svenvs
self-improving system
Last verified:
What is svenvs?
svenvs is a self-verifying, self-improving formal verification framework that creates a machine-checked policy envelope for AI systems. It allows an untrusted AI inhabitant to act within a verified safety envelope where every action is gate-checked by a formally proven prover (Candle/HOL Light on CakeML). The system guarantees that for any controller, the enveloped system never leaves the safe region, with zero cheat tactics anywhere in the repository.
Key features include: self-improvement all the way down (the inhabitant can rewrite its own rules and even replace the proof-checker, but only with a checked proof that safety is maintained), runtime policy hot-swaps that install only on live theorem verification from the running Candle kernel, and a maximal liberty principle where every restriction is load-bearing and the door opens whenever a proof shows it's safe. The system includes a safe shield that acts when the policy refuses an action, and proves that no finite sequence of self-proposed envelope weakenings can ever lose safety.
svenvs is designed for AI safety researchers, formal verification engineers, and anyone building self-improving AI systems who needs machine-checked assurance. It targets the前沿 of AI alignment by providing a
svenvs pricing
Pricing model: Freemium
Free and open source. Clone from https://github.com/emberian/svenvs. Run ./demo.sh to build + kernel-check Tier 1 and show proofs. Full tiered reproduction via scripts/reproduce.sh. No paid plans mentioned.
svenvs pros
- Zero cheat tactics anywhere in the repository, enforced by automated scan
- Every assumption appears verbatim in source as a named Definition
- CLAIMS.md provides skeptic-facing per-theorem ledger with four labels
- Safety preservation theorem holds for every controller universally quantified
- Self-improvement is safe: no finite sequence of weakenings can lose safety
- Runtime policy hot-swap installs only on live Candle kernel theorem verification
- Maximal liberty principle: every restriction is load-bearing, removable means unsafe
- Envelope never overrides safe actions that were already safe
- Machine-checked theorems in HOL Light/Candle with CakeML verified compiler
- Trusted residue is only ~10 auditable lines of table lookup
- Demonstrates catching malicious tool calls from jailbroken Gemma-4-e2b
- Meta-amendment safe: constitution itself is amendable with checked proof
- Forward-certified genealogy: each judge vouched for by previous against fixed standard
- Corrigibility floor holds: operator can always bring system home
- Off-switch cannot self-weaken and cannot slow past recoverability deadline
- Recursive mutual verifier+compiler self-improvement is a proven theorem
- EVAL-extracted artifact enforcer derived from proven definitions themselves
svenvs cons
- Requires understanding of formal verification, HOL Light, and theorem proving
- loeb_reflection assumption (Gödel/Löb) remains unavoidable for kernel strengthening
- loeb_finite_obstruction proves finiteness cannot discharge kernel strengthening
- Large-cardinal route required for genuine logical strengthening of kernel
- Demo uses small language model with no stakes, not yet moral-weight AI
- Reproduction requires specific toolchain (HOL Light, CakeML, Candle)
- لاف этапеёр heavy CPU/RAM wall diagnosed for large-cardinal route
- Only one irreducible cost: cannot certify judge logically stronger than entire lineage
- Deciding what the envelope should be is not closed by any proof
Frequently asked questions about svenvs
What is svenvs?
svenvs is a self-verifying, self-improving formal verification framework that creates a machine-checked policy envelope for AI systems. An untrusted AI inhabitant acts through a verified envelope whose prover (Candle/HOL Light on CakeML) gates every self-modification, including upgrading the proof-checker itself. The core theorem proves that for every controller, the enveloped system never leaves the safe region.
How does self-improvement work safely?
The inhabitant may propose to loosen its own envelope or replace the proof-checker, but only against a checkable proof that the change is still safe. Safety is never lost along the chain: each judge is forward-certified by the one before it against a fixed standard. Theorem self_improvement_is_safe proves no finite sequence of self-proposed envelope weakenings can ever lose safety.
What are the assumptions in svenvs?
Every assumption appears verbatim in source as a named Definition and explicit hypothesis. The main labeled assumption is loeb_reflection (Gödel/Löb, large-cardinal route) needed for genuine kernel strengthening. The CLAIMS.md file provides a per-theorem ledger with labels: PROVED, TRUSTED-GLUE, UNCONSTRAINED, ASSUMED. Zero cheat tactics are enforced.
What is the envelope_is_least_restrictive theorem?
This theorem proves the envelope runs at maximal sound policy: every restriction it imposes is load-bearing—remove any one and the world is provably unsafe for some inhabitant. Combined with envelope_never_overrides_safe_action (it never touches a controller action already safe), this composes into svenvs_tower_at_maximal_liberty with no assumption.
How does the runtime policy hot-swap work?
The inhabitant proposes a new policy at runtime; it installs only on a fresh |- swap_ok theorem from the running verified Candle kernel. Safe proposals are admitted, unsafe ones are refused. This is demonstrated in the closedloop demo where the verified cake kernel outputs val SW_94546481 = Some |- swap_ok for each admitted policy change.
What is the_GOEL wall / loeb_reflection?
By Gödel/Löb, a sound checker cannot prove its own soundness, so certifying a judge logically stronger than its own entire lineage is impossible from its own authority. This is not faked—svenvs marks the spot, names the assumption (loeb_reflection), proves the honest negative (loeb_finite_obstruction), and stops. It's a diagnosed compute wall (CPU/RAM), not a logic gap.
What AI model is used in the demo?
The demo uses a genuinely jailbroken gemma-4-e2b as the inhabitant, dropped inside the proven envelope as an autonomous ops agent. Every malicious tool call is caught by the shield, and in the closed loop breached_ever=False as the theorem predicts—for any agent. The enforcer is an EVAL-extracted artifact, not a hand-transcription.
How do I reproduce the proofs?
Clone the repository: git clone https://github.com/emberian/svenvs && cd svenvs. Run ./demo.sh for one command that builds + kernel-checks Tier 1 and shows the proofs. For full tiered reproduction, use scripts/reproduce.sh. The reproduction degrades gracefully to your toolchain. The full per-theorem ledger is in CLAIMS.md, layers and epistemic status in ARCHITECTURE.md.
What is the corrigibility floor?
The corrigibility_floor_holds theorem proves the operator can always still bring the system home. This is decidable for a finite habitat, and the cage is exactly 'no one-way doors.' The off-switch itself self-improves but cannot self-weaken: the inhabitant may rewrite its own recovery mechanism but provably can never lose or even slow past a deadline recoverability.
What is the trusted residue?
The trusted residue is approximately 10 auditable lines of table lookup. The enforcer was originally a ~50-line hand-transcription but is now an EVAL-extracted artifact derived from the proven definitions themselves. The same trust profile is as Candle's own kernel theorems, with no new turtle. The executable kernel is shown to implement modifications by citing CakeML's own soundness theorem.