Kaizen-3C progress log
What we're shipping, in public. Verified migrations, the DARPA TRACTOR self-benchmark, and the open human-eval collaboration — the work, not just the messaging.
Alongside the essay “The 0-unsafe trap,” the second bzip2 road is live: a drop-in that keeps the caller's allocator, the aliased memory profile, and the C ABI — the requirements a zero-unsafe codec quietly relaxes — and retains only the bounded boundary unsafe that forces, proven Miri-sound over its single-block proveout envelope (make miri, under both Stacked and Tree Borrows; multi-block is the honest open edge). Diff it against the zero-unsafe codec and decide which one your project actually asked for.
libbzip2-contract-honored-rs → read the study →bzip2 1.0.8, ported to idiomatic Rust with zero unsafe in every codec module — laid out module-for-module so it diffs directly against the reference Rust bzip2 from the Trifecta Tech Foundation. A single make check proves it byte-for-byte identical to the C reference over 265 commands: compress and decompress, low-memory mode, valid and malformed streams — and it re-runs on your own inputs. The first of several routes to a safe bzip2.
libbzip2-rs → read the study →The position, in the open: the C→Rust mandate delivers memory safety but adds a maintenance tax — teams left owning code in a language their veterans don't write. Our answer holds to the correctness, safety, and performance bar of DARPA TRACTOR's published methodology (as an independent self-benchmark — not a performer, no affiliation) and extends it beyond C→Rust to C→safe-C and Rust→safe-Rust: verified byte-for-byte, and human-reviewed, either way.
read the piece →The safe-Rust and hardened-C decoders are now checked byte-identical to the reference in CI on x86-64, ARM64, and big-endian s390x (via QEMU). A byte-order regression fails there, in public CI — not in production.
CI runs →We're doing the human-eval part in the open: a free migration of a scoped piece of a willing open-source project — C→safe-C, C→Rust, or Rust→safe-Rust — proven byte-for-byte identical to the original, in exchange for the maintainer's honest review. The work is public from day one.
the deal, both ways →An independent self-benchmark against DARPA TRACTOR's published methodology and baselines (we're not a performer, no affiliation). On the semantic memory-safety axis, our output measured the safest of the field, at 96.7% functional correctness — the harness is public and re-runnable.
scorecard + harness →One C image decoder, migrated to safe-Rust and hardened-C, each proven byte-identical to the original over a valid + hostile corpus with a single make check. Plus the “Own your intent” white paper and the Verbatim page.
qoi-safe-c →