1791 lines
56 KiB
JSON
1791 lines
56 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://levcs.dev/schemas/instance-benchmark-result-v1.json",
|
|
"title": "LeVCS instance benchmark result",
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"schema_version",
|
|
"gate",
|
|
"run_id",
|
|
"attestation",
|
|
"source",
|
|
"artifacts",
|
|
"workload",
|
|
"hardware",
|
|
"deployment",
|
|
"run_conditions",
|
|
"measurement",
|
|
"counts",
|
|
"bytes",
|
|
"latency_micros",
|
|
"resources",
|
|
"durability",
|
|
"verification",
|
|
"verdicts",
|
|
"promotable",
|
|
"outcome",
|
|
"storage"
|
|
],
|
|
"properties": {
|
|
"schema_version": {
|
|
"const": 1
|
|
},
|
|
"gate": {
|
|
"enum": [
|
|
"storage_primitive",
|
|
"in_process_protocol",
|
|
"deployed_30k",
|
|
"deployed_60k",
|
|
"recovery",
|
|
"overload",
|
|
"compaction",
|
|
"federation",
|
|
"release"
|
|
]
|
|
},
|
|
"run_id": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"attestation": {
|
|
"$ref": "#/$defs/attestation"
|
|
},
|
|
"source": {
|
|
"$ref": "#/$defs/source"
|
|
},
|
|
"artifacts": {
|
|
"$ref": "#/$defs/artifacts"
|
|
},
|
|
"workload": {
|
|
"$ref": "#/$defs/workload"
|
|
},
|
|
"hardware": {
|
|
"$ref": "#/$defs/hardware"
|
|
},
|
|
"deployment": {
|
|
"$ref": "#/$defs/deployment"
|
|
},
|
|
"run_conditions": {
|
|
"$ref": "#/$defs/run_conditions"
|
|
},
|
|
"measurement": {
|
|
"$ref": "#/$defs/measurement"
|
|
},
|
|
"counts": {
|
|
"$ref": "#/$defs/counts"
|
|
},
|
|
"bytes": {
|
|
"$ref": "#/$defs/bytes"
|
|
},
|
|
"latency_micros": {
|
|
"$ref": "#/$defs/latency"
|
|
},
|
|
"resources": {
|
|
"$ref": "#/$defs/resources"
|
|
},
|
|
"durability": {
|
|
"$ref": "#/$defs/durability"
|
|
},
|
|
"verification": {
|
|
"$ref": "#/$defs/verification"
|
|
},
|
|
"verdicts": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"enum": [
|
|
"pass",
|
|
"fail",
|
|
"not-applicable"
|
|
]
|
|
},
|
|
"required": [
|
|
"storage_primitive",
|
|
"in_process_protocol",
|
|
"deployed_30k",
|
|
"deployed_60k",
|
|
"recovery",
|
|
"overload",
|
|
"compaction",
|
|
"federation",
|
|
"release"
|
|
]
|
|
},
|
|
"promotable": {
|
|
"type": "boolean",
|
|
"description": "Whether this result may be promoted to an instance throughput claim. False exactly for storage_primitive: plan section 3 states a storage primitive result can never be promoted."
|
|
},
|
|
"outcome": {
|
|
"enum": [
|
|
"pass",
|
|
"fail",
|
|
"preliminary"
|
|
],
|
|
"description": "Whether this run met its gate. Only \"pass\" asserts the section 3 window rule; \"fail\" and \"preliminary\" keep a run archivable instead of unrepresentable."
|
|
},
|
|
"storage": {
|
|
"$ref": "#/$defs/storage"
|
|
}
|
|
},
|
|
"$defs": {
|
|
"digest": {
|
|
"type": "string",
|
|
"pattern": "^[0-9a-f]{64}$"
|
|
},
|
|
"nonnegative": {
|
|
"type": "integer",
|
|
"minimum": 0
|
|
},
|
|
"positive": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"attestation": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"signer",
|
|
"key_epoch",
|
|
"content_digest",
|
|
"signature"
|
|
],
|
|
"properties": {
|
|
"signer": {
|
|
"type": "string",
|
|
"pattern": "^ed25519:[0-9a-f]{64}$"
|
|
},
|
|
"key_epoch": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"content_digest": {
|
|
"$ref": "#/$defs/digest"
|
|
},
|
|
"signature": {
|
|
"type": "string",
|
|
"pattern": "^[0-9a-f]{128}$"
|
|
}
|
|
}
|
|
},
|
|
"source": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"revision",
|
|
"dirty_tree_digest",
|
|
"cargo_lock_digest",
|
|
"rustc",
|
|
"rustflags"
|
|
],
|
|
"properties": {
|
|
"revision": {
|
|
"type": "string",
|
|
"minLength": 7
|
|
},
|
|
"dirty_tree_digest": {
|
|
"$ref": "#/$defs/digest"
|
|
},
|
|
"cargo_lock_digest": {
|
|
"$ref": "#/$defs/digest"
|
|
},
|
|
"rustc": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"rustflags": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"artifacts": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"binary_digest",
|
|
"config_digest",
|
|
"workload_digest",
|
|
"corpus_digest",
|
|
"raw_metrics_digest",
|
|
"telemetry_versions"
|
|
],
|
|
"properties": {
|
|
"binary_digest": {
|
|
"$ref": "#/$defs/digest"
|
|
},
|
|
"config_digest": {
|
|
"$ref": "#/$defs/digest"
|
|
},
|
|
"workload_digest": {
|
|
"$ref": "#/$defs/digest"
|
|
},
|
|
"corpus_digest": {
|
|
"$ref": "#/$defs/digest"
|
|
},
|
|
"raw_metrics_digest": {
|
|
"$ref": "#/$defs/digest"
|
|
},
|
|
"telemetry_versions": {
|
|
"type": "object",
|
|
"minProperties": 1,
|
|
"additionalProperties": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"workload": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"name",
|
|
"seed",
|
|
"topology",
|
|
"selection",
|
|
"client_batch_commits",
|
|
"writer_group_limit",
|
|
"persistent_clients",
|
|
"validation_flags",
|
|
"generator"
|
|
],
|
|
"properties": {
|
|
"name": {
|
|
"const": "canonical-small-commit"
|
|
},
|
|
"seed": {
|
|
"type": "integer"
|
|
},
|
|
"topology": {
|
|
"enum": [
|
|
"many-ref",
|
|
"many-repo",
|
|
"hot-ref"
|
|
]
|
|
},
|
|
"selection": {
|
|
"enum": [
|
|
"uniform",
