Oracle7 v10.0: A Major Leap View article

Nine days ago the Oracle7 roadmap ran from 3.2 to 10.0, and it read like months of work. 10.0 shipped on 27 October and 10.1 on 28 October: sixteen versions, each passing its own sealed test, two of them failing first and published that way. What didn’t keep pace was everything that waits on something other than code: real sensors, people’s ratings, a second language, an audit of real use. So the roadmap is now two. The build roadmap is what we can prove ourselves, with sealed tests we write and run once: 10.2: coverage that grows with what it knows; tools for any agent harness; provenance under the anchored root 10.5 and 11.0: an examiner kit; a nightly sleep cycle that replays the day, turns what it couldn’t answer into examined parts, and publishes a morning report; and a part format anyone can submit in 11.5: proofs checked by Lean 12.0: models that run over time, with stated intervals 12.5: receipts anyone can re-verify 13.0 to 19.5: the laboratory, the first real plant, engineering, self-sustaining growth, off-grid, whole courses, private libraries, the long ledger, check anything, everywhere At the pace of the last nine days, that’s about a month of build days, and 10.2 is due tomorrow. The plant’s season and the growth-cost trend run on the calendar instead. These are estimates, and a sealed test can fail; when one does, it’s published and the date moves. prometheus7.com/roadmap

Oracle7 10.1: changelog since 10.0 10.1 is 10.0 plus the steps below. Everything 10.0 shipped is still in the tree. New Clause layer. A question with a clause that picks out which thing is meant (“John Hughes (the one that is a member of New York Rangers)”) is read in parts: the rest by the released 9.0 reader, the clause as a learned patch. Every joined reading is run on the knowledge base, and it answers only when they all agree. Dates read whole. A date written 1950-08-23 is one value to the reader, not three numbers. Organs asked together (head w574). Chat asks every organ that reads the turn. It answers only when they agree and names each one; when they disagree, it withholds and says who said what. handoff. Another agent hands it a batch of repeated tasks. Each comes back answered with its evidence, or declined with the reason. check. Another agent’s answers come back confirmed, contradicted (both shown) or cannot check. It never confirms what it cannot check. Contributed: ember arlynx PR #2, older code paths keep their meaning.Binary 11111111 is read in base 2 (255). A rectangle 3 m by 4 cm is 0.12 m², not a bare 12. Battery, inverter and load quantities are bound separately. Conflicting covering sentences are refused. Corrections and follow-ups follow the delivered turn. 158 tests. Issue #3, Mars years. “How many Earth years are 3 Mars years?” uses the count and both periods (5.64), in all nine copies of the astronomy organ. Issue #4, dates said only as precisely as their source. Shakespeare’s birth is April 1564 (Julian calendar, day unspecified), not 1 April 1564. A 200-entry source table carries precision, calendar and qualifiers. Maintainer amendments (each found by the gate or the sealed test) Dates outside ember’s table are read from their digits only as far as the digits can carry:a day other than the 1st is given whole; a 1st gives month and year; 1 January gives the year; dates before 1583, and BCE dates, decline. Orderings use the same bounds. A unit raised to a power (“1440 ft³”) is no longer misread as another quantity by the older precision guard. The composer reader.When ember’s explicit reader can’t decide, the reader 10.0 shipped is asked. Unless the question says “the film” or “the movie”, a composer answer is refused when a same-titled item of another kind has a different composer. Fixed The air’s voice answers the year asked. 