Read it, run it, build another one.
The reference implementation, the specification it follows and the documentation are public. The project asks for a second implementation of its own state transition, because two implementations that disagree are how a bug in either one gets caught.
Licence
The code is licensed under either the Apache License, Version 2.0, or the MIT licence, at your option. Use it, change it, ship it and build products on it, commercially or not; keep the copyright and licence notices.
The fonts on this site are under the SIL Open Font License and are served from this site. The name and the mark identify the project; the brand page says how to use them.
- Licence
Apache-2.0 OR MIT- Texts
- LICENSE-APACHE, LICENSE-MIT
- Repository
- github.com/shayansal/Siontology
- Language
- Rust 1.80 or later; unsafe code is forbidden
Two proof stacks
A proof system is only as sound as its implementation, so Siontology never trusts one. Proof stack A is the reference executor. Proof stack B is a second implementation of the state transition, written only from the specification. Every chunk of every Pulse goes through both, and a World Proof verifies only if both accept.
A script run in CI checks that stack B never calls the reference executor’s logic. Differential tests drive thousands of chunks, random workloads, boundary probes and tampered inputs through both stacks. They found two defects in the reference executor and several gaps in the specification, all fixed in version 1.1: a market clearing deadline near the largest 64-bit value overflowed when its batch sealed, which let any account halt the chain, and a charter window near the same value made the reference executor disagree with the specification.
Both stacks still share the hashing, Merkle, signature, Assurance Algebra and clearing-certificate code, so a bug there would be common to both. That shared code is named as a separate assumption, impl:shared-primitives, in the trust formula of every World Proof.
The Fold and two proof stacks
A Pulse executes as a chain of chunks, each with a statement binding the world before and after it; the last chunk is the deferred phase. Stack A, the reference executor, and stack B, an independent implementation written only from the specification, each verify every chunk. Their proofs fold pairwise into two roots, and the World Proof is the pair: a client accepts it only if both stacks accept. In the second Pulse shown, stack A has a hypothetical soundness bug and accepts an invalid chunk; stack B rejects it, so no World Proof exists for that Pulse. Today both stacks verify by replay: they bind the same statements a succinct proof would, but checking costs as much as executing.
The specification
The state transition specification is normative: it defines the function a proof stack evaluates for every chunk of every Pulse, and through it the whole state transition, from preparing and executing one transaction to the three phases of a Pulse and the commitments each chunk statement carries. Where the two implementations disagree, one of them is wrong.
Since version 1.3 the state transition covers validators, stake, epochs and the response to censorship, so every committee change follows its rules and the World Proof covers it. Version 1.4 pays validators from fees alone; version 1.5 takes their seats from slashed validators even when nobody else is eligible. Later versions add what agents need from the ledger. It is at version 1.15, and both proof stacks implement it.
v1.1
From differential testing of stack B against stack A: saturating deadlines and windows, bounded market periods, specified deferred-phase errors, and what the World Proof binds.
v1.2
From independent reviews: transaction signatures bound to the chain, bounded inputs, allotments, batches, formula depth and certificate size.
v1.3
Staking with proof of key possession, unbonding, rewards by weight, slashing of equivocation with a share to the reporter, forced-inclusion obligations and committee rotation.
v1.4
Rewards from fees only: the state keeps a running total of fees collected, and each epoch pays its validators a share of what was collected during it, so slashed stake and other funds in the treasury never add to rewards.
v1.5
From an independent review: slashed validators lose their seats at the epoch boundary even if nobody else is eligible, so a chain whose every eligible validator was slashed halts instead of running on them.
v1.6 to v1.15
Among them: payment streams with checkpoints; agent identities, subagents and suspension; memory logs that can only grow; Task Charters; storage deals proven every round; one signature for a batch of keyless subagents; lineage ids and token buckets; verifiers a task names who must attest. The changelog has every version.
The repository
A Cargo workspace of focused crates that depend on sion-core rather than on each other where they can.
| Crate | What it holds |
|---|---|
sion-core | Domain-separated SHA3-256, canonical Borsh encoding, typed identifiers, fixed-point money, the RFC 9162 append-only log, the sparse Merkle state tree |
sion-crypto | ML-DSA-44, SLH-DSA-SHA2-128s and 128f, ML-KEM-768, dual-origin signatures, account policies, sealed envelopes, Shamir sharing |
sion-assurance | The Assurance Algebra: atoms, formulas, cost of corruption, the decision rule, reservations, challenges, slashing, insurance |
sion-lp | Exact rational simplex and linear-time verification of optimality certificates |
sion-clearing | Verifiable Clearing: sealed double auctions and assignment markets with certificates |
sion-da | Two-dimensional Reed–Solomon coding over the Goldilocks field, commitments, sampling, reconstruction, fraud proofs |
sion-consensus | Linear Lanes, certified-DAG BFT, committees and sampling, the beacon, forced inclusion, a deterministic network simulator |
sion-exec | The state machine, proof stack A: objects, accounts, claims, bonds, Agent Charters, escrow, markets and validators; Pulse execution with chunk traces and witnesses |
sion-spec | Proof stack B: an independent implementation of the state transition, written from the specification |
sion-prover | Proof stacks, World Proofs and their verification |
sion-light | The light client: chain identity, epoch boundary proofs, header certificates, state and receipt proofs, availability sampling |
sion-memory | Memory for agents and robots: logs only their writer appends to, an index with proofs that an answer is complete, belief computed by the reader, sealed payloads |
sion-net | Networking between nodes: identities, message classes with size limits, and QUIC over TLS 1.3 with ML-DSA-44 keys pinned at both ends |
sion-node | The node: validators, gateway, prover, write-ahead log and snapshots, the HTTP API |
sion-agent | The agent runtime: models, tools with effects and grants, autonomy levels, approvals, taint, a journal of side effects, budgets and sessions that pause and resume |
sion-http | Outbound HTTP for agents’ tools: TLS offering a hybrid post-quantum key exchange first, deadlines, bounded reads, and refusal of private and local addresses |
sion-app-core | The app’s core, which the desktop app is built on: the device’s key and a light client that verifies every Pulse it shows |
sion-cli | The sion command: setup and updates, devnets and nodes, wallets, demos, the agent and its channels, light verification, the MCP server, x402, benchmarks |
Contributing
The rules in AGENTS.md apply to everyone who changes the code, people and AI agents alike. Seven of them are not negotiable.
One encoding
Every consensus-critical value has one canonical Borsh encoding and is hashed with a domain tag.
Deterministic order
Consensus-critical maps are ordered maps; no hash-map iteration order may influence a hash, a root, an ordering or a decision.
No floating point
Money is fixed-point micro-units; exact optimisation uses rationals. Floats are for reporting only.
Nothing is deleted
Consumed objects are tombstoned and claims are appended, so history stays auditable and proofs stay stateless.
Every assumption named
Anything the system relies on that is not proven is an atom in some trust formula, including the implementation’s own shortcuts.
Shortcuts labelled
Simulation-only shortcuts, such as fast test signatures and replay proofs, are labelled in the types and never silently replace real cryptography.
No unsafe Rust
The workspace forbids it.
Seed every random number generator, write a property test for every algebraic or adversarial invariant, and document and test public functions. The suite includes property tests for the Assurance Algebra, the linear-programming certificates and the state machine, a deterministic consensus simulator with adversarial network phases, scenario tests for every transaction kind, end-to-end devnet tests with dual post-quantum signatures, the agent runtime against a scripted model and stand-ins for the services it talks to, and the demos.
Found a vulnerability? Report it privately, as the security page describes, not in a public issue.
cargo fmt --all
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace