One memory-safe Rust continuum for geometry, physics, optimization, and rendering, organized as seven strictly-acyclic layers, L0 → L6 — where derivatives, error bounds, budgets, provenance, and cancellation ride inside the values.
A single request threads the whole continuum — lowered to a task DAG, scheduled, solved, and recorded, with evidence bubbling back up.
HELM lowers an agent's FrankenScript program to a task DAG; the DAG's nodes are budgeted, cancellable kernel invocations scheduled by SUBSTRATE; MORPH supplies geometry as charts of Regions; FLUX turns charts into complexes, cochains, and solved fields with adjoints and error estimates; ASCENT consumes objectives, gradients, and confidence sequences to propose new designs; LUMEN renders anything on demand; and every artifact and event lands in the Ledger.
Nothing crosses a layer boundary implicitly. Budgets, seeds, units, versions, and capabilities travel with the call; adjoints and error slices travel with the result.
Dependencies only ever point downward, L6 → L0. Each layer is a named region of the workspace, colored on the spectrum, carrying its own crates — and a mechanical xtask check fails any build that would create a cycle.
FrankenScript IR, sessions & capabilities, the Design Ledger, the plan-cost oracle, reports, and the agent API. The one true interface.
Spectral path tracing, direct chart rendering, deterministic image plumbing, and differentiable rendering where the marketing shot and the physics are the same bytes.
Shape / topology / global / derivative-free optimization over manifold variables, e-process racing, constraint calculus, and SOS certificates.
Exterior-calculus FEEC, CutFEM-on-SDF, structure-preserving integrators, constitutive laws, matrix-free solvers with adjoints, and certified speculation.
The Region / Chart abstraction, the Rep Router, SDF / mesh / F-rep / NURBS / voxel charts, geometric algebra, uniform queries, topology & manufacturability certificates.
Deterministic dense / sparse / FFT linear algebra, certified interval & Taylor arithmetic with exact predicates, Chebyshev spectral methods, QMC RNG, and autodiff.
Machine topology & SIMD dispatch, aligned arenas, the two-lane cancellable executor, tile kernels, structure-of-arrays, and the safe tile-kernel DSL.
Everything above L0 borrows its two guarantees: a bounded latency-to-cancel and bit-identical arithmetic, no matter how many cores you throw at it.
L0 · The Two-Lane Executor
latency lane + work-stealing throughput lane · latency-to-cancel ≤ 200µs
The executor runs two lanes: a latency lane for async orchestration, ledger I/O, and progress, running alongside a throughput lane — a work-stealing fork-join pool whose unit of work is a cache-aligned tile. A cancel request never waits behind a long compute: the design target is a bounded latency-to-cancel of ≤ 200 µs, and speculative races kill their losers mid-solve.
Determinism is a feature, not an accident
fixed-shape reduction trees → bit-identical across runs, threads, ISAs
Determinism is not a debug mode — it is a property of the reductions themselves. Fixed-shape reduction trees, counter-based RNG keyed by logical identity, and compensated summation make results bit-identical across thread counts and (best-effort) ISAs. The same study replays byte-for-byte on one core or ninety-six.
Every kernel ships its arithmetic-intensity analysis against measured machine peak. A performance claim is a fraction of a roof, never a bare number — and the targets are stated so they can be failed.
Roofline-honest kernels
arithmetic intensity vs machine peak · every kernel ships its roofline analysis
The two reference machines are deliberately opposite. The M4 Max pairs modest core counts with a huge unified bandwidth; the 96-core Threadripper starves each of its many cores. Bandwidth-per-core inverts by roughly 10× between them — so a kernel that is compute-bound on one is memory-bound on the other. The roofline registry stores both roofs, and the harness measures against real peak on each, refusing to let a folklore number stand in for a proof.
The hardest seam in simulation is the one between the shape and the field. FrankenSim routes representations and differentiates through the solution so that seam becomes a typed, certified value.
A Region is an abstract subset of space, never stored directly — it is only ever presented by Charts: SDF grids, half-edge meshes, F-rep trees, NURBS patches, voxel fields. When a task needs a different representation, the Rep Router solves a Pareto shortest-path problem over the graph of chart-to-chart conversions, picking the cheapest chain that respects your error budget — and every conversion emits a certificate.
Adjoint-native gradients
differentiate through the solution — not through the iterations
Gradients are adjoint-native: FrankenSim differentiates through the converged solution via the implicit function theorem, not by unrolling solver iterations. Sensitivities are exact and cheap, the same matrix-free apply serves the forward and adjoint passes, and a gradient check gates every merge — differentiability is a build requirement, not an afterthought.
Ten commitments the architecture is built to keep. Every crate, every merge gate, and every refusal traces back to one of them.
Pure, memory-safe Rust
One language, Franken-constellation dependencies only. Unsafe lives only in audited leaf capsules under 300 lines, each behind a safe façade.
Determinism is a feature
Bit-identical across runs, thread counts, and (best-effort) ISAs — via fixed-shape reduction trees, counter-based RNG keyed by logical identity, and compensated summation.
Differentiable or certifiable
Every operator is differentiable, certifiable, or ideally both. Gradients are checked at the merge gate; error bounds are first-class.
Budgets first
Every operation takes an accuracy / time / memory budget. The Error Ledger and Time Ledger compose them end-to-end and attribute every digit and every second.
Structure over brute force
Exact discrete de Rham (d∘d = 0), symplectic integrators, power-conserving ports. Preserve the math instead of resolving it away.
Matrix-free & roofline-honest
Kernels ship their arithmetic-intensity analysis against machine peak. No dense assembly where a matrix-free apply will do.
Cancellation-correct compute
Cancellation is a numerical primitive. Bounded latency-to-cancel of ≤ 200 µs; speculative races kill their losers mid-solve.
One data model
Complexes and cochains, everywhere. Geometry, fields, and operators share a single typed algebra instead of six incompatible schemas.
Provenance-complete
Content-addressed artifacts, event-sourced operations, and explain(artifact): a result always knows how it was made.
Agent-first ergonomics
The Five Explicits — units, seeds, budgets, versions, and capabilities — are never implicit, ever. Built for the swarm, compatible with humans.
The five things a FrankenScript program can never leave unsaid. This is what makes the whole system safe for an agent swarm to drive — never implicit, ever.
Units
Dimensional quantities are compile-time typed. A meter never silently becomes a second.
Seeds
Counter-based RNG keyed by logical identity. Every random draw is reproducible by construction.
Budgets
Accuracy, time, and memory ceilings travel with every call and compose across the whole plan.
Versions
The constellation is locked by hash. The kernels that produced a result are always recoverable.
Capabilities
The Cx context grants exactly what an operation may touch — arena, cancel token, ledger, budget.
You have seen the shape of the continuum. Now walk the crate inventory, or trace the phases that build it — each one Gauntlet-gated before it ships.