A number is not a result until it has passed its own verification. 一个数字，在它没通过自己的验证之前，不算结果。
LLM agent tool-use safety · chip EDA orchestration · chemical kinetics reduction · ML evaluation auditing · verifiable sovereign-debt covenants
LLM agent 的工具调用安全验证 · 芯片 EDA 编排 · 化学动力学约简 · 机器学习评测审计 · 主权债务条款的可验证执行
Featured / 代表作 · autoforge · agentic-eda · unifolm-wla-toolkit · debt-verify · agent-os · robot-spine · materials-spine
Everything below is the same argument, tested in different domains.
下面这些项目其实是同一个主张，换领域各测一遍。
- Verify the instrument before the number / 先审量具，再报数字 — a fitness score, an AUC, a rule classifier and a proof's "lower bound" are all instruments. Each main project takes the definition of the oracle away from the thing being measured, and CI asserts the published number cannot drift.
适应度、AUC、规则分类器、证明里的「下界」都是量具。主项目都把判定权从被测对象手里拿走，并让 CI 断言数字不许漂。 - Transfer the same skeleton / 同一副骨架换领域 — search → prove → perturb → cover shows up in EDA, in measured materials tables and in arm dynamics, with an independent engine (MuJoCo, z3,
abc cec) as the external check where one exists.
search → prove → perturb → cover 在 EDA、材料实测表、机械臂动力学里各跑一遍；有外部引擎（MuJoCo、z3、abc cec）时交给它对拍。 - Publish the boundary / 把边界写进结果 — negative results, unsupported conclusions, unreachable layers and rejected baselines are printed beside the wins. When a claim is later found unsupported it is downgraded in place with the reason recorded, not quietly deleted.
阴性结果、无法支持的结论、够不到的层、被驳回的基线，都和赢的那一面一起印出来。主张后来站不住时，原地降级并写明原因，不悄悄删掉。
| Project | The number it refuses to accept | 它不接受的那个数字 |
|---|---|---|
| debt-verify | Whether a debt covenant was triggered. Point estimates answer all 84 adjudicable units — but once each answer must still hold against the published amendment record, 75% become unsupportable. Kleene K3 three-valued logic + distributed free conformal intervals + P/NP-hard / PSPACE-hard trichotomy; the 3-SAT reduction is cross-checked against z3, 120/120. | 一条债务条款"是否被触发"的结论——点值判定在 84 个可判单元全部有答案，但要求答案在已公布修订记录上仍成立之后，75% 变得无法支持。三值逻辑 (Kleene K3) + 分布式自由 conformal 区间 + P/NP-hard/PSPACE-hard 三分，3-SAT 归约与 z3 对拍 120/120 |
| autoforge | A tool's own fitness score. An independent validity gate takes the right to define the oracle and the fitness function away from the tool under test. Clean ablation on a real model: gate on, intact rate stays 3/3; gate off, it degrades to 0/3 within 4 generations. On PyPI, 1,176 tests. | 一个工具自己的适应度——独立 validity gate 把 oracle 和 fitness 定义权从被测工具手里收回。真模型干净消融：gate 开则完好率恒 3/3，关掉 4 代内退化到 0/3。已发布 PyPI，1176 项测试 |
| agentic-eda | A circuit's area. Equivalence to the reference netlist must be proven first (abc cec returns counterexamples / yosys equiv requires 0 unproven). 13 strategies × 11 benchmarks, best −30.1% area / −61.2% depth, full flow down to sky130 layout. |
一个电路的面积——必须先证明与参考网表等价（abc cec 给反例 / yosys equiv 要求 0 unproven）。13 策略 × 11 基准，最优 -30.1% 面积 / -61.2% 深度，全链路到 sky130 版图 |
| evidence-gate | A model's AUC. Same code, two public targets: EGFR passes every gate, hERG is rejected (0.453 across eras). Label-permutation negative controls run first to falsify the pipeline, before any score is quoted. | 一个模型的 AUC——同一份代码两个公共靶点，EGFR 全门通过，hERG 被驳回（换年代 0.453）。先跑标签置换阴性对照证伪管线，再谈分数 |
| tool-market | Whether a tool is alive. A two-axis orthogonal state machine decouples "can it be called" from "which version is in effect"; append-only log with a SHA-256 hash chain. | 一个工具"活着"这件事——双轴正交状态机解耦"能否调用"与"哪个版本生效"，append-only 日志 + SHA-256 哈希链 |
| materials-spine | A gain from Bayesian acquisition. Four measured materials tables, eight rules, five seeds: no Bayesian arm beats the best model-free baseline, and the repository says so — next to the permuted-response control that keeps its own gains small (space-filling +24.63±0.46 vs random +19.96±5.48 on the hard table; control +1.27, −0.53). 330 campaign rows, 443 on one hash chain whose head is published outside the ledger, so rewriting the last row is visible. | 一个贝叶斯采集带来的增益——四张实测材料表、八种规则、五个种子：没有任何贝叶斯臂打赢最好的无模型基线，而且仓库照实印出来，旁边就是它自己的阴性对照（置换响应后增益必须小：难表上 space-filling +24.63±0.46 对 random +19.96±5.48，对照 +1.27、−0.53）。330 条 campaign 行、443 行一条哈希链，链头发布在账本之外，改尾行也会被发现 |
eda-spine chains qoragent / assertforge / covagent into one pipeline: the post-synthesis gate-level netlist must still satisfy the properties already proven at RTL.
