Vörðr

License

SPDX-License-Identifier: CC-BY-SA-4.0

Vörðr is free software under the Palimpsest License (PMPL-1.0-or-later). See LICENSE.txt for full terms.

Formally verified container orchestration and verification engine.

Guardian of containers. Watcher of states. Keeper of proofs.

Native .ctp runtime — Reference implementation of the verified-container-spec Runtime Integration.

The Name

Vörðr (Old Norse: /ˈvørðr/) means "guardian" or "watcher" — a spirit that follows and protects. In this system, Vörðr watches container lifecycles, guards state transitions, and ensures formal correctness through mathematical proof.

The ASCII-safe spelling is vordr.

The Languages

Vörðr is polyglot by design, using the right tool for each verification domain:

Language	Domain	Rationale
ReScript	LSP server & MCP adapter	Native JSON-RPC handling, optimal for protocol adapters, fast iteration
Zig	FFI implementation layer	C-compatible exports without headers, memory-safe, zero-cost C interop
Idris2	ABI definitions & formal proofs	Dependent types prove interface correctness, memory layout verification
Elixir	Container orchestration	BEAM fault tolerance + GenStateMachine for reversible state transitions
Rust	CLI and performance paths	Zero-cost abstractions, container runtime integration

Current Status

Overall: ~45% — Early alpha with partial implementations.

What works today:

• Elixir GenStateMachine orchestrator with reversibility journal (~85%)

• Idris2 dependent-type proofs for container lifecycle (~90%, but not wired into runtime)

• ReScript MCP adapter protocol layer (~80%, untested against live gateway)

• Temporal isolation engine in Elixir (~70%)

• Repository structure, CI/CD skeleton, documentation skeleton

What does not work yet:

• No real container runtime — the Rust CLI compiles but cannot create, run, or stop containers (no namespace/cgroup/rootfs calls)

• eBPF kernel programs — only userspace type definitions exist; zero BPF bytecode

• Ada/SPARK code — source files present but never compiled with GNAT; C stubs used at runtime

• Zig FFI — exported function signatures exist with no implementation behind them

• Integration testing — no cross-language end-to-end tests

Component	Status	Description
Idris2 Proofs	Real (~90%)	Dependent type proofs for container lifecycle, SBOM, attestation. Not integrated into Rust runtime.
Elixir Orchestrator	Mostly functional (~85%)	GenStateMachine container lifecycle, reversibility journal, Borg integration. Needs FFI NIF bridge.
MCP Server	Protocol layer (~80%)	ReScript JSON-RPC 2.0 server with method definitions. Not tested end-to-end with Svalinn.
Temporal Isolation	Surprisingly complete (~70%)	BEAM port interceptor concept, time-dilation logic. Not integrated with eBPF clock manipulation.
Rust CLI	Scaffolding (~30%)	CLI subcommands defined, Cargo project builds. No actual runtime calls (clone, unshare, pivot_root).
Rust eBPF	Userspace only (~10%)	Aya probe definitions and event types. No kernel-side BPF programs.
Ada/SPARK Trust	Specs only (~5%)	Ada source files exist but have never been compiled. Using C stubs.
Zig FFI	Placeholder (~5%)	C-compatible function signatures exported. No real container operations.

Quick Start

Prerequisites

• Deno (>= 1.40) - Runtime for ReScript LSP/MCP servers

• Zig (>= 0.11.0) - FFI layer compilation

• Idris2 (>= 0.6.0) - ABI verification (optional)

• Elixir (>= 1.16.0) with OTP 26+ - Container orchestration (optional)

• Rust (>= 1.75.0) - CLI (optional)

Build

# Clone the repository
git clone https://github.com/hyperpolymath/vordr.git
cd vordr

# Build Zig FFI layer
cd ffi/zig
zig build
zig build test

# Build ReScript LSP/MCP servers
cd ../../src/lsp
npx rescript build

cd ../mcp-adapter
npx rescript build

# Optional: Build Rust CLI
cd ../../src/rust
cargo build --release

Run the LSP Server

Stdio Transport (for VS Code/Neovim/Emacs):

cd src/lsp/transport/stdio
deno run --allow-read --allow-write StdioTransport.res.js

HTTP Transport (for web clients):

cd src/lsp/transport/http
deno run --allow-net HttpTransport.res.js
# Listens on http://localhost:8081

Run the MCP Server

cd src/mcp-adapter
deno run --allow-net HttpServer.res.js
# Exposes JSON-RPC 2.0 interface on http://localhost:8080

VS Code Extension

Install the extension from editors/vscode/:

cd editors/vscode
npm install
npm run compile
code --install-extension .

