What the suite proves
Each property is a behaviour a published wheel gates, driven by a real test, never spec text and never a mock. CEWP, the CIRIS Epistemic Web Platform, is a governable, post-quantum, decentralized mesh, and the suite proves each of those words holds.
Decentralized mesh
Messages cross a live transport node-to-node, with no center. A→B delivery is driven across every holder mode over a 4-node, 3-owner fabric (test_340).
Post-quantum
Identity and the audit chain are Ed25519 + ML-DSA-65 hybrid; the content cascade is X25519 + ML-KEM-768 (test_250 / test_100 / test_320). PQ protects the long-lived secrets, where harvest-now-decrypt-later actually bites.
Governable
Membership roots in an accountable human (owner_bind, CC 3.2), with delegated and revocable moderation and namespace admission (test_270 / test_240 / test_260), over a tamper-evident audit chain (test_320).
Scales without Big Tech
The replication discipline and scaling factors that make internet-scale feasible on ordinary hardware are checked properties, not slides (test_210 / test_211 / test_200).
The structural-alignment bet is that maintaining a consistent deception across many independent constraints is combinatorially more expensive than telling the truth. You raise the cost of misalignment rather than hoping it was trained away. That cost is only real when the constraints are external and independently verifiable, not a model's own self-reported coherence. This suite is that external layer made executable.
Why a separate suite
The wheels ship apart and run together.
The stack ships as separately-published extension wheels (storage, crypto, transport, node-serving), each released on its own cadence but designed to run together in one process. Cohabitation has failure modes that exist nowhere else and that no single repo can test: two wheels defining what looks like the same type that the interpreter rejects, shared substrate handles that must agree on shape and lifetime, version skew, and wire bytes one wheel signs that another must verify byte-for-byte. Each wheel's own tests compile into one combined build where those problems vanish. This harness installs the real, separately-published wheels together, the only place the bugs surface.
The dependency chain, from the foundation up
The matrix evaluates the chain bottom-up. CIRISConformance governs the matrix floors and cross-wheel gates every combination must pass before it boots.
1 · CIRISVerify
crypto + trust
2 · CIRISPersist
data + state
3 · CIRISEdge
mesh + transport
4 · CIRISServer
node serving
5 · CIRISAgent
client + mobile
Counts below are measured, not estimated: test-function definitions on each repo's main branch, counted by grep. Executed cases run higher via parametrization.
Ecosystem matrix and contract governance
Not a deployable binary. It defines the reference matrices and the integration boundaries every other project must satisfy before any combination of wheels is allowed to boot. The standard it tests against is the CIRIS Constitution (CC 0.4), the ecosystem's superalignment standard.
Cohabitation gates
the real, separately-published wheels are installed together and driven in one process, where cross-wheel bugs that vanish in any single repo's combined build finally surface.
Real wheels, never mocks
every assertion calls a published wheel and checks its behaviour. A missing feature is filed upstream and marked an expected failure, never skipped or worked around.
Matrix-alignment validation
strict compatibility floors between dependent projects, to prevent cross-library (PyO3 / UniFFI) initialization skew.
124 tests · Python cohabitation gates here, plus the Rust feature-conformance lane in CIRISServer.
Cryptographic and trust foundation
The bedrock. Hybrid Ed25519 + ML-DSA-65 signing, the Merkle transparency log, attestation. Code cannot progress unless the trust layer is flawless.
Pre-flight
AST-level verification and D27 conformance gates, so runtime code never depends on .md documentation.
Static analysis
strict mypy type checking across all cryptographic modules.
Multi-arch compilation
builds the C / Rust FFI extensions (.so, .dylib, .dll) for x86_64 and aarch64.
~1,200 tests · key generation, signature determinism, isolated TPM2 mock testing.
Data and state management
The substrate: federation-key directory, blob storage, the audit chain, the outbound queue, admission gates. Durable across every platform.
Dual-backend parity sweep
every test runs against both Dockerized PostgreSQL (distributed) and SQLite (local / mobile) for absolute functional parity.
Upgrade-compat fixture capture
legacy schema snapshots are loaded and migrated, to guarantee zero data loss across upgrades.
Cross-platform serialization parity
data serialized on Windows x64 is read losslessly on macOS ARM64 and Linux.
~2,150 tests · ACID compliance, concurrent locking, multi-threaded isolation, I/O regressions.
Mesh networking and transport
The routing tier: federation wire dispatch, durable send, the inbound trust gate, and the decentralized peer-to-peer logic.
Leviculum / Reticulum-rs integration
validates the PyO3 / UniFFI boundary for TCP-loopback, LoRa, and packet-radio transports.
Network-mesh simulation
virtualized topologies test peer discovery and cryptographic routing-table propagation.
Latency and drain assertions
asserts flush() and stop() drain their queues within strict millisecond thresholds.
~990 tests · byte-level packet encoding, async stream handling, SAS verification, network-boundary fuzzing.
Headless operations and node serving
The node-serving engine: capacity scoring, detection, egress filtering, the reconsideration-DoS guard, the audit-log client. Also hosts the Rust conformance lane for substrate-internal behaviour the agent never drives.
API conformance
HTTP / REST and Server-Sent Events surface (/v1/federation/*, /a2a), validating token-tier gating (Observer vs. Admin).
Headless generation
PyInstaller binaries plus signed, multi-arch (amd64 / arm64) Docker images.
Rust conformance lane
feature-conformance for behaviour the substrate enforces internally, beyond the Python cohabitation gates.
~630 tests · rate-limiting, CORS, streaming serialization, concurrent asyncio task processing.
User-facing client (desktop and mobile)
The culmination: all five layers integrated into one client. Also runs the safety batteries, the agent half of the constitutional-compliance claim.
Safety batteries
adversarial mental-health safety batteries across 29 locales, driven through the qa_runner; each run publishes its capture as a CI artifact, so the sweeps are auditable run-over-run.
Localization guard
a stdlib-only guard guarantees 29-locale mirror parity for the Android / iOS Kotlin / Swift bundles, so no raw key ever renders.
Registry-signed build
canonical hashes of the resources and Python runtime tree, signed to satisfy the CIRISVerify contract, then the final cross-platform artifacts.
~11,500 tests · plus 90+ qa_runner modules, sharded 8 ways. UI bridging, capability execution, safety-interpretation sweeps, end-to-end across all five projects.
CIRIS is not a wrapper. It is an institutional architecture for AI, verified end to end against its own constitution.