|
|
"zipf-0.9"
|
|
]
|
|
},
|
|
"client_batch_commits": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 64
|
|
},
|
|
"writer_group_limit": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 512
|
|
},
|
|
"persistent_clients": {
|
|
"$ref": "#/$defs/positive"
|
|
},
|
|
"validation_flags": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"request_signature",
|
|
"replay",
|
|
"pack_hash_and_framing",
|
|
"outer_embedded_type_match",
|
|
"complete_graph",
|
|
"authority_and_role",
|
|
"instance_policy",
|
|
"repository_policy",
|
|
"typed_ref_cas",
|
|
"fast_forward",
|
|
"durability_fence_before_response"
|
|
],
|
|
"properties": {
|
|
"request_signature": {
|
|
"type": "boolean"
|
|
},
|
|
"replay": {
|
|
"type": "boolean"
|
|
},
|
|
"pack_hash_and_framing": {
|
|
"type": "boolean"
|
|
},
|
|
"outer_embedded_type_match": {
|
|
"type": "boolean"
|
|
},
|
|
"complete_graph": {
|
|
"type": "boolean"
|
|
},
|
|
"authority_and_role": {
|
|
"type": "boolean"
|
|
},
|
|
"instance_policy": {
|
|
"type": "boolean"
|
|
},
|
|
"repository_policy": {
|
|
"type": "boolean"
|
|
},
|
|
"typed_ref_cas": {
|
|
"type": "boolean"
|
|
},
|
|
"fast_forward": {
|
|
"type": "boolean"
|
|
},
|
|
"durability_fence_before_response": {
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"description": "Which checks the measured system actually performed. Pinned per gate by the conditional rules in allOf: all true for every instance gate, and per-flag for storage_primitive, whose measured system is the store alone (contract review 2026-07-24-B)."
|
|
},
|
|
"generator": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"description": "Must equal the frozen generator in bench/workloads/small-commit.toml."
|
|
}
|
|
}
|
|
},
|
|
"hardware": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"profile",
|
|
"cpu",
|
|
"numa",
|
|
"governor",
|
|
"microcode",
|
|
"ram_bytes",
|
|
"swap_events",
|
|
"filesystem",
|
|
"mount_options",
|
|
"nvme",
|
|
"firmware",
|
|
"write_cache",
|
|
"barriers",
|
|
"scheduler",
|
|
"temperature_celsius",
|
|
"nic",
|
|
"driver",
|
|
"link_mbps",
|
|
"mtu",
|
|
"kernel"
|
|
],
|
|
"properties": {
|
|
"profile": {
|
|
"enum": [
|
|
"minimum-30k",
|
|
"release-60k",
|
|
"diagnostic"
|
|
]
|
|
},
|
|
"cpu": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"numa": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"governor": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"microcode": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"ram_bytes": {
|
|
"$ref": "#/$defs/positive"
|
|
},
|
|
"swap_events": {
|
|
"const": 0
|
|
},
|
|
"filesystem": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"mount_options": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"nvme": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"firmware": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"write_cache": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"barriers": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"enum": [
|
|
"enabled"
|
|
]
|
|
},
|
|
"scheduler": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"temperature_celsius": {
|
|
"type": "number"
|
|
},
|
|
"nic": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"driver": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"link_mbps": {
|
|
"$ref": "#/$defs/positive"
|
|
},
|
|
"mtu": {
|
|
"$ref": "#/$defs/positive"
|
|
},
|
|
"kernel": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
}
|
|
},
|
|
"deployment": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"persistent_data_mount",
|
|
"tmpfs",
|
|
"overlay",
|
|
"remote_storage",
|
|
"durability_enabled",
|
|
"systemd",
|
|
"cgroup",
|
|
"proxy",
|
|
"tls",
|
|
"store_directory_attributes"
|
|
],
|
|
"properties": {
|
|
"persistent_data_mount": {
|
|
"type": "boolean",
|
|
"description": "Re-pinned to true by the \"reference_profile\" rule in allOf, and a passing run must declare that fidelity. Relaxed from an unconditional const so a diagnostic run on a non-persistent mount is representable-and-disqualified rather than unrepresentable (contract review 2026-07-28-C)."
|
|
},
|
|
"tmpfs": {
|
|
"type": "boolean",
|
|
"description": "Re-pinned to false by the \"reference_profile\" rule in allOf. A tmpfs run can never be a pass, because outcome \"pass\" requires reference_profile fidelity, which requires tmpfs false."
|
|
},
|
|
"overlay": {
|
|
"const": false
|
|
},
|
|
"remote_storage": {
|
|
"const": false
|
|
},
|
|
"durability_enabled": {
|
|
"const": true
|
|
},
|
|
"systemd": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"cgroup": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"proxy": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"tls": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"store_directory_attributes": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"description": "Effective attributes for the journal and segment directories, read back at startup and compared against the reference profile. Recording without verifying would let a silently copy-on-write-mounted run claim nodatacow."
