19+ entries with criterion CIs | Yes — `evidence/perf/negative_evidence_ledger.md` | None known | [Code-verified, High — ledger exists; numbers maintainer-asserted] |
| CI-observed or third-party runs | — | **Empty.** Zero GitHub Actions workflows; no observable runs. | [External, High] — the empty column is itself a finding |

**Methodology audit:** the comparison doc records same-worker, same-binary rows with criterion confidence intervals in the negative-evidence ledger (per-optimization entries with agent attribution, including *rejections* — e.g., an optimization attempt rejected when the CI overlapped zero) [Code-verified, High]. The doc is JAX-version-pinned (0.10.1, CPU, May 2026) and self-scopes: it concedes JAX wins large-batch matmuls (XLA fusion) and admits "most microbenchmarks favor JAX" [Maintainer claim, High]. Per-number audit on the two extreme rows: the **reduce_sum 22x** row compares against JAX's 54.2µs for a 1k-element reduce_sum — a number dominated by JAX's dispatch overhead, not its kernel speed; the "win" measures FrankenJAX's lower dispatch floor, not faster computation, so the 22x is **honest but uninteresting** [Inference, High]. The **grad(log(exp)) 4.7x** row is more substantive: 6.1µs vs 1.3µs on a scalar-valued gradient suggests genuine AD overhead advantage at small scale — though with no A/A null calibration published and no independent rerun, it remains a single-worker claim [Inference, Medium].

**Would it survive an independent rerun?** The methodology is unusually auditable (pinned versions, CIs, published failures), but the independent column is empty and nothing can be observed executing — so the honest answer is "the numbers are checkable in principle and uncheckable in practice" [Inference, High].

**Reproduction cost:** moderate for CPU microbenchmarks (Rust nightly + Python JAX 0.10.1); the blocker is the **0-byte `rust-toolchain.toml`** — the nightly version is unpinned, so a reproducer cannot know which toolchain the numbers were produced on [Inference, High].

## 4.6 Competitive landscape

**The lane:** standalone, verifiable JAX transform semantics outside Python. **Who owns it today:** JAX itself — by definition, since the semantics are defined by the JAX implementation and there is no independent specification. JAX wins today for one blunt reason: it is the only artifact that *is* JAX semantics, it compiles through XLA to real hardware, and it has a decade of ecosystem around it; FrankenJAX reimplements the meaning of composition while explicitly not reimplementing the compilation that makes JAX fast — so against the incumbent it is a reference implementation competing with the thing it references, which is a fight it cannot win on utility and does not try to win (the README concedes it is not a production-ML replacement) [Inference, High].

**Why the lane is unoccupied** — and the packet should be explicit: it is unoccupied because **nobody has shown up**, not because competitors were beaten [Inference, Medium]. No prior attempt at standalone JAX semantics was found (no stalled project, no abandoned fork, no JAX-team export of the semantics layer) — the demand is asserted by one maintainer and evidenced by nobody [External, High within recall caveats]. The two incumbent-adjacent answers to "semantics outside Python" deserve naming: **JAX's own `jax.export`** serializes lowered StableHLO programs for execution without Python — it is the incumbent's portability story, and it undercuts the need for a *semantic* reimplementation wherever the use case is "run this traced program elsewhere" [External, High]; **MLIR** is the adjacent lane for "verifiable IR," but MLIR gives you IR infrastructure, not AD-transform semantics — a reader wondering "why not MLIR" gets: different layer, no AD rules [Inference, Medium].

**Competitors / alternatives:** **JAX** (the reference; owns the lane) [External, High]. **Enzyme** (LLVM-level AD; different layer — differentiates compiled code, not a transform IR) [External, Medium]. **Burn / Candle** (Rust ML frameworks; do not try to be JAX — no transform composition semantics) [External, Medium]. **jax2tf / TensorFlow bridges** (bind to existing frameworks rather than reimplementing) [External, Medium]. None competes on *verifiable standalone transform semantics* — which is either the opportunity or the warning, depending on whether demand materializes [Inference, Medium].

