vesl
vesl v0.1 in-progress

Primitives and tooling for verifiable apps.

:: Merkle commitments. STARK proofs. RBAC. Audit log. Settlement queue. Fourteen verifiable primitives that compose into one deterministic kernel. You write the application logic. Vesl writes the crypto.

:: the four surfaces compose grafts in nockapp.toml
[package]
name     = "license-registry"
template = "basic"

[settle-graft]
gate-chain = [
  "sig-verify-schnorr",
  "manifest-verify",
]

[rbac-graft]
admins = ["~0xa2c1..."]

[registry-graft]
[log-graft]
[batch-graft]
::  five grafts. one command composes them.
::  nockup graft inject --apply hoon/app/app.hoon
::  app.hoon  —  the only Hoon you write.
::  five domain causes, ~5 lines each.

++  issue-license
  |=  [holder=@ux  terms=@t]
  ^-  (list effect)
  ?>  (is-admin src.bowl)
  =/  id=@ud  (next-id registry)
  ::  registry-graft remembers; log-graft trails;
  ::  settle-graft commits the merkle root.
  :~  [%registry-put id holder terms]
      [%log-append %license-issued id]
      [%settle-note id (commit terms)]
  ==
// main.rs — typed Rust at every seam.
// No noun construction. No drift surprises.

use vesl_core::{Mint, build_issue_license_poke, PokeOutcome};
use vesl_test::Harness;

#[tokio::main]
async fn main() -> Result<()> {
    let app = vesl_hull::serve("out.jam").await?;
    let holder = pubkey_from_hex("0xa2c1...");

    let poke = build_issue_license_poke(holder, b"v1: MIT");
    match app.poke(SystemWire.to_wire(), poke).await? {
        PokeOutcome::Accepted { effects } => print_effects(effects),
        PokeOutcome::Rejected { reason }  => eprintln!("deny: {reason}"),
        PokeOutcome::Crashed  { error  }  => panic!("{error}"),
    }
    Ok(())
}
// GET /status  —  build provenance at the HTTP layer.
{
  "hull_id":         "license-registry",
  "notes_settled":   1247,
  "settlement_mode": "merkle-schnorr",
  "gate":            "sig-verify-schnorr ∘ manifest-verify",
  "grafts": ["settle", "rbac", "registry", "log", "batch"],
  "manifest_shas": {
    "settle":   "sha256:7f3a...e1b2",
    "rbac":     "sha256:c801...44ab",
    "registry": "sha256:9d2c...77f4",
    "log":      "sha256:1e6f...3d09",
    "batch":    "sha256:b4a1...5c20"
  }
}
// grep manifest_shas against `nockup graft inject` output.
// what you composed is what you're running.
@ud 04 panel 01 of 04

compose, don't write

:: Building a verifiable app means weeks of crypto code, replay-attack logic, and a hand-rolled HTTP server before you ship a feature. Vesl ships those weeks as composable grafts. One command wires any subset into your kernel.

typed at every seam

:: Every cause has a build_*_poke builder. Every response is a PokeOutcome. Drift between Rust and Hoon becomes a compile error, not a 3 a.m. page. You write Rust, not noun construction.

what you test is what you ship

:: vesl-test boots the compiled kernel and runs your assertions against it. No mock divergence. No "it works in dev." The Nock interpreter your tests hit is the one your users hit.

@tas ++catalog

the library

:: Four families. Pick what you need. Compose from Rust. Nothing is hidden; every graft is one TOML stanza and one source commit you can read.

commitment

@ud 04

:: The plumbing of proof. Commit data, verify roots, settle notes, prove computations.

  • mint @ux append-only merkle commitment
  • settle @ux hard settlement, replay protection
  • guard @flag soft verification, returns loobean
  • forge @ux stark proofs, epoch-versioned

gates

@ud 05

:: Pre-written verification predicates. Pick one in the manifest, or chain several for multi-step verification.

  • sig-verify-ed25519 @flag signed attestations
  • sig-verify-schnorr @flag nockchain-native signatures
  • manifest-verify @flag structured-document commitment
  • set-membership @flag allowlist / blocklist
  • bounded-value @flag age gates, balance checks

state

@ud 05

:: Opinionated state shapes. Registries, queues, counters, permissions — domain-keyed scaffolding that slots into your kernel.

  • registry @tas user directories, config stores
  • queue @tas job queues, request backlogs
  • counter @ud sequence numbers, nonces, metering
  • rbac @ux permission enforcement
  • kv @tas simple key-value store

behavior

@ud 04

:: Runtime rules and observers. Input validation, audit logs, deterministic time, settlement batching.

  • validate @flag rule checks before poke runs
  • log @ud monotonic audit trail
  • clock @da deterministic time primitive
  • batch @ud buffer intents, flush on trigger
@tas ++substrate

what vesl stands on.

:: Vesl does not invent the foundation. Nockchain ships the cryptographic substrate — Schnorr-over-Cheetah, tip5 hashing, transparent STARKs, post-quantum by default. Underneath that is Nock: twelve reduction rules and a single opcode for change. Vesl is fourteen primitives on top of all of it. Your app inherits every layer.

Nock 4K. 340 bytes of pseudocode. The smallest deterministic VM that means it.
  • vesl :: 14 grafts. typed Rust SDK. real-kernel harness.
  • nockchain :: PQ crypto. transparent STARKs. schnorr-over-cheetah.
  • nock :: 12 rules. deterministic. forever.

:: Vesl is in active development. The catalog is stable enough to compose; the API surface will move before @tas v1.0. Build on it if you're shipping something that has to be true, not just running.