Caletta is testing whether consumer Apple Silicon, deterministic replay, and peer-to-peer transport can support machine learning that operators own. Each critical claim receives a measurement and an evidence state. A failed measurement remains in the record. This page is the ledger.
Measured
- Two machines exchanged and merged one adapter. Two Apple Silicon machines independently fine-tuned LoRA adapters, exchanged them, and wrote byte-identical merged files in three consecutive rounds. Validation loss fell from 6.07 to 2.23. See Two Macs, one adapter.
- Adapter exchange consumed 98.7 percent of round time. Moving 2.5 MB between machines dominated the measured run. A replacement protocol has specified pass bars but has not yet passed them.
- Sparse recomputation catches tampering at tunable cost. A verifier that re-executes a sparse sample of a committed update's output coordinates raises tamper detection as the sample grows, at measured verifier cost: in one measured setting, sampling under half a percent of bytes caught 82 percent of a defined corruption for about two percent of verifier time. Measured against synthetic corruption; the run against a real recomputer is still owed, and we say so.
- Pure-Go collectives hold the C++ latency floor over Thunderbolt RDMA. In a two-host benchmark the pure-Go path matched the C++ floor at the median and edged ahead at the tail, with zero heap allocations per collective. Proven at two ranks and 16 KiB payloads on Apple hardware only, and not yet wired into the mesh layer above it.
Analyzed, measurement pending
- Byte-reproducible merging has exact sufficient conditions. The conditions that make a floating-point merge byte-identical across independent hosts are worked out, with a failure taxonomy for how real implementations silently break them and a pre-registered cross-architecture property test. All result cells pending.
- Peer-advertised weights may defeat aggregation after selection. If surviving peers are combined by weights they report themselves, one peer can inflate its influence after the selection step. One-peer-one-vote is the proposed counter. The three-arm poisoning demonstration has not been run.
- Pipeline-split training across two Macs was bit-exact once; the record must be re-captured. A model split across an M4 Max and an M3 Max pair reproduced sequential computation over real TCP to bit-exact logits, 769,536 values with maximum difference zero, in a working run whose raw record did not survive. By our own rules a number without its surviving measurement is a target, so it sits here until the run is re-captured.
- Preliminary observations point to the network as the constraint. Consumer Wi-Fi on this fleet appeared near 20 megabits per second. A 181 MiB sync took about a fifth of a second on loopback and more than a minute on the physical link. The raw record did not survive, so the link-budget measurement is pending.
- The exchange bottleneck has a designed fix. A streaming, resumable, verified store protocol with a latency model calibrated against the measured run. Its decision rules are fixed in advance so a later revision cannot move the goalposts.
Pre-registered, not yet run
- Byte-exact GPU-to-CPU replay at useful model sizes. The claim that a strict CPU backend can reproduce a GPU inference trace bit for bit is critical to verification without trusted hardware, and it has not been measured where it matters. The measurement is specified before the result exists.
- A training floor for several Macs on home Wi-Fi. The hypothesis is that a roughly 20-megabit-per-second link will constrain the run before memory or compute. Both the link-budget measurement and the training-floor run are pending.
- Reproducible agent binaries across independent builders. Byte-equivalent rebuilds can bind a binary to reviewed source only if independent builders actually reproduce the bytes. A pre-registered study defines the harness; the harness is not built.
Rules of the program
- A number without a surviving measurement is a target, not a result.
- Failures stay in the record. The rank-4 transfer that stopped before merge remains in the ledger.
- Verification evidence never silently becomes credit. Checking that work happened and deciding who gets credit for it are separate decisions, kept separate on purpose.
- Every pending claim has an outcome that would refute it.
The write-ups behind this ledger are in preparation for publication and available for review on request. For what a verification record does and does not establish, see What a training receipt does and does not prove. For the run itself, see Two Macs, one adapter. For where the program is pointed, see Democratized distributed training.