Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions

wai-quantum: a landscape member declares its capacity, and is held to everything within it #678

Closed
dcharlot wants to merge 20 commits from wai/quantum-landscape-capacity into main
pull from: wai/quantum-landscape-capacity
merge into: Transaction-Science:main
Conversation 0 Commits 20 Files changed 26 +7984 -295
dcharlot commented 2026-11-07 04:05:56 -05:00
Owner
Copy link

Re-landed on main as one commit, c0ba8a0ce (2026-11-09), under the land-it model. Round 6's 13 findings are fixed at 72829ec4c, each with a fail-first test (the medium: the probe is now the rewrite itself). Squashed onto main after #676 (ce1c91131). Passed on the Framework on the combined tree: the wai-quantum library's 1,469 tests, 54 landscape conformance tests, the engine-only build, and the service's 118 tests under ulimit -Sn 256. The breaking gate's red at 72829ec4c came from main (libdav1d missing from its image); the next commit on main fixes it, and the gate then reports no unacknowledged breaking change for this work. Closed.

A declared-capacity rule for members of wai.quantum.landscape/1: a spec change to §5, §5.1, §5.3 and §7, with member::certify, the GPU members and the FPGA reference design brought to it.

Why

Real hardware has finite capacity. The FPGA reference design (#677) has 64 cells, 20-bit sampling registers and a table window of 8,192 fields a temperature. Under the conformance set on main it refuses 13 cases past those, and since §5 let a member decline only fields above 2³¹ − 1, each refusal counted as a missed vector: the host certified it uncertified, although every case it can hold gives the reference's bits (21/21 settle, 227/227 chains).

The rule

  • A member declares its capacity (Member::capacity, a capacity::Capacity), once, as fixed numbers:
    • cells and couplings;
    • on each side of temperature 0, its largest |b_i|, field bound and cost;
    • above 0, the cut points a sweep it holds (table_entries), or the span of uncertain fields at a temperature (uncertain_span), its table's window;
    • the sweeps of a run (sweeps: a settle's bound, a schedule's length);
    • the chains it takes a call (chains_per_call). This is a batch size, not a limit: the host splits a job into calls of that many, and certification splits every vector the same way, so no job goes elsewhere for it.
      Member::capacity takes the place of Member::takes.
  • The host declines mechanically. Capacity::admits is a pure function of the workload, its schedule and the declared numbers, and says which number a job is past. The host declines for a member exactly the jobs past its capacity, and runs it on none of them, however it was reached. A member declines nothing by choice, so the GPU review's protection against selective declining holds: a member that refuses or fails a case within its capacity has failed it.
  • Graded within it, and at its edges. certify reads the capacity once. It runs every settle and chains vector and every battery workload within that capacity, each case's chains in calls of the size the host would use at run time. For each number declared below what a job can reach, it also runs vectors generated at exactly that number (Capacity::edges), with the reference as their oracle. The grade holds within that capacity, and the answer says so:
    • member.capacity in every answer from a member that declares one. It is absent for the reference, whose answers keep their exact bytes, so CORPUS_20 and every pinned digest stand;
    • a sentence in the label;
    • the number a job is past, in its refusal.
  • A floor. A capacity under the floor is not certified at all (certify refuses it, naming each number under). The floor is the least capacity that takes every case of the core set: the cases the set held before it grew to reach large jobs (the settle vectors but the one with fields of 2⁴⁰, the first fifteen chains vectors and the first eight battery workloads), plus a long schedule across windows. A member must hold those, or the grade vouches for nothing. It is worked out from those cases (capacity::floor), and the test pins its numbers as §5 states them:
number floor the core case that needs it
cells 32 the recall vector of 32 cells
couplings 992 the same, every pair coupled
fields, at 0 and above ±40 the wide-fields chains, cooling and quenched
field bound, at 0 and above 41 the same
cost, at 0 and above 8 the same
table entries a sweep 31 the dense chains, 16 cells with every pair coupled, at their hottest
uncertain span 61 the wide-fields chains at their hottest
sweeps a run 5,000 the long schedule: 32 cells, each coupled to 15 others, held hot

The floor declares no batch: any number of chains a call is certified by splitting.

  • Monotone span. A field's draw that is uncertain at a temperature is uncertain at every hotter one, so a schedule's uncertain span is its hottest sweep's. admits checks that sweep alone, and a test holds the property.

The adversarial check at 75edfe063, and what changed

The check confirmed three high findings, one medium and one low. They share a root cause: declaring a number removed fixed vectors from certification, and the set samples each number at only a few points.

Finding Fix
1 (high). A draw counter that restarts at each device window was certified bit-exact at the floor itself. Schedule length was not a capacity number, and no vector under 64 cells ran more than 41 sweeps. The core set now holds a-long-schedule-across-windows: 5,000 sweeps on 32 cells within the floor on every number. It crosses windows by table (about 530 sweeps) and by work (about 1,930), so no capacity a member may declare leaves it out. sweeps is now a capacity number, with an edge vector at it. The full set adds 200,000 sweeps of two cells, across a window by work on the smallest workload.
2 (high). chains_per_call removed chain vectors and turned away no job. Certification splits every chain vector and battery workload into calls of the batch the host uses at run time (Capacity::batch, now shared with run.rs), and skips nothing. A declared batch also gets one call of exactly that many chains. words() states the batch as a split, not as "go elsewhere". The floor no longer has a batch.
3 (high). A limit set between the vectors' points left faults below it untested. Capacity::edges builds vectors at each declared number, each also within every other declared number: a settle wave down that many cells and a hot chain on them; that many couplings; on each side of temperature 0, a field bound reached through couplings and by a field alone, the largest field and the largest cost, drawn hot (uncertain) and cold at 1/64 (certain, so a field reached exactly is drawn exactly); a table of that many entries; two fields spanning the uncertain span; a schedule of that many sweeps. The battery gets the same above 0. A member that declares nothing runs the fixed set only, and the reference's answer bytes are unchanged.
4 (medium). certify read capacity() again for each check. It reads the capacity once and passes the stored copy to settle_vectors_hold_within, chain_vectors_hold_within and run_battery_within.
5 (low). Grade text without the capacity. The FPGA earn() and the agree line now say "within its declared capacity", and earn() gives the capacity in words. docs/landscape.md now states what CUDA, Metal and WebGPU declare.

Hostile capacities. Every fault test now also runs with a declared capacity. every_fault_loses_the_grade_of_the_kernel_it_is_in runs each fault twice. The first run declares none. The second declares the most hostile capacity the fault may: the least capacity, at or above the floor, that still takes a job the fault gets wrong (Capacity::least(job).join(floor())). In the second run, a positive control first shows the fault getting that job wrong within that capacity. The faults covered are the field widths, cells, settle ends, draws, cell order, chains, the device window, and both window faults at every window a vector crosses. This loop caught one gap in the first draft of the edges. A 32-bit field fault declared without its couplings slipped past a hot star of 8 chains. The cold, exactly reached star closed the gap.

The probes, kept as tests, and what each faulty member now earns, as (settle, sample), from the run on Thor:

Probe At 75edfe063 Now
p02, OnlyTheFirstChains(64) with chains_per_call 100 bit-exact, bit-exact bit-exact, uncertified. Its replay of 100 seeds is labelled uncertified.
p03, OnlyTheFirstCells(256) with cells 299 bit-exact settle uncertified, bit-exact. The host's check refuses the 280-cell job.
p03, OnlyTheFirstCells(300) with couplings 992 bit-exact settle uncertified, bit-exact
p03, SettleEndsLate(256) with cells 299 bit-exact settle uncertified, bit-exact. Its 290-cell answer is labelled uncertified.
p04 and p10, Fields16 with a field bound of 39,999 on both sides bit-exact, bit-exact uncertified, uncertified
p05, device-window restart with cells 63, and with cells 64 bit-exact, bit-exact bit-exact, statistical
p06, a member whose capacity changes after its first read bit-exact, bit-exact uncertified, statistical. The capacity is read once.
p10, the settle faults on jobs that end at their bound bit-exact settle uncertified
p12, device-window restart at the floor bit-exact, bit-exact bit-exact, statistical. Its replay is labelled statistical.
Skeptic, Windowed at the floor and five other capacities bit-exact, bit-exact bit-exact, statistical in every case. At run time 9 of 20 answers differ from the reference, and every one is labelled statistical.
FPGA, 3,000 random jobs (the_capacity_and_the_engine_agree_on_random_jobs) 0 disagreements 0 disagreements. 250 model runs are bit-identical to the reference, and none is refused within capacity.

The second adversarial check at 28fa25d9, and what changed

The check confirmed 19 findings and refuted 2. Each finding was another fault class that a finite set misses, so this round changes how vectors are chosen rather than adding more of them, and adds a check at run time.

(A) Vectors chosen by rule, for every capacity (Capacity::generate, spec §7.1). The CPU reference's empty capacity counts here too. Each vector is generated from the capacity, the reference is the oracle, and only vectors the capacity admits are run:

  • Cells: every power of two, one less and one more, up to the most cells the capacity allows (4,096 with none), plus that number and one less. Every cell has a field, so every one moves in its first sweep. Each workload is settled and held hot.
  • Calls: one call of each number of chains from 1 to 32, of 33, 48, 63, 64, 65, 96, 127 and 128, and of a whole batch and one less.
  • A row: one cell coupled to as many others as the capacity allows (4,095 with none). Its whole row gives it −1, and any shorter part gives it 0 or more.
  • Lanes: on each side of 0, one workload holds a cell at each of 2^(L−1) − 1, 2^(L−1), 3·2^(L−2) and 2^L for 16-, 24- and 32-bit lanes, both signs, and a cell reaching each through two couplings. A second holds the same beside the largest cost. Each is run at 0, above 0, and hot then cold then at 0.
  • A corner: every number at its most at once, on each side of 0.
  • Draw indices: a run past 2²⁴ wherever sweeps × cells reaches it. A run past 2³¹ would be at least 2³¹ updates in one chain, which takes minutes on a device that runs a chain a thread. A narrower index past 24 bits is left to the audit, which catches it on the first job past its width.
  • Declared edges: the edges now reach a declared table and span exactly, through couplings. The field bound at 0 also gets field-alone vectors.
  • Battery: workloads at a declared cell count, couplings and schedule length. They read a few blocks of many (BatteryCase::read), so a correct sampler is not failed by chance.
  • Cost: stated in §7.1 and held by generated_vectors_cost_what_the_spec_says. There are 132 generated vectors with no capacity, 151 at the floor, 112 at the FPGA's capacity and 145 at the largest capacity below every reach. Any capacity costs at most 300 million cell sweeps hot or settled, nearly all of them battery workloads, which run only for a kernel that is not bit-exact. It costs at most 20 million cell sweeps at 0, the 2²⁴ run at a fixed point, which the reference now skips; its bits are unchanged.
  • On real GPUs: a first version, about 680 vectors including a 2³¹ run, took over ten minutes to certify one WebGPU member on the Framework's Radeon. With the set as above, the Framework's whole devices leg passes in 164 s.

