---
title: Stage 3
type: reference
tags: :passepartout:roadmap:
created: 2026-05-24
---

← [[id:4a1f23b0-abc3-4def-9876-543210abcdef][Stage 2 — Verification]]  → [[id:4a1f23b0-abc5-4def-9876-543210abcdef][Stage 4 — Inference]]

# Stage 3: Lisp Machine

*Summary: The [[id:84a537b4-4256-50c8-91f5-dd5b4538418f][verified Lisp machine]]. One image, one [[id:1c95ce7d-a2db-506a-9608-df68f9ae211b][memory graph]], one [[id:45ea493b-94ad-5885-aa65-0c846e5c3c1d][gate stack]].
No kernel, no process boundaries, no memory corruption. The verification subsystem, the environment subsystem, and the social protocol are no longer separate components — they are properties of the same machine.*

## What is added

Passepartout spans three engineering phases that converge on the same architecture:

### Phase A — Software emergence (2-3 years)

The Lisp machine emerges inside a host OS. A single SBCL image absorbs every
user interface into one address space:

- **Lish editor:** a multi-threaded Common Lisp editor via Qt/QML (EQL5).
  The agent's system prompt lives in an Org buffer — visible, editable,
  hot-reloadable. Org-babel for inline evaluation. The editor IS the daemon.
- **Nyxt browser:** Common Lisp web browser in three erosion stages:
  Qt+WebKit → S-expression DOM → pure Lisp layout. Web content is natively
  queryable and modifiable as Lisp data structures.
- **Lish shell:** text-stream replaced by plists. Pipe becomes function
  composition. Scripts become Lisp functions on memory objects.
- **Emacs migration (three phases):** parasite bridge (v0.4.0) → ELisp
  compatibility layer inside CL image → native CL implementations.
- **Minibuffer:** universal command surface — edit files, navigate web,
  run Lisp expressions, invoke agent commands.
- **Provenance store becomes native Lisp hash table with persistence.**
  The symbolic engine queries it directly — no IPC, no file parsing at runtime.
  Empirical parameters, validity envelopes, and benchmark data live in the same
  address space as the evaluator and gate

### Phase B — Cannibalization (3-5 years)

Gradual replacement of every external dependency with native Lisp:

- TCP bridge → internal function call (single SBCL image)
- QML layout → Lisp layout (Yoga FFI as intermediate)
- WebKit → Lisp DOM + Lisp-native layout engine
- Qt widgets → Lisp-native X11/Wayland bindings
- Font rendering → HarfBuzz FFI → Lisp replacement
- Qt event loop → SBCL native thread scheduler
- Linux bootloader → Stage0 Lisp bootstrap (500 bytes hex → self-hosting Lisp)

The system remains usable at every step. Each replacement is a component swap.

### Phase C — [[id:84a537b4-4256-50c8-91f5-dd5b4538418f][Hardware]] (5-10 years)

The dual-unit ASIC: one chip, two compute units, one Merkle-verified memory graph:

1. **Symbolic core** — tagged RISC-V (4-8 type tag bits per word, hardware
   type checking, single-cycle LISP.CAR/LISP.CDR). Runs gate stack, cognitive
   loop, general Lisp evaluation.
2. **Tensor unit** — cons-cell-native matrix compute. Walks the tensor DAG
   directly for attention and matmul. No FFI boundary, no GPU mirror.

Prototyping: TinyTapeout (130nm, 8-bit tagged toy) → FPGA core (DE10-Nano,
VexRiscv) → FPGA tensor (Xilinx VU9P, cons-cell matmul) → shuttle (12nm,
tagged RISC-V at 100-300MHz) → ASIC (5nm, both units on die).

Phase migration: parasitic FPGA PCIe card → functional hijacking → driver
cannibalization → self-hosting (Stage0 on bare metal).

Hardware GC: dedicated Scavenger bus master runs GC in parallel with symbolic
and tensor computation. Persistent NVRAM: boot to exactly where you left off.

## What is eliminated

- **Memory corruption entirely** — verified Lisp evaluator, no undefined
  behavior. No buffer overflow, use-after-free, type confusion.
- **OS kernel exploitation** — no kernel. Evaluator is the substrate. No
  syscalls, no drivers, no MMU to confuse.
- **Compiler backdoors** — Lisp-to-Lisp compilation within the verified
  evaluator. [[id:13e6ae54-2d24-5aa0-b1cd-a7e8e749aa70][Ken Thompson's "Trusting Trust"]] is structurally impossible.
- **Malware / viruses / worms** — no "download and execute" path that bypasses
  the gate. The evaluator only runs objects in the verified memory graph.
- **Supply chain at binary level** — every object has a Merkle chain to its
  origin. A dependency is a pointer, not a file.
- **The subsystem composition problem** — one address space, one
  semantics, one proof. The interface between verification, environment, and
  protocol is an internal relationship.

## What does this cost?

- **Lisp tax on everything** — verified execution is 2-10x slower than
  optimized C on equivalent hardware. Symbolic core is designed to minimize
  this; tensor unit sidesteps it for neural compute
- **No backward compatibility** — existing software doesn't run on the Lisp
  machine. No Linux binaries, no x86 drivers, no GPU compute stacks (without mirror path)
- **Single address space fragility** — no process isolation. A bug in the
  editor can corrupt the browser. One crash radius, one machine
- **Massive engineering investment** — shortest plausible timeline to a usable
  software Lisp machine is 2-3 years; ASIC 5-10 years
- **Ecosystem abandonment** — no open-source packages, no shared libraries.
  Everything is in the Merkle memory graph or it doesn't exist

## What does this enable?

Deductive security replaces empirical security. Memory bugs — the dominant
attack vector for decades — are structurally eliminated. No more patching for
CVEs. No ASLR, no DEP, no CFI — the class of attacks they mitigate doesn't
exist. Every boot is a fresh verification that the evaluator, memory graph,
and gate stack are intact.

## When is this viable?

- **Software (Phase A+B):** 2-3 years on existing hardware. Single SBCL image,
  gate stack, Lish/Nyxt/Lish — usable on a developer workstation today.
- **ASIC (Phase C):** 5-10 years. FPGA prototype within 1-2 years, shuttle
  within 3-5, commercial foundry 5-10.

## In practice

Memory bugs — the dominant attack vector for decades — are structurally
eliminated. No more patching for CVEs. No antivirus, no firewall (at the
machine level — network boundaries remain). A Passepartout Lisp machine that
boots correctly will not crash from a memory corruption bug, ever.

But you've given up the entire existing software world. You cannot run Firefox,
Postgres, nginx, Python, or any Linux binary. The machine is a Lisp machine
and everything must be written in Lisp. The practical trade is: absolute
memory safety at the cost of adopting an entirely new computing paradigm.
This is not an upgrade path — it is a replacement.

← [[id:4a1f23b0-abc3-4def-9876-543210abcdef][Stage 2 — Verification]]  → [[id:4a1f23b0-abc5-4def-9876-543210abcdef][Stage 4 — Inference]]

:PROPERTIES:
:CREATED:  [2026-05-24 Sun]
:WEIGHT:  16
:ID:       4a1f23b0-abc4-4def-9876-543210abcdef
:END:
