The Demo · AI you can prove
Native x86-64 and a typed interpreter. Same program. They agree — or we show you exactly where they don't.
The transcripts below are a recorded run — real, captured from our own repo, the exact command shown and the raw output one click away, unedited. And now the live playground is here: edit a program yourself and watch the two runtimes agree, in your own browser.
Recorded run · press ▶ Replay to watch it again
Two independent runtimes. One certificate.
Every QUANTA program compiles to native x86-64 AND runs in a typed tree-walking interpreter. On every single compile — never disabled — the two are compared, value for value. This is that comparison, captured live from the repo, not simulated for the web.
chapters/L0/algos/algos.q — six classic algorithms, hand-written in QUANTA
fn powmod(b, e, m) {
let result = 1; let base = b; let exp = e;
while (exp > 0) {
if ((exp & 1) == 1) { result = (result * base) % m; }
base = (base * base) % m; exp = exp >> 1;
}
return result;
}
// ...plus ackermann, collatz_steps, hanoi_moves, binomial, euclid
// main() runs 20 assert()s, then returns their checksum (113).$ ./qc2 --check chapters/L0/algos/algos.q
NATIVE x86-64 ▸ executing…
TYPED INTERPRETER ▸ executing…
Now try it yourself · live, in this tab
Don't take the recording's word for it — run the gate yourself.
Edit the program below and watch it execute two independent ways at once — a tree-walking interpreter and a compiled bytecode VM — proven identical value-for-value, live. Break it on purpose and the gate surfaces the mismatch. Nothing is sent to us; this is your machine, not a recording of ours.
When they don't match — the most convincing screen we own
A real 32-bit wraparound, caught, not covered up.
QUANTA has no 32-bit type — every integer is a uniform 64-bit value. Real C unsigned int arithmetic wraps at 2³²; QUANTA’s doesn’t. So when we converted a genuine wraparound function, the converter didn’t quietly call it equivalent — the gate refused, and said exactly why.
$ ./c2q wrap_test.c # a real 32-bit-unsigned-wraparound function
QUANTA (native ≡ interp — the sacred gate still holds)
ORIGINAL C ▸ gcc -O2, run for real
Note what held and what didn’t: native ≡ interpreter still passed — that gate is about QUANTA agreeing with itself, and we can prove it is able to fail. What failed here was gate 3, the behavioural check against the original C — exactly the case it exists to catch. This is why the corpus holds 1,053 certified functions and not one more. What the converter certifies depends entirely on which corpus you point it at, so we publish the corpus with every number.
| Corpus | Certified yield | Basis |
|---|---|---|
| Numeric C, pre-filtered to the long/double subset | 14 of 15 · 93% | Measured, one run — the corpus c2q is built for |
| Pure algorithm, maths and codec cores (sort, hash, bignum, DCT, CRC, matrix) | 60–80% | Projected by domain — not yet run end to end |
| Data-structure libraries (btree, hashmap, arena) | 35–55% | Projected by domain — pointer glue drops out |
| Network, storage and OS glue (TCP state machines, VFS, blit) | 15–35% | Projected by domain — mostly syscalls and state |
| Idiomatic concurrency, actors, GPU kernels | ~5% | Projected by domain — effectively out of reach today |
| Wild, unfiltered C — 5 permissive repos, 1,423 repo-authored functions | 6.7% gate-green · 1.9% certified | Measured, harvest run 3, 2026-07-10 |
Read the bottom rung against the top one. The converter refuses a plain int clamp(int, int, int) outright — C’s 32-bit int wraps at 2³² and QUANTA’s uniform 64-bit integer does not, so the two are not equivalent and it will not say they are. Most C ever written is typed int. That one refusal is most of the distance between the top rung and the bottom one, and it is the same refusal that made the transcript above fail rather than pass. The low wild number is not the converter being weak; it is the gate declining to certify what it cannot prove.
The negative control · the rung almost nobody climbs
Anyone can show you their gate passing. Here is ours, failing on command.
A check that always passes and a check that cannot fail produce the same screenshot. So the compiler carries an environment variable whose only job is to corrupt one bit of its own output and prove the comparison bites. Both runs below were reproduced field-for-field on gcc 15.2.0 against a record made on gcc 9.4.0 — six major compiler versions apart.
$ QCC16_TAMPER=40000 ./qc2 # flip one bit of the compiler's own output, on purpose
CLEAN RUN ▸ ./qc2
TAMPERED RUN ▸ QCC16_TAMPER=40000 ./qc2
Read what the failing run reports. Both outputs are still the same length — 75,815 bytes each — with the same entry offset; nothing structural changed. The check found the difference anyway, at exactly the byte we corrupted, and named the value it expected against the value it got. And here is the hazard we would rather you learned from us: qc2 exits 0 in both runs. Only the printed output tells them apart, which is why every harness we ship greps the output instead of trusting the return code — and why wiring this into CI on the exit status alone checks nothing at all. The full report, including what this claim is not.
What’s next