|
|
}
|
|
}
|
|
},
|
|
"run_conditions": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"description": "The conditions the run was obtained under, as values a consumer can check. Contract review 2026-07-28-C: a bundle whose caveats live only in a human report reads as unconditional to everyone who receives it, and a free-text caveat field is not a condition anything can check. Every field is a closed enumeration or a boolean; there is no prose member and no catch-all value. The verification claims in $defs.verification are conditioned on these declarations, so a run that did not perform a check has no way to assert the claim that names it.",
|
|
"required": [
|
|
"initialization_path",
|
|
"mutation_path",
|
|
"checkpointing",
|
|
"index_maintenance",
|
|
"index_run_ceiling",
|
|
"receipt_reconciliation",
|
|
"objects_new_source",
|
|
"commit_id_uniqueness",
|
|
"build_profile",
|
|
"environment_fidelity"
|
|
],
|
|
"properties": {
|
|
"initialization_path": {
|
|
"enum": [
|
|
"store_engine_open",
|
|
"segment_initialize_root",
|
|
"shard_drive_create"
|
|
],
|
|
"description": "How the store root the run measured was created. Only \"store_engine_open\" is the production entry point, and a passing storage_primitive run must declare it. B1 landed startup state 1, so the submit path now builds its root that way and the earlier segment::initialize_root seeding is retired; \"segment_initialize_root\" is retained because a bundle emitted before that change must still be readable and must still be readable as what it was. The journal seam declares \"shard_drive_create\", which is its own creation path and not a weakening."
|
|
},
|
|
"mutation_path": {
|
|
"enum": [
|
|
"store_engine_submit",
|
|
"journal_drive"
|
|
],
|
|
"description": "The entry point the measured transactions actually went through. This is the branch discriminator for the storage_primitive verification rules in allOf: \"journal_drive\" is the Wave A journal seam below engine.rs, which has no sequencer, no receipts, and no index, and may not assert what it cannot observe."
|
|
},
|
|
"checkpointing": {
|
|
"enum": [
|
|
"exercised",
|
|
"enabled_not_reached",
|
|
"unimplemented",
|
|
"disabled_by_configuration"
|
|
],
|
|
"description": "Scope §7 requires that the P2 runs not have been achieved with checkpointing disabled. That clause lived only in prose until this review; it is now mechanical, because a passing storage_primitive run must declare \"exercised\". \"unimplemented\" is today's honest value: StoreEngine::checkpoint returns NotImplemented, so no checkpoint is taken."
|
|
},
|
|
"index_maintenance": {
|
|
"enum": [
|
|
"runs_sealed",
|
|
"deltas_retained_in_memory",
|
|
"no_index_in_path"
|
|
],
|
|
"description": "Whether the index reached a steady state. \"deltas_retained_in_memory\" is a run that holds every delta layer it published and whose lookup fan-out grows for its whole duration, which is not the steady state a P2 measurement is of; a passing storage_primitive run must declare \"runs_sealed\". \"no_index_in_path\" is the journal seam, where nothing below engine.rs touches an index at all."
|
|
},
|
|
"index_run_ceiling": {
|
|
"enum": [
|
|
"store_default",
|
|
"raised_above_store_default",
|
|
"raised_because_index_sealing_unimplemented"
|
|
],
|
|
"description": "Whether StoreOptions::max_index_runs was left at the store default (64) or raised above it. Cross-checked against resources.configured_ceilings.max_index_runs by the two \"index run ceiling\" rules in allOf: \"store_default\" bounds the recorded value at 64 and either raised value floors it at 65, so a bundle that declares one and records the other is invalid. The recorded value must be the value the run configured, never a constant restated here. DEPRECATED: \"raised_because_index_sealing_unimplemented\" is accepted only so archived v1 bundles stay valid; index-delta sealing is implemented and the emitter no longer produces it. It states a cause the emitter never verified — the declaration is derived by comparing the configured ceiling with the store default, so it named a reason for a fact it only observed. Emit \"raised_above_store_default\", which is that fact and nothing more. Contract review 2026-08-09-B."
|
|
},
|
|
"receipt_reconciliation": {
|
|
"enum": [
|
|
"exact_receipts_reconciled",
|
|
"canonical_receipt_digest_reconciled",
|
|
"acceptance_of_any_committed_status",
|
|
"no_receipts_in_path"
|
|
],
|
|
"description": "What the run reconciled each acknowledged operation against. verification.operation_receipts_reconciled is required exactly when this is one of the first two values and forbidden under the last two. Today's harness reads back TransactionStatus and accepts any Committed(_) payload, and the receipt_digest it journals is a digest of the operation id rather than of the receipt, so it must declare \"acceptance_of_any_committed_status\" and consequently may not assert the claim. \"no_receipts_in_path\" is the journal seam, which produces no receipts to reconcile."
|
|
},
|
|
"objects_new_source": {
|
|
"enum": [
|
|
"summed_from_receipts",
|
|
"derived_from_transaction_count"
|
|
],
|
|
"description": "Where counts.objects_new came from. verification.objects_new_equals_three_per_commit is forbidden under \"derived_from_transaction_count\": a harness that computes objects_new as transactions * 3 and then asserts the flag has written a tautology, not a check, and that is what the claim was originally excluded for. \"summed_from_receipts\" means each committed receipt's own objects_new was summed independently and compared against a separately counted 3 * counts.counted_commits."
|
|
},
|
|
"commit_id_uniqueness": {
|
|
"enum": [
|
|
"checked_globally_across_ack_records",
|
|
"inferred_from_seed_domains",
|
|
"not_checked"
|
|
],
|
|
"description": "How blob, tree, and commit identifier uniqueness was established. verification.unique_blob_tree_commit_ids is forbidden under the last two values. Per-record uniqueness is not uniqueness: two acknowledgment records may each be internally distinct and still share a commit id. Distinct generator seed domains make a collision unlikely rather than absent, which is an argument and not a check, so \"inferred_from_seed_domains\" is named here rather than folded into the passing value."