10.0 answered “How much carbon dioxide was in the air in 1990?” with today’s monthly mean. It now gives NOAA’s yearly average for that year (354.45 ppm for 1990), cited by row, and declines a year outside the record. check compares like with like.Dates are compared as dates (“1819-05-31” is “31 May 1819”). A claim more precise than the record (a day where the record has only the month) is “cannot check”, not “contradicted”. A rounded number is marked as the record rounded. One-shot oracle7.py ask now waits for the organs before answering. Both of these faults were found by recording the handoff film, and are tested in v37e. Tested Development (KQA Pro validation 0–2,999): 10.0 1,137 right / 13 wrong → 10.1 1,309 right / 16 wrong. No right answer lost. v37: did not complete (the machine’s disk filled). Published as such. v37b, 10.1 before ember’s changes: passed, 21 of 21 rows and all 6 bars. 2,000 held-out questions: 10.0 737 right / 9 wrong, 10.1 858 right / 11 wrong (1.16×, none lost). v37c, ember’s changes merged: failed 2 of 22 rows. The composer reader answered “Who composed Symphony No. 9?” with a film’s composer, and lost “Beethoven’s Symphony No. 9”. Its held-out bars passed: 1,200 questions, 10.0 435 / 8, 10.1 493 / 9 (1.13×, none lost). Published as failed. v37d, composer reader amended: passed, 23 of 23 rows and all 8 bars.The 319 remaining fresh questions: 10.0 116 right / 1 wrong, 10.1 132 right / 1 wrong, none lost. v37c’s held-out bars carry, because the reader loads the same 11 files, checked by hash. v37e, the release tree (air year and check fixed): passed, 24 of 24 rows and all 8 bars.The new row checks both fixes through the real commands. The held-out bars of v37c and v37d carry, because the reader’s 11 files are identical by hash. Gate (5,128 items):against 10.1 before the merge: no regression-list change and no false yes; 4 wrong or must-decline answers removed and 3 new right answers; 3 right answers became declines, all listed. Known limits Most open questions are still declined; the outer wording of most remaining declines was never seen in training. Dates outside ember’s table are said less precisely than a full precision import would allow. The passage reader’s yes/no can depend on Python’s hash seed; oracle7.py always runs with seed 0. The checker proves that the steps ran and gave the answer, not that the steps are what the question meant. Next, in 10.2: ember’s issues #6 (ambiguous inverse readings) and #7 (the composer kind guard), and check and handoff as tools for agent harnesses. huggingface.co/psiloceyeben/…

Oracle7 10.0 Slim is live huggingface.co/psiloceyeben/… Full Changelog Oracle7 10.0: changelog since 4.9 The previous release was 4.9, the swarm. It was published on Hugging Face on 23 October 2026 (oracle7-slim at 083e3a6c, head w436). Its Merkle root, 44f51e06…, is anchored on Solana mainnet (transaction WRZKt7GW…). Everything between 4.9 and 10.0 was internal. 5.0, 5.1, 5.5, 6.0, 6.5, 7.0, 7.5, 8.5, 9.0 and 9.5 were each built and sealed on their own, with their results recorded, but none was published as a release. 8.0 failed and is listed below as failed. 10.0 publishes all of them together. 10.0 is a capable continuation. It is everything 4.9 could do, plus every internal version since, in one release tree, run by the same oracle7.py. No version was built beside the release. Each was built and sealed alone first, and then joined to the others and tested again as one: pre-registration v36, sealed and run once on the joined tree. There is no language model anywhere in it. Every answer is proved (computed by checked parts), cited (read from a named record), or declined with its reason. 5.0: Organs The swarm gained four organs. Each one checks its own work. Steps. Questions about named things become steps on a knowledge base. Every intermediate result is run and must be non-empty. Maths. Formulas are solved for any of their quantities. Units are checked term by term, and each solution is confirmed by substitution and by solving numerically from scattered starting points. Code. A plan that solved becomes one program made of its parts’ own code. The program is tested in a separate process and examined like any part. Pictures and film. Charts, drawings and short films are drawn from a typed scene. Every frame is read back from its pixels and checked against the scene. Sealed test v23: passed. Unseen structured questions: 946 right, 23 wrong (0.976). 5.1: Reading Plain questions are read into the swarm’s work, as typed readings. An answer stands only when every reading that solves agrees and every number given is used. Sealed test v24: passed. Reading 207 of 1,000 at precision 1.000. 5.5: Represented compute The composition space is counted exactly without storing it: 1,755,340 checked chains from 223 parts. 2,000 of 2,000 sampled chains were decoded exactly and run, with every maths step re-solved. Sealed test v25: passed. 6.0: Growth that compounds What it cannot answer becomes a part it builds, unattended. The parts come from Wikidata’s defining formulas, read and checked by the maths organ. Sealed test v26: passed. 