The engine behind
every verified number.
Kernalin isn't a model with a UI bolted on. Every proposed speedup runs the same disciplined pipeline — check it's correct, prove it isn't cheating, measure it honestly, then ship it — with a permanent record at every step. This is what makes the guarantee real, and what your engineers can audit line by line.
Eight stages, one contract.
Intake
Accept and statically check Triton, PyTorch, CUDA, and ONNX workloads against a strict contract.
Verify
A 5-stage correctness gate runs before any timing — smoke, shape sweep, adversarial, determinism, edge cases.
Measure
L2-flushed, CUDA-graph-captured timing over a full latency distribution; clocks locked when the host permits, otherwise labelled AS_DEPLOYED.
Decide
A Bayesian ROPE verdict against the GPU noise floor: credibly faster, equivalent, or regressed.
Anti-cheat
Input-differential and operation-coverage checks — independent, so a reward-hack has to beat both.
Optimize
A Claude Coder / Judge loop proposes kernel variants, each fed back through the same gauntlet.
Gate
A tiered CI regression gate blocks anything that would ship slower or wrong.
Report
An immutable, auditable run-log with a metric-diff you can reason about after the fact.
A validator can't certify the compiler it ships with.
Race-free proved by an explicit happens-before witness per read — not an opinion. Functional correctness still rests on the instruction obligations. The verdict says exactly that.
Properties the architecture guarantees.
Contracts-first
Sandboxed execution
Network-isolated
Immutable audit trails
RL-ready trajectory logging
Three agents share one verified engine.
Optimization Agent
Consumes profiling telemetry, generates optimization hypotheses, and scores confidence.
Benchmark Agent
Runs multiple workload variants, compares results, and selects the fastest implementation.
Regression Agent
Compares baseline metrics, detects anomalies, and triggers proactive notifications.
Trust isn't a promise. It's the order of operations.
A candidate is measured only after it clears the correctness gate. A fast wrong answer is not a result — it is rejected before a stopwatch starts.
Input-differential and operation-coverage checks close different gaps. A kernel that games one still has to survive the other.
The decision is a Bayesian ROPE verdict against a measured noise floor — never a naive percentage that hardware jitter can fake.
Where Kernalin cannot measure or prove something — no counter access, no clock control, an unsupported PTX opcode in the megakernel verifier (research preview) — it says so instead of certifying.
See the whole pipeline in motion.
Bring a contracts-first, verification-gated engine to your GPU workloads. Join the early-access program.