|
|
},
|
|
"build_profile": {
|
|
"enum": [
|
|
"debug",
|
|
"release",
|
|
"release_with_debug_assertions"
|
|
],
|
|
"description": "The cargo profile the measured binary was built with. \"reference_profile\" environment fidelity requires \"release\"; a debug run is recordable, and is thereby disqualified from a pass rather than silently comparable to a release number."
|
|
},
|
|
"environment_fidelity": {
|
|
"enum": [
|
|
"reference_profile",
|
|
"diagnostic"
|
|
],
|
|
"description": "Whether the run met the frozen environment. \"reference_profile\" re-pins deployment.persistent_data_mount true, deployment.tmpfs false, build_profile \"release\", and a named hardware profile. \"diagnostic\" admits a non-persistent mount or a debug build and is mechanically disqualified: outcome may only be \"fail\" or \"preliminary\" and no verdict may be \"pass\". outcome \"pass\" requires \"reference_profile\" at every gate, so nothing about this relaxes what a claim costs."
|
|
}
|
|
}
|
|
},
|
|
"measurement": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"warmup_seconds",
|
|
"measured_seconds",
|
|
"repetition",
|
|
"started_at",
|
|
"ended_at",
|
|
"one_minute_windows",
|
|
"histogram_format",
|
|
"coordinated_omission_corrected",
|
|
"windows_meeting_target_percent",
|
|
"windows_below_floor_count"
|
|
],
|
|
"properties": {
|
|
"warmup_seconds": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"measured_seconds": {
|
|
"$ref": "#/$defs/positive"
|
|
},
|
|
"repetition": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 3
|
|
},
|
|
"started_at": {
|
|
"type": "string",
|
|
"format": "date-time"
|
|
},
|
|
"ended_at": {
|
|
"type": "string",
|
|
"format": "date-time"
|
|
},
|
|
"one_minute_windows": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"items": {
|
|
"type": "number",
|
|
"minimum": 0
|
|
}
|
|
},
|
|
"histogram_format": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"coordinated_omission_corrected": {
|
|
"type": "boolean",
|
|
"description": "Latency corrected for coordinated omission. Applicable at every gate. A closed-loop driver that cannot correct for it must report false, not omit it: the measurement was applicable and was not performed."
|
|
},
|
|
"windows_meeting_target_percent": {
|
|
"type": "number",
|
|
"minimum": 0,
|
|
"maximum": 100,
|
|
"description": "Pinned to >=95 only when outcome is \"pass\"; a failed or preliminary run must be recordable."
|
|
},
|
|
"windows_below_floor_count": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"description": "Pinned to 0 only when outcome is \"pass\"."
|
|
}
|
|
}
|
|
},
|
|
"counts": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"offered_requests",
|
|
"accepted_requests",
|
|
"rejected_requests",
|
|
"duplicate_requests",
|
|
"acknowledged_requests",
|
|
"counted_commits",
|
|
"objects_new"
|
|
],
|
|
"properties": {
|
|
"offered_requests": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"accepted_requests": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"rejected_requests": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"duplicate_requests": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"acknowledged_requests": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"counted_commits": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"objects_new": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
}
|
|
}
|
|
},
|
|
"bytes": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"raw",
|
|
"pack_compressed",
|
|
"application",
|
|
"wire"
|
|
],
|
|
"properties": {
|
|
"raw": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"pack_compressed": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"application": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"wire": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
}
|
|
}
|
|
},
|
|
"latency": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"p50",
|
|
"p95",
|
|
"p99",
|
|
"max",
|
|
"histogram_digest"
|
|
],
|
|
"properties": {
|
|
"p50": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"p95": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"p99": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"max": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"histogram_digest": {
|
|
"$ref": "#/$defs/digest"
|
|
}
|
|
}
|
|
},
|
|
"resources": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"configured_ceilings",
|
|
"observed_peaks",
|
|
"time_series_digest",
|
|
"cpu_percent",
|
|
"storage_utilization_percent",
|
|
"memory_current_bytes",
|
|
"open_fds",
|
|
"compaction_debt_returned_low",
|
|
"no_growth_passed"
|
|
],
|
|
"properties": {
|
|
"configured_ceilings": {
|
|
"type": "object",
|
|
"minProperties": 1,
|
|
"required": [
|
|
"max_index_runs"
|
|
],
|
|
"properties": {
|
|
"max_index_runs": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"description": "The StoreOptions::max_index_runs the run actually configured, read back from the options the store opened with — never the store default restated here, and never omitted. Bounded against run_conditions.index_run_ceiling by the two \"index run ceiling\" rules in allOf, so a defaulted or contradicted value is invalid rather than merely unverified. It is a ceiling this workload genuinely reaches: the run seals against it, and its fan-out trigger is what imposes the steady state a P2 number has to be measured in."