**What would have to be true for FrankenJAX to matter:** a consumer who needs JAX semantics *without* JAX the system (embedded Rust, verified pipelines, air-gapped audit) and who trusts maintainer-asserted conformance — a narrow, real, currently empty market [Inference, Medium].

## 4.7 Adversarial review

**Strengths (genuinely earned):**

1. **The unsafe posture is the tightest assessed in the program to date** — 16 crates `forbid(unsafe_code)`, `fj-ffi` `deny`s it, and the single production unsafe block is the FFI *call* itself with a written SAFETY argument covering signature-mismatch failure modes. (Calibration: "in the program to date" covers the packets completed so far, a stated comparison set.) [Code-verified, High]
2. **The differential-oracle discipline is real and counted** — 861 fixtures across five families, counted exactly per family; the conformance gate script and TTL proof matrix exist as artifacts. The *discipline* is verified; the *results* (all-green) are maintainer-asserted on the local RCH fleet, and the strength should be read with that split. [Counted/Verified, High on discipline; Medium on greenness]
3. **The negative-evidence ledger is a genuine methodological contribution** — per-optimization entries with agent attribution, same-worker/same-binary criterion rows with CIs, and explicit rejections. As an idea it ports beyond this repo (see next step 6). [Code-verified, High]
4. **The TTL is a novel artifact class** — no competitor produces auditable proof objects for transform composition; the semantic matrix (6 accepted / 6 correctly rejected) shows the ledger can *reject*, which is what makes a proof artifact trustworthy rather than decorative. [Code-verified, High]

**Weaknesses (load-bearing):**

1. **No observable execution of anything.** Zero GitHub Actions workflows means every test count, gate result, and benchmark number is attested only by checked-in JSON produced on the maintainer's local RCH fleet. The evidence machinery is elaborate — TTLs, e2e forensic logs, gate scripts, ledger refreshes — but it is all self-attested. This is the single fact that bounds every other claim in the packet [External + Inference, High].
2. **The documentation contradicts itself on basic facts** (118/113/157/162 primitives; 15/17 crates; 162k/460k lines; empty toolchain pin; stale CHANGELOG head) — which means the README cannot be trusted as a summary of the repo, and every number in this packet had to be re-counted from source [Counted, High].
3. **`jit` is a no-op and the GPU backend is a planning document** — the two most load-bearing words in "JAX reimplementation" (compilation, acceleration) are explicitly out of scope, leaving an interpreter for the semantic core. Honest, but it caps the ceiling: this can never be a JAX *replacement*, only a JAX *reference* [Code-verified, High].
4. **The AD "157/157" claim survives on placeholder zero-rules, not wildcards** — this round corrected v2's wildcard description: both dispatchers are exhaustive by construction (136 VJP arms, 123 JVP arms, no `_` arm). The actual gap is 50 zero-gradient VJP arms, several covering differentiable primitives (`Ldexp`, `CopySign`, `Select`, `OneHot`, `Cummax`) where zero is a placeholder. The two documented Cholesky AD bugs show the hand-derived rules are fallible (two found implies an unknown number unfound), and the placeholder zeros are the larger unknown [Code-verified + Inference, Medium].
5. **The benchmark story is honest but uninteresting at the headline number** — the 22x reduce_sum win measures dispatch-floor difference, not compute; the 4.7x grad win is more substantive but single-worker and uncalibrated [Inference, Medium-High].
6. **Bus factor one, by policy** — the repo explicitly does not accept outside contributions, and the 2,035 closed beads were all closed by the same human; the "independent second pair of eyes" never exists even in principle [Maintainer claim + External, High].
7. **The rider poisons the program's own engagement** — "Use" includes benchmarking, testing, analyzing, indexing, datasets, training corpora, evaluation harnesses, and ML pipelines; automatic termination, destruction requirement, equitable relief, fee-shifting. The program cannot run this repo's code, quote it in training, or evaluate against it without the rider's termination clause firing [License-verbatim, High].
8. **The fixture set is fixed, not live** — 861 cases that never regenerate against current JAX; oracle drift is the slow failure mode, and no fixture-refresh trigger exists in the repo's own process [Inference, Medium].