materials-spine points the same four stages (search / prove / perturb / cover) at a domain with no EDA in it — measured materials tables, conservation-free, engineering laws tested against their own controls — to answer a measurable question: is this four-stage shape the shape of EDA, or the shape of any trustworthy search? Earlier probes in the same slot (kinetics-spine, formula-screen, process-spine) are archived and folded into it.
eda-spine 把 qoragent / assertforge / covagent 串成一条链：综合后的门级网表必须仍满足在 RTL 上已证的性质。
materials-spine 把这四段 (search / prove / perturb / cover) 指向一个完全不含 EDA 的领域——实测材料数据表、工程法则对着自己的对照挨个受审——用来回答一个可测量的问题：这四段是 EDA 的形状，还是任何可信搜索的形状。 这个位置上前几轮探针（kinetics-spine、formula-screen、process-spine）已归档并合并进它。
robot-spine — FK / IK / capsule collision / safety gate, with zero-dependency verification. The number it refuses to accept is "my dynamics equations are correct", so the arm is handed to an engine I did not write: across 49 poses, G(q) differs from MuJoCo's qfrc_bias by 1.8e-15 N·m; the same PD controller reaches identical endpoints on both plants with max deviation 8.0e-3 rad en route (different integrators, reported separately). Single-start IK reaches only 57% — printed next to the 100% from multi-start, and asserted in CI so it is not allowed to look better.
robot-spine 把同一副骨架指向运动：FK / IK / 胶囊碰撞 / 安全门，验证路径零依赖。它不接受的那个数字是「我的动力学方程是对的」——所以把这台臂交给不是自己写的引擎去算：49 个位姿上 G(q) 与 MuJoCo 的 qfrc_bias 差 1.8e-15 N·m，同一 PD 在两套 plant 上终点完全相同、途中最大差 8.0e-3 rad（积分器不同，如实分开报告）。单起点 IK 只到 57%，在多起点 100% 旁边一起印着，并在 CI 里断言它不许变好看。
Same thesis, moved to "can an AI actually take over your own machine".
同一个主张，换到"AI 能不能接管你自己的机器"这一层。
| Repo | The number it refuses to accept | 它不接受的那个数字 |
|---|---|---|
| agent-os | The sentence "AI can get into everything" — split into nine layers from L0 microcode to L8 cloud, each answering who is in charge, how far the local machine actually reaches, and why it cannot. L0 measured on Update Revision 0541400a: cannot write, with the reason recorded as a physical fact rather than a to-do. |
"AI 打通一切"这句话——拆成 L0 微码到 L8 云端九层，每层回答谁说了算、本机碰得到哪、碰不到的原因。L0 实测 Update Revision 0541400a，写不了，理由写成物理事实而不是待办 |
| agent-anyapp | "This software can be taken over by an AI" — three channels (official-api / local-db / client-drive) converge on one {name,args,returns,channel} contract. WeChat is the measured counterexample: 28 libraries, 124,383,232 bytes, zero plaintext; process holds zero listening ports; the tool returns unsupported instead of reporting success. |
"这个软件能被 AI 接管"——三条通道（official-api / local-db / client-drive）收敛成同一个 {name,args,returns,channel} 契约；微信实测是反例：28 个库 124,383,232 字节零明文、进程零监听端口，工具如实返回 unsupported 而不是报成功 |
| kernel-lab | "I can get into the kernel" — KMDF driver skeleton + test signing + VM debugging, entirely through Microsoft's official signing path; the driver's only IOCTL returns the caller's PID, so it cannot hide anything. | "我能进内核"——KMDF 驱动骨架 + 测试签名 + VM 调试，全程走微软官方签名路；驱动的唯一 IOCTL 只返回调用者 PID，故意藏不住 |
Together, these three say one thing: turn black boxes into contracts with safety boundaries that an AI can drive — and record what is unreachable as "unreachable", not as "not done yet".
