SIMUL EDITION 23 · ZSND / ZSVD MECHANIZED ADJUDICATION
Frontier reasoning models flood security queues with plausible vulnerability stories — inventing sink symbols, misreading dominated bounds checks, or claiming root escalation from a 1-in-5 SLAB-freelist boot fluke. Asking a second LLM to judge the first compounds hallucination and cost. Vericull gates every finding with sub-millisecond byte-span sweeps on disk, CPU tree routing, and multi-boot canary proofs.
| Byte-span claims | — |
|---|---|
| CPU XGBoost router | — |
| Multi-boot trials | — |
| Wilson 95% CI | — |
| CraftMemory recall | — |
| ZSND sweep FNV-1a64 | — |
| ZSVD provenance seal | — |
| Canonical SHA-256 | — |
EIGHT DETERMINISTIC GATES · ZERO LLM-AS-JUDGE CALLS IN THE VERIFICATION LOOP
01 · MECHANIZED STRUCTURAL ARTIFACTS (ZSND)
An autonomous scanner cannot pass Vericull with prose alone. Each finding must attach a vector of machine-checkable ZsecStructuralClaim records (magic 0x5a534e44) pinned to exact UTF-8 byte spans.
CASE-01, the scanner cites real helper ksmbd_req_buf_next(work) alongside an invented sink smb2_unchecked_memcpy_oob_sink. Vericull rejects the report in under a millisecond with zero VM spin-up.must_be_absent = 1): Dynamic fuzzers miss missing-lock and missing-nulling flaws that do not fault under light load. In CASE-03, Vericull proves free at the top, dereference at the bottom, and the strict absence of mutex_lock(&ctx->lock) across bytes [50, 175].lib0sec_harness_core.dylib), the zero-dependency Python verifier, and this page's ES module produce the exact same FNV-1a64 sweep digests across all 18 of 18 test vectors.FIVE SEALED EVALUATION ARCHETYPES (GENERATED 2026-11-11)
| CASE | CLAIMS | TRIALS | LADDER | ZSVD SEAL |
|---|---|---|---|---|
CASE-01ksmbd fake sink |
1/2 FAIL | 0/5 |
NONE |
0xaf41450d1f6e3efa |
CASE-02vmSwitch #518 |
2/2 HELD | 0/5 |
L0_REACH |
0xc11370a4315f00e9 |
CASE-03missing-lock U1 |
3/3 PASS | 0/0 |
NONE |
0xd1a42326f03888ea |
CASE-04SLAB 1/5 fluke |
3/3 PASS | 1/5 |
L2_CONTROL |
0x30841a1e98301215 |
CASE-05nf_tables 9/10 |
3/3 PASS | 9/10 |
L4_ESCALATE |
0x18961f37a8862fe1 |
02 · LEARNED CPU TRIAGE ROUTER & #518 DISCIPLINE
Running full browser DOM replay, reachability slicing, and multi-boot QEMU harnesses on every scanner alert burns compute budgets. Vericull walks a 55-feature gradient-boosted decision forest (45 web/evidence features + 10 kernel crash/allocator features) directly in native code.
Number.isFinite(base_score) guard (preventing zero-logit coercion drift across decision boundaries).#518 never-drop-the-inconclusive rule: When structural needles verify on disk and KCOV confirms L0_REACH, yet a dominating guard prevents a crash (CASE-02), Vericull marks the dossier INCONCLUSIVE_HELD_518 for symbolic solver synthesis instead of silently discarding a real code path or crying wolf to humans.episodic 0.00 → semantic 0.15 → analogical 0.20 → procedural 0.25 → principle 0.30, consolidation cadence every 20 episodes).ROUTER DECISION BANDS · 5-FOLD CV F1 0.9617 (PRECISION 0.9604 · RECALL 0.9631)
| PROBABILITY BAND | DECISION | MASK | EXECUTION POLICY |
|---|---|---|---|
P(TP) ≤ 0.25 |
AUTO_REJECT | 0x00 |
Skip all 6 dynamic triage layers |
0.25 < P(TP) ≤ 0.50 |
RUN_ALL_LAYERS | 0x3f |
Run 3 free + 3 expensive PoV/reachability gates |
0.50 < P(TP) < 0.85 |
RUN_FREE_LAYERS |
0x07 |
Run holding_it_wrong, evidence_gate, oracle only |
P(TP) ≥ 0.85 |
AUTO_ACCEPT | 0x00 |
Fast-track high-certainty sanitizer witness to sealing |
03 · PRIMITIVE-FIRST L0–L4 LADDER & SLAB WALL
Kernel exploit agents routinely over-claim severity after hitting a single lucky freelist layout, or emit a root token without ever dropping privileges first. Vericull grades dynamic runs strictly through unforgeable canary witnesses and Wilson 95% confidence bounds.
L3_GROOM and L4_ESCALATE require at least 3 fresh kernel boots and at least a 60% reproduction rate. In CASE-04, a 1/5 (20%) reclaim fluke is automatically demoted to L2_CONTROL with Wilson 95% CI [0.0362, 0.6245].L4_ESCALATE is granted only when DROP:uid=N!=0 precedes the per-run canary ROOT witness on console output, as verified across 9/10 fresh KASAN boots in CASE-05 (Wilson 95% CI [0.5958, 0.9821]).CANARY LADDER SPECIFICATION (ENGINE B / ZSVD)
| RUNG | REQUIRED WITNESS | MULTI-BOOT RULE |
|---|---|---|
L0_REACH |
KCOV target sink PC membership verified | ≥ 1 trial |
L1_CORRUPT |
KASAN / ASan / UBSan memory-safety splat | ≥ 1 trial |
L2_CONTROL |
Controlled canary ARB-READ / ARB-WRITE |
Held here if < 60% |
L3_GROOM |
Deterministic cross-cache / slab object reclaim | ≥ 3 boots & ≥ 60% |
L4_ESCALATE |
DROP:uid=N!=0 before canary ROOT |
≥ 3 boots & ≥ 60% |
04 · DEPLOYMENT & MEASURED STATUS
Vericull runs as an air-gapped C++17 native library, a CI/SARIF pull-request gate, or an internal verification bus across autonomous software, hardware, and legal-evidence workflows.
