A deterministic virtual machine and provenance engine by Albert Lane, offered to companies as a leased runtime under the Albert Lane Proprietary Software License v100.0.
What it is. “Lane-VM is a deterministic virtual machine runtime, state transition governor, and cryptographic provenance engine that enforces multi-party dual custody, hardware-rooted monotonic state transitions, external entropy injection, and statutory legal identity embedding across distributed execution environments.” — Lane-VM System Audit (evidence #134)
How it is built. According to RFC 9001 and the hardening paper, a C++20 host kernel holds the root of trust. Python guests run inside it. Compiled .lane binaries carry a 64-bit magic header, and memory, telemetry and wire packets are fingerprinted to their author (sources below).
Each use case below is drawn from Albert Lane’s published research. The status line repeats what that research says has and hasn’t been proven.
What the research says. The Lane-VM Sovereign Provenance Engine is a lightweight, deterministic provenance injector and container-package generator written in standard-library Python. A pre-commit hook or CI runner injects line-0 legal and identity headers (preserving interpreter directives), and the build stage writes a .lvm / .lane JSON-LD manifest that records an immutable SHA-256 hash and timestamp of the source.
How a company uses it. Put the injector in your CI pipeline so every source file carries a tamper-evident header and every build ships a signed-hash manifest. A removed or edited header changes the SHA-256 digest, which is the proof of tampering the analysis describes. The analysis compares this with Sigstore and SPDX: those cover artifacts and dependency trees, while Lane-VM targets source-level authorship.
Status in the research: Specified with a reference implementation in the analysis.
Sources:
Request a lease for this use →
What the research says. The hardening paper moves the root of trust from the interpreted script tier to a C++20 host kernel. Binaries must start with the 64-bit magic constant 0x3F8F9A1B2C3D, memory uses a non-standard 17,684-byte stride, and guests emit an HMAC heartbeat every 1,000 instructions. RFC 9001 specifies the same header, stride and heartbeat, plus CRC-32 packet checks.
How a company uses it. Run proprietary algorithms inside a runtime whose binaries, memory layout and wire packets carry the rights holder's fingerprint. Under the paper's threat model, that resists AI crawlers, scrapers and automated decompiler pipelines.
Status in the research: Specified (RFC 9001, Final / Proprietary). The system audit rates the non-standard stride and bit-widths as a Low-Medium risk (5.9/10) because they block standard formal-verification and debugging tools. Its suggested fix is to run standard RISC-V or WebAssembly bytecode inside the core sandbox.
Sources:
Request a lease for this use →
What the research says. RFC 0102 and SAFD-FRAMEWORK-SPEC-01 define a full-duplex WebSocket stream framework for script-re-execution runtimes such as Streamlit, Gradio and Dash. Network I/O runs on isolated background threads, with deterministic backpressure and resource caps. Ingress is pinned to pre-verified IP literals. Private, loopback, link-local (including the 169.254.169.254 metadata service) and reserved ranges are blocked, and 6to4, NAT64 and Teredo targets are decoded so they can't be used to slip past the blocklist.
How a company uses it. Corporate data and ops teams that run Python dashboards can host live feeds without freezing the UI or opening an SSRF path into internal networks or cloud metadata endpoints.
Status in the research: Specified, with a Python reference implementation in RFC 0102.
Sources:
Request a lease for this use →
What the research says. The system audit describes binding VM state to TPM 2.0, Android StrongBox (Titan M2), Apple Secure Enclave or external keys (YubiKey, Ledger, Trezor) through PCR quotes and monotonic counters. The goal is to detect cloning, rollback and device swaps, with multi-party co-signature and append-only tombstone records when parties disagree.
How a company uses it. Compliance-heavy teams can design record-keeping where every state change is hash-chained and tied to hardware, and where no single administrator can quietly roll history back.
Status in the research: The audit is candid. It rates the hardware-to-software binding and the human-to-robot binding UNPROVEN, and the userland Termux deployment has no instantiated hardware attestation. It also notes that SEC Rule 17a-4 and FRE 902(13)/(14) claims lack certification from an accredited independent forensic firm, and it ranks 15 gaps with fixes, such as Linux IMA measurement into TPM PCR 10.
Sources:
Request a lease for this use →
What the research says. The audit describes a dual-tier topology: an offline, air-gapped human macro-ledger, and a corporate micro-ledger that runs on Cloudflare Workers, aros.albertlane.net and EVM testnets. State roots are anchored with a VaultAnchored event on the Zenith Testnet (Chain ID 936485). The Multi-VM paper sets out a tri-VM ledger that runs EVM, Substrate FRAME and Cosmos SDK / CosmWasm together.
How a company uses it. Enterprises can anchor their own audit roots to a public chain, so outside parties can check that history was not rewritten, and can settle across EVM and Cosmos-style environments.
Status in the research: Design stage. The audit rates chain portability PARTIALLY PROVEN and lists the Zenith faucet dependency as a High risk (8.8/10). The Zenith contract deployment for albertlane.net is not live yet: it is waiting on validators and a funded deployer.
Sources:
Request a lease for this use →
What the research says. The Froi Sovereign Edge build plan adapts the Lane-VM interpreter into a deployment host behind a Cloudflare edge worker and a GitHub App. Its COMPUTE ops (github_fetch, r2_store, kv_read and kv_write) are host-locked so they can't be used for SSRF.
How a company uses it. Engineering orgs can run GitHub-triggered build and deploy steps on an edge host whose every network call is allow-listed.
Status in the research: Build plan. Phases P1 and P2 are marked “To Build”.
Sources:
Request a lease for this use →