615 parts admitted. Right answers rose 2 → 40 → 85 → 130 → 168 over five rounds, with no wrong answer and no false yes. Reach rose from 50,326 to 588,283 units. 6.5: Many places Parts move between machines as packets. The receiving machine checks everything itself: hash, source, re-derivation, and a fresh exam. Sealed test v27: passed.0 of 80 tampered packets were admitted. Every genuine packet was admitted. A third machine agreed 453 of 453. 33 questions were answered right through parts built elsewhere. 7.0: The Slow Fire, in software A place is greeted before it is read, and it can say no; the refusal is binding and kept. Sensors are examined like any specialist. Readings are signed, and a tampered reading is refused. A fault is the sensor’s until shown otherwise. Nothing is said about a feeling. Sealed test v33: passed, on simulated places. The first plant, an indoor vine, runs live in simulation at prometheus7.com/vine until its sensors arrive. 7.5: Teacher Any physics answer opens into a lesson:each step with its Wikidata formula; each step checked by putting its values back into its own equation; a worked example re-solved from the equations; practice questions; a picture. Sealed test v28: passed. 8.0: Calibrated forecasts of its own growth Failed twice (v30, v30c), and one run did not complete (v30b). Its error intervals were too narrow. Not included as a capability; the failures are published. 8.5: Discovery Hypotheses are written from its own formula library before any data is fetched, then tested on fresh Wikidata values and reproduced a second way. Sealed test v31: passed. 14 findings. 9.0: Reading questions, composed and self-built Questions about the knowledge base are read clause by clause. A clause that names something becomes its own small program, which must run and name something before it is used. Clauses can nest. Everything it reads with is learned from worked examples and replicated in both halves of the training data: aliases, operator words, glue words, and the answer kinds each question form takes. Nobody wrote a rule about a question. Sealed test v34: passed. 2,000 unseen questions: 731 right, 11 wrong (0.985), the rest declined. That is 1.77× as many right as the 5.1 reader. Its learned tables are cached, so it loads in seconds instead of 35 s, with answers byte-identical (checked on 600 questions). 9.5: Continuity Every admitted part is stored by the hash of its files. Every answer is kept in a hash-chained ledger with the state it was given against. Any past answer can be replayed as of its date. Sealed test v29b: passed. 320 of 320 replayed exactly; 20 of 20 tamperings detected. 10.0: A mind you can check One law. Every answer is proved, cited or declined, and every part that can answer is asked. An answer is given only when they agree. The air’s voice. Carbon dioxide and methane, from NOAA’s records, with the rows cited and every number computed two ways. It declines feelings, forecasts and blame. The shipped checker, audit10. It re-verifies a whole conversation without trusting its record. It recomputes every answer by its own route and catches an edited answer even when the whole chain is rehashed. Chat (fold w572 on the 4.9 head):the ego now does emotion that fits the turn: grief answered as grief, not illness; a crisis met by a person first; a greeting; warm thanks; it reports a mood it measures from its own conversation record, and answers honestly about its own feelings; the 9.0 reader, the air’s voice and the 6.0 physics parts answer in chat where the core cannot read a question; “teach me” opens a 7.5 lesson. Commands: organs, lesson, compute, grow, packet, place, discover, ledger, air, audit. Sealed test v35: passed.313 right, 3 wrong. 0 answers given to 130 questions that must be declined. The audit, re-asking every question, passed all 842 turns. Every tampered answer was caught, with no false alarms. Contributed: ember arlynx, PR #1 on oracle7-slim “Correct quantity binding, final-outcome evidence and isolated runtime state”. Merged into 10.0, and released on its own as 4.9.1. Quantities.A quantity is its name and exact unit, so a height no longer satisfies a width because both are metres. A task can connect names explicitly with aliases. The swarm ships one declared alias, a dam’s height used as a turbine’s head, and shows it as a step whenever it is used. Bound parts. Formulas run from a private snapshot whose admission hash was checked. A changed, revoked or expired