这三条线合起来的一句话：把黑箱变成有契约、有安全边界、可被 AI 驱动的接口，并且把够不到的地方写成"够不到"，不是写成"还没做"。
- unifolm-wla-toolkit — a data pipeline implementing Unitree UnifoLM-WLA-1.0's official spec: 54-D action / 60-D state unified representation, SE(3) relative poses, zero-dependency URDF forward kinematics. No GPU, no real robot, no weights. All 15 self-checks pass in one command. The 7 places where the spec is undefined are written up as a note to Unitree.
按宇树 UnifoLM-WLA-1.0 官方规范实现的数据管线：54 维动作 / 60 维状态统一表示、SE(3) 相对位姿、零依赖 URDF 正运动学。不需要 GPU、真机、权重。15 步自检一条命令全过。规范里 7 处未定义的地方写成了给宇树的说明。 - llm-safety-eval-audits — every recomputable number behind three manuscript drafts (none accepted or peer-reviewed; submission status is author-recorded). Recomputing found: the grading script's fallback branch fired silently 28 times out of 120 trials; the rule classifier treated as ground truth is only 53% correct against human labels, and agrees with the LLM judge at 61.6% raw but kappa 0.115.
三篇稿件草稿的全部可重算数据（均未录用、未经同行评议，投稿状态为作者自记）。重算发现：被打分脚本的回退分支在 120 次试验里悄悄触发了 28 次；被当作真值的规则分类器在人工标注上只有 53% 正确，与 LLM 裁判原始一致率 61.6% 但 kappa 仅 0.115。 - craftagent — machine-tool condition data to anomaly attribution, standard library only (on that factory machine, one missing dependency is one more thing that cannot be installed). Synthetic data with planted ground truth; all 5 acceptance checks pass.
机床工况数据到异常归因，只用 Python 标准库（工厂那台机器上少一个依赖就少一个装不上的理由）。合成数据埋真值，5 项验收全过。
- swpl — Skew-Phase Law: an empirical working hypothesis about data-structure selection under Zipf load, with a probability-mass-partitioned ζ-Trie. No lower bound, optimality or phase-transition theorem is proved; see
paper/CLAIM_STATUS.md. - agent-safety-bench — a multi-step agent safety-compliance benchmark; it measures critical depth, not single-turn refusals.
- benign-rag-trap — exploratory: family-dependent differences in rule-classified refusal on 660 stored responses. Labels are not human-adjudicated and no journal submission is claimed.
Short version: almost none. As of 2026-11 this account holds 50 repositories (36 public, 14 private); 46 are self-origin and 37 were created after 2026-09-01. Across all of them: 5 stars, 1 fork, 0 open issues, 0 pull requests from outside contributors, 0 peer-reviewed publications. CI is self-run, and the numbers above were measured on the author's machines. Strong internal verification, very weak external evidence — this gap is the single largest weakness of the portfolio.
一句话：几乎没有。 截至 2026-11，这个账号有 50 个仓库（36 公开、14 私有），46 个为自创、37 个建于 2026-09-01 之后。全站合计 5 star、1 fork、0 个开放 issue、0 个外部贡献者 PR、0 篇同行评议论文。CI 是自己跑的，页面上的数字来自作者自己的机器：内部验证强、外部证据弱，这是整个组合最大的短板。
This section is written by the maintainer. It is a disclosure, not external validation; describing the gap does not close it.