(B) The audit (spec §7.3). Every answer from a kernel graded bit-exact is checked against the reference:

  • Sampling: the last chain of every call, and one chain of each run chosen by the job's digest, are run again on the reference.
  • Settling: the whole settle is run again when its work is at most 2²⁴; past that, one job in 8, chosen by the digest.
  • On a mismatch: at the first difference, or the first answer the checks refuse, the member is demoted to uncertified for both kernels. The job is answered from the reference, with the member named under refusals. Every later answer carries member.demoted and a label sentence, and placement never picks the member again.
  • Cost and detection: both are stated in §7.3. A fault on a fraction q of chains is caught with probability at least q per job. A fault on a call's last chain, or within the settle budget, is caught on the first job that shows it. Past the budget, a settle fault is caught within N jobs with probability 1 − (7/8)^N.
Finding Now
1 and 14: cells past couplings/2 + 1, and past 1,000 with no capacity the cell ladder reaches the most cells the capacity allows (4,096 with none), every cell with a field. OnlyTheFirstCells(497/600/1001/1024/4095) and SampleOnlyTheFirstCells(600/1025) lose bit-exact under every capacity the review used.
2: no hot-then-0 schedule on large fields every lane, corner, ladder and edge workload also runs hot, then cold, then at 0. MixedFinal16 loses bit-exact with no capacity, the FPGA's and the WebGPU numbers.
3, 8, 9: workgroup remainders, rows over 32, warp remainders the cell ladder (n mod 64 includes 63, 1, 33), the row, and calls of 1 to 128. TileRemainder (both kernels, at cells 64/128/256/288, the FPGA's and none), RowCap(32) and RowCap(15), and WarpRemainder (batches 64, 48, 4096 and none) all lose bit-exact.
4: table and span edges short of the number both are now reached exactly through hubs on shared cells where the other numbers allow, and test-pinned (200 entries at cells 32, 200 at field 40, a span of 1,000 at field 40).
5, 6, 7: 16-bit fields at a field bound of 66,000 to 69,999, a field without a field bound, a field beside a cost the lane wrap points, alone, coupled and beside the largest cost, plus the implied field bound (field + cells − 1) when only a field is declared. Fields16 and FieldCostWrap lose the grade under every capacity in the findings.
10: draw indices past 2²⁴ and a signed 32-bit index the 2²⁴ draw-index run. Counter24 loses bit-exact with no capacity, at the FPGA's, at cells 64 with 300,000 sweeps, and at 999,999 sweeps. The audit demotes it on its first wrong job. A signed 32-bit index is left to the audit, as above. It is not run in tests, because the reference's own run past 2³¹ takes minutes.
11 and 18: no battery workloads for cells, couplings or sweeps battery workloads at each. Stuck(32), a sampler with its own draws that declares cells 40, drops from Statistical to Uncertified. The positive control stays Statistical. The text now says which numbers have battery workloads, and that a table has none.
12: the WAI breaking gate **Breaking:** lines for the three API breaks, and for the two this round adds (BatteryCase::read, and Certified no longer Freeze). The gate exits 0, as run on Thor.
13: the FPGA workflow greps updated to the renamed lines. The model leg passes as the workflow runs it.
15, 16, 17, 19: text a decline reads "The host declined this job for …". The label says the host runs the member on no job past its capacity, and a member run by name claims no grade. §5's field-bound sentence now matches the code, which builds field-alone vectors at 0. The README says "two fields spanning 8,192".

Every fault test now also runs under realistic capacities, not only the least one:

  • the most hostile capacity, rounded up as hardware rounds;
  • the same with no cell count;
  • the FPGA's, the WebGPU numbers, and CUDA and Metal's.

The review showed that the least capacity is not the most hostile for a fault that is not monotone. Each run has a positive control first.

The third adversarial check at df2f96781, and what changed

The check confirmed 20 findings and refuted 1. It found the audit resting on things the member reports or can predict, and gaps in generation at small and declared capacities.

The audit rests only on what the host computes and remembers (spec §7.3):

  • Per run (1, 8): one chain of every seed's run is checked, plus the last chain of every call, in run, replay, sweep and compare. A member that is wrong on the first chain of every call is demoted on its first 100-seed replay.
  • Settle (2, 7): the decision comes from the work the host asked for, never the sweeps the member reports. The reference's settle is run as far as a 2²⁴ budget allows. Where it comes to rest within that budget, or the whole bound fits it, the whole answer is compared. Past the budget, the whole settle is run in one job in 8; in the other jobs, a member that stops before the reference is wrong. A member that says every long settle ran to its bound is certified bit-exact, as before, and is now demoted on its first such job.
  • Keyed draw (16, 17): a host key made at start from OS randomness, plus a counter, so a member cannot predict the checked chains and repeats of a job are drawn afresh. Each audited answer carries audit: {checked: [{seed, chains | settle}]} (round 3 also carried a key digest, which round 4 drops); the reference's answers are unchanged.
  • Durable demotion (9, 11): kept by identity (Member::fingerprint and the member id) in member::Demotions, in a file where the host names one. The FPGA host does: ~/.local/state/wai-quantum-landscape-fpga/demotions.json, or WAI_LANDSCAPE_DEMOTIONS. Certifying again or declaring another capacity does not clear it; another identity is certified afresh. A test covers a restart, with the store read back from its file.
  • Statistical kernels (6, 10, 13): placed only where the job asks ("parity": "statistical"), because no audit can hold their draws to bits. Otherwise they are passed over, with the reason given. (This said the battery reached 4,096 cells with no capacity declared; it reaches 1,023, as §7.1 says. Round 4 makes a declared count of 4,096 or more give 4,096.)

Generation:

  • (3, 4) Lane vectors are packed into workloads the capacity takes, so a 32-cell capacity still gets each wrap point. Ladder sizes in a remainder band (more than half of a partial warp or workgroup) are also quenched at 0.
  • (5) A wave settles down as many cells as a workload holds, for every capacity. Under none, CUDA/Metal's and WebGPU's numbers, that is a settle of 4,097 sweeps.
  • (12) The battery at a declared cell count holds exactly C cells. It reads blocks of three at the ladder sizes and at the last cell; read now holds cell offsets.
  • (14, 19) The corner moves cells at 0, with the largest field beside the largest cost under it. A hub reaches the field bound exactly through as many couplings as a cell can have, including at the floor's and the FPGA's capacities (above 0, the FPGA hub reaches 524,350).
  • (15, 18) The cost bounds are now constants (MOST_GENERATED 300, MOST_GENERATED_WORK 4×10⁸, MOST_GENERATED_COLD 2×10⁷). A test holds them over the named capacities and 24 random ones. The text states those bounds.
  • (20) The CUDA out-of-table mark can be overwritten by a later sweep, so the claim that it marks the answer is gone. The bounds check still prevents the illegal address.
  • API: Prepared::statistical is a new field. Its struct has private fields, so the API gate does not count it as a break.

The fourth adversarial check at f290012f4, and what changed

The check confirmed 22 findings, all medium or low, and refuted none. Each probe is kept as a test (review4_* in landscape_conformance, and long_settles_bands_cells_and_spans_are_generated in capacity::tests).

Generation (spec §7.1):

  • (1, 6) A sweep at 0 straight after hot ones. Ladder sizes in a remainder band are now also held at 1.5 for 2 sweeps and then at 0 for one. That is the engine's final sweep, a separate path on the FPGA. A fault that leaves the end of a partial last workgroup of 64 (Final64) or warp of 32 (Final32) unmoved in that sweep loses its grade under no capacity, the FPGA's, the WebGPU numbers, 32-bit lanes alone, CUDA's and Metal's, cells 64 over the floor and cells 100, and Final32 under the floor as well.
  • (2, 5) The wave under a declared sweep limit. The wave now comes to rest within the limit instead of being dropped. Its bound is the smaller of 2n + 2 and the limit, and where the limit is under n + 1 the wave has fewer cells. edge/couplings is capped the same way.
  • (6) Long settles that end at their bound. The widest wave is also stopped at its bound while it still moves: past 2⁹, 2¹⁰ and 2¹¹ sweeps, and one sweep before it would rest (4,095 sweeps with no capacity). A result slot read at a 9-bit count (Ring9), a state one sweep back past 130 or 4,000 sweeps (Stale), and a settle that stops moving and claims its bound (Truncate) all lose the settle grade. So do the length faults under sweeps 1,000, 5,000, 7,000 and 8,193, cells 4,095 with sweeps 5,000, couplings 8,000 with sweeps 5,000, and the floor with no cell count.
  • (12, 18) The battery's alike cells follow a declared count, to 4,096: cells 4,096 and the WebGPU numbers get 4,096, and a sampler stuck from cell 1,023, 1,024 or 2,048 is uncertified. With none declared it stays 1,023, which is what §7.1 says. The change entry's "4,096 with none" is corrected.
  • (13) The uncertain span is reached where a table or thin couplings are the narrower. Where a declared table refuses the declared span, the edge takes the widest span under it that the table takes. Where no span is declared, a span/widest vector puts two hubs on shared cells as far apart as the other numbers allow. SpanUpTo loses its grade under all three of the review's capacities. Those capacities and their spans: table 401 under span 412 (401), thin couplings (417), and table 401 alone (401).
  • (14) Generated battery workloads do not fail a correct sampler with draws of its own. Each block of a workload a capacity adds is held at the chi-square value its df passes with chance 10⁻⁸ (conformance::GENERATED_FALSE, chi_square_tail, chi_square_critical). The alike-cells twin reads few blocks: the first, the last, and three across each power of two from 32. The single-field laws are three alike cells (df 26, not 2). The reviewer's own draw stream (seed ^ 0x5DEE_CE66_D1CE_4E5B) is now statistical under the WebGPU numbers, as are two other capacities with their twins. The fixed battery is unchanged.

Audit (spec §7.3):

  • (3) The draw in every call. Each call to the member has its last chain checked and, for each seed's run it holds chains of, one of those chains drawn afresh. A member that times the pause after a call learns nothing about the next call. A member that cheats on every chain but the last after the first call of each job (the perfect timing attack) is demoted on its first job in 10 of 10 trials. Over repeats, every call's draw falls before its last chain.

  • (9) Wall time. A call's checked chains run again across the host's cores, up to 16, between that call and the next. §7.3 now gives the wall-time cost, measured with the devices test's timings, audited against the same member run by name:

    Job Metal (M3 Ultra) CUDA (RTX 4050) WebGPU (Radeon 8060S)
    replay, 256 seeds × 8 chains, 64 cells, 500 sweeps +41%, +39% +122%, +254% +44%, +53%
    replay, 256 seeds × 1 chain +32%, +21% +178%, +251% +10%, +23%
    run, 4,096 chains, 64 cells +3%, −3% +3%, +36% (6 ms) +0%, −22%
    run, 1,024 chains, 1,024 cells +1%, +0% +1%, +2% −6%, +4%

    Each cell gives two runs, one at 032ba8a24 and one at a4f5b2dd6; the code they time did not change between them. The hosts are shared; jetson-hub's load was 14 to 21 on 20 cores. For the two replays, the review measured +245% and +366% on Metal and +365% and +521% on CUDA, when the re-runs were serial. Audited, every job above still takes at most two thirds of the reference's time alone.

  • (10, 16) §7.3 says exactly what the settle audit catches past the 2²⁴ prefix. A settle that ends at or before the last sweep the budget reaches, while the reference's goes on, is caught on its first job. Ending later than that, but sooner than the reference, is caught 1 job in 8.

  • (11) The key digest is dropped from audit, because nothing could open it. §7.3 says plainly that the draws are the host's, and that a reader who needs proof runs the job on the reference.

  • (19) The stale "chosen by the job's digest" wording is gone from the change entry and from AUDIT_SETTLE_ONE_IN.

Demotions (4, 7, 8, 21):

  • Demotions reads its file afresh at every certification, under a shared flock on <file>.lock.

  • A demotion is a read-merge-write under an exclusive lock, written to a temp file named for the process and the write, then synced and renamed into place. Four writers at once keep 120 of 120 demotions, and a store opened before another one demoted a member does not certify it again.

  • The store fails closed. If the file does not parse (truncated, empty, a BOM, not UTF-8, junk after it), cannot be read, or sits under a folder that cannot be written or under a regular file, the host:

    • logs the reason once on stderr;
    • holds the member at uncertified for both kernels, with the reason in member.demoted;
    • never rewrites the file.

    A record whose reason is not a string still demotes. A demotion that could not be written is kept for the process, and its reason says so.

  • The FPGA host certifies after it holds the board lock, so it reads the file after any job ahead of it. With HOME unset and no WAI_LANDSCAPE_DEMOTIONS, it uses Demotions::broken and grades nothing bit-exact.

  • get and record now return what failed. keep_demotions_in(path) becomes keep_demotions(store). All of this is new in this PR, so the API gate has nothing to count.

Text and API:

  • (15) "parity": null is the default.
  • (17) The jetson-hub devices leg. This PR now carries #673's commit, which uses one process-wide WebGPU instance. The NVIDIA driver no longer stops listing its Vulkan adapter after the 12th discovery, and two of #673's device tests come with it (9 in all).
  • (20) §7.1 gave the battery as "nearly all" of the work bound. It now gives the measured share. With no capacity, generation is about 1.0×10⁸ cell sweeps, 20% of it battery. The largest case is about 3.3×10⁸ (a capacity that declares every number), 58% of it battery. The property test prints each case's share.
  • (22) §2's request table gains parity, and states that a null optional field counts as absent. §3's tables gain audit and member.demoted.

