# The trust roadmap moved from claims to gates

> On main since rc2: The trust roadmap moved from claims to gates. The July trust push turned the “real but manually verified” caveats into blocking CI jobs.

Source: https://kern-lang.eu/releases/trust-roadmap-gates

On main since rc2

## Release notes

The July trust push turned the “real but manually verified” caveats into blocking CI jobs. `reproducibility` rebuilds the compiler and checks the IR and the binary byte-for-byte per commit; `ddc` compiles the compiler with two independent C toolchains and fails the build on any divergence, which is the Trusting-Trust check made routine. The independent seed path produces a working compiler without the shipped binary. Formal work extended past the proof-of-method: `formal/caps/` proves `well_typed_confinement`, that a well-typed program which mints no kind-_k_ capability can never reach an authority-_k_ primitive, which is exactly the E0404 guarantee, plus that the functional checker matches the declarative typing relation.

Supply chain: lockfile chain-integrity is a fail-closed SHA-256 chain, and kern-pkg now derives a dependency's _actual_ capability set from `kern audit-caps --json` and rejects a package that escalates beyond its declared manifest. `docs/VERIFICATION-DOSSIER.md` ties every trust claim to the exact command that checks it, and `scripts/kern_verified.sh` grants the mark only to a toolchain that passes deterministic IR + reproducible binary + DDC + full conformance on the clean-room seed. Documentation joined the gate set too: `make check-docs` fails on any stdlib or test count that drifts from the source, and every fenced Kern example in the normative docs must typecheck (it found six real API-stale examples on first run and 18 stale numbers).