本节由维护者本人所写，是披露而不是外部验证；写下差距并不等于填上了它。
| Evidence / 证据 | What it shows / 能说明 | What it does not / 不能说明 |
|---|---|---|
| CI on 26 core repos (24 green / 2 red at audit time; both red jobs fixed in the 2026-11 batch) / 26 个主仓的 CI | the committed checks pass on GitHub-hosted runners / 提交的检查在 GitHub runner 上能过 | that a third party tried it / 有第三方试过 |
verify_readme_numbers.py, check_claims.py, measurement_validity.py / 数字与主张复核脚本 |
prose and committed data have not drifted / 文字与数据没漂 | that the measurement convention is valid / 量法本身有效 |
| 1,900+ self-run tests, hash chains, negative controls / 自测、哈希链、阴性对照 | internal consistency / 内部自洽 | human adjudication or independent replication / 人工判定或独立复现 |
PyPI swpl 0.1.0, autoforge-agent / 已发包 |
the artefact is installable / 产物可安装 | peer review or real adoption / 同行评议或真实采用 |
Claim status (downgraded in place, 2026-11) / 主张现状（2026-11 原地降级）
| Project | Status / 状态 |
|---|---|
| swpl | Working hypothesis, not a theorem. "0.88 comparisons" counted tree levels, not comparisons; the lower-bound proof was invalid; the benchmark used log n where the lemma needs ζ_n(α). See paper/CLAIM_STATUS.md. / 工作假设，不是定理，详见 paper/CLAIM_STATUS.md |
| benign-rag-trap | Exploratory. All rates are deterministic rule-labeler outputs over 660 stored responses, not human-adjudicated safety rates. The earlier ">95% human agreement" claim is withdrawn; scripts/measurement_validity.py gates human validation at Cohen's kappa >= 0.6. / 探索性；所有比率均为规则标注器输出，非人工判定 |
| llm-safety-eval-audits | Three manuscript drafts, none accepted or peer-reviewed. Submission IDs are author-recorded; no editorial correspondence is stored here. / 三篇稿件草稿，均未录用、未经同行评议 |
| Cover letters / 投稿信 | Drafts, not sent. / 草稿，未投递 |
One-command checks / 一条命令的复核
| Repo | Command |
|---|---|
| quant | python -B -m unittest discover -s tests -q (110 tests) |
| rtforge | python scripts/report.py |
| swpl | python -m pytest -q && python scripts/check_claims.py |
| benign-rag-trap | python scripts/verify_readme_numbers.py && python scripts/measurement_validity.py && python scripts/check_claim_scope.py |
| llm-safety-eval-audits | python scripts/verify_readme_numbers.py |
| craftagent | python -m craftagent verify |
| autoforge | python -m pip install -e ".[dev]" && python -m pytest tests -q |
All of these run on a fresh clone with no API key, no GPU and no model weights.
以上都不需要 API key、GPU 或模型权重，在全新 clone 上即可运行。
How to help / 怎么帮上忙
The most valuable contribution is an independent reproduction — success or failure. Use the "Independent reproduction / 独立复现" issue template in any of the seven repositories above, with your commit hash, python -c "import sys, platform; print(sys.version, platform.platform())", the exact commands and the full output. "Check 3 fails on my machine" is worth more than a star.
最有价值的贡献是独立复现，成功或失败都算。在上述任一仓库用「Independent reproduction」模板开 issue 即可；「第 3 项检查在我机器上挂了」比一个 star 有用得多。
What would actually move the needle: a third-party reproduction; human labels with Cohen's kappa >= 0.6 for benign-rag-trap; an external pull request; or a peer-reviewed result. Until one of those exists, nothing here should be described as externally validated.
真正能改变结论的：第三方复现；benign-rag-trap 达到 Cohen's kappa >= 0.6 的人工标注；外部 PR；同行评议结果。在这些出现之前，这里没有项目应被称作「已被外部验证」。
Identity / 身份
Canonical account: ZhangYangyi03 — Yangyi Zhang, Georgetown University. Some published metadata still carries a legacy yz1571 owner (for example PyPI swpl 0.1.0, released 2026-09-04); treat the ZhangYangyi03 repositories as canonical. The PyPI 0.1.0 page still describes an "optimal ζ-Trie" and is not the same artefact as this repository's 0.1.1; correcting it requires a new release with the maintainer's PyPI credentials.
规范身份：ZhangYangyi03 / Yangyi Zhang，Georgetown University。部分已发布元数据仍带旧 yz1571 标识（如 PyPI swpl 0.1.0，2026-09-04 发布），以 ZhangYangyi03 下的仓库为准。PyPI 0.1.0 页面仍写着「optimal ζ-Trie」，与仓库里的 0.1.1 不是同一产物；修正需要维护者用 PyPI 凭据发新版。
Questions about agent tool governance, verification pipelines, or robot data formats — open an issue; I read every issue on the main repos.
有关于 agent 工具治理、验证流水线、或者机器人数据格式的问题，开 issue 就行——主仓库的 issue 我都会看。
Every project documents what it does not do. debt-verify detects "a conclusion unsupported by the published record", not "the sovereign is lying"; agentic-eda tells you 11/11 benchmarks still carry sign-off violations it cannot fix. That boundary is mine, not a disclaimer.
每个项目都写了它不做的那件事（debt-verify 检出的是"结论不被公布记录支持"，不是"债务国造假"；agentic-eda 会告诉你 11/11 基准仍带它修不了的签核违规）。这条边界是我的，不是免责声明。
Python · verification pipelines · LLM agent systems · EDA orchestration · numerical reproducibility