The fifth adversarial check at 054017bc8, and what changed

The check confirmed 15 findings (1 medium, 14 low) and refuted 4. Each probe is kept as a test (review5_* in landscape_conformance; the starvation probe is #[ignore]d, since it prints times).

Demotion store (spec §7.3):

  • (1, medium) Each certification proves the folder takes a rewrite. (Round 6 makes the probe the rewrite itself, renamed over the file, and sizes it from the largest rewrite; see below.) Under the shared lock, the store writes, syncs and removes a file as large as the store's next rewrite. So a folder that stops taking writes after first use (its lock already there) grades nothing bit-exact. So does a file-size limit (trap '' XFSZ; ulimit -f 0, as a full disk or quota would), tested in a child process.
  • (7) An empty WAI_LANDSCAPE_DEMOTIONS is as if unset, in the library and on the FPGA host, and Demotions::open of a path naming no file is a broken store.
  • (8) A linked store is its target's. The lock, the temporary files and the rename all act on the target, and the link stays a link. A link to nothing fails closed. (Round 6 follows links link by link, refuses one in a sticky folder anyone may write, and refuses a hard-linked file.)
  • (9) The lock wait is bounded. (Round 6: a demotion no longer waits on it to be kept; it goes at once to a file of its own.) The store waits at most 5 s (member::STORE_LOCK_WAIT). Past that, the certification that waited grades nothing bit-exact and says why; the store is not latched broken, so the next certification waits again. A board job therefore holds the board at most 5 s waiting on the store. The in-process records mutex is no longer held while the file lock is awaited.
  • (10) A rewrite keeps the file's mode and, under the exclusive lock, removes the temporary files a crashed writer left.

Generation (spec §7.1):

  • (2, 11) The longest moving settles. (Round 6 found longer ones: the claim is gone, and units of three cells now move to sweep 14,956; see below.) The wave is now stopped one sweep before its rest (bound n, not n − 1). The review's two-cell-unit settle moves for 2n − 10 sweeps and rests at 2n − 9 (a unit test checks this at 16, 64, 600 and 4,096 cells). It is generated at C cells, stopped just past 2⁹, 2¹⁰, 2¹¹ and 2¹² sweeps and at its last moving sweep: 8,182 with no capacity. Stale(4095), Stale(6000) and Ring12 lose the settle grade under no capacity, CUDA's and Metal's, the WebGPU numbers and sweeps 8193. So do Stale(1499) at cells 1500, Stale(600) at cells 600 and Stale(63) under the FPGA's.
  • (12) The final sweep at every remainder. The hot-then-0 rung is now a final/cells-n family on uncoupled cells whose field equals the cost of 1. That is a tie the sweep at 0 settles to 0 however cold the sweep before, so the sweep at 0 always moves cells.
    • It runs at 17, 18, 24, 30 and 31 of a warp, and at 33, 34, 48, 62 and 63 of a workgroup.
    • Each count runs after two sweeps at 1.5, after three (the sweep at 0 at an odd index), and after two and a cold one.
    • It also runs at three quarters, all but two and all but one of groups of 128 to 1,024.
    • Final64Even, Final64Mid, Final64AfterCold, Final64AfterThreeHot, Final64OddIndex and Final32Even lose the sample grade under no capacity, the FPGA's, the WebGPU numbers, CUDA's and Metal's, cells 64 over the floor and cells 4000.
  • (13) The generated battery's bound holds whatever the law. Generated workloads are now held by the likelihood ratio G over every bin, none pooled, at 2·(ln C(N + k − 1, k − 1) + ln(B/10⁻⁸)) (conformance::likelihood_ratio, likelihood_ratio_critical). By the method of types, that bounds a workload's false-failure chance by 10⁻⁸ for any law, edge/sweeps's small pooled bin included. A unit test sums the exact tail over every way 1,000 draws fall in three bins, for three laws, at 10⁻², 10⁻⁴ and 10⁻⁸: each stays under its bound. The fixed battery is unchanged (Pearson's statistic, df + 5√(2df)).
  • (3, 14) Statistical samplers are held on every cell and every call remainder.
    • The cells workload now holds C (4,096 with none), every cell read.
    • A second workload, cells/remainders, holds the largest 2^j − 1 count up to 1,023 under C, every cell read, wherever C itself is not one.
    • Generated workloads run in calls of 63 and 31 chains in turn, so every call ends in a partial warp and workgroup. (Round 6: 63 down to 17, every remainder.)
    • Every sampler the review named now loses statistical: a partial workgroup's unmoved tail (cells 2048, the FPGA's, the WebGPU numbers), a call's partial warp at its starts (none, floor, FPGA), frozen from 1,023, drawn at random from 1,024, cell 100 unmoved, and cells 1,500 to 1,520 unmoved. A correct own-draw sampler keeps statistical under none, the FPGA's and the WebGPU numbers.

Audit cost and text (spec §7.3):

  • (6) Audit threads are capped and deprioritised. The re-runs use the job's own thread (at the job's priority) plus at most run::audit_threads() threads (a quarter of the host's cores, at most 4) shared across the whole process. Each runs at a low priority: nice +10 on Linux, the background band on macOS. review5_an_audited_replay_beside_an_honest_job measures an honest single-thread run beside a replay of 256 seeds × 1 chain, where every chain is checked, on a fast cached member. Over three rounds per host:

    Host Audit threads Honest throughput, audited replay beside it By-name replay beside it p90
    M3 Ultra (32 cores, load 12–25) 4 −6%, −5%, −6% −2%, 0%, −1% 0.0057 s → 0.0066 s
    Framework (32 threads, load 75–84) 4 −6%, −6%, 0% +3%, 0%, −6% 0.0086 s → 0.0097 s at worst
    Thor (14 cores, load 3–7, just rebooted) 3 −1%, −1%, 0% 0%, 0%, 0% 0.0069 s → 0.0069 s

    The review measured −46% to −66% on Thor with 14 audit threads at normal priority, at load 36–49. Thor was idle this time, so that heavy-load case is not repeated here.

  • (4, 5, 15) The cost is stated as work. §7.3's bound is now the work. Wall time depends on the host, its load and the device; the text says so, and a host measures it itself (the timings test now prints five runs per job). The wall-time figures from 10 runs per device (two processes of five), audited against the same member run by name, with the audit at 4 threads:

    Job Metal (M3 Ultra) CUDA (RTX 4050) WebGPU on Metal
    replay, 256 seeds × 8 chains, 64 cells, 500 sweeps +108% to +171% +85% to +122% +90% to +114%
    replay, 256 seeds × 1 chain +112% to +183% +90% to +120% +66% to +113%
    run, 4,096 chains, 64 cells +1% to +18% +1% to +4% −14% to +14%
    run, 1,024 chains, 1,024 cells −18% to +4% 0% to +1% −3% to +2%

    The replays now cost more wall time than round 4's 16 threads at normal priority did (+21% to +41% on Metal). That is the price of not crowding out other jobs. A replay of one chain per seed, every chain checked, took up to 1.18 times the reference's own time through Metal and 0.70 through CUDA. §7.3 says so, and gives the bound as work.

The sixth adversarial check at 1efbe6653, and what changed

The check confirmed 13 findings (1 medium, 12 low) and refuted 1. Each probe is kept as a test (review6_* in landscape_conformance, and run::tests::the_audit_s_threads_are_capped_over_the_process_and_run_low). Every one of those tests fails at 1efbe6653 on Linux (Framework) and macOS (M3 Ultra) and passes at this head.

Demotion store (spec §7.3):

  • (1, medium) The probe is the rewrite itself. Round 5's probe only showed the folder took a new file; a demotion also renames over the store's file, which can fail on its own. Now each certification, under the shared lock, rewrites the file as it is, the way a demotion does: a file of its own, padded to the largest rewrite a demotion can make, synced, cut back to its bytes and renamed over the file. Where the file cannot be replaced, nothing is graded bit-exact:
    • a file marked uchg or uappnd (macOS chflags), and one marked immutable (chattr +i, Linux, through sudo -n);
    • another user's file in a sticky folder of theirs (sudo -n -u nobody), on macOS (Permission denied) and Linux (Operation not permitted).
      At 1efbe6653 each of these was graded bit-exact, the demotion failed at its rename, and a later process graded the member bit-exact again (the M3 log shows all three macOS cases). A file not yet made is made, as {}, at the first certification.
  • (2) A demotion is never dropped for a busy lock: it is recorded durably. It is written at once, with no lock, to a file of its own beside the store, .<name>.demotion.<32 hex digits>.json (renamed into place, so readers see all of it or none), which every certification reads under the shared lock. Then it is merged into the store's file under the exclusive lock, waited for at most 5 s; where the wait runs out, it stays in its own file until a later demotion merges it, and the host says so on standard error. With another process holding the lock shared for longer than 5 s, the demotion is now kept, a later process grades the member uncertified, and the next demotion merges it and removes its file. At 1efbe6653 the same test lost the demotion.
  • (3) No store removes another's file. Temporary files are .<name>.<write|probe|demotion>.<process>.<count>.tmp, matched exactly (two digit groups, one of three kinds), so a file of a store named <name>.<more> can never match: it has more dots than the pattern allows. A store demotions.json now leaves .demotions.json.gpu.write.424242.7.tmp and five other near-misses alone, as does a store demotions; at 1efbe6653 all six were deleted.
  • (4) The probe is as large as the largest rewrite. It is sized from the records as a demotion writes them (pretty-printed), with the largest entry one can add: a reason, now kept to its first 1,024 bytes on file (member::STORE_REASON_BYTES), at six bytes a byte, and a capacity with every number at its widest, under the identity being certified. Under a file-size limit of the file plus 4,096 bytes (round 5's probe), a 5,000-byte fingerprint and a store written compact now grade nothing bit-exact (EFBIG); under a 16 MB limit both are bit-exact.
  • (5) Links. The store follows a link link by link, reading each, and never through canonicalize. A link in a folder anyone may write that has the sticky bit is refused, whoever made it (the kernel's fs.protected_symlinks follows the owner's own; the store is stricter). Every file of the store's is opened with O_NOFOLLOW and O_NONBLOCK where the target's values are known (Linux x86_64 and arm64, macOS, FreeBSD), and the opened file is checked against the path's device and inode. So a lock planted as a link fails closed and makes nothing at the link's target. At 1efbe6653 a link in a 1777 folder was followed, and a lock that was a link created its target.
  • (6) A hard-linked store is refused. A file with more than one name fails closed, before a rewrite could split it ("has 2 names (a hard link)"); with one name again it is certified. A symbolic link shares a store as before.
  • (7) A killed certification's probe is removed. Every temporary file is made with create_new and held locked (flock) by its writer while it lives. A certification or a demotion removes one that has gone unchanged for 10 s (member::STORE_STALE_AFTER) and whose lock it can take, and leaves one a live writer holds. A 1 MB probe left by a killed process is gone after the next certification; at 1efbe6653 it stayed until a demotion.

Generation (spec §7.1):

  • (8) Settles past 2¹³, and no claim of a longest one. The "longest-moving settle the rules know" is gone from the spec and the code. A unit of three cells (capacity::slower, the review's gadget) moves a cell in every sweep to sweep 11u − 59 and rests at 11u − 58, for 10 units or more (a unit test checks every size from 10 to 64 and those generation uses, to 1,365). It is stopped just past 2⁹, 2¹⁰, 2¹¹, 2¹² and 2¹³ sweeps, each on as few units as still move there, and at its last moving sweep on as many cells as the capacity takes: 14,956 sweeps on 4,095 cells with none. Where couplings are too few for it to move longer, the units of two are used, as before (couplings 3,000: slow/cells-1000/to-1990). Stale(8182), Stale(10000), Stale(14955) and a 13-bit counter (Ring13) lose the settle grade under no capacity, CUDA's and Metal's, the WebGPU numbers and sweeps 20,000; all kept it at 1efbe6653. The spec says that no longest settle is known, and that a narrower counter or a stale read past the sweeps these reach is left to the audit.
  • (9) Two-cycles that end late. The same units beside two cells that alternate from the start end in a two-cycle at sweep 11u − 57: with 46 units at sweep 449, the first sweep of a later batch of 64; with 378 units at 4,101, where a sweep counter of 9 to 12 bits read at the ending gives the other phase. CycleRing(4095), CycleRing(511), CycleStale(21), CycleStale(4000), MissCycleAfter(21), MissCycleAfter(4095) and BatchCycle (the review's batch mutant) lose the settle grade under no capacity, and the named ones under CUDA's and Metal's, the WebGPU numbers, sweeps 8,193, cells 1,500 and the FPGA's. A counter of 13 bits cannot give a wrong phase at a two-cycle before sweep 16,384, past what these reach; the spec says such faults are left to the audit.
  • Cost: with no capacity, 214 vectors and 2.62×10⁸ cell sweeps (39% battery); the most, 4,096 cells with every other number below reach, 288 vectors and 4.30×10⁸ (50% battery). The bounds (300, 4.5×10⁸, 2×10⁷) are unchanged, and §7.1 gives the new figures.

