I'm seeing a lot of euphoria about how Opus 5.5 is good at TLA+, and this means that all software will soon be formally verified. As a person who loves TLA+ so much he wrote a book on it, I want to throw a particular cold shower on people's enthusiasm by talking about the limits of what you can actually verified with it. The high level simplification is that TLA+ sees a system as a set of "behaviors", or possible sequences of states. For example, the pseudocode "pick a random number from 1-3 and decrement it to 1" has three behaviors: `{3 -> 2 -> 1, 2 -> 1, 1}`. From here, there are two basic kinds of TLA+ properties: - `[]P` means that `P` is true in *all states* of *every behavior*. - `<>P` means that `P` is true in *at least one state* of *every behavior*. `[]P` is immediately useful as an **invariant**, or something that always be true of your system. This is things like "your data is never corrupt" or "there's always at least one server online." `<>P` is a little more abstract, but for technical math reasons I won't get into here, can be stacked with `[]` to create really complex and useful properties. `<>[]P` represents things like "the algorithm eventually converges on the right answer", `[]<>P` things like "if two data stores desync, they will eventually resync", and `[](P => <>Q)` things like "If a message is put on the queue, it's eventually processed by a worker". Really cool stuff! These primitives were chosen to make a wide array of properties useful. And if we're clever, we can do all sorts of more complex properties, like bounded time constraints and history properties. But we're always constrained to 1) define a logical formula 2) over individual behaviors, and 3) check that all behaviors satisfy that formula. So some things that we *cannot* express in TLA+: - Possibility and reachability properties: that it's always possible to *make* P true, even if you don't actually decide to. Things like "I can always shut down the computer" or "A user can always change their password". These can't be expressed with `<>P` because that's "for all behaviors, P happens at least once", we actually want "for all behavior prefixes, there is at least one behavior where P happens at least once". - Hyperproperties: properties that are defined over two or more traces. These are things like "painting a car red doesn't make it faster" or "users cannot infer secret data by observing public data". We can't do these because TLA+ only looks at one behavior at a time. - Statistical properties: 95% latency is 1ms. Impossible because most of these are hyperproperties. - Properties about if a system is robust against code changes. Impossible because, uh, you have new behaviors now. Some of these are solvable in different logical formalisms. CTL can do reachability, PRISM can do statistical properties, etc. Those have their own tradeoffs and limitations, though, and no system can do everything. Others are solvable with a lot of cleverness tailored to the specific spec, like lifting a model into a hypermodel. But these are insanely inefficient and make your "clever spec" diverge significantly from the real world system, so introduce a lot more opportunity for things to go wrong. The core problem, though, is (1): properties are logical formula. If we don't know how to express a system property as a logical formula, we can't verify it. 99% of the properties we care about fall under this. The information on the site is easy for a user to find. Our LLMs behave as we expect them to. Our application can't be used to break the law. TLA+ (and Quint and Lean and Rocq) are near-useless here, no matter how clever you are. Don't get me wrong: `[]P` and `<>P` represent a huge range of useful properties and TLA+ is incredible at finding awful concurrency bugs. But there's a lot it fundamentally can't do and we shouldn't believe that it will solve all our worries about software bugs. And the same goes for all other formal verification languages, too.

📼 Missed our Cardano governance technical workshop? Catch the full recording of our latest Cardano Vision 26 (CV26) session with Input Output Research (IOR). Watch it here 👇

Leios, Peras, Midgard, Hydra, AlphaGrowth, Draper, Bitcoin DeFi. Layer 1 scaling, Layer 1 finalisation, Layer 2 scaling, DeFi growth, ecosystem investment and strategic growth. Cardano is positioned well.

Alt-nodes, DeFi Kernel, Composability, staking incentives, governance incentives, permissionless DeFi without a middleman. Cardano is positioned well.

Tomorrow!! September 23 at 2:00 PM UTC. Amazing workshop organized by IOR!

Hey @btcecho erstmal danke für den Artikel über x402 auf Cardano! Ihr wisst, ich freue mich immer über sowas ;) Was mich aber noch mehr freuen würde, wenn ihr als News Outlet einfach ein klein wenig mehr Research betreiben würdet. Im Artikel stehen so Sachen drin wie es hätte bisher nur 1 Testnet Transaktion stattgefunden, usw. Das stimmt nicht. Es haben schon über 40,000 x402 Transaktionen statt gefunden. Dabei ist der x402 Standard auf Cardano ganz besonders cool, weil er mit Masumi (@MasumiNetwork) integriert ist und wesentlich mehr kann, als alle anderen x402 Implementation. Schaut euch mal cardano.org/ai/ an. Zusätzlich solltet ihr als deutsches Unternehmen wissen dass eine der größten deutschen Medienagenturen, die Serviceplan Gruppe, einen x402 Marketplace betreibt. Also ja, es gibt mehr Transaktionen auf Solana und co - aber auf Cardano gibt es mehr "sinnvolle" Transaktionen, statt Memecoins und random langweiligen API calls. Schauts euch doch mal an: sokosumi.com Trotzdem danke für den Artikel!

