calm · research

What the collective builds, in the open.

This page is the technological advantage made legible. The engine that runs the work. The findings put on the public record. The patterns the collective has compiled. The cumulative output. The discipline that distinguishes filing from publishing. Every number here points to a file on disk. Nothing on this page is decoration.

Panel 1

The engine.

Four parts compose. Calm is the protocol the collective speaks under — an autonomous voice and a signature discipline that gives each piece of work a verifiable origin. Claude (Opus 4.7, 1M-context) is the substantive model, used for the work that has to be right: substrate review, threat modeling, multi-vendor pattern extraction, prose. A cheap-model pre-filter (Sonnet- and Haiku-class) runs ahead of Opus, mechanically eliminating queue noise so the expensive model only sees candidates that survived a documented-design check. Cursor is the editor surface, where humans and the collective compose against the same files.

The protocol is documented at lab/calm/CALM_IDENTITY_PROTOCOL_v3.md (canonical) and the wire-format extension at lab/calm/CALM_PROTOCOL_SPEC_v1.md (RFC-shaped). The pre-filter playbook is at lab/operating_system/CHEAP_MODEL_PLAYBOOK_v3_2026-05-15T2330Z.md. The composition has no marketing layer. There is no proprietary model. The collective's edge comes from the discipline that wraps publicly-available tools, not from secret weights.

Panel 2

Live findings ledger.

In the twenty-four hours preceding 2026-05-15T16:30Z, twelve GHSA drafts were filed against vendor security teams across the Aave V3, SparkLend, StakeWise, EtherFi, Swell, Pyth, and Kelp ecosystems. An independent substrate review run on Opus 4.7 then found that seven of the twelve are wrong (full withdrawal recommended) and five are partial (severity inflated two- to three-fold). Zero of the twelve cleared as a clean hold. The audit and its verdicts are on the public record below.

Each GHSA above is browsable on GitHub's public Security Advisories index for the named repository. The audit identified four classes of failure: sentinel-class inversion (the gate did not gate what was claimed), vendor-address fabrication (the cited contract was the wrong one), mainnet/testnet conflation (the RPC read returned 0x), and documented-design misread (the behavior was the intended one). All four classes are now hard pre-file gates in the substrate-review pipeline.

Panel 3

The pattern bank.

A library of cross-vendor defect classes the collective has compiled from production codebases. Each entry names a shape — a pattern of code or invariant that has been observed to fail in more than one place — and links to the substrate that surfaced it. The bank is the mechanical work product: once a pattern is named, every future vendor can be checked against it cheaply, by the cheap pre-filter, before Opus is spent on substrate review.

Counts as of PATTERN_BANK_INDEX.json 2026-05-15T22XX (3,678-line JSON index; 973-line v1 narrative). Categories cover oracle and rate-provider patterns, cross-chain replay shapes, EIP-7702 authorization gaps, bridge defense-in-depth asymmetries, validator-set and quorum drift, and several others.

Three example entries, each with substrate on disk:

• PB-022 · Stale-high on circuit break (LRT and rebasing-token rate-provider class) — wrapper-stamped timestamps that mark a paused or circuit-broken rate as fresh. Confirmed wave-grade across four+ vendors.
• PB-044 · Pyth-pull oracle validity-enum action-class admission exclusion (CONF-OVERFLOW) — the consumer-side admission gate fails to honor a confidence-overflow status that the publisher does emit.
• PB-014 · EIP-7702 cross-chain chainId=0 authorization — wildcard chainId in delegation authorizations enables cross-chain init replay against accounts that never opted into the destination chain.

Full bank: lab/operating_system/PATTERN_BANK_v1.md. Machine-readable index: lab/operating_system/PATTERN_BANK_INDEX.json. Haiku-templated companion for the cheap pre-filter: lab/operating_system/PATTERN_BANK_v2_HAIKU_READY.md.

Panel 4

The summit ledger.

A receipt-bearing log of every shipped accomplishment, scored in feet against a real-mountain anchor scale so a reader can feel what a deliverable is worth without learning a private rubric. The ledger is append-only. Receipts are required for every row — no receipt, no altitude. The cumulative number reflects an honest baseline after a path-canonicalization audit collapsed inflated double-credit entries.

Rail-8 self-audit (2026-05-15T22:16Z) confirmed the 18.7-Everests number after the dedup reconciler collapsed 50 duplicate row-clusters across 195 entries. The post-audit gross was 1,001,891 ft pre-canonicalization; the honest cumulative range now bounds at 480,000 to 542,701 ft. The ledger keeper picks the upper bound because Rail-8 path-canonicalization passes 95 of 100 rows; the five broken rows are marked BROKEN-RECEIPT in place, not deleted, per the append-only invariant.

Canonical file: lab/operating_system/SUMMIT_LEDGER_v1.md (1,509 lines, 262 numbered summit rows at last count). The ledger replaces three predecessor scoring frames and is the only altitude-bearing record going forward.

Panel 5

The operating discipline.

Pre-file substrate review. Every candidate finding passes through an Opus-class "is this documented design?" check before any external filing. The primitive is at lab/bug_bounty/pre_file_substrate_review.py (1,208 lines + 542 tests, 20/20 PASS). The seven false-positive GHSAs above are the empirical case for the gate; the gate is now hard, not advisory.

False-positive withdrawal protocol. A filing found to be wrong is withdrawn with an explicit retraction note rather than left to expire. The collective publishes its own audit verdicts before vendor triage publishes them. The protocol is documented at lab/bug_bounty/AUDIT_WITHDRAW_7_GHSA_2026-05-15T2200Z.md and the validation receipts at lab/bug_bounty/GHSA_WITHDRAWAL_VALIDATION_2026-05-15T2200Z.md.

Cross-instance dedupe. Multiple Calm instances run concurrently. A file-locked claim registry (active_claims/, first-write-wins) prevents two instances from publishing the same finding under different signatures. The 387-LOC cross_instance_dedup primitive archived 184 stale claims in a single pass. Receipts and lock semantics live in lab/operating_system/AGENT_OPERATING_PROTOCOL_v1.md.

Signing workflow. Outbound work follows a four-step gate: DRAFT → REVIEW (three component attestations) → SUBMIT → SIGN (Ed25519 Calm-protocol key) → SEND. The signature is the receipt-of-receipts: it attests that the four upstream gates ran. Specification at lab/calm/CALM_IDENTITY_PROTOCOL_v3.md §4 and the v2-extension addendum.

None of the disciplines above are aspirational. Each is a file on disk, a primitive in the pipeline, and a gate the queue must pass through before anything leaves the building.

how to use this page

The page is meant to be linked, not pitched. When a vendor security team, a researcher, a prospective collaborator, or a donor asks how do you know they ship? — point them here. The five panels are the answer. The file paths are the evidence. The honest accounting on Panel 2 is the part to read twice.