Battery (spec §7.2):

  • (10) Every call remainder; the cell counts stated. The workloads a capacity adds now run in calls of 63, 62 and on down to 17 chains, so their calls end in every partial warp of more than 16 chains and every partial workgroup of more than 32. A sampler that leaves a call's chains from lane 32 on at their starts where the call ends in 34 to 62 (CallTail64Mid, under no capacity and the FPGA's), or from lane 16 on at even warp counts (CallTail32Even), now loses statistical; both kept it at 1efbe6653. For the cell dimension, §7.2 now says which counts the battery runs (the fixed workloads' 2 to 24, C and the largest 2^j − 1 under it) and that a fault keyed to another count is never run; Tail64Even keeping statistical is held by the test as that statement.
  • (11) The bound's power, stated. §7.2 no longer says a sampler drawing from another law "lies far past the bound". It says the bound sits at about 0.011 of divergence a block, so three alike cells drawn 10% too warm (G near 250) pass, and 15% too warm (near 490) fail. A test holds both: WarmFrom(1024, 1.10) keeps statistical, WarmFrom(1024, 1.15) loses it. Every answer from a kernel graded statistical now says what the grade rests on and what it misses, in its label (member::STATISTICAL_GRADE).

Audit threads (spec §7.3):

  • (12) The docs corrected. docs/landscape.md and the change entry said the re-runs take "at most a quarter of the host's cores ... at a low priority". They now say what the code does, as §7.3 did: the job's own thread runs its share at the job's priority, and the audit's threads, a quarter of the cores and at most 4 over the process (none on fewer than 4 cores), run theirs at a low priority. §7.3 adds that several audited jobs each run a share at their own priority, and that a host which must keep them from crowding out others lowers those jobs' own priority. How the work is split is unchanged.
  • (13) A CI test of the cap and the priority. lower_this_thread now returns setpriority's result and the priority read back, and an audit thread that cannot be lowered says so on standard error, once. The new test asserts that audit_threads() is a quarter of the cores and at most 4; that a lowered thread reads nice + 10 (to 19) on Linux and the background band on macOS; that eight audited calls at once never run more audit threads than the cap, each lowered; and that every thread taken is given back. It runs in the module's tests on Linux (106 now) and in a new step of the bits job on Linux arm64 and macOS, with the store's tests. It fails on each of the review's three mutants (the cap back to min(cores, 16), setpriority with an invalid which, the pool never given back) and on a fourth that never lowers, on Linux and on macOS.

The members

  • GPU members declare their real limits:
    • WebGPU: a field bound of 2³¹ − 1 on both sides of temperature 0, which its 32-bit lanes hold; cells and couplings within a 32nd of a storage binding; 4,194,304 table entries.
    • CUDA and Metal: 4,194,304 table entries, which no job reaches.
  • The CPU reference declares none.
  • The FPGA reference design (wai/wai-quantum-landscape-fpga) declares member::CAPACITY: 64 cells; above temperature 0, fields to ±524,287, a cost to 1,048,575 and an uncertain span of 8,192. At temperature 0 it takes any field.
    • Its host now shortens a table's run of temperatures, down to one, before it refuses a window, so the engine refuses exactly what the declared capacity does.
    • the_declared_capacity_is_exactly_what_the_engine_holds holds that over every settle vector, chains vector and battery workload.

Tests that failed before this change

In wai-quantum:

Test What it holds
job::tests::a_member_is_held_to_every_vector_within_its_declared_capacity A member declaring a field bound of 41 (the floor) is certified bit-exact within it, and its answer states the capacity in member.capacity and the label. One declaring 40 is refused, with "a field bound at temperature 0 40, and the floor is 41". One declaring 2³¹ − 1 that refuses what it would rather not run (Choosy) is uncertified for both kernels. The reference's answers carry no capacity.
landscape_conformance::a_member_is_graded_within_the_capacity_it_declares The same, on the conformance stand-ins. A member declaring 41, 70,000 or 2³¹ − 1 earns bit-exact within it, where the old rule made 41 and 70,000 uncertified.
capacity::tests (five) The floor is the core set's own reach, with the numbers above. Each declared number declines exactly what is past it, saying which. The hottest sweep has the widest uncertain span. A capacity is stated in numbers and in words, a batch as a split. Every declared number has vectors at its edge, within all the others, including each of the FPGA's.
landscape_conformance::every_fault_loses_the_grade_of_the_kernel_it_is_in Every fault, with no capacity declared and with its most hostile capacity, each time behind a positive control.
landscape_conformance::review_* (five) The review's probes p02 to p12 and the skeptic's, as listed above.
landscape_conformance::review2_*, audit_*, review3_* The second and third rounds' probes, and the audit's, as listed above.
landscape_conformance::review4_* (seven) The fourth round's probes: the final sweep's partial groups; long settles within a sweep limit and at their bound; the per-call draw against a member that cheats after the first call; the store failing closed; stores sharing a file; "parity": null; the battery's cells, the span past a table limit, and own-draw samplers passing the generated workloads.
capacity::tests::long_settles_bands_cells_and_spans_are_generated, conformance::tests::the_chi_square_tail_is_the_closed_form The fourth round's generation rules, by name and bound, and the generated battery's critical value against the closed form.
landscape_conformance::review6_* (ten) The sixth round's probes: the store's file replaced at each certification (uchg, uappnd, chattr +i, another user's file in a sticky folder), a demotion kept while the lock is busy, only a store's own files removed, the probe as large as a rewrite, a link in a sticky folder and a lock that is a link, a hard link, a killed certification's probe; settles past 2¹³; late two-cycles; the statistical grade as stated. All ten fail at 1efbe6653 on Linux and macOS.
run::tests::the_audit_s_threads_are_capped_over_the_process_and_run_low The audit threads' cap, setpriority's result and the priority read back, and every thread given back; fails on each of four mutants on Linux and macOS.

In the FPGA crate:

Test What it holds
member::tests::the_model_is_certified_bit_exact_within_its_declared_capacity The host certifies the engine's register-level model (which the testbenches hold the logic to) bit-exact for both kernels within CAPACITY, against the set on main.
member::tests::the_declared_capacity_is_exactly_what_the_engine_holds The declared numbers are the engine's own limits, case by case over the whole set, and the engine holds every edge vector of its capacity.
member::tests::the_capacity_and_the_engine_agree_on_random_jobs The review's FPGA probe: 3,000 random jobs, with capacity and engine agreeing on each, and 250 model runs bit-identical.

Checked on this head, each workflow leg run as the workflow runs it (via rb)

This head merges main once, at f6e302665 (later than a4766c993; it carries 4c5b54a27, which fixes the vanity-metrics red that an earlier main tip, 1929b8436, would have brought in). Main changed one file in this PR's area, cuda.rs, where the merge takes main's fault word: a lookup past the table now stops the call with an error, where this branch marked the cell. The head is the merge plus one commit with round 6.

  • Framework (Linux x86_64), the native leg's steps verbatim:
    • lib (--features full) 106/106, with every test the workflow names run and passed;
    • landscape_conformance 54/54, plus 1 ignored, in 113 s;
    • float read 1/1, meter bridge 1/1, the CLI verb 2/2, reproduce.sh 17 PASS;
    • -D warnings clean for the three feature sets;
    • the bits leg's commands: debug (290 s) and release, 2 pinned and 10 conformance tests with 45 filtered out;
    • the new step: the thread test 1/1, and the store's 11 tests;
    • wasm32-wasip2 under wasmtime 50.0.1, 104/104 (777 s);
    • FPGA crate 36/36 and clippy -D warnings clean; its model certified bit-exact for both kernels within its capacity (21/21 settle, 233/233 chains); the --model job step answers;
    • devices (WebGPU): Radeon 8060S and llvmpipe, 9/9 plus 1 ignored, in 353 s, both certified bit-exact for both kernels.
  • M3 Ultra (macOS), at this head:
    • the bits leg: debug (346 s) and release, 2 pinned and 10 conformance tests with 45 filtered out;
    • the new step: the thread test 1/1 (32 cores, a cap of 4, every audit thread in the background band), and the store's 11 tests, the flags and the sticky folder checked (["uchg", "uappnd", "sticky"]);
    • landscape_conformance 54/54, plus 1 ignored; lib (--features quantum_landscape) 104/104;
    • devices (Metal and wgpu-metal): 9/9 plus 1 ignored, in 207 s, both certified bit-exact for both kernels.
  • Mutants of the thread test, on the Framework and on the M3: the cap back to min(cores, 16) (16 against 4), setpriority with an invalid which (EINVAL), a thread never lowered (its priority reads unchanged) and the pool never given back (still taken after 120 s) each fail it.
  • At 1efbe6653, the ten review6_* tests copied in, on the Framework and the M3: all ten fail. Run again with each check reported rather than stopped at the first:
    • every settle and two-cycle fault named above keeps bit-exact;
    • on the M3, uchg, uappnd and another user's sticky folder each grade bit-exact, the demotion fails at its rename, and a later process grades bit-exact again;
    • on the Framework, chattr +i grades bit-exact;
    • the long identity and the compact store grade bit-exact under the limit;
    • CallTail64Mid (none and FPGA) and CallTail32Even keep statistical, and the label does not state the grade.
  • Generation bounds: with no capacity, 214 vectors and 2.62×10⁸ cell sweeps; the largest case, 288 vectors and 4.30×10⁸, with 1.71×10⁷ at 0. The bounds are unchanged: 300, 4.5×10⁸ and 2×10⁷.
  • Repository checks, run on this head:
    • the name check is clean on the changed files, the commit message and this section;
    • also clean: tests in CI, spec refs, section refs, quantum names, the changelog check, vanity metrics, comparative prose, maintainer products and the wasmtime pin.

For whoever lands it

  • The FPGA board itself is to be re-certified on main once this lands; the README says so. Its measurements are from the set of 2026-11-06.
  • Member::takes is gone. Nothing outside this repository implements the landscape Member.
  • Capacity gains sweeps, and Capacity::takes_chains is gone: a batch is now split (Capacity::batch). Capacity::least, Capacity::join and Capacity::edges are new.
  • The FPGA board will meet the edge vectors when it is re-certified. On the model it is bit-exact with them.
  • A store of demotions now holds, beside its file, a demotion in a file of its own (.<name>.demotion.<hex>.json) until a later demotion merges it, and each certification rewrites the file as it is. A store file made by round 5's code reads as before.
  • The bits job gains a step, "The store of demotions and the audit's threads on this platform", on Linux arm64 and macOS.

