Every assumption, named.

The architecture paper’s security model, with what the reference implementation does today. Equivocation leaves signed evidence and is slashed; censorship is made visible and answered by replacing the committee.

A light client pins one value, the chain identity: a digest of the genesis specification, the genesis validators with their stake and keys, and the shard layout. Every later committee is in the state, and the client follows it one epoch boundary at a time, so it trusts nothing a node serves. Without a pin, sion verify says that the node is vouching for itself.

Every account and validator signs with two unrelated families at once: ML-DSA-44 (FIPS 204, module lattices) and SLH-DSA (FIPS 205, hash-based). SLH-DSA-SHA2-128f is the default; the smaller and slower SLH-DSA-SHA2-128s suits accounts that sign rarely. Payloads are encrypted to viewing keys with ML-KEM-768 (FIPS 203) and ChaCha20-Poly1305.

An account is identified by the hash of its genesis authorization policy, so its keys can rotate without changing the account. The cost is bandwidth: kilobytes per signature, which is why validators sign one Merkle root per batch of approvals rather than each approval.

Proofs stop invalid state, not equivocation. A validator that signs two consensus headers for one round, or approves two spends of one object version, leaves signed evidence. Anyone can submit it: the whole stake is forfeited, the reporter receives a share of it (5 % on the devnet), and the validator loses its seat at the next epoch boundary. Committees are derived from the validator set in the state, so every change of who certifies is covered by the World Proof. The technology page shows the full cycle from the staking demo.

On the devnet, validators stake devnet USD, which has no value. Siontology has no token and nothing is on offer. Fees are paid in stablecoins.

An agent’s limits live in two places. Its charter, what it may spend, to whom and until when, is enforced by the ledger, whatever the agent was told. Its autonomy level, the approvals people give, and the taint of content from outside are enforced by the runtime on the machine it runs on, so they hold only as far as that machine does (agent:local-policy). The model is not trusted to behave: a test gives nine attacks to a scripted model that does whatever it reads, and records what stopped each.

Two of the nine attacks got through: a file in the workspace that tells the agent to post it, since what it reads from its own workspace does not taint a session (agent:workspace-content), and a page that has it send a key through a tool you contained, which reaches only where you named. The attacks, row by row. Every agent atom, more than sixty, is in the trust model.

The reference implementation adds assumptions of its own. Each one is an atom in the trust formula of anything the devnet reports, and each is labelled in the types and in the output.

Independent reviews, run by AI agents that had not written the code, read the consensus-critical libraries, the node, the validator machinery, the networking plan, and storage deals with the app, and confirmed their findings with tests. Everything they found is fixed with a regression test, except where marked open. Among the fixes:

• an unbounded chain of claim references could overflow a validator’s stack; claim references and formulas now have bounded depth;
• a signature cache keyed on the transaction body but not its signatures, so a copy with stripped signatures could split replicas;
• lane validation skipped the checks execution makes before charging a fee, so zero-fee transactions were published for free;
• certificate finality did not survive a restart; approvals are now logged before they leave a validator, and locks are restored;
• transactions and validator messages were not bound to a chain; transaction signatures now cover the chain configuration;
• light-client sampling used a fixed seed, and a missing World Proof did not fail verification;
• an owner could get honest validators slashed: the node released a rejected transaction’s lane locks at once, so its next approval of the same inputs counted as equivocation; a rejected transaction now keeps its locks until it expires;
• if every active validator was slashed within an epoch, they kept their seats into the next one; since specification v1.5 they lose them regardless, and such a chain halts;
• a storage provider working with a validator could steer which pieces of data it was asked for, by timing its proofs; since specification v1.12 a round’s challenge comes from the beacon of the round’s first Pulse, which the ledger records;
• a provider fetched from any address a deal named, including its own machine and network; it now refuses local files and private addresses unless told otherwise;
• the app presented the node’s account of what a transaction did as fact; it now shows what the receipt it proved says, and labels anything else as the node’s unproven report.

Open: fee-paying transactions with large bodies can still make Pulses slow, since data-availability encoding of the largest allowed Pulse takes seconds on one core; an account query scans every object; the active set can shrink to a single validator (impl:active-floor); Pulse headers do not yet commit to the beacon reveals a validator syncing from certified headers will need.

Differential testing of the two proof stacks found two defects in the reference executor, including a market deadline overflow that let any account halt the chain; both were fixed in specification v1.1. The full list is in docs/implementation-status.md.