**Bear-case steelman:** *FrankenJAX is a 460k-line monument to a question nobody asked, built by one person with AI assistance, whose own README can't keep its story straight, whose "compiler" is an interpreter, whose test suite has never been observed passing by anyone but its author, and whose license forbids the two labs whose models wrote half of it from even reading it. The TTL is a pretty JSON artifact proving that transforms composed — in a system where the flagship transform provably does nothing. The rational response is admiration for the evidence machinery and zero engagement with the software.* — This steelman lands because weaknesses 1, 2, and 7 are independently verifiable facts, not interpretations [Inference, High — the steelman's premises are sourced; its conclusion is argued].

## 4.8 Governance, license, and community health

**Authorship:** one human committer; 53 of the 100 most recent commits carry agent Co-Authored-By trailers (52 Claude-family — 48 "Claude Opus 4.8 (1M context)," 3 "Claude," 1 "Claude Opus 4.8" — plus 1 Grok) [External, High]. The line-level agent share is unknown; the commit-trailer share is exact [External, High].

**Governance:** single maintainer; the repo explicitly does not accept outside contributions [Maintainer claim, High]. The beads tracker shows 12 open and 2,035 closed/other items [Counted, High] — all closed by the same human, which connects the governance policy directly to the evidence story: the project's impressive self-review machinery (gates, ledgers, forensic logs) is review *by* the author *of* the author's work, and no outside contributor can ever supply the second pair of eyes the policy forbids [Inference, High].

**License — read verbatim at the pin:** "MIT License (with OpenAI/Anthropic Rider)" [License-verbatim, High]. The MIT grant is standard; the rider then: (a) **excludes** OpenAI, Anthropic, "their respective affiliates," "any party acting for or on behalf of or in concert with or for the benefit of" them, "including agents," from "any right, license, or permission" — broader than frankenredis's rider, which did not name affiliates or acting-for parties [License-verbatim, High]; (b) **defines "Use" expansively** — "Use expressly includes any benchmarking, testing, analyzing, indexing, evaluation, or other processing of the Software, and any inclusion of the Software (or any part or derivative thereof) in any dataset, index, training corpus, evaluation harness, or machine learning pipeline"; (c) **automatic termination** on violation ("all rights granted … shall automatically terminate … without notice"), plus a **destruction requirement** ("destroy all copies … and certify such destruction"), **equitable relief**, and **fee-shifting** [License-verbatim, High]. Classification: **non-OSI** — it discriminates against persons/groups (the two named labs, their affiliates, and their agents), violating OSD §5, and restricts fields of endeavor (benchmarking, evaluation, training), violating OSD §6 [Inference, High].

**Rider scoping (with the frankenredis comparison):** this rider's Affiliate/Control broadening means the exclusion reaches further than frankenredis's — not just the two labs but anyone "acting for or on behalf of" them, which in a program that *uses* Claude-family models as research agents plausibly includes the program's own assessment pipeline [Inference, Medium — legal reading, not legal advice]. The irony the packet must state plainly: 53% of recent commits were co-authored by the models of the labs the rider excludes, and the rider's definition of "Use" includes *analyzing* — which is what this packet is [External + License-verbatim, High].

**Community health:** 11 stars, 4 forks, zero releases, zero tags, zero Actions workflows [External, High]. No contributor ladder (no outside contributions accepted), no public roadmap beyond beads, no security policy file observed [Code-verified, Medium — absence in tree]. Health verdict: a healthy *personal* research program; not a community project by design [Inference, Medium].
## 4.9 NODUS assessment