Provides LSP features for .ctp bundles and .gatekeeper.yaml files.

CLI Usage

# Start a container
vordr run nginx:latest --name web

# List containers
vordr ps

# Stop a container
vordr stop web

# Rollback last operation (Bennett-reversible)
vordr undo --last

# Show reversibility chain
vordr audit --chain

# Run diagnostics
vordr doctor

Architecture

                    ┌───────────────────────────────────────────┐
                    │            VÖRÐR CORE                     │
                    │  LSP/MCP Server + Container Runtime       │
                    └─────────────┬─────────────────────────────┘
                                  │
         ┌────────────────────────┼────────────────────────────┐
         │                        │                            │
         ▼                        ▼                            ▼
┌──────────────────┐    ┌──────────────────┐    ┌──────────────────┐
│   LSP Protocol   │    │   MCP Server     │    │   Zig FFI Layer  │
│   [ReScript]     │    │   [ReScript]     │    │   [Zig + Idris2] │
│   Port 8081      │    │   Port 8080      │    │   (C-compatible) │
└──────────────────┘    └──────────────────┘    └──────────────────┘
         │                        │                            │
         ▼                        ▼                            ▼
┌──────────────────┐    ┌──────────────────┐    ┌──────────────────┐
│  Stdio/HTTP      │    │   SVALINN        │    │   Container Ops  │
│  Transports      │    │   Gateway        │    │   Verify/Create  │
└──────────────────┘    └──────────────────┘    └──────────────────┘
         │                        │                            │
         └────────────────────────┼────────────────────────────┘
                                  │
              ┌───────────────────┴───────────────────┐
              │                                       │
              ▼                                       ▼
    ┌──────────────────┐                  ┌──────────────────┐
    │  CERRO TORRE     │                  │  Elixir GenServer│
    │  (Signing)       │                  │  (Orchestration) │
    │  [Rust Ed25519]  │                  │  [BEAM VM]       │
    └──────────────────┘                  └──────────────────┘

Key Components:

• LSP Server (ReScript): Language Server Protocol for IDE integration

• MCP Server (ReScript): Model Context Protocol for LLM/gateway integration

• Zig FFI: C-compatible container operations with Idris2 ABI proofs

• Svalinn Gateway: Request validation and MCP client

• Cerro Torre: Ed25519 signing of .ctp bundles (Rust)

• Elixir Orchestrator: GenStateMachine-based container lifecycle

Components

Component	Location	Description
LSP Protocol	src/lsp/protocol/	ReScript LSP server with Types.res (500+ lines) and Server.res (400+ lines)
LSP Transports	src/lsp/transport/	Stdio transport for editors, HTTP transport for web clients (port 8081)
VS Code Extension	editors/vscode/	TypeScript extension for .ctp bundles and .gatekeeper.yaml files
MCP Server	src/mcp-adapter/	ReScript JSON-RPC 2.0 server (port 8080) with containers/ and images/ methods
Idris2 ABI	src/abi/	Dependent type definitions (Types.idr, Layout.idr, Foreign.idr) with formal proofs
Zig FFI	ffi/zig/src/	C-compatible container operations (300+ lines), NO C headers, direct Idris2→Zig
Elixir Orchestrator	src/elixir/	GenStateMachine-based container state machine, reversibility journal
Rust CLI	src/rust/cli/	Container lifecycle commands (needs Zig FFI integration)

Elixir State Machine

The Elixir orchestrator implements a formally verified container lifecycle:

    ImageOnly → Created → Running ⇄ Paused
                   │          │        │
                   │          ▼        │
                   │       Stopped ←───┘
                   │          │
                   ▼          ▼
                 Removed ← ───┘

Each state transition is logged for reversibility:

