ANNIE Week 7: The Public Surface Lands

[Skip to main content](#main-content)

ANNIE Week 7: The Public Surface Lands — License Gate, Verification CLI, and a Documentation Operating System

Building in public: how eleven days of unglamorous engineering turned ANNIE from a private repo into a published surface buyers can read, license, and independently audit.

TL;DR

            - **The license gate is real.** Ed25519-signed `.lic` files bind to host fingerprint.
            - **`annie verify` shipped** as a top-level subcommand for independent auditing.
            - **Two correctness fixes** on the hot path (emergency-stop ordering and WAL refactor).
            - **Hardened CI** moved to Woodpecker with `error-leak-scan` and `frontmatter-scan`.
            - **Public docs launched** at [annie.verifiableproof.systems](https://annie.verifiableproof.systems/).
            - **Documentation labeling standard (schema 1.1)** and language-integrity policy enforced.

If you only read one section, read Why “Going Public” Is a Discipline Problem.

Where we were two weeks ago

Week 6 ended with the Aegis pivot finished. ANNIE had a working policy decision point — an AegisAgent orchestrator, a JSON-over-stdio daemon, and a SPARK-verified ring buffer. What we did not have was a way for anyone outside the team to acquire, install, run, or audit any of it.

The two-week plan was structural: turn the verified kernel into a product, without compromising the formal-methods properties that make the project worth building.

What shipped

1. The license gate

The annie binary now refuses to start the daemon without a valid, binding-matching .lic file. The license file is JSON with an Ed25519 signature. The offline issuance binary, annie-issue-license, is deliberately excluded from customer release builds.

2. annie verify — independent audit

A core commitment of ANNIE is that customers should not have to trust us to audit their own deployment. The annie verify subcommand walks the ceremony audit log and checks structural integrity, monotonic timestamps, and signature presence.

3. Emergency-stop ordering fix on the hot path

A quiet but important correctness fix in annie-api/src/lib.rs. Reordered so the key wipe happens before the state transition to Halted, ensuring any racing thread that observes the halt also observes the wiped cache.

4. Audit persistence, second pass

The audit subsystem now uses a dedicated WAL connection per worker to prevent contention. We replaced the LockedSecretKey type with honest heap zeroization via Zeroizing<Vec<u8>>.

5. CI hardening: Woodpecker + governance gates

CI moved to a self-hosted Woodpecker pipeline. Two new gates were added:

            - **`error-leak-scan`**: Prevents internal technical terms from appearing in customer-visible error output.
            - **`frontmatter-scan`**: Validates that all documentation follows the new labeling standard.

6. The documentation labeling standard

Every document now carries machine-readable frontmatter (schema 1.1). This includes a typed semantic registry for IDs, visibility tiers, and an agent consumption contract for autonomous systems reading the corpus.

7. The language-integrity policy

Bans “consensus laundering” and “anthropomorphic drift.” It mandates functional descriptors over brand metaphors and requires that every absolute (like “guarantees”) be bounded by a specific scope.

8. The public surface goes live

Launched annie.verifiableproof.systems. Accessibility was a first-class concern: we included skip-links, ARIA landmarks, and verified screen-reader labels.

Why “Going Public” Is a Discipline Problem

There’s a temptation to let language drift into marketing hyperbole. The technical line is “the kernel halts within a microsecond.” Marketing wants “ANNIE eliminates hardware-faults.” The gap between those is where formal-methods projects die. Our control loop and our documentation pipeline run the same algorithm: Predictable refusal of out-of-bound claims.

What we explicitly did NOT do

            - NVIDIA CUDA support (currently AMD ROCm only).
            - Managed-cloud SaaS (ANNIE is local-first).
            - ISO 13849-1 certification (architectural alignment is finished, but certification is a future workstream).

Numbers

                        Surface
                        State

                    Commits to main repo (since Week 6)15
                    License gate (Ed25519)Shipped, stable
                    `annie verify` CLIShipped, stable
                    CI pipelineWoodpecker, 9 steps, 2 governance gates
                    SPARK kernel proofsLevel 2, no failed checks
                    Hot-path budget~12 microseconds (unchanged)

What’s next

            - `visibility-scan` CI gate.
            - Migrate 19 historical documents to schema 1.1.
            - Expand the Threat Model page.
            - Auto-generate CLI reference from `--help`.

Verifiable Proof Systems

General inquiries: annie@verifiableproof.systems

Pre-orders: preorder@verifiableproof.systems