- **Orbital position: 4/5** — the transform-semantics domain is central to differentiable programming; the packet's evidence machinery is relevant beyond this repo. [Inference, Medium]
- **Velocity: 2/5** — high commit volume through August, but the September window is evidence-regeneration/hygiene commits (35,991 insertions in JSON artifacts in the pin); feature velocity appears to have consolidated [External + Inference, Medium]
- **Community: 1/5** — 11 stars, 4 forks, zero releases, no outside contributions accepted by policy [External, High]
- **Adoption: 1/5** — no production users, no downstream dependents, no release artifact, no independent coverage found [External, High within recall caveats]
- **Strategic relevance: 2/5** — the *software* is untouchable under the rider (benchmarking, testing, analyzing, and evaluation-harness use are all expressly barred), so program engagement is limited to the *methodology* (TTL, negative-evidence ledger) as an exportable pattern. The score is 2, not 1, because the methodology export is real; it is not 3 because nothing in the repo itself can be adopted [Inference, Medium]
- **Impact potential: 2/5** — the TTL and negative-evidence ledger could influence how the program (and others) structures evidence; the AD engine itself has no path to impact without demand, releases, and a license change [Inference, Medium]
- **Time to mainstream: 2/5** — years at best; the rider, the no-contributions policy, and the missing compilation half are structural, not incremental [Inference, Low]

**TRL: 4** — validated in a laboratory setting (the lab being the maintainer's own RCH fleet): the AD semantics are checked against JAX oracles by a real differential harness, but nothing has been observed executing outside the author's environment, and the compilation/acceleration half of the problem is explicitly out of scope. TRL 4, not 5, because "relevant environment" validation requires an observer other than the author — and none exists [Inference, Medium]. (A point, not a range: the author's-environment boundary is the bright line; TRL 5 would require the independent observer.)

**NODUS ring: Explore** — substantive-but-unproven is the textbook Explore case: the evidence machinery is unusually rigorous for a solo project, the AD core is genuinely implemented (not stubbed), and the trajectory is active. The ring's advancement blocker is the **license rider alone**: while it stands, the program cannot benchmark, analyze, or evaluate the software, so no amount of technical progress advances the ring — Explore-with-a-ceiling. The zero-public-CI fact is priced into the low Community/Adoption/Impact scores rather than stated as a second ring rule, because the Rulebook's ring rules name the rider class of blocker, not CI [Inference, Medium]. If only the CI trigger fires (public workflows appear, rider unchanged): the ring stays Explore — the advancement blocker is legal, not evidential [Inference, Medium].

## 4.10 Idea-space positioning

**Genesis ideas** (novel contributions): the **Trace Transform Ledger** as an auditable proof artifact for transform composition — no competitor produces this; the closest JAX-side analogues (`jax.debug` tracing, `jax.export` serialization) record *programs*, not *proofs of composition correctness*, which is the distinction that makes the TTL novel rather than redundant [Code-verified + Inference, Medium]. The **negative-evidence perf ledger** as a methodology pattern — per-optimization entries with agent attribution and published rejections [Code-verified, High]. The **differential-oracle fixture discipline at this scale** (861 counted cases) for a clean-room AD reimplementation [Counted, High].

**Commodity ideas** (correctly treated as such): the Jaxpr-shaped IR, tape-based reverse-mode AD, forward-mode tangents, the e-graph optimizer — all standard machinery, and the project treats them as such (no novelty claimed) [Code-verified, High]. One softening from v1: the packet called the Jaxpr IR shape "commodity," but JAX's Jaxpr is not a standard — the *idea* of a functional-array IR is commodity; this *particular* shape is JAX-derived. The distinction matters because the IR's JAX-likeness is what makes the oracle fixtures meaningful [Inference, Medium].

**Missing from the idea space:** any treatment of **automatic batching beyond vmap** (pmap is fail-closed, xmap unimplemented) [Code-verified, High]; **no story for higher-order differentiation through control flow** beyond what the fixtures cover [Inference, Medium]; **no compilation story at all** — the idea space ends where XLA begins, which the project is honest about [Maintainer claim, High].

## 4.11 Trajectory and outlook

**Direction:** consolidation. The August feature push has given way to a September of evidence-regeneration commits (JSON ledger refreshes, TTL updates, auto-formatting), the pin being the largest such commit [External + Inference, Medium]. The stated roadmap (from beads + docs): GPU backend (PTX/CUTLASS planning), `pallas`-style kernel language, distributed collectives — all currently stubs or planning docs [Maintainer claim, Medium].