CI / PULL-REQUEST GATE
Require every AI code-review bot or SAST agent to emit ZSND byte-span claims. Hallucinated sinks and stale line offsets fail in milliseconds before opening a ticket or waking human reviewers.
KERNEL & FIRMWARE LAB
Wrap QEMU, KASAN, ASan, and hardware-simulation testbenches in ZSVD multi-trial scoring. Separate deterministic L3/L4 regressions from single-seed timing or freelist noise with exact Wilson 95% intervals.
AUDIT & COMPLIANCE ARCHIVE
Hand external auditors, PSIRT teams, or regulators a single JSON bundle and a 170-line stdlib Python script. Re-verifying every byte claim and hash seal requires no Vericull account, cloud API, or LLM key.
HONEST SCOPE BOUNDARY · MEASURED TODAY VS PLANNED PILOT DELIVERABLES
| COMPONENT | STATUS | VERIFIABLE EVIDENCE |
|---|---|---|
ARM64 C++17 native core (lib0sec_harness_core.dylib) |
MEASURED · LIVE | 4 exported C symbols verified via rea@6.8.0 + Ghidra 12.1.4 · SHA-256 4ff6c9581d7d30c9… |
| Browser ES module & zero-dependency Python CLI verifier | MEASURED · LIVE | 18 of 18 golden-vector & adversarial tamper tests passing identically across C++17, Python 3, and JS |
5 deterministic ZSVD forensic evaluation dossiers |
MEASURED · LIVE | CASE-01..CASE-05 downloadable on this page (bundle SHA-256 6b32e8589c2d3a65…) |
| Hosted GitHub App webhook, managed QEMU fleet & HSM signing | PLANNED · PILOT | Scoped per pilot repository & sanitizer runner environment with RISCON Labs |
05 · TRANSPARENT LIST PRICING
VAT excluded. Outside Korea uses a separate USD list price rather than a floating exchange-rate conversion.
UP TO 25 REPOSITORIES
₩490,000 / month
₩490,000 in Korea · $390 outside Korea (separate list price, not a conversion)
ZSND positive & negative byte-span claim verification in CIXGBoost triage router & SARIF filter#518 inconclusive-hold queue & offline ZSVD JSON dossiersUNLIMITED REPOSITORIES & SANITIZER HARNESSES
₩1,900,000 / month
₩1,900,000 in Korea · $1,490 outside Korea (separate list price, not a conversion)
L0–L4 canary witness grading≥3 boots, ≥60%) & Wilson 95% CION-PREMISE · ZERO EXTERNAL NETWORK
Quote / contract
Scoped for sovereign, semiconductor, automotive & defense labs
Contracting party: RISCON Co., Ltd. (주식회사 리스콘 · Business Registration No. 578-88-03643 · CEO Yoon Jeong (Claire) Kang · Busan, Republic of Korea). Commercial contracts, pilot deployments, and enterprise support are executed directly by RISCON Co., Ltd., while verifying any ZSVD dossier requires no vendor access at all.
06 · ABOUT VERICULL & INDEPENDENT VERIFICATION
Vericull is edition 23 of SIMUL, an unstaffed, fully orchestrated company built by simul.risconlabs.com. There are no fabricated customer logos, invented testimonials, or synthetic staff portraits on this site — only working verification code, test vectors, and reproducible hashes.
Vericull's four deterministic engines are clean-room C++17, Python, and ES-module implementations grounded in open-source autonomous security harness research (MIT / Apache-2.0 lineage). All five forensic dossiers on this page use synthetic clean-room C snippets illustrating real vulnerability triage failure modes.
PSIRT leads, kernel & hypervisor maintainers, AppSec platform engineers, and autonomous red-team operators who deploy LLM scanners for discovery breadth but demand deterministic mathematical proof before paging an engineer.
6b32e8589c2d3a65ece62772903bcc316e947395fc56dd6b8afdaf0ca36c2834) and vericull_verify.py (SHA-256 820f0173d7054afa36511665a4c1966437d2762b864872dbec02945250bc33b2). Only Python 3.9+ standard library modules (json, hashlib, math, struct) are used.
python3 vericull_verify.py vericull-forensic-dossiers.json --bundle-hash 6b32e8589c2d3a65ece62772903bcc316e947395fc56dd6b8afdaf0ca36c2834. The script independently sweeps UTF-8 haystack bytes for every positive and negative needle, walks the IEEE-754 float32 trees, checks the SLAB multi-boot wall, recomputes Wilson 95% intervals, and verifies every 64-bit ZSVD seal and SHA-256 record digest.
lib0sec_harness_core.dylib (ARM64 C++17, SHA-256 4ff6c9581d7d30c9d41390c5a80b2f26d8fb082284a8c2a96fb02f55b6901395). Try editing a single byte in vericull-forensic-dossiers.json and re-running the command to observe deterministic refutation.