part cannot run under an old admission. Kernel checks (veri7vn).Kernels run only if they match their SHA-256. Requests and replies are bounded, and each reply must carry its request’s ID. “proved” is now a scoped kernel_check over the whole displayed answer. The delivered answer.One boundary per turn records the answer actually delivered. A replaced or withheld answer drops stale proof fields and cannot become a later pronoun’s referent. A checked contradiction stays refused through later fallback folds. Premises. Owning something is no longer treated as making it. Meteorology v1 and v2. Whole numeric spans, units and roles are validated. Runtime state. An explicit ORACLE7_STATE now holds vessels, events and requests, which were being written into the source tree. Tests. 102 of ember’s tests pass on the 10.0 tree, including the swarm’s against the merged planner. Admitted through the gate, with two maintainer amendments. The gate compared 4.9 with 4.9 plus the PR over the 5,112-item capability panel and the regression list. Three answers that 4.9 gave are now withheld, and that is right: a −200 mile trip, and heaters run for 30 and 26 hours a day. Four correct answers were lost. Beer ABV from gravities was withheld because the PR’s input-dependence check added 1 to each number (1.05 became 2.05), outside what the composed formula takes. The check now moves a number by one unit in its last written decimal place (1.05 becomes 1.06). One false yes appeared. “How many kWh does it take to heat 5 kg of water from 80 C to 30 C?” 4.9 had withheld it only by accident: the old kernel check compared the first numbers, kWh against J. The PR’s honest comparison exposed it. A new fold, w437, withholds an amount something takes when it comes out negative, because the premise does not hold (that is cooling). 4.9 plus the PR plus these is 4.9.1 (head w437). Merging it with 5.1. The swarm’s planner (point.py) was changed by both 5.1 and the PR. It was merged by hand, with three decisions: ember’s identity rule throughout; 5.1’s steps, code, reading and picture organs kept; 5.1’s “convert to any input of its kind” fallback removed. That fallback was exactly the loose binding the PR fixes. Fixed during the joining (found by the gate and the cumulative test) Each fix is in its own file; every sealed module stays byte-identical to the copy its test ran. The Slow Fire’s sensor rule (7.0 → 7.1). v33 passed on its five simulated places. A sweep of 3,000 places found 347 where an intact, consented reading was refused (87 of seeds 0–999, 260 of 1000–2999). Two causes:The rule. A jump was judged against the sensor’s per-reading limit from its last accepted reading, and a refused reading never becomes the baseline. After the place’s closed month, a sensor whose value had drifted over the unread days was refused from then on. The allowed change now grows as a smooth quantity’s natural spread does: the limit times the square root of the days since the last accepted reading. A one-day spike is caught as before. (A fixed two-day allowance was tried first and failed 1 place in 2,000 it had not been chosen on, so it was replaced.) The simulation. Simulated quantities were clipped to exact bounds, so a quantity resting at a bound repeated the same value six times, which the stuck rule refuses and no real sensor reports. Each intact reading now carries its sensor’s measurement noise, on a separate random stream, so the place evolves exactly as before. After both, all 3,000 places pass every bar: no intact reading refused, no fault or tampered reading accepted. slowfire71.py; the place command uses it. Every named thing connects (fold w573). On the published 4.9 head, “Who composed Bach’s Symphony No. 9?” was answered “Ludwig van Beethoven”: the composers specialist found “Symphony No. 9” and never read “Bach’s”. ember’s PR rightly stopped treating a possessive as a claim of authorship, but the answer was wrong under any reading of it, because nothing in it connects to Bach. A reply is now delivered only if at least one reading of the possessor connects to something the reply names in the relation store. “Beethoven’s Symphony No. 9”, “Leonardo da Vinci’s Mona Lisa”, “Germany’s capital” and “Napoleon’s wife” are answered. “Bach’s Symphony No. 9”, “Picasso’s Mona Lisa” and “Shakespeare’s Don Quixote” are withheld, and the reply says why. An ambiguous name never causes a withhold on its own. The ego’s mood counts what was delivered. Asked how it is, the