|
|
}
|
|
},
|
|
"additionalProperties": {
|
|
"type": "number",
|
|
"minimum": 0
|
|
}
|
|
},
|
|
"observed_peaks": {
|
|
"type": "object",
|
|
"minProperties": 1,
|
|
"additionalProperties": {
|
|
"type": "number",
|
|
"minimum": 0
|
|
}
|
|
},
|
|
"time_series_digest": {
|
|
"$ref": "#/$defs/digest"
|
|
},
|
|
"cpu_percent": {
|
|
"type": "number",
|
|
"minimum": 0
|
|
},
|
|
"storage_utilization_percent": {
|
|
"type": "number",
|
|
"minimum": 0
|
|
},
|
|
"memory_current_bytes": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"open_fds": {
|
|
"$ref": "#/$defs/nonnegative"
|
|
},
|
|
"compaction_debt_returned_low": {
|
|
"type": "boolean"
|
|
},
|
|
"no_growth_passed": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
},
|
|
"durability": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"external_ack_journal_digest",
|
|
"ack_journal_fenced_before_count",
|
|
"recovery_reconciled",
|
|
"acknowledged_loss",
|
|
"torn_transactions"
|
|
],
|
|
"properties": {
|
|
"external_ack_journal_digest": {
|
|
"$ref": "#/$defs/digest"
|
|
},
|
|
"ack_journal_fenced_before_count": {
|
|
"const": true
|
|
},
|
|
"recovery_reconciled": {
|
|
"type": "boolean"
|
|
},
|
|
"acknowledged_loss": {
|
|
"const": 0
|
|
},
|
|
"torn_transactions": {
|
|
"const": 0
|
|
}
|
|
}
|
|
},
|
|
"verification": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"setup_traffic_excluded",
|
|
"commits_in_recovered_closure",
|
|
"acknowledged_sequences_reconciled"
|
|
],
|
|
"properties": {
|
|
"setup_traffic_excluded": {
|
|
"const": true
|
|
},
|
|
"unique_blob_tree_commit_ids": {
|
|
"const": true,
|
|
"description": "Every blob, tree, and commit identifier the run acknowledged is distinct, checked globally across every recovered acknowledgment record rather than within each record and never inferred from distinct generator seed domains. Earnable at storage_primitive only through StoreEngine::submit, where the transactions carry real objects; forbidden on the journal seam, which has none. Gated on run_conditions.commit_id_uniqueness (contract review 2026-07-28-C)."
|
|
},
|
|
"objects_new_equals_three_per_commit": {
|
|
"const": true,
|
|
"description": "Receipt-reported objects_new, summed independently across every committed receipt, equals a separately counted 3 * counts.counted_commits. Both sides must be counted; deriving either from the transaction total makes the assertion unfailable, which is what this claim was originally excluded for. Earnable at storage_primitive only through StoreEngine::submit, where the store stages the canonical three objects per commit and reports them on the receipt. Gated on run_conditions.objects_new_source (contract review 2026-07-28-C)."
|
|
},
|
|
"blobs_recomputed": {
|
|
"const": true,
|
|
"description": "Not applicable at storage_primitive, where no object graph exists; omitted there rather than falsified, since false would claim the check was applicable and failed."
|
|
},
|
|
"commits_in_recovered_closure": {
|
|
"type": "boolean",
|
|
"description": "Every counted commit proved present in the recovered closure of its acknowledged ref. Requires graph traversal, so false at storage_primitive, where acknowledged_sequences_reconciled is the storage-layer proof instead."
|
|
},
|
|
"operation_receipts_reconciled": {
|
|
"const": true,
|
|
"description": "Every acknowledged operation was read back and its receipt reconciled against the receipt the run recorded when it acknowledged, either exactly or through a frozen canonical receipt digest. Approved in principle for the StoreEngine::submit path and NOT EARNED by the emitter as it stands: store-bench accepts any TransactionStatus::Committed(_) payload without comparing it, and the receipt_digest it journals is a digest of the operation id rather than of the receipt, so it must declare run_conditions.receipt_reconciliation = \"acceptance_of_any_committed_status\" and is thereby forbidden from asserting this. Expressible now so that landing the reconciliation is an emitter change and not a second schema amendment (contract review 2026-07-28-C)."
|
|
},
|
|
"metadata_complete": {
|
|
"const": true,
|
|
"description": "Not applicable at storage_primitive, where no object graph exists; omitted there rather than falsified, since false would claim the check was applicable and failed."
|
|
},
|
|
"acknowledged_sequences_reconciled": {
|
|
"const": true,
|
|
"description": "Every externally acknowledged shard_sequence present in what production recovery adopted, reconciled against the external ACK journal. Required at every gate; at storage_primitive it is the proof that replaces commits_in_recovered_closure."
|
|
}
|
|
}
|
|
},
|
|
"storage": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"index_bytes_per_object",
|
|
"checkpoint_lookup_fanout",
|
|
"evidence_signing_micros_p50",
|
|
"fences",
|
|
"transactions"
|
|
],
|
|
"properties": {
|
|
"index_bytes_per_object": {
|
|
"type": "number",
|
|
"minimum": 0,
|
|
"description": "Section 13 stop condition: index cost per object."
|
|
},
|
|
"checkpoint_lookup_fanout": {
|
|
"type": "number",
|
|
"minimum": 0,
|
|
"description": "Section 13 stop condition: index runs searched per lookup."
|
|
},
|
|
"evidence_signing_micros_p50": {
|
|
"type": "number",
|
|
"minimum": 0,
|
|
"description": "Section 5.2 requires P2 to measure signing cost separately."
|
|
},
|
|
"fences": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"description": "Durability fences performed. With transactions, this is the mechanical form of 'no per-object fsync'."
|
|
},
|
|
"transactions": {
|
|
"type": "integer",
|
|
"minimum": 0
|
|
},
|
|
"trim_settle_seconds": {
|
|
"type": "number",
|
|
"minimum": 0,
|
|
"description": "Idle/trim interval between repetitions, so repetition 3 is not measured against a differently garbage-collected device than repetition 1 (scope 8.2)."