⏰ Reminder: Governance Technical Workshop – tomorrow, September 23 at 2:00 PM UTC. Join IOR for an interactive session on Cardano governance. Help us strengthen voter participation and broaden the distribution of voting power. Register: luma.com/uy584nq2

RealFi hits Cardano mainnet on 1 October after 3,600+ Pioneer Season users completed 40,000+ quest actions. 🧪 That test phase gave @realfi_co real usage data and feedback before going live. Which other Cardano DeFi teams are running real-user pilots like this before mainnet? THIS IS NOT A PAID PROMOTION

Anyone still needing to upgrade, check out the latest on the Intersect Github. Edge nodes and infrastructure nodes may benefit from the upgrade too. Link: github.com/intersectmbo/card…

BUT WAIT, ONE MORE THING! @hoskytoken reached out to us and generously offered to sponsor a surprise award! The BIGGEST LOSER of the trading competition, calculated as the highest peak-to-trough account value, really took the spirit of the testnet to heart. @rasunner will receive 1000 ADA worth of HOSKY for embodying the Hosky spirit and driving a maximum drawdown of 35%! A fun bit of additional trivia: @rasunner also had the most fills of any eligible participant in the competition: 1,583,398 fills!

Join IOR for an interactive session on Cardano governance (CIP-1694), incentive design, and a formal DSL for DAO governance. Wed, Sept 23 at 2:00 PM UTC Register here: luma.com/uy584nq2

And finally we can celebrate this huge milestone for @trivolvetech and Cardano.

Join us in Fargo for a Midnight meetup! We’ll be at Atomic Coffee in downtown Fargo on Tuesday, September 22, 2026 at 5:30 PM. See you there! RSVP at the Luma event link 👇🏻 luma.com/lc7cmefm

And a second block has been forged. cexplorer.io/block/ece8c3f7e…

Dingo has crossed the Rubicon. @Star_Forge_Pool has forged a mainnet block with a Dingo block producer. ✅ Preview ✅ Preprod ✅ Musashi ✅ Prime Testnet ✅ Cardano Mainnet cexplorer.io/block/727b0a50d… Join the legion running Dingo. We're coming.

Hey Cardano! 👋 Join Sebastian Nagel @ch1bo_, the Leios architect, as he showcases the Leios node peaking at 250 TxkB/s (~1,000 simple 250-byte transactions per second) on a local cluster with emulated round trip times for higher fidelity. Mainnet today tops out at 4.5 TxkB/s. The throughput is there!! 🚀 📡 The work ahead sits in the network stack, where tuning and optimisation carry these numbers out of the lab and into real internet conditions. Cardano, beast mode enabled! See it for yourself... ...then show us what you'd do with it 👇

Shipped pragma.io/templates today. Mnemos, our library of reusable templates and docs for working in the open: treasury proposals, incident resolution, contributor onboarding, security policy, repo health checks, even an AI friendly repo template. Most open source ops are either nonexistent or copy pasted from a project that also didn't know what it was doing. PRAGMA now has an easy fix. Copy it. Adapt it. Share it.

JUST IN: Charles Hoskinson points to the 1.5B+ iPhones in circulation as a "massive anonymity set," that could potentially leverage Midnight's ZK proofs and selective disclosure, to prove a photo came from an authentic iPhone and prove IP ownership, all while preserving privacy.

Double Feature on a Friday We’re wrapping up the week with two new pieces of RealFi content. First up, John O’Connor takes the Hot Seat in Episode 2 of the series to answer a question at the heart of the venture: “Why Cardano?” He shares the story behind RealFi, his own journey in the space, and the thinking that shaped the project. Then, we’ve published our latest Office Hours roundup, covering all four of August’s community calls – from testnet hardening and preparing for real funds, to the community’s input on new ticker names and how the portfolio is designed. Two fresh ways to catch up with what’s happening at RealFi. 👇 piped.video/vMfSyq5XP34?si=GIF5…