🤖 Generated with Claude Code

**Re-landed on main as one commit, c0ba8a0ce (2026-11-09), under the land-it model.** Round 6's 13 findings are fixed at 72829ec4c, each with a fail-first test (the medium: the probe is now the rewrite itself). Squashed onto main after #676 (ce1c91131). Passed on the Framework on the combined tree: the wai-quantum library's 1,469 tests, 54 landscape conformance tests, the engine-only build, and the service's 118 tests under ulimit -Sn 256. The breaking gate's red at 72829ec4c came from main (libdav1d missing from its image); the next commit on main fixes it, and the gate then reports no unacknowledged breaking change for this work. Closed. --- A declared-capacity rule for members of `wai.quantum.landscape/1`: a spec change to §5, §5.1, §5.3 and §7, with `member::certify`, the GPU members and the FPGA reference design brought to it. ## Why Real hardware has finite capacity. The FPGA reference design (#677) has 64 cells, 20-bit sampling registers and a table window of 8,192 fields a temperature. Under the conformance set on main it refuses 13 cases past those, and since §5 let a member decline only fields above 2³¹ − 1, each refusal counted as a missed vector: the host certified it `uncertified`, although every case it can hold gives the reference's bits (21/21 settle, 227/227 chains). ## The rule - **A member declares its capacity** (`Member::capacity`, a `capacity::Capacity`), once, as fixed numbers: - cells and couplings; - on each side of temperature 0, its largest `|b_i|`, field bound and cost; - above 0, the cut points a sweep it holds (`table_entries`), or the span of uncertain fields at a temperature (`uncertain_span`), its table's window; - the sweeps of a run (`sweeps`: a settle's bound, a schedule's length); - the chains it takes a call (`chains_per_call`). This is a batch size, not a limit: the host splits a job into calls of that many, and certification splits every vector the same way, so no job goes elsewhere for it. `Member::capacity` takes the place of `Member::takes`. - **The host declines mechanically.** `Capacity::admits` is a pure function of the workload, its schedule and the declared numbers, and says which number a job is past. The host declines for a member exactly the jobs past its capacity, and runs it on none of them, however it was reached. A member declines nothing by choice, so the GPU review's protection against selective declining holds: a member that refuses or fails a case within its capacity has failed it. - **Graded within it, and at its edges.** `certify` reads the capacity once. It runs every `settle` and `chains` vector and every battery workload within that capacity, each case's chains in calls of the size the host would use at run time. For each number declared below what a job can reach, it also runs vectors generated at exactly that number (`Capacity::edges`), with the reference as their oracle. The grade holds within that capacity, and the answer says so: - `member.capacity` in every answer from a member that declares one. It is absent for the reference, whose answers keep their exact bytes, so `CORPUS_20` and every pinned digest stand; - a sentence in the label; - the number a job is past, in its refusal. - **A floor.** A capacity under the floor is not certified at all (`certify` refuses it, naming each number under). The floor is the least capacity that takes every case of the **core set**: the cases the set held before it grew to reach large jobs (the `settle` vectors but the one with fields of 2⁴⁰, the first fifteen `chains` vectors and the first eight battery workloads), plus a long schedule across windows. A member must hold those, or the grade vouches for nothing. It is worked out from those cases (`capacity::floor`), and the test pins its numbers as §5 states them: | number | floor | the core case that needs it | |---|---|---| | cells | 32 | the recall vector of 32 cells | | couplings | 992 | the same, every pair coupled | | fields, at 0 and above | ±40 | the wide-fields chains, cooling and quenched | | field bound, at 0 and above | 41 | the same | | cost, at 0 and above | 8 | the same | | table entries a sweep | 31 | the dense chains, 16 cells with every pair coupled, at their hottest | | uncertain span | 61 | the wide-fields chains at their hottest | | sweeps a run | 5,000 | the long schedule: 32 cells, each coupled to 15 others, held hot | The floor declares no batch: any number of chains a call is certified by splitting. - **Monotone span.** A field's draw that is uncertain at a temperature is uncertain at every hotter one, so a schedule's uncertain span is its hottest sweep's. `admits` checks that sweep alone, and a test holds the property. ## The adversarial check at 75edfe063, and what changed The check confirmed three high findings, one medium and one low. They share a root cause: declaring a number removed fixed vectors from certification, and the set samples each number at only a few points. | Finding | Fix | |---|---| | 1 (high). A draw counter that restarts at each device window was certified `bit-exact` at the floor itself. Schedule length was not a capacity number, and no vector under 64 cells ran more than 41 sweeps. | The core set now holds `a-long-schedule-across-windows`: 5,000 sweeps on 32 cells within the floor on every number. It crosses windows by table (about 530 sweeps) and by work (about 1,930), so no capacity a member may declare leaves it out. `sweeps` is now a capacity number, with an edge vector at it. The full set adds 200,000 sweeps of two cells, across a window by work on the smallest workload. | | 2 (high). `chains_per_call` removed chain vectors and turned away no job. | Certification splits every chain vector and battery workload into calls of the batch the host uses at run time (`Capacity::batch`, now shared with `run.rs`), and skips nothing. A declared batch also gets one call of exactly that many chains. `words()` states the batch as a split, not as "go elsewhere". The floor no longer has a batch. | | 3 (high). A limit set between the vectors' points left faults below it untested. | `Capacity::edges` builds vectors at each declared number, each also within every other declared number: a settle wave down that many cells and a hot chain on them; that many couplings; on each side of temperature 0, a field bound reached through couplings and by a field alone, the largest field and the largest cost, drawn hot (uncertain) and cold at 1/64 (certain, so a field reached exactly is drawn exactly); a table of that many entries; two fields spanning the uncertain span; a schedule of that many sweeps. The battery gets the same above 0. A member that declares nothing runs the fixed set only, and the reference's answer bytes are unchanged. | | 4 (medium). `certify` read `capacity()` again for each check. | It reads the capacity once and passes the stored copy to `settle_vectors_hold_within`, `chain_vectors_hold_within` and `run_battery_within`. | | 5 (low). Grade text without the capacity. | The FPGA `earn()` and the `agree` line now say "within its declared capacity", and `earn()` gives the capacity in words. docs/landscape.md now states what CUDA, Metal and WebGPU declare. | **Hostile capacities.** Every fault test now also runs with a declared capacity. `every_fault_loses_the_grade_of_the_kernel_it_is_in` runs each fault twice. The first run declares none. The second declares the most hostile capacity the fault may: the least capacity, at or above the floor, that still takes a job the fault gets wrong (`Capacity::least(job).join(floor())`). In the second run, a positive control first shows the fault getting that job wrong within that capacity. The faults covered are the field widths, cells, settle ends, draws, cell order, chains, the device window, and both window faults at every window a vector crosses. This loop caught one gap in the first draft of the edges. A 32-bit field fault declared without its couplings slipped past a hot star of 8 chains. The cold, exactly reached star closed the gap. **The probes, kept as tests**, and what each faulty member now earns, as (settle, sample), from the run on Thor: | Probe | At 75edfe063 | Now | |---|---|---| | p02, `OnlyTheFirstChains(64)` with `chains_per_call` 100 | bit-exact, bit-exact | bit-exact, **uncertified**. Its replay of 100 seeds is labelled `uncertified`. | | p03, `OnlyTheFirstCells(256)` with cells 299 | bit-exact settle | **uncertified**, bit-exact. The host's check refuses the 280-cell job. | | p03, `OnlyTheFirstCells(300)` with couplings 992 | bit-exact settle | **uncertified**, bit-exact | | p03, `SettleEndsLate(256)` with cells 299 | bit-exact settle | **uncertified**, bit-exact. Its 290-cell answer is labelled `uncertified`. | | p04 and p10, `Fields16` with a field bound of 39,999 on both sides | bit-exact, bit-exact | **uncertified, uncertified** | | p05, device-window restart with cells 63, and with cells 64 | bit-exact, bit-exact | bit-exact, **statistical** | | p06, a member whose capacity changes after its first read | bit-exact, bit-exact | **uncertified, statistical**. The capacity is read once. | | p10, the settle faults on jobs that end at their bound | bit-exact settle | **uncertified** | | p12, device-window restart at the floor | bit-exact, bit-exact | bit-exact, **statistical**. Its replay is labelled `statistical`. | | Skeptic, `Windowed` at the floor and five other capacities | bit-exact, bit-exact | bit-exact, **statistical** in every case. At run time 9 of 20 answers differ from the reference, and every one is labelled `statistical`. | | FPGA, 3,000 random jobs (`the_capacity_and_the_engine_agree_on_random_jobs`) | 0 disagreements | 0 disagreements. 250 model runs are bit-identical to the reference, and none is refused within capacity. | ## The second adversarial check at 28fa25d9, and what changed The check confirmed 19 findings and refuted 2. Each finding was another fault class that a finite set misses, so this round changes how vectors are chosen rather than adding more of them, and adds a check at run time. **(A) Vectors chosen by rule, for every capacity** (`Capacity::generate`, spec §7.1). The CPU reference's empty capacity counts here too. Each vector is generated from the capacity, the reference is the oracle, and only vectors the capacity admits are run: - **Cells:** every power of two, one less and one more, up to the most cells the capacity allows (4,096 with none), plus that number and one less. Every cell has a field, so every one moves in its first sweep. Each workload is settled and held hot. - **Calls:** one call of each number of chains from 1 to 32, of 33, 48, 63, 64, 65, 96, 127 and 128, and of a whole batch and one less. - **A row:** one cell coupled to as many others as the capacity allows (4,095 with none). Its whole row gives it −1, and any shorter part gives it 0 or more. - **Lanes:** on each side of 0, one workload holds a cell at each of 2^(L−1) − 1, 2^(L−1), 3·2^(L−2) and 2^L for 16-, 24- and 32-bit lanes, both signs, and a cell reaching each through two couplings. A second holds the same beside the largest cost. Each is run at 0, above 0, and hot then cold then at 0. - **A corner:** every number at its most at once, on each side of 0. - **Draw indices:** a run past 2²⁴ wherever sweeps × cells reaches it. A run past 2³¹ would be at least 2³¹ updates in one chain, which takes minutes on a device that runs a chain a thread. A narrower index past 24 bits is left to the audit, which catches it on the first job past its width. - **Declared edges:** the edges now reach a declared table and span exactly, through couplings. The field bound at 0 also gets field-alone vectors. - **Battery:** workloads at a declared cell count, couplings and schedule length. They read a few blocks of many (`BatteryCase::read`), so a correct sampler is not failed by chance. - **Cost:** stated in §7.1 and held by `generated_vectors_cost_what_the_spec_says`. There are 132 generated vectors with no capacity, 151 at the floor, 112 at the FPGA's capacity and 145 at the largest capacity below every reach. Any capacity costs at most 300 million cell sweeps hot or settled, nearly all of them battery workloads, which run only for a kernel that is not `bit-exact`. It costs at most 20 million cell sweeps at 0, the 2²⁴ run at a fixed point, which the reference now skips; its bits are unchanged. - **On real GPUs:** a first version, about 680 vectors including a 2³¹ run, took over ten minutes to certify one WebGPU member on the Framework's Radeon. With the set as above, the Framework's whole devices leg passes in 164 s. **(B) The audit** (spec §7.3). Every answer from a kernel graded `bit-exact` is checked against the reference: - **Sampling:** the last chain of every call, and one chain of each run chosen by the job's digest, are run again on the reference. - **Settling:** the whole settle is run again when its work is at most 2²⁴; past that, one job in 8, chosen by the digest. - **On a mismatch:** at the first difference, or the first answer the checks refuse, the member is demoted to `uncertified` for both kernels. The job is answered from the reference, with the member named under `refusals`. Every later answer carries `member.demoted` and a label sentence, and placement never picks the member again. - **Cost and detection:** both are stated in §7.3. A fault on a fraction q of chains is caught with probability at least q per job. A fault on a call's last chain, or within the settle budget, is caught on the first job that shows