|
|
},
|
|
"store_directory_attributes_verified": {
|
|
"const": true
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"gate": {
|
|
"const": "storage_primitive"
|
|
},
|
|
"outcome": {
|
|
"const": "pass"
|
|
}
|
|
},
|
|
"required": [
|
|
"gate",
|
|
"outcome"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"latency_micros": {
|
|
"properties": {
|
|
"p99": {
|
|
"maximum": 50000
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"title": "a passing storage_primitive run must meet its latency ceiling"
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"gate": {
|
|
"const": "in_process_protocol"
|
|
},
|
|
"outcome": {
|
|
"const": "pass"
|
|
}
|
|
},
|
|
"required": [
|
|
"gate",
|
|
"outcome"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"latency_micros": {
|
|
"properties": {
|
|
"p50": {
|
|
"maximum": 20000
|
|
},
|
|
"p95": {
|
|
"maximum": 50000
|
|
},
|
|
"p99": {
|
|
"maximum": 100000
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"title": "a passing in_process_protocol run must meet its latency ceiling"
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"gate": {
|
|
"const": "deployed_30k"
|
|
},
|
|
"outcome": {
|
|
"const": "pass"
|
|
}
|
|
},
|
|
"required": [
|
|
"gate",
|
|
"outcome"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"latency_micros": {
|
|
"properties": {
|
|
"p50": {
|
|
"maximum": 20000
|
|
},
|
|
"p95": {
|
|
"maximum": 50000
|
|
},
|
|
"p99": {
|
|
"maximum": 100000
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"title": "a passing deployed_30k run must meet its latency ceiling"
|
|
},
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"gate": {
|
|
"const": "deployed_60k"
|
|
},
|
|
"outcome": {
|
|
"const": "pass"
|
|
}
|
|
},
|
|
"required": [
|
|
"gate",
|
|
"outcome"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"latency_micros": {
|
|
"properties": {
|
|
"p50": {
|
|
"maximum": 20000
|
|
},
|
|
"p95": {
|
|
"maximum": 50000
|
|
},
|
|
"p99": {
|
|
"maximum": 100000
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"title": "a passing deployed_60k run must meet its latency ceiling"
|
|
},
|
|
{
|
|
"title": "validation flags and promotability are pinned per gate",
|
|
"if": {
|
|
"properties": {
|
|
"gate": {
|
|
"const": "storage_primitive"
|
|
}
|
|
},
|
|
"required": [
|
|
"gate"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"promotable": {
|
|
"const": false
|
|
},
|
|
"workload": {
|
|
"properties": {
|
|
"validation_flags": {
|
|
"properties": {
|
|
"request_signature": {
|
|
"const": false
|
|
},
|
|
"replay": {
|
|
"const": false
|
|
},
|
|
"pack_hash_and_framing": {
|
|
"const": false
|
|
},
|
|
"outer_embedded_type_match": {
|
|
"const": false
|
|
},
|
|
"complete_graph": {
|
|
"const": false
|
|
},
|
|
"authority_and_role": {
|
|
"const": false
|
|
},
|
|
"instance_policy": {
|
|
"const": false
|
|
},
|
|
"repository_policy": {
|
|
"const": false
|
|
},
|
|
"typed_ref_cas": {
|
|
"const": true
|
|
},
|
|
"fast_forward": {
|
|
"const": false
|
|
},
|
|
"durability_fence_before_response": {
|
|
"const": true
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"verification": {
|
|
"not": {
|
|
"anyOf": [
|
|
{
|
|
"required": [
|
|
"blobs_recomputed"
|
|
]
|
|
},
|
|
{
|
|
"required": [
|
|
"metadata_complete"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"properties": {
|
|
"commits_in_recovered_closure": {
|
|
"const": false
|
|
}
|
|
},
|
|
"required": [
|
|
"commits_in_recovered_closure"
|
|
]
|
|
}
|
|
},
|
|
"description": "The claims forbidden at this gate on every path, whichever entry point was measured. blobs_recomputed and metadata_complete require an object graph the store is forbidden to traverse (plan §5.1), and commits_in_recovered_closure requires the ref closure that traversal would produce, so neither path can earn them and this is not branch-conditional. The three claims that became earnable through StoreEngine::submit are ruled on by the two mutation-path rules below."
|
|
},
|
|
"else": {
|
|
"properties": {
|
|
"promotable": {
|
|
"const": true
|
|
},
|
|
"run_conditions": {
|
|
"properties": {
|
|
"initialization_path": {
|
|
"const": "store_engine_open"
|
|
},
|
|
"mutation_path": {
|
|
"const": "store_engine_submit"
|
|
},
|
|
"checkpointing": {
|
|
"enum": [
|
|
"exercised",
|
|
"enabled_not_reached"
|
|
]
|
|
},
|
|
"index_maintenance": {
|
|
"const": "runs_sealed"
|
|
}
|
|
}
|
|
},
|
|
"workload": {
|
|
"properties": {
|
|
"validation_flags": {
|
|
"properties": {
|
|
"request_signature": {
|
|
"const": true
|
|
},
|
|
"replay": {
|
|
"const": true
|
|
},
|
|
"pack_hash_and_framing": {
|
|
"const": true
|
|
},
|
|
"outer_embedded_type_match": {
|
|
"const": true
|
|
},
|
|
"complete_graph": {
|
|
"const": true
|
|
},
|
|
"authority_and_role": {
|
|
"const": true
|
|
},
|
|
"instance_policy": {
|
|
"const": true
|
|
},
|
|
"repository_policy": {
|
|
"const": true
|
|
},
|
|
"typed_ref_cas": {
|
|
"const": true
|
|
},
|
|
"fast_forward": {
|
|
"const": true
|
|
},
|
|
"durability_fence_before_response": {
|
|
"const": true
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"verification": {
|
|
"properties": {
|
|
"unique_blob_tree_commit_ids": {
|
|
"const": true
|
|
},
|
|
"objects_new_equals_three_per_commit": {
|
|
"const": true
|
|
},
|
|
"blobs_recomputed": {
|
|
"const": true
|
|
},
|
|
"operation_receipts_reconciled": {
|
|
"const": true
|
|
},
|
|
"metadata_complete": {
|
|
"const": true
|
|
},
|
|
"commits_in_recovered_closure": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"unique_blob_tree_commit_ids",
|
|
"objects_new_equals_three_per_commit",
|
|
"blobs_recomputed",
|
|
"operation_receipts_reconciled",
|
|
"metadata_complete",
|
|
"commits_in_recovered_closure"
|
|
]
|
|
},
|
|
"measurement": {
|
|
"properties": {
|
|
"coordinated_omission_corrected": {
|
|
"const": true
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"title": "the journal-drive seam may not assert what it cannot observe",
|
|
"description": "Contract review 2026-07-28-C. The three claims that became earnable through StoreEngine::submit stay forbidden here, and the provenance declarations are pinned to the only values the seam can truthfully make. Forbidding the claims alone would not be enough: a drive-path bundle could otherwise declare exact receipt reconciliation or a global uniqueness check it has no receipts and no objects to perform, and the pins are what make that combination invalid rather than merely unverified.",
