No hidden framework
HTML, CSS and ECMAScript modules, all checked into this repository. Browser code only imports relative, first-party modules.
Read the repository ↗ QSOL-IMC / DECLARATION NO. 001 / 30 OCT 2026
THE SOFTWARE
DECLARATION OF
INDEPENDENCE.
No Docker. No Kubernetes. No Node.js. No npm. No unnecessary dependencies. Just software that stands on its own.
0Third-party browser packages
100%Vanilla browser technologies
stdlibPython audit toolchain
OPENSource, tests and audit method
THE REVOLUTION WILL NOT BE CONTAINERISED ✳ CORRECTNESS OUTRANKS COMPLEXITY ✳ PROOF OVER POSTURING ✳
01 / THE POSITION
YOUR APP DOESN'T NEED
A FUCKING ORCHESTRA.
A small website should not require a container fleet, a build pipeline, a dependency resolver, and twelve configuration dialects just to put a button on the screen.
We aren't claiming containers, package managers, or orchestration never solve real problems. We're rejecting the default assumption that every problem needs them.
01Correctness over convenienceWrite tests. Preserve invariants.
02Auditability over abstractionSmall surface. Legible source.
03Portability over lock-inBrowser standards and Python stdlib.
04Evidence over slogansReproduce the result yourself.
This is not War,This is a Divorce.
This Isn't War, This Is Pest Control
02 / THE LIVE PROOF LABNO FRAMEWORK.
NO FRAMEWORK.
ACTUAL ENGINEERING.
Interactive, deterministic cellular automata running entirely in your browser. No downloads, CDNs, npm, WebAssembly, or server calls. Inspect every line.
Each pixel is computed locally from an eight-bit neighbourhood rule. Identical inputs produce identical cell states and fingerprints.
CONTROL PANEL v1.0
STATE FINGERPRINT / FNV-1a
CELLS COMPUTED
LAST RENDER (MS)
REPLAY ASSERTION
Fingerprint is a reproducibility checksum, not a cryptographic security claim. Render timing is an observation on your device, not a benchmark against another stack.
DON'T TRUST THE POSTER.
VERIFY THE RECEIPTS.
Make it prove itself
Run the deterministic algorithm checks here, in this browser. They exercise seeded randomness, automaton evolution, fingerprints, and replay identity.
Not yet executed in this session.
Python. No pip install.
Run the repository scanner and unittest suite using the Python standard library. It searches for dependency manifests, remote executable assets, and hashes first-party browser files.
python3 scripts/audit.py --json
python3 -m unittest discover -s tests -v
Audit specification ↗IMPORTANT DISTINCTION
Zero third-party packages is not zero trust. The browser, operating system, Python interpreter, GitHub Pages hosting, and their supply chains remain real dependencies. This project reduces avoidable application dependencies; it does not claim invulnerability.
04 / SOFTWARE INDEPENDENCE EVIDENCE LEDGER
THE RECEIPTS.
THE RECEIPTS.
NOT THE RHETORIC.
A public, source-linked inventory of QSOLKCB repositories, with filename evidence collected from their default-branch Git trees. Browse observed package manifests, container markers and workflow files. No known manifest observed does not mean zero dependencies. Unknown and truncated scans stay unknown.
Loading evidence metadata…
Evidence boundary: This ledger does not run project tests, trace dependency imports, inspect private repositories, or assign vulnerability scores. Package manifests may describe development tooling; their absence does not prove independence. The public catalogue is curated, while the ledger targets a reproducible public repository listing. Inspect the methodology, QSOL-IMC. The private QSOL-CONTEXT source is not imported or exposed.
05 / THE DEPENDENCY TRIBUNAL
NO RIGGED BENCHMARKS.
NO RIGGED BENCHMARKS.
SHOW YOUR WORK.
Run two first-party implementations of the same deterministic DOM workload on your device: direct DOM replacement and a small local keyed reconciler. Timings, adapter source sizes, paired differences and SHA-256 evidence receipts are generated locally on demand. No external services or package installation.
WHAT THIS IS NOT: The local keyed adapter is an illustrative abstraction, NOT React, Vue, Svelte, or a representative framework benchmark. Timings include detached DOM mutations only: no layout, paint, memory, network, production build, or cross-hardware claims. Bootstrap intervals describe sample resampling, not controlled operating conditions.
No measurement has run. The results below are intentionally empty.
No measured receipt yet.
06 / THE GREMLIN MUSEUM
THE BUGS ARE
THE BUGS ARE
IN CAPTIVITY.
A safe, interactive archive of software failure modes. Reproduce the mistakes, inspect the bounded correction, and run assertions before accepting the evidence. Three specimens reflect documented INDEPENDENCE review findings; two are clearly labelled illustrative security examples.
SECURE DISPLAY CONTRACT: All specimens are hard-coded local data or inert source strings. No untrusted markup is rendered as HTML; no exploit executes; no third-party host is contacted. This is not a vulnerability scanner, CVE database, or penetration-testing service. Learn the pattern, not an attack against somebody else's systems.
No museum-wide run yet. Exhibit observations are generated on demand.
No evidence receipt yet.
07 / GREMLIN BREEDING LABORATORY
BREED THE BUGS.
BREED THE BUGS.
TEST THE TESTS.
Deterministic mutation testing: 15 harmless, predefined defects in five isolated first-party function families. Run a small or expanded test suite and inspect exactly which defects it catches. Every mutant has a known divergent witness. No deployed source is modified.