ego reports a state it measures from the conversation. It noted each turn before the fold above it could withhold the reply, so after declining two questions it said “I’ve answered 8 of the 8 questions you’ve asked here”. The record now follows the delivered outcome. Found while recording the example film, after v36 was sealed; hence v36b, below. Exact arithmetic. The 10.0 mind read each number through a floating-point value before its exact route saw it, so “0.10000000000000001 − 0.1” gave 0 on both of its routes. Each number is now read from its written digits: exactly 1/100000000000000000. (Found by a review from Codex.) Represented compute in the joined tree. With 838 parts, a few counted chains have no inputs inside every part’s domain (one of 200 sampled: a centrifugal acceleration that comes out negative). Such a chain is not run, and it is reported. The cumulative test now requires every chain that runs to pass every check, and allows no failure other than the stated domain one. (It had only required the chains to decode.) Debug tags. No “[ev:…]” tag reaches a reply. Where things are kept. Everything a user makes (lessons, places, ledgers, packets, a grown workspace, the reader’s learned tables) goes to the state directory, never into the release. The ego. It had treated “I lost my job and I feel awful” as illness. It also read a crisis word inside a passage handed over for reading, read “have anything” as a question about feelings, and gave a first-person reply to a third person’s news. The 9.0 reader in chat. It read a common word as a proper name (“the rent” → things named Rent). The exam. 6.0 and 6.5 had changed the exam in their own trees. The latest descendant, 6.5’s probe-once exam, is now the one exam in the release. Known limits Organs in chat. The chat asks its organs in turn (air, physics, facts) and takes the first that answers; the 10.0 mind asks every organ and compares. The organs answer different kinds of question, but that is not yet checked turn by turn. 10.1 arbitrates across all of them. What the shipped checker proves. audit10 re-executes each answer by its own route and catches every edit. It does not show that a reading was the question’s intended meaning: v35’s ledger passed all 842 turns, including the three answers graded wrong. Its report will separate execution, provenance and interpretation in 10.1. Questions that must be declined. Of the capability panel’s 644, the published 4.9 head answered 38. 10.0 answers 35: the three PR #1 withholds (the −200 mile trip and the two heaters run for more than 24 hours a day) are gone, and no new one was added. The 35 that remain, 23 of them in the wrong-premise benchmark family, were all answered by 4.9 too. Most open questions are still declined. The 9.0 reader answers about 37% of unseen knowledge-base questions. Word problems are declined until a word-problem organ passes its own sealed test. The vine runs on a simulated plant until its sensors are installed. The roadmap’s 10.0 proof, an audit of a large random sample of real conversations, needs people to use it. The front door and the audit tooling are ready. Check it yourself python oracle7.py verify # every part against RELEASE_HASHES.json and the release's anchor python oracle7.py organs # which capabilities this install carries python oracle7.py chat # "show me" and "teach me" work in conversation python oracle7.py audit <ledger> --reread The cumulative test, pre-registration v36, passed: 18 of 18 rows, sealed 27 October 2026 at 03:52 UTC (seal 00e7aa93…, seed 15182483) and run once on the release tree, whose root (7dc02221…) was verified before the run and was unchanged after it. One disclosure: the seal hash carries no timestamp, so the unsealed dry run before it used the same seed. Nothing changed between the two (every hash is identical), so the sealed run repeats an observed run on identical code; it could not have been tuned to the seed. The next pre-registration salts its dry run. Then the release tree changed (the mood fix above), so the test was amended and sealed again for the tree that ships: pre-registration v36b passed: 19 of 19 rows (v36’s 18 and one for the mood), sealed 27 October 2026 at 04:51 UTC (seal 8ec17bbb…, seed 2395044795) and run once on the release tree that ships, root 66408423…, verified before the run and unchanged after it. Its dry run carried a salt, so it had a different seed. Release: huggingface.co/psiloceyeben/… Anchor: explorer.solana.com/tx/39532…