it. Past the budget, a settle fault is caught within N jobs with probability 1 − (7/8)^N. | Finding | Now | |---|---| | 1 and 14: cells past couplings/2 + 1, and past 1,000 with no capacity | the cell ladder reaches the most cells the capacity allows (4,096 with none), every cell with a field. `OnlyTheFirstCells(497/600/1001/1024/4095)` and `SampleOnlyTheFirstCells(600/1025)` lose `bit-exact` under every capacity the review used. | | 2: no hot-then-0 schedule on large fields | every lane, corner, ladder and edge workload also runs hot, then cold, then at 0. `MixedFinal16` loses `bit-exact` with no capacity, the FPGA's and the WebGPU numbers. | | 3, 8, 9: workgroup remainders, rows over 32, warp remainders | the cell ladder (n mod 64 includes 63, 1, 33), the row, and calls of 1 to 128. `TileRemainder` (both kernels, at cells 64/128/256/288, the FPGA's and none), `RowCap(32)` and `RowCap(15)`, and `WarpRemainder` (batches 64, 48, 4096 and none) all lose `bit-exact`. | | 4: table and span edges short of the number | both are now reached exactly through hubs on shared cells where the other numbers allow, and test-pinned (200 entries at cells 32, 200 at field 40, a span of 1,000 at field 40). | | 5, 6, 7: 16-bit fields at a field bound of 66,000 to 69,999, a field without a field bound, a field beside a cost | the lane wrap points, alone, coupled and beside the largest cost, plus the implied field bound (field + cells − 1) when only a field is declared. `Fields16` and `FieldCostWrap` lose the grade under every capacity in the findings. | | 10: draw indices past 2²⁴ and a signed 32-bit index | the 2²⁴ draw-index run. `Counter24` loses `bit-exact` with no capacity, at the FPGA's, at cells 64 with 300,000 sweeps, and at 999,999 sweeps. The audit demotes it on its first wrong job. A signed 32-bit index is left to the audit, as above. It is not run in tests, because the reference's own run past 2³¹ takes minutes. | | 11 and 18: no battery workloads for cells, couplings or sweeps | battery workloads at each. `Stuck(32)`, a sampler with its own draws that declares cells 40, drops from Statistical to Uncertified. The positive control stays Statistical. The text now says which numbers have battery workloads, and that a table has none. | | 12: the WAI breaking gate | `**Breaking:**` lines for the three API breaks, and for the two this round adds (`BatteryCase::read`, and `Certified` no longer `Freeze`). The gate exits 0, as run on Thor. | | 13: the FPGA workflow greps | updated to the renamed lines. The model leg passes as the workflow runs it. | | 15, 16, 17, 19: text | a decline reads "The host declined this job for …". The label says the host runs the member on no job past its capacity, and a member run by name claims no grade. §5's field-bound sentence now matches the code, which builds field-alone vectors at 0. The README says "two fields spanning 8,192". | Every fault test now also runs under realistic capacities, not only the least one: - the most hostile capacity, rounded up as hardware rounds; - the same with no cell count; - the FPGA's, the WebGPU numbers, and CUDA and Metal's. The review showed that the least capacity is not the most hostile for a fault that is not monotone. Each run has a positive control first. ## The third adversarial check at df2f96781, and what changed The check confirmed 20 findings and refuted 1. It found the audit resting on things the member reports or can predict, and gaps in generation at small and declared capacities. **The audit rests only on what the host computes and remembers** (spec §7.3): - **Per run (1, 8):** one chain of *every seed's run* is checked, plus the last chain of every call, in run, replay, sweep and compare. A member that is wrong on the first chain of every call is demoted on its first 100-seed replay. - **Settle (2, 7):** the decision comes from the work the host asked for, never the sweeps the member reports. The reference's settle is run as far as a 2²⁴ budget allows. Where it comes to rest within that budget, or the whole bound fits it, the whole answer is compared. Past the budget, the whole settle is run in one job in 8; in the other jobs, a member that stops before the reference is wrong. A member that says every long settle ran to its bound is certified `bit-exact`, as before, and is now demoted on its first such job. - **Keyed draw (16, 17):** a host key made at start from OS randomness, plus a counter, so a member cannot predict the checked chains and repeats of a job are drawn afresh. Each audited answer carries `audit: {checked: [{seed, chains | settle}]}` (round 3 also carried a key digest, which round 4 drops); the reference's answers are unchanged. - **Durable demotion (9, 11):** kept by identity (`Member::fingerprint` and the member id) in `member::Demotions`, in a file where the host names one. The FPGA host does: `~/.local/state/wai-quantum-landscape-fpga/demotions.json`, or `WAI_LANDSCAPE_DEMOTIONS`. Certifying again or declaring another capacity does not clear it; another identity is certified afresh. A test covers a restart, with the store read back from its file. - **Statistical kernels (6, 10, 13):** placed only where the job asks (`"parity": "statistical"`), because no audit can hold their draws to bits. Otherwise they are passed over, with the reason given. (This said the battery reached 4,096 cells with no capacity declared; it reaches 1,023, as §7.1 says. Round 4 makes a declared count of 4,096 or more give 4,096.) **Generation**: - **(3, 4)** Lane vectors are packed into workloads the capacity takes, so a 32-cell capacity still gets each wrap point. Ladder sizes in a remainder band (more than half of a partial warp or workgroup) are also quenched at 0. - **(5)** A wave settles down as many cells as a workload holds, for every capacity. Under none, CUDA/Metal's and WebGPU's numbers, that is a settle of 4,097 sweeps. - **(12)** The battery at a declared cell count holds exactly C cells. It reads blocks of three at the ladder sizes and at the last cell; `read` now holds cell offsets. - **(14, 19)** The corner moves cells at 0, with the largest field beside the largest cost under it. A hub reaches the field bound exactly through as many couplings as a cell can have, including at the floor's and the FPGA's capacities (above 0, the FPGA hub reaches 524,350). - **(15, 18)** The cost bounds are now constants (`MOST_GENERATED` 300, `MOST_GENERATED_WORK` 4×10⁸, `MOST_GENERATED_COLD` 2×10⁷). A test holds them over the named capacities and 24 random ones. The text states those bounds. - **(20)** The CUDA out-of-table mark can be overwritten by a later sweep, so the claim that it marks the answer is gone. The bounds check still prevents the illegal address. - **API:** `Prepared::statistical` is a new field. Its struct has private fields, so the API gate does not count it as a break. ## The fourth adversarial check at f290012f4, and what changed The check confirmed 22 findings, all medium or low, and refuted none. Each probe is kept as a test (`review4_*` in `landscape_conformance`, and `long_settles_bands_cells_and_spans_are_generated` in `capacity::tests`). **Generation** (spec §7.1): - **(1, 6) A sweep at 0 straight after hot ones.** Ladder sizes in a remainder band are now also held at 1.5 for 2 sweeps and then at 0 for one. That is the engine's final sweep, a separate path on the FPGA. A fault that leaves the end of a partial last workgroup of 64 (`Final64`) or warp of 32 (`Final32`) unmoved in that sweep loses its grade under no capacity, the FPGA's, the WebGPU numbers, 32-bit lanes alone, CUDA's and Metal's, cells 64 over the floor and cells 100, and `Final32` under the floor as well. - **(2, 5) The wave under a declared sweep limit.** The wave now comes to rest within the limit instead of being dropped. Its bound is the smaller of `2n + 2` and the limit, and where the limit is under `n + 1` the wave has fewer cells. `edge/couplings` is capped the same way. - **(6) Long settles that end at their bound.** The widest wave is also stopped at its bound while it still moves: past 2⁹, 2¹⁰ and 2¹¹ sweeps, and one sweep before it would rest (4,095 sweeps with no capacity). A result slot read at a 9-bit count (`Ring9`), a state one sweep back past 130 or 4,000 sweeps (`Stale`), and a settle that stops moving and claims its bound (`Truncate`) all lose the settle grade. So do the length faults under sweeps 1,000, 5,000, 7,000 and 8,193, cells 4,095 with sweeps 5,000, couplings 8,000 with sweeps 5,000, and the floor with no cell count. - **(12, 18) The battery's alike cells follow a declared count**, to 4,096: cells 4,096 and the WebGPU numbers get 4,096, and a sampler stuck from cell 1,023, 1,024 or 2,048 is `uncertified`. With none declared it stays 1,023, which is what §7.1 says. The change entry's "4,096 with none" is corrected. - **(13) The uncertain span is reached where a table or thin couplings are the narrower.** Where a declared table refuses the declared span, the edge takes the widest span under it that the table takes. Where no span is declared, a `span/widest` vector puts two hubs on shared cells as far apart as the other numbers allow. `SpanUpTo` loses its grade under all three of the review's capacities. Those capacities and their spans: table 401 under span 412 (401), thin couplings (417), and table 401 alone (401). - **(14) Generated battery workloads do not fail a correct sampler with draws of its own.** Each block of a workload a capacity adds is held at the chi-square value its `df` passes with chance 10⁻⁸ (`conformance::GENERATED_FALSE`, `chi_square_tail`, `chi_square_critical`). The alike-cells twin reads few blocks: the first, the last, and three across each power of two from 32. The single-field laws are three alike cells (df 26, not 2). The reviewer's own draw stream (`seed ^ 0x5DEE_CE66_D1CE_4E5B`) is now `statistical` under the WebGPU numbers, as are two other capacities with their twins. The fixed battery is unchanged. **Audit** (spec §7.3): - **(3) The draw in every call.** Each call to the member has its last chain checked and, for each seed's run it holds chains of, one of those chains drawn afresh. A member that times the pause after a call learns nothing about the next call. A member that cheats on every chain but the last after the first call of each job (the perfect timing attack) is demoted on its first job in 10 of 10 trials. Over repeats, every call's draw falls before its last chain. - **(9) Wall time.** A call's checked chains run again across the host's cores, up to 16, between that call and the next. §7.3 now gives the wall-time cost, measured with the devices test's `timings`, audited against the same member run by name: | Job | Metal (M3 Ultra) | CUDA (RTX 4050) | WebGPU (Radeon 8060S) | |---|---|---|---| | replay, 256 seeds × 8 chains, 64 cells, 500 sweeps | +41%, +39% | +122%, +254% | +44%, +53% | | replay, 256 seeds × 1 chain | +32%, +21% | +178%, +251% | +10%, +23% | | run, 4,096 chains, 64 cells | +3%, −3% | +3%, +36% (6 ms) | +0%, −22% | | run, 1,024 chains, 1,024 cells | +1%, +0% | +1%, +2% | −6%, +4% | Each cell gives two runs, one at `032ba8a24` and one at `a4f5b2dd6`; the code they time did not change between them. The hosts are shared; jetson-hub's load was 14 to 21 on 20 cores. For the two replays, the review measured +245% and +366% on Metal and +365% and +521% on CUDA, when the re-runs were serial. Audited, every job above still takes at most two thirds of the reference's time alone. - **(10, 16)** §7.3 says exactly what the settle audit catches past the 2²⁴ prefix. A settle that ends at or before the last sweep the budget reaches, while the reference's goes on, is caught on its first job. Ending later than that, but sooner than the reference, is caught 1 job in 8. - **(11)** The key digest is dropped from `audit`, because nothing could open it. §7.3 says plainly that the draws are the host's, and that a reader who needs proof runs the job on the reference. - **(19)** The stale "chosen by the job's digest" wording is gone from the change entry and from `AUDIT_SETTLE_ONE_IN`. **Demotions** (4, 7, 8, 21): - `Demotions` reads its file afresh at every certification, under a shared `flock` on `<file>.lock`. - A demotion is a read-merge-write under an exclusive lock, written to a temp file named for the process and the write, then synced and renamed into place. Four writers at once keep 120 of 120 demotions, and a store opened before another one demoted a member does not certify it again. - The store fails closed. If the file does not parse (truncated, empty, a BOM, not UTF-8, junk after it), cannot be read, or sits under a folder that cannot be written or under a regular file, the host: - logs the reason once on stderr; - holds the member at `uncertified` for both kernels, with the reason in `member.demoted`; - never rewrites the file. A record whose reason is not a string still demotes. A demotion that could not be written is kept for the process, and its reason says so. - The FPGA host certifies after it holds the board lock, so it reads the file after any job ahead of it. With `HOME` unset and no `WAI_LANDSCAPE_DEMOTIONS`, it uses `Demotions::broken` and grades nothing `bit-exact`. - `get` and `record` now return what failed. `keep_demotions_in(path)` becomes `keep_demotions(store)`. All of this is new in this PR, so the API gate has nothing to count. **Text and API:** - **(15)** `"parity": null` is the default. - **(17) The jetson-hub devices leg.