Self-certifying geometry kernel
Roshera is a native Rust B-Rep kernel built to be driven by machines rather than operated by hand. Every operation that touches geometry returns a verifiable certificate: soundness across nine structural invariants, DOF accounting, conflict witnesses.
Where it cannot answer inside a verified envelope, it refuses with a typed error rather than returning an approximation labelled exact.
The reason this matters is not craftsmanship. It is that the operator has changed. For forty years a geometry kernel answered to a human with eyes — someone who would notice a face flipped inside out, a bore that didn't go through, a fillet that quietly ate a neighbouring feature. The kernel could be approximately honest because a person was holding the other end of the contract.
An agent has no eyes. It receives a solid, believes it, and builds the next twelve operations on top. A wrong answer does not announce itself at the moment it is produced — it surfaces four steps later as a part that will not manufacture, and by then the reasoning that produced it is gone. Silence is the failure mode, and no amount of model capability fixes it, because the model is not the thing that is wrong.
So the contract has to move into the kernel. Not a confidence score, not a validation pass you can forget to run — a structural proof, computed under the same lock as the mutation, returned with every single call, failing closed.
What you are looking at
That is not a mesh with a smooth shader on it. It is twenty-three analytic faces — planar, cylindrical, conical — and the colours are the kernel's own surface classification, not decoration. Every band on a chamfer is a real 0.8×45° conical face carried on its own surface, not a darkened edge in a triangle soup.
The distinction is load-bearing. A face that knows it is a cylinder of radius 8 gives an exact bore area, an exact mass moment, and a watertight mesh at any tessellation density. A face that is merely 400 triangles which happen to lie near a cylinder gives you numbers that look right and drift — and it cannot answer the question "is this a through bore?" at all.
Chamfering all thirty-nine convex edges in a single call is the operation where kernels quietly produce a leaky solid: each blend removes material at a vertex where three surfaces already disagree. This one returned watertight, manifold, zero boundary edges, with the Euler characteristic unchanged at −8 — the four bolt holes and the bore still correctly accounted for after the blend.
The wager
Every kernel has an envelope. The question is what happens at its edge. The industry's default answer is to return something — a fitted surface, a tolerance-widened weld, a result that is probably fine — because a human will catch it if it isn't.
We take the opposite position, and it costs us. A refusal is a worse demo than a wrong answer, because the wrong answer looks like a part. But a refusal is the only response an agent can actually act on: it names the entities, states the reason, and says what to do instead. The agent recovers on the next call. A silent approximation cannot be recovered from, because nothing knows it happened.
This is also why the envelope is published rather than hidden. A kernel selling honest refusal that conceals its own limitations has already failed its own test — so the map of what does and does not work is a first-class page of this site, maintained against the source tree rather than against intent.
RosheraREFUSED chamfer_edges
Edges 32 and 2 share corner vertex 0 —
same-kind corner-patch synthesis for this
vertex kind is not yet implemented.
Do not apply sequentially.