# Start a container
{:ok, pid} = Vordr.Containers.start_container("nginx:1.26", name: "web")

# Transition state
:ok = Vordr.Containers.start(pid)
:ok = Vordr.Containers.pause(pid)
:ok = Vordr.Containers.resume(pid)

# Rollback with reversibility
:ok = Vordr.Reversibility.rollback(pid, steps: 2)

Integration with Svalinn Ecosystem

Component	Role	Communication
Svalinn	Edge gateway, request validation	Calls Vörðr via MCP/JSON-RPC
Cerro Torre	Provenance-verified builds	Produces .ctp bundles verified by Vörðr
verified-container-spec	Protocol specification	Schema definitions for attestations, runtime integration patterns

Runtime Integration

Vörðr is the reference implementation for native .ctp bundle execution. Other runtimes (nerdctl, Podman) can integrate via plugins, shims, or hooks as described in the Runtime Integration Specification.

Unique to Vörðr:

• Verification is always enforced - no opt-out (design goal)

• Formally verified state transitions (Idris2 proofs — not yet runtime-integrated)

• Bennett-reversible container lifecycle (Elixir layer)

• SPARK cryptographic operations (planned — Ada code not yet compiled)

Svalinn Integration

Svalinn delegates container operations to Vörðr via standard MCP methods:

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "containers/create",
    "arguments": {
      "image": "nginx:1.26",
      "name": "web",
      "config": { "readOnlyRoot": true }
    }
  }
}

Standard MCP Methods: - containers/list - List all containers - containers/create - Create a new container - containers/start - Start a container - containers/stop - Stop a container - containers/remove - Remove a container - images/verify - Verify image signatures - images/list - List available images

Cerro Torre Integration

Vörðr verifies .ctp bundles signed by Cerro Torre:

# Generate Ed25519 signing key
cerro-sign keygen --private-key signing.key --public-key signing.pub

# Sign a container bundle
cerro-sign sign --key signing.key --message <bundle-hash> --output signature.sig

# Vörðr verifies signature when loading bundle
vordr run nginx.ctp --verify --public-key signing.pub

Cerro Torre provides: - Ed25519 signing of container bundles (Rust implementation) - Public key distribution via .ctp metadata - Provenance attestation in bundle format

Vörðr provides: - Signature verification using ed25519-dalek - Gatekeeper policy enforcement - Runtime integrity checks

Project Structure

vordr/
├── src/
│   ├── lsp/                    # Language Server Protocol
│   │   ├── protocol/           # Core LSP logic
│   │   │   ├── Types.res       # LSP types (500+ lines)
│   │   │   └── Server.res      # LSP server (400+ lines)
│   │   └── transport/          # Transport layers
│   │       ├── stdio/          # Stdio transport (editors)
│   │       └── http/           # HTTP transport (web clients)
│   ├── mcp-adapter/            # Model Context Protocol
│   │   ├── src/McpClient.res   # MCP client
│   │   └── src/HttpServer.res  # JSON-RPC 2.0 server
│   ├── abi/                    # Idris2 ABI definitions
│   │   ├── Types.idr           # Type definitions with proofs
│   │   ├── Layout.idr          # Memory layout verification
│   │   └── Foreign.idr         # FFI declarations
│   ├── elixir/                 # Orchestration layer
│   │   ├── lib/vordr/
│   │   │   ├── application.ex
│   │   │   ├── containers.ex
│   │   │   ├── containers/container.ex  # GenStateMachine
│   │   │   ├── reversibility.ex
│   │   │   └── reversibility/journal.ex
│   │   └── mix.exs
│   └── rust/                   # CLI
│       ├── cli/                # Subcommands
│       └── Cargo.toml
├── ffi/
│   └── zig/                    # Zig FFI implementation
│       ├── build.zig
│       ├── src/main.zig        # C-compatible exports (300+ lines)
│       └── test/
├── editors/
│   └── vscode/                 # VS Code extension
│       ├── src/extension.ts
│       └── package.json
├── .machine_readable/
│   ├── STATE.scm               # Project state
│   ├── META.scm                # Architecture decisions
│   └── ECOSYSTEM.scm           # Ecosystem position
├── Containerfile               # Multi-stage Rust build
└── README.adoc