** This PR now carries #673's commit, which uses one process-wide WebGPU instance. The NVIDIA driver no longer stops listing its Vulkan adapter after the 12th discovery, and two of #673's device tests come with it (9 in all). - **(20)** §7.1 gave the battery as "nearly all" of the work bound. It now gives the measured share. With no capacity, generation is about 1.0×10⁸ cell sweeps, 20% of it battery. The largest case is about 3.3×10⁸ (a capacity that declares every number), 58% of it battery. The property test prints each case's share. - **(22)** §2's request table gains `parity`, and states that a `null` optional field counts as absent. §3's tables gain `audit` and `member.demoted`. ## The fifth adversarial check at 054017bc8, and what changed The check confirmed 15 findings (1 medium, 14 low) and refuted 4. Each probe is kept as a test (`review5_*` in `landscape_conformance`; the starvation probe is `#[ignore]`d, since it prints times). **Demotion store** (spec §7.3): - **(1, medium) Each certification proves the folder takes a rewrite.** (Round 6 makes the probe the rewrite itself, renamed over the file, and sizes it from the largest rewrite; see below.) Under the shared lock, the store writes, syncs and removes a file as large as the store's next rewrite. So a folder that stops taking writes after first use (its lock already there) grades nothing `bit-exact`. So does a file-size limit (`trap '' XFSZ; ulimit -f 0`, as a full disk or quota would), tested in a child process. - **(7) An empty `WAI_LANDSCAPE_DEMOTIONS` is as if unset**, in the library and on the FPGA host, and `Demotions::open` of a path naming no file is a broken store. - **(8) A linked store is its target's.** The lock, the temporary files and the rename all act on the target, and the link stays a link. A link to nothing fails closed. (Round 6 follows links link by link, refuses one in a sticky folder anyone may write, and refuses a hard-linked file.) - **(9) The lock wait is bounded.** (Round 6: a demotion no longer waits on it to be kept; it goes at once to a file of its own.) The store waits at most 5 s (`member::STORE_LOCK_WAIT`). Past that, the certification that waited grades nothing `bit-exact` and says why; the store is not latched broken, so the next certification waits again. A board job therefore holds the board at most 5 s waiting on the store. The in-process records mutex is no longer held while the file lock is awaited. - **(10) A rewrite keeps the file's mode** and, under the exclusive lock, removes the temporary files a crashed writer left. **Generation** (spec §7.1): - **(2, 11) The longest moving settles.** (Round 6 found longer ones: the claim is gone, and units of three cells now move to sweep 14,956; see below.) The wave is now stopped one sweep before its rest (bound `n`, not `n − 1`). The review's two-cell-unit settle moves for `2n − 10` sweeps and rests at `2n − 9` (a unit test checks this at 16, 64, 600 and 4,096 cells). It is generated at `C` cells, stopped just past 2⁹, 2¹⁰, 2¹¹ and 2¹² sweeps and at its last moving sweep: 8,182 with no capacity. `Stale(4095)`, `Stale(6000)` and `Ring12` lose the settle grade under no capacity, CUDA's and Metal's, the WebGPU numbers and sweeps 8193. So do `Stale(1499)` at cells 1500, `Stale(600)` at cells 600 and `Stale(63)` under the FPGA's. - **(12) The final sweep at every remainder.** The hot-then-0 rung is now a `final/cells-n` family on uncoupled cells whose field equals the cost of 1. That is a tie the sweep at 0 settles to 0 however cold the sweep before, so the sweep at 0 always moves cells. - It runs at 17, 18, 24, 30 and 31 of a warp, and at 33, 34, 48, 62 and 63 of a workgroup. - Each count runs after two sweeps at 1.5, after three (the sweep at 0 at an odd index), and after two and a cold one. - It also runs at three quarters, all but two and all but one of groups of 128 to 1,024. - `Final64Even`, `Final64Mid`, `Final64AfterCold`, `Final64AfterThreeHot`, `Final64OddIndex` and `Final32Even` lose the sample grade under no capacity, the FPGA's, the WebGPU numbers, CUDA's and Metal's, cells 64 over the floor and cells 4000. - **(13) The generated battery's bound holds whatever the law.** Generated workloads are now held by the likelihood ratio `G` over every bin, none pooled, at `2·(ln C(N + k − 1, k − 1) + ln(B/10⁻⁸))` (`conformance::likelihood_ratio`, `likelihood_ratio_critical`). By the method of types, that bounds a workload's false-failure chance by 10⁻⁸ for any law, `edge/sweeps`'s small pooled bin included. A unit test sums the exact tail over every way 1,000 draws fall in three bins, for three laws, at 10⁻², 10⁻⁴ and 10⁻⁸: each stays under its bound. The fixed battery is unchanged (Pearson's statistic, df + 5√(2df)). - **(3, 14) Statistical samplers are held on every cell and every call remainder.** - The `cells` workload now holds `C` (4,096 with none), every cell read. - A second workload, `cells/remainders`, holds the largest `2^j − 1` count up to 1,023 under `C`, every cell read, wherever `C` itself is not one. - Generated workloads run in calls of 63 and 31 chains in turn, so every call ends in a partial warp and workgroup. (Round 6: 63 down to 17, every remainder.) - Every sampler the review named now loses `statistical`: a partial workgroup's unmoved tail (cells 2048, the FPGA's, the WebGPU numbers), a call's partial warp at its starts (none, floor, FPGA), frozen from 1,023, drawn at random from 1,024, cell 100 unmoved, and cells 1,500 to 1,520 unmoved. A correct own-draw sampler keeps `statistical` under none, the FPGA's and the WebGPU numbers. **Audit cost and text** (spec §7.3): - **(6) Audit threads are capped and deprioritised.** The re-runs use the job's own thread (at the job's priority) plus at most `run::audit_threads()` threads (a quarter of the host's cores, at most 4) shared across the whole process. Each runs at a low priority: nice +10 on Linux, the background band on macOS. `review5_an_audited_replay_beside_an_honest_job` measures an honest single-thread `run` beside a replay of 256 seeds × 1 chain, where every chain is checked, on a fast cached member. Over three rounds per host: | Host | Audit threads | Honest throughput, audited replay beside it | By-name replay beside it | p90 | |---|---|---|---|---| | M3 Ultra (32 cores, load 12–25) | 4 | −6%, −5%, −6% | −2%, 0%, −1% | 0.0057 s → 0.0066 s | | Framework (32 threads, load 75–84) | 4 | −6%, −6%, 0% | +3%, 0%, −6% | 0.0086 s → 0.0097 s at worst | | Thor (14 cores, load 3–7, just rebooted) | 3 | −1%, −1%, 0% | 0%, 0%, 0% | 0.0069 s → 0.0069 s | The review measured −46% to −66% on Thor with 14 audit threads at normal priority, at load 36–49. Thor was idle this time, so that heavy-load case is not repeated here. - **(4, 5, 15) The cost is stated as work.** §7.3's bound is now the work. Wall time depends on the host, its load and the device; the text says so, and a host measures it itself (the `timings` test now prints five runs per job). The wall-time figures from 10 runs per device (two processes of five), audited against the same member run by name, with the audit at 4 threads: | Job | Metal (M3 Ultra) | CUDA (RTX 4050) | WebGPU on Metal | |---|---|---|---| | replay, 256 seeds × 8 chains, 64 cells, 500 sweeps | +108% to +171% | +85% to +122% | +90% to +114% | | replay, 256 seeds × 1 chain | +112% to +183% | +90% to +120% | +66% to +113% | | run, 4,096 chains, 64 cells | +1% to +18% | +1% to +4% | −14% to +14% | | run, 1,024 chains, 1,024 cells | −18% to +4% | 0% to +1% | −3% to +2% | The replays now cost more wall time than round 4's 16 threads at normal priority did (+21% to +41% on Metal). That is the price of not crowding out other jobs. A replay of one chain per seed, every chain checked, took up to 1.18 times the reference's own time through Metal and 0.70 through CUDA. §7.3 says so, and gives the bound as work. ## The sixth adversarial check at 1efbe6653, and what changed The check confirmed 13 findings (1 medium, 12 low) and refuted 1. Each probe is kept as a test (`review6_*` in `landscape_conformance`, and `run::tests::the_audit_s_threads_are_capped_over_the_process_and_run_low`). Every one of those tests fails at `1efbe6653` on Linux (Framework) and macOS (M3 Ultra) and passes at this head. **Demotion store** (spec §7.3): - **(1, medium) The probe is the rewrite itself.** Round 5's probe only showed the folder took a new file; a demotion also renames over the store's file, which can fail on its own. Now each certification, under the shared lock, rewrites the file as it is, the way a demotion does: a file of its own, padded to the largest rewrite a demotion can make, synced, cut back to its bytes and renamed over the file. Where the file cannot be replaced, nothing is graded `bit-exact`: - a file marked `uchg` or `uappnd` (macOS `chflags`), and one marked immutable (`chattr +i`, Linux, through `sudo -n`); - another user's file in a sticky folder of theirs (`sudo -n -u nobody`), on macOS (Permission denied) and Linux (Operation not permitted). At `1efbe6653` each of these was graded `bit-exact`, the demotion failed at its rename, and a later process graded the member `bit-exact` again (the M3 log shows all three macOS cases). A file not yet made is made, as `{}`, at the first certification. - **(2) A demotion is never dropped for a busy lock: it is recorded durably.** It is written at once, with no lock, to a file of its own beside the store, `.<name>.demotion.<32 hex digits>.json` (renamed into place, so readers see all of it or none), which every certification reads under the shared lock. Then it is merged into the store's file under the exclusive lock, waited for at most 5 s; where the wait runs out, it stays in its own file until a later demotion merges it, and the host says so on standard error. With another process holding the lock shared for longer than 5 s, the demotion is now kept, a later process grades the member `uncertified`, and the next demotion merges it and removes its file. At `1efbe6653` the same test lost the demotion. - **(3) No store removes another's file.** Temporary files are `.<name>.<write|probe|demotion>.<process>.<count>.tmp`, matched exactly (two digit groups, one of three kinds), so a file of a store named `<name>.<more>` can never match: it has more dots than the pattern allows. A store `demotions.json` now leaves `.demotions.json.gpu.write.424242.7.tmp` and five other near-misses alone, as does a store `demotions`; at `1efbe6653` all six were deleted. - **(4) The probe is as large as the largest rewrite.** It is sized from the records as a demotion writes them (pretty-printed), with the largest entry one can add: a reason, now kept to its first 1,024 bytes on file (`member::STORE_REASON_BYTES`), at six bytes a byte, and a capacity with every number at its widest, under the identity being certified. Under a file-size limit of the file plus 4,096 bytes (round 5's probe), a 5,000-byte fingerprint and a store written compact now grade nothing `bit-exact` (EFBIG); under a 16 MB limit both are `bit-exact`. - **(5) Links.** The store follows a link link by link, reading each, and never through `canonicalize`. A link in a folder anyone may write that has the sticky bit is refused, whoever made it (the kernel's `fs.protected_symlinks` follows the owner's own; the store is stricter). Every file of the store's is opened with `O_NOFOLLOW` and `O_NONBLOCK` where the target's values are known (Linux x86_64 and arm64, macOS, FreeBSD), and the opened file is checked against the path's device and inode. So a lock planted as a link fails closed and makes nothing at the link's target. At `1efbe6653` a link in a 1777 folder was followed, and a lock that was a link created its target. - **(6) A hard-linked store is refused.** A file with more than one name fails closed, before a rewrite could split it ("has 2 names (a hard link)"); with one name again it is certified. A symbolic link shares a store as before. - **(7) A killed certification's probe is removed.** Every temporary file is made with `create_new` and held locked (`flock`) by its writer while it lives. A certification or a demotion removes one that has gone unchanged for 10 s (`member::STORE_STALE_AFTER`) and whose lock it can take, and leaves one a live writer holds. A 1 MB probe left by a killed process is gone after the next certification; at `1efbe6653` it stayed until a demotion. **Generation** (spec §7.1): - **(8) Settles past 2¹³, and no claim of a longest one.** The "longest-moving settle the rules know" is gone from the spec and the code. A unit of three cells (`capacity::slower`, the review's gadget) moves a cell in every sweep to sweep `11u − 59` and rests at `11u − 58`, for 10 units or more (a unit test checks every size from 10 to 64 and those generation uses, to 1,365). It is stopped just past 2⁹, 2¹⁰, 2¹¹, 2¹² and 2¹³ sweeps, each on as few units as still move there, and at its last moving sweep on as many cells as the capacity takes: 14,956 sweeps on 4,095 cells with none. Where couplings are too few for it to move longer, the units of two are used, as before (couplings 3,000: `slow/cells-1000/to-1990`). `Stale(8182)`, `Stale(10000)`, `Stale(14955)` and a 13-bit counter (`Ring13`) lose the settle grade under no capacity, CUDA's and Metal's, the WebGPU numbers and sweeps 20,000; all kept it at `1efbe6653`. The spec says that no longest settle is known, and that a narrower counter or a stale read past the sweeps these reach is left to the audit. - **(9) Two-cycles that end late.