Hybrid verification agent
Invariants, not
hope.
rig-verifier-runtime checks the same temporal invariants two independent ways: a static BFS model-checker over every reachable state, and a live runtime monitor that must raise an alarm within 2 steps of a violation actually occurring — not after the fact.
rig-verifier-runtime · model checking + runtime verification · ghost-variable augmentation[higgsfield: gold-lit hexagonal shield hologram over a dark state-machine diagram, one node flagged in red, cinematic key light]
Why teams install
What rig-verifier-runtime earns back
Finds every planted violation, no false positives
Golden model plus 5 mutants, including a 2-bug combo scenario — BFS matches the expected violation set exactly on all 6.
‹8f5968a›Catches it live, not in a postmortem
A DONE-without-VERIFYING violation at step 5 is flagged by the runtime monitor at step 5 — 0-step lag, well inside the 2-step budget.
‹a026d5d›Disable the monitor and the miss is provable
With the runtime monitor off, the same live violation occurs but is never flagged — the gate goes RED, and an independent oracle proves it was real.
‹d6f9d4a›How it works
Three steps. No faith required.
01
Model
Compose the agent’s state machine with a ghost variable so temporal precedence becomes a plain state check.
02
Check
BFS the full reachable space statically; monitor the live run step by step, no lookahead.
03
Cross-verify
Both methods must agree on the same invariants; a lag beyond 2 steps fails the gate.
Proof band
One packet. Every claim accounted for.
packet rig/rig-verifier-runtime · MCRuntime v1 battery golden + 5 mutants · live scenario direct_error_to_done result static_all_match TRUE — 6/6 scenarios · runtime_lag_steps 0 (≤ 2) invariant INV_P1_DONE_REQUIRES_VERIFYING — violated at step 5, alarmed at step 5 anchor PASS — disable-monitor regression independently reproduced ‹8f5968a› themis SEALED — merge gate armed
Every rig-verifier-runtime run emits a packet like this — hash-chained, verifier-signed, and queryable from your own dashboard. How ProofPackets work →
Buyers
Who runs rig-verifier-runtime
Principal Eng
safety-critical multi-agent systems
Head of Verification
regulated autonomous systems
Research Lead
formal-methods-adjacent agent teams
Objections
Answered before you ask
Isn’t static analysis enough on its own?
Static analysis proves a violation is reachable in the model. It says nothing about whether your live run actually hit it, or how fast you’d know. The runtime monitor closes that gap — 0-step lag on the tested violation.
Why check the same invariant two ways?
Because a monitor that’s silently disabled looks identical to a monitor watching a clean run — until you prove the violation was real and still missed. That’s exactly what the disable-runtime-monitor regression demonstrates.
What’s the ghost variable for?
It turns a temporal precedence property — “DONE requires having previously visited VERIFYING” — into a plain state check, so both the BFS model-checker and the step-by-step runtime monitor can evaluate the identical predicate.
Pricing
Start free. Pay when it pays.
Generalist ships today. Domain Expert adds vertical memory + priors. Custom is built to your stack.
Free
Priced after a short conversation
1 invariant, static-only checking.
Team
Priced after a short conversation
Unlimited invariants, live runtime monitor, full scenario battery.
Pro
Priced after a short conversation
Dedicated verifier fleet incl. bespoke invariant authoring, SLA.
SB 26-189 readiness — dual-verified invariants are the exact evidence class the bill’s audit language names.