**Realistic 12-month outlook:** if the consolidation phase completes (toolchain re-pinned, gates re-run from clean checkout, README reconciled with the tree), the project becomes the most credible *reference implementation* of JAX transform semantics in existence — a genuine contribution to the research literature of AD. If the roadmap's GPU/distributed ambitions are pursued with the current resourcing (one human, agent-assisted), the risk is scope sprawl: the honest core (transform semantics + AD + evidence) diluted by aspirational backends that repeat the "planning document as progress" pattern [Inference, Medium].

**Concrete revisit triggers** (all observable, dated 2026-09-22):

1. **A public CI workflow appears** (any `.github/workflows/*.yml` in the repo) → re-run this packet's evidence section: green claims become CI-observed for the first time [External check].
2. **The rider is narrowed or removed** (LICENSE diff) → the ring's advancement blocker lifts; re-score Strategic relevance and Impact potential [License check].
3. **A release artifact is published** (crates.io publish or GitHub Release) → Adoption and Time-to-mainstream re-score; the "no release" ceiling lifts [External check].
4. **The 50 zero-gradient VJP arms are audited** (placeholder count reaches zero per next step 3) → claim 1 in §4.3 upgrades from "partially demonstrated" to "verified" [Code check].
5. **A second implementation verifies a TTL artifact** → next step 1's falsifiability condition resolves; Genesis-idea status confirmed or denied [External check].
6. **An independent benchmark appears** (third-party numbers, or this program's own under a narrowed rider) → §4.5's independent column fills; the "honest but uninteresting" audit gets a second data point [External check].
7. **No fixture re-capture commit in 180 days** (no oracle-fixture refresh by 2027-03-22) → treat all fidelity claims as stale; oracle drift becomes the dominant risk [Git/API check].

## 4.12 The one-paragraph case

FrankenJAX is an unusually evidence-serious solo reimplementation: 861 counted JAX-oracle fixtures, a real differential conformance harness, the tightest unsafe census seen to date, a novel auditable proof artifact for transform composition (the TTL), and a published ledger of its own optimization failures — all of which would make it a strong Explore-ring candidate on technical merit alone. But the packet's verdict is Explore-*with-a-ceiling*, and the ceiling is legal, not technical: the license rider expressly bars the two AI labs (and their affiliates, agents, and anyone acting for them) from even *analyzing* the code, which plausibly includes this program's own agent-assisted assessment pipeline — so the software cannot be benchmarked, tested, quoted in training data, or evaluated by the program while the rider stands. Add zero observable CI (every green claim is self-attested JSON from the author's RCH fleet), a README that understates its own codebase 3×, a `jit` that is a verified no-op, and a no-outside-contributions policy, and the recommendation is: **track the methodology (TTL, negative-evidence ledger) as an exportable pattern; do not engage the software until the rider narrows.** The trajectory to watch is consolidation — if the toolchain gets re-pinned, the gates re-run from a clean checkout, and the README reconciled, the project becomes the credible reference implementation it claims to be; until then it is a 460k-line proof that one person with AI assistance can build a JAX-semantics engine and its own courtroom, with no witnesses admitted.