|
|
"if": {
|
|
"properties": {
|
|
"gate": {
|
|
"const": "storage_primitive"
|
|
},
|
|
"run_conditions": {
|
|
"properties": {
|
|
"mutation_path": {
|
|
"const": "journal_drive"
|
|
}
|
|
},
|
|
"required": [
|
|
"mutation_path"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"gate",
|
|
"run_conditions"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"verification": {
|
|
"not": {
|
|
"anyOf": [
|
|
{
|
|
"required": [
|
|
"unique_blob_tree_commit_ids"
|
|
]
|
|
},
|
|
{
|
|
"required": [
|
|
"objects_new_equals_three_per_commit"
|
|
]
|
|
},
|
|
{
|
|
"required": [
|
|
"operation_receipts_reconciled"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"run_conditions": {
|
|
"properties": {
|
|
"index_maintenance": {
|
|
"const": "no_index_in_path"
|
|
},
|
|
"receipt_reconciliation": {
|
|
"const": "no_receipts_in_path"
|
|
},
|
|
"objects_new_source": {
|
|
"const": "derived_from_transaction_count"
|
|
},
|
|
"commit_id_uniqueness": {
|
|
"const": "not_checked"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"title": "the production submit path at storage_primitive earns two claims and must state them",
|
|
"description": "Contract review 2026-07-28-C. StoreEngine::submit stages the canonical three objects per commit and reports them on its own receipt, and the transactions carry real blob, tree, and commit identifiers, so these two claims are no longer inapplicable — they are required, with the provenance that makes each a check rather than a restatement. operation_receipts_reconciled is deliberately absent from this list: it is approved in principle and not yet earned, and the receipt-reconciliation rule below is what decides it.",
|
|
"if": {
|
|
"properties": {
|
|
"gate": {
|
|
"const": "storage_primitive"
|
|
},
|
|
"run_conditions": {
|
|
"properties": {
|
|
"mutation_path": {
|
|
"const": "store_engine_submit"
|
|
}
|
|
},
|
|
"required": [
|
|
"mutation_path"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"gate",
|
|
"run_conditions"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"verification": {
|
|
"properties": {
|
|
"unique_blob_tree_commit_ids": {
|
|
"const": true
|
|
},
|
|
"objects_new_equals_three_per_commit": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"unique_blob_tree_commit_ids",
|
|
"objects_new_equals_three_per_commit"
|
|
]
|
|
},
|
|
"run_conditions": {
|
|
"properties": {
|
|
"initialization_path": {
|
|
"enum": [
|
|
"store_engine_open",
|
|
"segment_initialize_root"
|
|
]
|
|
},
|
|
"index_maintenance": {
|
|
"enum": [
|
|
"runs_sealed",
|
|
"deltas_retained_in_memory"
|
|
]
|
|
},
|
|
"receipt_reconciliation": {
|
|
"enum": [
|
|
"exact_receipts_reconciled",
|
|
"canonical_receipt_digest_reconciled",
|
|
"acceptance_of_any_committed_status"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"title": "objects_new_equals_three_per_commit requires an independently summed objects_new",
|
|
"description": "Applies at every gate, not only storage_primitive. A count derived from the transaction total makes the claim unfailable wherever it is asserted.",
|
|
"if": {
|
|
"properties": {
|
|
"run_conditions": {
|
|
"properties": {
|
|
"objects_new_source": {
|
|
"const": "derived_from_transaction_count"
|
|
}
|
|
},
|
|
"required": [
|
|
"objects_new_source"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"run_conditions"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"verification": {
|
|
"not": {
|
|
"required": [
|
|
"objects_new_equals_three_per_commit"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"title": "unique_blob_tree_commit_ids requires a global uniqueness check",
|
|
"description": "Applies at every gate. Per-record uniqueness and distinct seed domains are both weaker than the claim: the first cannot see a collision between two records, and the second is an argument about likelihood rather than an observation.",
|
|
"if": {
|
|
"properties": {
|
|
"run_conditions": {
|
|
"properties": {
|
|
"commit_id_uniqueness": {
|
|
"enum": [
|
|
"inferred_from_seed_domains",
|
|
"not_checked"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"commit_id_uniqueness"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"run_conditions"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"verification": {
|
|
"not": {
|
|
"required": [
|
|
"unique_blob_tree_commit_ids"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"title": "operation_receipts_reconciled is forbidden where no receipt was reconciled",
|
|
"description": "Contract review 2026-07-28-C, and the reason the claim can be landed before it is earned. Accepting any Committed status is not reconciling a receipt; it reports that something committed, which acknowledged_sequences_reconciled already says. The journal seam declares no_receipts_in_path and is covered by the same clause. Both values are named here and both earning values are named in the companion rule below, so neither rule has an else branch that would fire on a bundle with no declaration at all.",
|
|
"if": {
|
|
"properties": {
|
|
"run_conditions": {
|
|
"properties": {
|
|
"receipt_reconciliation": {
|
|
"enum": [
|
|
"acceptance_of_any_committed_status",
|
|
"no_receipts_in_path"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"receipt_reconciliation"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"run_conditions"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"verification": {
|
|
"not": {
|
|
"required": [
|
|
"operation_receipts_reconciled"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"title": "operation_receipts_reconciled is required where a receipt was reconciled",
|
|
"description": "A run that reconciled exact receipts, or a frozen canonical receipt digest, must assert the claim rather than leave it optional: the check was performed and its result is a required part of the record. On the journal-drive path this rule and the mutation-path rule combine to make an exact-receipt declaration unsatisfiable, which is the intended reading — a seam with no receipts cannot have reconciled any. Stated as its own rule rather than as the else of the rule above so that neither fires on a bundle carrying no declaration at all: absence of run_conditions is refused by the top-level required list, and one refusal reported once is worth more than the same defect reported under a claim the run never mentioned.",