NO FREE PASSES: A surviving Gremlin means the chosen test subset missed a known defect. These are hand-curated pure-function fixtures, NOT automatic mutation of the deployed application, an attack tool, or repository-wide code coverage. A high score here does not prove the site is secure.
No mutation tests have run. Results are generated only when you start the experiment.
No evidence receipt yet.
08 / THE SECRET SOURCE — AI × HUMAN × GITHUB
THE SOFTWARE DOESN'T
THE SOFTWARE DOESN'T
BUILD ITSELF.
AI + WEB TECH = UNLIMITED POTENTIAL.
Here's the part the previous five releases didn't tell you: an independent human with an idea, AI engineering assistance, first-party web standards, GitHub pull requests, persistent source history, adversarial review, and the willingness to say NO when a change drifts off mission.
The slogan is aspirational, not literal: AI has failure modes, finite context and capability limits; humans and computers have budgets, platform limits and responsibilities. The method creates leverage, not automatic correctness. This section describes our working practice, not a measured productivity experiment or proof that AI is infallible.
THE EIGHT-STEP HUMAN–AI GITHUB LOOP
Select each stage. The human directs and approves; AI helps design, implement and troubleshoot; source-control records and tests provide independently inspectable evidence. No stage below executes an AI model or GitHub operation.
HOW TO GET AI MORE CORRECT — AND MAKE IT DRIFT LESS
Treat each item as a guardrail that you can verify. Ticking a box is only your acknowledgement; it does not inspect a repository, run tests, certify code, or authorise a merge.
MAKE A BOUNDED AGENT HANDOFF — NO PROMPT MAGIC
Supply a concrete goal, explicit boundaries, invariants and acceptance tests. Generate a reusable handoff contract you can inspect and copy. All fields stay in this browser page: there is no submission, backend, saved session or LLM API call.
No handoff generated.
No handoff generated.
THE FIVE RELEASES ARE THE CASE STUDY
These are links to the project's actual merged pull requests, not invented speed or accuracy benchmarks. The lesson is the repeatable *review discipline* — not that every AI-produced patch was correct on the first try.
09 / PROOF CONTRACTS — THE EVIDENCE MUST MATCH THE CLAIM
DON'T JUST TRUST TESTS.
DON'T JUST TRUST TESTS.
CHALLENGE THE CONTRACT.
Run bounded checks against the actual first-party JavaScript, using separately implemented mathematical oracles. Exhaust every binary automaton row through width eight under all 256 rules, evaluate an exact-integer geometric sum, check seeded replay and hash formats, and expose a known mutable-fingerprint counterexample.
BOUNDED BROWSER CHECKS: These local JavaScript results cover only their enumerated finite domains. They are not formal proofs of the browser implementation. Separate versioned Lean and SPARK/Ada evidence applies only to the mathematical and Ada reference models, not to this UI. Known counterexamples remain visible.
USER-REPORTED LOCAL GNATPROVE RUN · PR #13 HEAD
21 / 21 ADA REFERENCE CHECKS PROVED
INSPECT SPARK EVIDENCE ↗
GNATprove FSF 16.1.0 reported all 21 checks proved, exit code 0. The same checkout reported 186/186 Python tests passed. These are version-pinned, user-reported results—not independent execution attestation or proof of Python/JavaScript equivalence.
No local proof-contract checks have run. The results below are intentionally empty.
No receipt issued.
09B / DETERMINISTIC PROPERTY GENERATION & MINIMISATION
FIND THE GREMLIN.
FIND THE GREMLIN.
SHRINK THE EVIDENCE.
Run seed-replayable, bounded property tests against the real first-party automaton. A deliberately injected wraparound-boundary defect demonstrates canonical counterexample minimisation; a separate real legacy Uint8Array ownership counterexample demonstrates an opt-in defensive-copy alternative.
Every input is deterministic at a fixed seed. The mutant is an explicit teaching fixture, not a discovered production vulnerability. The ownership defect is real, and the existing API remains unchanged. No claims of mathematical proof or authentic external execution.
Property lab not executed yet.
No receipt issued.
09C / LEAN + SPARK / EXECUTABLE FOUR-CELL BRIDGE
PROVE THE MODEL.
PROVE THE MODEL.
TEST THE IMPLEMENTATION.
Explore v0.9's AUTOMATA4/1 finite specification: all 256 rules × all 16 four-bit rows, with fixed-zero exterior boundaries. The browser executes the real first-party JavaScript evolve(), compares all 4,096 simultaneous transitions to independent arithmetic and detects input mutation.
Nothing has run. No verification is claimed.
No receipt issued.
FINITE CONFORMANCE IS NOT A FORMAL REFINEMENT PROOF. SHA-256 RECEIPTS ARE NOT EXECUTION ATTESTATION. New Lean and GNATprove results remain NOT_RUN until verified on actual toolchains.
SPECIFICATION & PROOF EVIDENCE ↗ · OFFLINE RECEIPT VERIFIER ↗
10 / A THOUGHT EXPERIMENTCOMPLEXITY
COMPLEXITY
COMPOUNDS.
Explore a synthetic dependency tree. This is a mathematical illustration, not measured npm, Docker, Kubernetes, or vulnerability data. Real package graphs share nodes, often have cycles, and aren't perfect trees.
HYPOTHETICAL PACKAGE NODES
Counts nodes in a hypothetical tree, not distinct packages or actual security defects. The direct dependency layer is included.
11 / THE SIGNATURE
WE DID NOT LEAVE
SOFTWARE ENGINEERING.
SOFTWARE ENGINEERING LEFT US.
QSOL-IMCIndependent Software Sovereignty Initiative
READ THE SOURCE ↗