## 4.13 Open questions

1. **Who is the second witness?** Every green claim in the packet traces to the maintainer's RCH fleet. Is there any observer — a CI run, a third-party benchmark, a downstream user — who has ever seen this test suite pass? None was found [External, High within recall caveats].
2. **Does the rider bar this very assessment?** "Use" includes "analyzing" and "evaluation"; the assessment pipeline uses Claude-family models. The packet proceeded on the reading that *reading publicly visible code to write an assessment* is analysis the rider forbids to the labs' agents — a question for counsel, not for this packet [Inference, Medium].
3. **What produced the 861 fixtures' "green"?** The fixture cases are counted; the runs that passed them are not observable. A single public CI log would answer this permanently [Inference, High].
4. **How many AD rules are really hand-derived?** Dispatch coverage is exhaustive by construction (no wildcards — corrected this round), but 50 VJP primitives sit behind zero-gradient arms and a visible subset (`Ldexp`, `CopySign`, `Select`, `OneHot`, `Cummax`/`Cummin`, `Qr`, `Svd`, `Eigh`) are differentiable, so zero is a placeholder. The e-graph side has the same shape of question: 86 claimed distinct rules vs 99 counted `rewrite!` invocation sites, no distinct-rule inventory performed. The zero-gradient audit (next step 3) is the forcing function for the AD half [Code-verified, High].
5. **What is the line-level agent share of the 460k lines?** The packet has the commit-trailer share (53 of the last 100 commits) but not the code share — and the bus-factor story differs sharply between "an agent wrote the scaffolding" and "an agent wrote the AD rules." A `git blame` aggregation by trailer-attributed commits would answer it; until then, "agent-assisted" describes the process, not the artifact [Inference, Medium].
6. **Was `rust-toolchain.toml` ever non-empty?** The file is 0 bytes at the pin while the README points at it; git history (unavailable in the shallow clone) would show whether the pin regressed or the file was always empty — a one-command check for the next round [Git-observed, High — the emptiness; history unknown].

---

## 5. Adversarial deepening — the eight questions

**Q1. What is the single strongest piece of evidence *for* the project's central claim, and what would falsify it?** The central claim is "this Rust code implements JAX's transform semantics faithfully." The strongest evidence is the 861-case differential fixture set: fixed programs with expected outputs captured from real JAX, run against the Rust engine, with the gate script and TTL proof matrix as the attesting artifacts [Counted, High]. It would be falsified by a single fixture case that passes in the ledger but fails on re-execution from a clean checkout — which is exactly why the empty `rust-toolchain.toml` matters: without a pinned toolchain, "re-execution" is not a well-defined operation, and the strongest evidence rests on an unpinned foundation [Inference, High].

**Q2. What is the single strongest piece of evidence *against* the project's viability, and what would neutralize it?** The license rider: it names OpenAI and Anthropic, their affiliates, and anyone acting for them — and defines "Use" to include benchmarking, testing, analyzing, indexing, datasets, training corpora, evaluation harnesses, and ML pipelines, with automatic termination, a destruction requirement, equitable relief, and fee-shifting [License-verbatim, High]. This single paragraph converts a technically strong Explore candidate into software the program cannot touch. It would be neutralized by narrowing the rider to training-data use (the plausible original intent — keeping the code out of competitors' models) while permitting benchmarking, analysis, and evaluation; the frankenredis rider comparison shows the wording is a choice, not boilerplate, since this rider's Affiliate/Control broadening goes further [Inference, Medium].

**Q3. What is the most interesting technical decision, and is it right?** Building the Trace Transform Ledger as a *proof artifact* rather than a *debug log* — every transform composition emits `{root_jaxpr, transform_stack, transform_evidence}` with a `composition_signature()`, and the semantic matrix demonstrates the ledger can reject invalid compositions, which is what separates evidence from decoration [Code-verified, High]. It is right as an idea and premature as a claim: the TTL is only as trustworthy as the engine it observes, and with no independent observer the ledger is the author witnessing himself — the decision becomes *right in the strong sense* the day a second implementation verifies a TTL artifact (next step 1) [Inference, Medium].

**Q4. What is the most misleading number in the repo, and what is the honest version?** The "reduce_sum 1k: 22x faster than JAX" headline [Maintainer claim, Medium]. The honest version: "FrankenJAX's dispatch floor is ~2.4µs vs JAX's ~54.2µs on a trivially small kernel, because JAX pays Python/XLA dispatch overhead that dominates at 1k elements; on any workload where compute matters, JAX's XLA fusion wins and the doc concedes it." The number is honest — the methodology doc is unusually transparent about it — but it is uninteresting, and a cold reader who stops at the headline learns the wrong lesson [Inference, High].

**Q5. What would a serious competitor do differently?** A serious competitor for the "verifiable JAX semantics" lane would not reimplement JAX at all — it would build on `jax.export`'s StableHLO serialization and add the missing piece FrankenJAX actually invented: the proof artifact. That is, the TTL attached to exported JAX programs, verified by an independent checker, gets 90% of the auditability value with none of the 460k-line reimplementation risk — and it runs on real XLA hardware [Inference, Medium]. FrankenJAX's moat, if it has one, is not the AD engine (commodity ideas, honestly treated as such) but the evidence machinery; a competitor should steal the ledger, not the engine.