|
|
"if": {
|
|
"properties": {
|
|
"run_conditions": {
|
|
"properties": {
|
|
"receipt_reconciliation": {
|
|
"enum": [
|
|
"exact_receipts_reconciled",
|
|
"canonical_receipt_digest_reconciled"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"receipt_reconciliation"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"run_conditions"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"verification": {
|
|
"properties": {
|
|
"operation_receipts_reconciled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"operation_receipts_reconciled"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"title": "index run ceiling: a declared store default bounds the recorded value",
|
|
"if": {
|
|
"properties": {
|
|
"run_conditions": {
|
|
"properties": {
|
|
"index_run_ceiling": {
|
|
"const": "store_default"
|
|
}
|
|
},
|
|
"required": [
|
|
"index_run_ceiling"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"run_conditions"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"resources": {
|
|
"properties": {
|
|
"configured_ceilings": {
|
|
"properties": {
|
|
"max_index_runs": {
|
|
"maximum": 64
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"title": "index run ceiling: a declared raise must record a raised value",
|
|
"if": {
|
|
"properties": {
|
|
"run_conditions": {
|
|
"properties": {
|
|
"index_run_ceiling": {
|
|
"enum": [
|
|
"raised_above_store_default",
|
|
"raised_because_index_sealing_unimplemented"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"index_run_ceiling"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"run_conditions"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"resources": {
|
|
"properties": {
|
|
"configured_ceilings": {
|
|
"properties": {
|
|
"max_index_runs": {
|
|
"minimum": 65
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"title": "reference-profile fidelity re-pins the environment the deployment schema used to pin outright",
|
|
"description": "Contract review 2026-07-28-C. deployment.persistent_data_mount and deployment.tmpfs were unconditional consts, which made a diagnostic tmpfs run unrepresentable rather than disqualified. They are re-pinned here, and outcome \"pass\" requires this fidelity at every gate, so nothing a claim used to cost has changed.",
|
|
"if": {
|
|
"properties": {
|
|
"run_conditions": {
|
|
"properties": {
|
|
"environment_fidelity": {
|
|
"const": "reference_profile"
|
|
}
|
|
},
|
|
"required": [
|
|
"environment_fidelity"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"run_conditions"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"deployment": {
|
|
"properties": {
|
|
"persistent_data_mount": {
|
|
"const": true
|
|
},
|
|
"tmpfs": {
|
|
"const": false
|
|
}
|
|
}
|
|
},
|
|
"run_conditions": {
|
|
"properties": {
|
|
"build_profile": {
|
|
"const": "release"
|
|
}
|
|
}
|
|
},
|
|
"hardware": {
|
|
"properties": {
|
|
"profile": {
|
|
"enum": [
|
|
"minimum-30k",
|
|
"release-60k"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"title": "a diagnostic run is representable and mechanically disqualified",
|
|
"description": "Contract review 2026-07-28-C. The alternative was what stood before it: a debug, tmpfs diagnostic run could not be encoded at all, so its number lived on a console and in prose. Recording it is worth nothing unless the record also refuses to let it be read as a result, so the outcome is bounded and no verdict may be pass.",
|
|
"if": {
|
|
"properties": {
|
|
"run_conditions": {
|
|
"properties": {
|
|
"environment_fidelity": {
|
|
"const": "diagnostic"
|
|
}
|
|
},
|
|
"required": [
|
|
"environment_fidelity"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"run_conditions"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"outcome": {
|
|
"enum": [
|
|
"fail",
|
|
"preliminary"
|
|
]
|
|
},
|
|
"verdicts": {
|
|
"additionalProperties": {
|
|
"enum": [
|
|
"fail",
|
|
"not-applicable"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"title": "a passing run at any gate must have met the reference environment",
|
|
"if": {
|
|
"properties": {
|
|
"outcome": {
|
|
"const": "pass"
|
|
}
|
|
},
|
|
"required": [
|
|
"outcome"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"run_conditions": {
|
|
"properties": {
|
|
"environment_fidelity": {
|
|
"const": "reference_profile"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"title": "a passing storage_primitive run must have measured the production path in a steady state",
|
|
"description": "Scope §7 requires the P2 runs not to have been achieved with checkpointing disabled, and a run holding every index delta in memory for its whole duration is not the steady state a P2 number describes. Both were prose until contract review 2026-07-28-C; here they are conditions a consumer checks. A root seeded outside StoreEngine::open is disclosed rather than forbidden — but it cannot ride into a pass.",
|
|
"if": {
|
|
"properties": {
|
|
"gate": {
|
|
"const": "storage_primitive"
|
|
},
|
|
"outcome": {
|
|
"const": "pass"
|
|
}
|
|
},
|
|
"required": [
|
|
"gate",
|
|
"outcome"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"run_conditions": {
|
|
"properties": {
|
|
"initialization_path": {
|
|
"const": "store_engine_open"
|
|
},
|
|
"mutation_path": {
|
|
"const": "store_engine_submit"
|
|
},
|
|
"checkpointing": {
|
|
"const": "exercised"
|
|
},
|
|
"index_maintenance": {
|
|
"const": "runs_sealed"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"title": "a passing run must meet the section 3 one-minute-window rule",
|
|
"if": {
|
|
"properties": {
|
|
"outcome": {
|
|
"const": "pass"
|
|
}
|
|
},
|
|
"required": [
|
|
"outcome"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"measurement": {
|
|
"properties": {
|
|
"windows_meeting_target_percent": {
|
|
"minimum": 95
|
|
},
|
|
"windows_below_floor_count": {
|
|
"const": 0
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|