**Q6. What is the thing the maintainer is most proud of, and is the pride justified?** The evidence machinery — the TTL, the 861 fixtures, the gate scripts, the e2e forensic logs, the negative-evidence ledger — is clearly where the pride lives: the September pin is a 36k-line evidence-regeneration commit, and the negative-evidence docs run to book length [External + Code-verified, High]. The pride is justified for the *machinery* (it is genuinely the most rigorous self-attestation apparatus in the program to date) and unjustified for what the machinery *attests to* (greenness observed by nobody but the author) — the pride confuses the courtroom with the verdict [Inference, Medium].

**Q7. What is the single most important unanswered question, and what experiment answers it?** Whether any independent party has ever observed the test suite passing. The experiment is trivial: add one GitHub Actions workflow running `cargo test --workspace` on the pinned toolchain, and link the run. Cost: an afternoon. Information value: it converts every "maintainer-asserted" tier in this packet to "CI-observed" in one stroke — the highest leverage-per-effort action available to the project, and its absence after 4,420 commits is itself evidence about priorities [Inference, High].

**Q8. If this project disappeared tomorrow, what would be lost?** The software would not be missed — it has no users, no releases, no downstream dependents, and JAX itself remains the reference [Inference, Medium]. What would be lost is the *methodology*: the TTL as an artifact class for auditable transform composition, the negative-evidence perf ledger as a template for honest optimization reporting, and the demonstration that a solo maintainer with agent assistance can build AD infrastructure at this scale with a real differential harness. The durable loss is the evidence pattern, not the engine — which is why the packet's recommendation is to extract the pattern (next steps 1 and 6) rather than engage the software [Inference, Medium].

### 5b. Rulebook §5's binding eight — v10 addendum

The eight questions above are this packet's adversarial set. Rulebook §5 (v1.0) binds a
different eight; they are answered here from the packet's existing evidence, one paragraph
each, with no new research.

**1. Provenance.** The packet's own provenance chain: shallow clone of HEAD (full history
unavailable — §6), authorship via commit trailers (53 of the last 100 commits agent-attributed)
plus the GitHub commits API, counts by static analysis, "green" attested only by the
maintainer's RCH fleet [Git-observed for emptiness of rust-toolchain.toml; Maintainer claim
for greenness; External, High within recall caveats for the no-second-witness finding].
In-repo, the Trace Transform Ledger is the provenance mechanism — every transform composition
emits `{root_jaxpr, transform_stack, transform_evidence}` with a `composition_signature()`
[Code-verified, High]. Portable attestation would require signed TTL artifacts plus a pinned
toolchain; the empty `rust-toolchain.toml` (0 bytes at the pin) is the missing link that
makes "re-execution" undefined [Inference, High].

**2. The embeddable unit.** The TTL as an artifact class, detached from the 460k-line engine:
attachable to `jax.export`'s StableHLO serialization and checkable by an independent verifier,
capturing most of the auditability value with none of the reimplementation risk [Inference,
Medium — argued in Q5]. Adoption cost: writing the independent checker and defining the TTL
schema as a contract rather than a debug log; the packet records the schema exists but no
second implementation has verified a TTL artifact [Code-verified, High for the schema;
Inference, Medium for the cost].

**3. Unexercised option value.** The evidence machinery itself: the 861-case differential
fixture set, gate scripts, and negative-evidence perf ledger are a reusable harness for any
numerics port, currently coupled to this engine [Counted, High]. The e-graph side holds
unresolved option value — 86 claimed distinct rules vs 99 counted `rewrite!` invocation
sites, no distinct-rule inventory performed [Code-verified, High]. The 50 VJP primitives
behind zero-gradient arms are placeholders, not capability [Code-verified, High].

**4. Benchmark honesty.** The "reduce_sum 1k: 22x faster than JAX" headline is the most
misleading number (Q4): honest version is a dispatch-floor measurement (~2.4µs vs ~54.2µs
on a trivially small kernel), uninteresting at compute scale, and the maintainer's own
methodology doc concedes it [Maintainer claim, Medium; Inference, High for the reading].
Numbers that would survive an independent rerun: the dispatch-floor figures, given a pinned
toolchain — which does not exist. No benchmark number is load-bearing for the thesis; the
thesis is semantic fidelity, attested by fixtures, not speed [Inference, High].

**5. The governance path.** One maintainer, 4,420 commits, no CI, no second maintainer, no
releases, no downstream dependents [Counted/External, High]. The credible route to an
institution runs through the evidence machinery, not the engine: a second party verifying
TTL artifacts (next step 1) creates the first external stakeholder. What breaks first if
velocity decays: JAX API drift — the 861 oracle fixtures are captured from real JAX, and
undetected drift silently rots the oracle [Inference, High].

**6. The license as strategy.** The rider names OpenAI and Anthropic, their affiliates, and
anyone acting for them, and defines "Use" to include benchmarking, testing, analyzing,
indexing, datasets, training corpora, evaluation harnesses, and ML pipelines, with automatic
termination, a destruction requirement, equitable relief, and fee-shifting [License-verbatim,
High]. It sabotages the stated mission: this very assessment — reading public code to write
an analysis with Claude-family models — is arguably a use the rider forbids [Inference,
Medium]. Narrowing the rider to training-data use (the plausible original intent) while
permitting benchmarking, analysis, and evaluation would serve the mission; the frankenredis
rider comparison shows the breadth is a choice, not boilerplate [Inference, Medium].

**7. Agent-era fit.** No concrete agent workload would pick this over JAX today: no releases,
no users, an unpinned toolchain, and greenness observed by nobody but the author
[Inference, High]. The agent-relevant export is the pattern, not the software: auditable
transform composition (TTL) for agent-generated numerics, where the agent's output needs a
checkable proof artifact. What must become true first: a pinned toolchain, one public CI
run (converting every maintainer-asserted tier to CI-observed in one stroke), and a second
implementation verifying a TTL artifact [Inference, High].

**8. The kill test.** A single fixture case that passes in the ledger but fails on
re-execution from a clean checkout falsifies the central claim ("this Rust code implements
JAX's transform semantics faithfully") — and the empty `rust-toolchain.toml` means
"re-execution" is currently undefined, so the test cannot even be staged [Inference, High].
The softer kill: JAX shipping native auditable transform attestation, which would strand
the TTL's novelty without touching the engine [Inference, Medium].

---

## 6. Limitations

What was not done, explicitly: the workspace was never compiled and nothing was executed — all counts are static analysis and all "green" claims are maintainer-asserted; no test suite was run, no benchmark reproduced, no fixture re-executed. History deepening failed (shallow clone; fetch failed on a config lock), so authorship analysis used the GitHub commits API (100 most recent) rather than full `git log`. No GitHub Actions state exists to observe — there is no CI to check, which is itself a finding. No crates.io publish check was possible (API returned 403 bot-protection); publish status is "not referenced in assessed materials." No CVE scan of the 42-dependency lockfile. No independent web coverage search beyond recall-caveated queries. The e-graph distinct-rule inventory (86 claimed vs 99 counted invocation sites) was not performed. JAX-version drift in the oracle fixtures was not measured. [All method statements, High]

---

*End of packet v5 (final). Round 4 grading reports: [frankenjax-v4-grade-A.md](sandbox:/home/hatch/workspace/franken-research/frankenjax-v4-grade-A.md), [frankenjax-v4-grade-B.md](sandbox:/home/hatch/workspace/franken-research/frankenjax-v4-grade-B.md) (B's report includes the A×B cross-check). Prior rounds: v3 reports; v2 reports + [frankenjax-v2-xcheck.md](sandbox:/home/hatch/workspace/franken-research/frankenjax-v2-xcheck.md); v1 reports + [frankenjax-v1-xcheck.md](sandbox:/home/hatch/workspace/franken-research/frankenjax-v1-xcheck.md).*