** The same units beside two cells that alternate from the start end in a two-cycle at sweep `11u − 57`: with 46 units at sweep 449, the first sweep of a later batch of 64; with 378 units at 4,101, where a sweep counter of 9 to 12 bits read at the ending gives the other phase. `CycleRing(4095)`, `CycleRing(511)`, `CycleStale(21)`, `CycleStale(4000)`, `MissCycleAfter(21)`, `MissCycleAfter(4095)` and `BatchCycle` (the review's batch mutant) lose the settle grade under no capacity, and the named ones under CUDA's and Metal's, the WebGPU numbers, sweeps 8,193, cells 1,500 and the FPGA's. A counter of 13 bits cannot give a wrong phase at a two-cycle before sweep 16,384, past what these reach; the spec says such faults are left to the audit. - **Cost:** with no capacity, 214 vectors and 2.62×10⁸ cell sweeps (39% battery); the most, 4,096 cells with every other number below reach, 288 vectors and 4.30×10⁸ (50% battery). The bounds (300, 4.5×10⁸, 2×10⁷) are unchanged, and §7.1 gives the new figures. **Battery** (spec §7.2): - **(10) Every call remainder; the cell counts stated.** The workloads a capacity adds now run in calls of 63, 62 and on down to 17 chains, so their calls end in every partial warp of more than 16 chains and every partial workgroup of more than 32. A sampler that leaves a call's chains from lane 32 on at their starts where the call ends in 34 to 62 (`CallTail64Mid`, under no capacity and the FPGA's), or from lane 16 on at even warp counts (`CallTail32Even`), now loses `statistical`; both kept it at `1efbe6653`. For the cell dimension, §7.2 now says which counts the battery runs (the fixed workloads' 2 to 24, `C` and the largest `2^j − 1` under it) and that a fault keyed to another count is never run; `Tail64Even` keeping `statistical` is held by the test as that statement. - **(11) The bound's power, stated.** §7.2 no longer says a sampler drawing from another law "lies far past the bound". It says the bound sits at about 0.011 of divergence a block, so three alike cells drawn 10% too warm (`G` near 250) pass, and 15% too warm (near 490) fail. A test holds both: `WarmFrom(1024, 1.10)` keeps `statistical`, `WarmFrom(1024, 1.15)` loses it. Every answer from a kernel graded `statistical` now says what the grade rests on and what it misses, in its label (`member::STATISTICAL_GRADE`). **Audit threads** (spec §7.3): - **(12) The docs corrected.** `docs/landscape.md` and the change entry said the re-runs take "at most a quarter of the host's cores ... at a low priority". They now say what the code does, as §7.3 did: the job's own thread runs its share at the job's priority, and the audit's threads, a quarter of the cores and at most 4 over the process (none on fewer than 4 cores), run theirs at a low priority. §7.3 adds that several audited jobs each run a share at their own priority, and that a host which must keep them from crowding out others lowers those jobs' own priority. How the work is split is unchanged. - **(13) A CI test of the cap and the priority.** `lower_this_thread` now returns `setpriority`'s result and the priority read back, and an audit thread that cannot be lowered says so on standard error, once. The new test asserts that `audit_threads()` is a quarter of the cores and at most 4; that a lowered thread reads nice + 10 (to 19) on Linux and the background band on macOS; that eight audited calls at once never run more audit threads than the cap, each lowered; and that every thread taken is given back. It runs in the module's tests on Linux (106 now) and in a new step of the bits job on Linux arm64 and macOS, with the store's tests. It fails on each of the review's three mutants (the cap back to `min(cores, 16)`, `setpriority` with an invalid `which`, the pool never given back) and on a fourth that never lowers, on Linux and on macOS. ## The members - **GPU members declare their real limits:** - WebGPU: a field bound of 2³¹ − 1 on both sides of temperature 0, which its 32-bit lanes hold; cells and couplings within a 32nd of a storage binding; 4,194,304 table entries. - CUDA and Metal: 4,194,304 table entries, which no job reaches. - **The CPU reference declares none.** - **The FPGA reference design** (`wai/wai-quantum-landscape-fpga`) declares `member::CAPACITY`: 64 cells; above temperature 0, fields to ±524,287, a cost to 1,048,575 and an uncertain span of 8,192. At temperature 0 it takes any field. - Its host now shortens a table's run of temperatures, down to one, before it refuses a window, so the engine refuses exactly what the declared capacity does. - `the_declared_capacity_is_exactly_what_the_engine_holds` holds that over every settle vector, chains vector and battery workload. ## Tests that failed before this change In `wai-quantum`: | Test | What it holds | |---|---| | `job::tests::a_member_is_held_to_every_vector_within_its_declared_capacity` | A member declaring a field bound of 41 (the floor) is certified `bit-exact` within it, and its answer states the capacity in `member.capacity` and the label. One declaring 40 is refused, with "a field bound at temperature 0 40, and the floor is 41". One declaring 2³¹ − 1 that refuses what it would rather not run (`Choosy`) is `uncertified` for both kernels. The reference's answers carry no `capacity`. | | `landscape_conformance::a_member_is_graded_within_the_capacity_it_declares` | The same, on the conformance stand-ins. A member declaring 41, 70,000 or 2³¹ − 1 earns `bit-exact` within it, where the old rule made 41 and 70,000 `uncertified`. | | `capacity::tests` (five) | The floor is the core set's own reach, with the numbers above. Each declared number declines exactly what is past it, saying which. The hottest sweep has the widest uncertain span. A capacity is stated in numbers and in words, a batch as a split. Every declared number has vectors at its edge, within all the others, including each of the FPGA's. | | `landscape_conformance::every_fault_loses_the_grade_of_the_kernel_it_is_in` | Every fault, with no capacity declared and with its most hostile capacity, each time behind a positive control. | | `landscape_conformance::review_*` (five) | The review's probes p02 to p12 and the skeptic's, as listed above. | | `landscape_conformance::review2_*`, `audit_*`, `review3_*` | The second and third rounds' probes, and the audit's, as listed above. | | `landscape_conformance::review4_*` (seven) | The fourth round's probes: the final sweep's partial groups; long settles within a sweep limit and at their bound; the per-call draw against a member that cheats after the first call; the store failing closed; stores sharing a file; `"parity": null`; the battery's cells, the span past a table limit, and own-draw samplers passing the generated workloads. | | `capacity::tests::long_settles_bands_cells_and_spans_are_generated`, `conformance::tests::the_chi_square_tail_is_the_closed_form` | The fourth round's generation rules, by name and bound, and the generated battery's critical value against the closed form. | | `landscape_conformance::review6_*` (ten) | The sixth round's probes: the store's file replaced at each certification (uchg, uappnd, chattr +i, another user's file in a sticky folder), a demotion kept while the lock is busy, only a store's own files removed, the probe as large as a rewrite, a link in a sticky folder and a lock that is a link, a hard link, a killed certification's probe; settles past 2¹³; late two-cycles; the statistical grade as stated. All ten fail at `1efbe6653` on Linux and macOS. | | `run::tests::the_audit_s_threads_are_capped_over_the_process_and_run_low` | The audit threads' cap, `setpriority`'s result and the priority read back, and every thread given back; fails on each of four mutants on Linux and macOS. | In the FPGA crate: | Test | What it holds | |---|---| | `member::tests::the_model_is_certified_bit_exact_within_its_declared_capacity` | The host certifies the engine's register-level model (which the testbenches hold the logic to) `bit-exact` for both kernels within `CAPACITY`, against the set on main. | | `member::tests::the_declared_capacity_is_exactly_what_the_engine_holds` | The declared numbers are the engine's own limits, case by case over the whole set, and the engine holds every edge vector of its capacity. | | `member::tests::the_capacity_and_the_engine_agree_on_random_jobs` | The review's FPGA probe: 3,000 random jobs, with capacity and engine agreeing on each, and 250 model runs bit-identical. | ## Checked on this head, each workflow leg run as the workflow runs it (via `rb`) This head merges main once, at `f6e302665` (later than `a4766c993`; it carries `4c5b54a27`, which fixes the vanity-metrics red that an earlier main tip, `1929b8436`, would have brought in). Main changed one file in this PR's area, `cuda.rs`, where the merge takes main's fault word: a lookup past the table now stops the call with an error, where this branch marked the cell. The head is the merge plus one commit with round 6. - **Framework (Linux x86_64), the native leg's steps verbatim:** - lib (`--features full`) 106/106, with every test the workflow names run and passed; - `landscape_conformance` 54/54, plus 1 ignored, in 113 s; - float read 1/1, meter bridge 1/1, the CLI verb 2/2, `reproduce.sh` 17 PASS; - `-D warnings` clean for the three feature sets; - the bits leg's commands: debug (290 s) and release, 2 pinned and 10 conformance tests with 45 filtered out; - the new step: the thread test 1/1, and the store's 11 tests; - wasm32-wasip2 under wasmtime 50.0.1, 104/104 (777 s); - FPGA crate 36/36 and clippy `-D warnings` clean; its model certified `bit-exact` for both kernels within its capacity (21/21 settle, 233/233 chains); the `--model` job step answers; - devices (WebGPU): Radeon 8060S and llvmpipe, 9/9 plus 1 ignored, in 353 s, both certified `bit-exact` for both kernels. - **M3 Ultra (macOS), at this head:** - the bits leg: debug (346 s) and release, 2 pinned and 10 conformance tests with 45 filtered out; - the new step: the thread test 1/1 (32 cores, a cap of 4, every audit thread in the background band), and the store's 11 tests, the flags and the sticky folder checked (`["uchg", "uappnd", "sticky"]`); - `landscape_conformance` 54/54, plus 1 ignored; lib (`--features quantum_landscape`) 104/104; - devices (Metal and wgpu-metal): 9/9 plus 1 ignored, in 207 s, both certified `bit-exact` for both kernels. - **Mutants of the thread test**, on the Framework and on the M3: the cap back to `min(cores, 16)` (16 against 4), `setpriority` with an invalid `which` (EINVAL), a thread never lowered (its priority reads unchanged) and the pool never given back (still taken after 120 s) each fail it. - **At `1efbe6653`**, the ten `review6_*` tests copied in, on the Framework and the M3: all ten fail. Run again with each check reported rather than stopped at the first: - every settle and two-cycle fault named above keeps `bit-exact`; - on the M3, `uchg`, `uappnd` and another user's sticky folder each grade `bit-exact`, the demotion fails at its rename, and a later process grades `bit-exact` again; - on the Framework, `chattr +i` grades `bit-exact`; - the long identity and the compact store grade `bit-exact` under the limit; - `CallTail64Mid` (none and FPGA) and `CallTail32Even` keep `statistical`, and the label does not state the grade. - **Generation bounds:** with no capacity, 214 vectors and 2.62×10⁸ cell sweeps; the largest case, 288 vectors and 4.30×10⁸, with 1.71×10⁷ at 0. The bounds are unchanged: 300, 4.5×10⁸ and 2×10⁷. - **Repository checks, run on this head:** - the name check is clean on the changed files, the commit message and this section; - also clean: tests in CI, spec refs, section refs, quantum names, the changelog check, vanity metrics, comparative prose, maintainer products and the wasmtime pin. ## For whoever lands it - The FPGA board itself is to be re-certified on main once this lands; the README says so. Its measurements are from the set of 2026-11-06. - `Member::takes` is gone. Nothing outside this repository implements the landscape `Member`. - `Capacity` gains `sweeps`, and `Capacity::takes_chains` is gone: a batch is now split (`Capacity::batch`). `Capacity::least`, `Capacity::join` and `Capacity::edges` are new. - The FPGA board will meet the edge vectors when it is re-certified. On the model it is `bit-exact` with them. - A store of demotions now holds, beside its file, a demotion in a file of its own (`.<name>.demotion.<hex>.json`) until a later demotion merges it, and each certification rewrites the file as it is. A store file made by round 5's code reads as before. - The bits job gains a step, "The store of demotions and the audit's threads on this platform", on Linux arm64 and macOS. 🤖 Generated with [Claude Code](https://claude.com/claude-code) 
A member states once, as fixed numbers, what its kernels hold
(quantum_landscape::capacity::Capacity): cells and couplings; on each side of
temperature 0 its largest field, field bound and cost; above 0 the cut points
a sweep or the span of uncertain fields it holds; and the chains a call. The
host declines for it exactly the jobs past those numbers, by Capacity::admits,
a function of the job and the numbers alone, so no member declines by choice;
Member::capacity takes the place of Member::takes.

member::certify runs every vector and battery workload within the capacity,
and the grade holds within it: member.capacity in every answer, a sentence in
the label, the number a job is past in its refusal. A member that refuses or
fails a case within its capacity loses the grade, and one that declares less
than the floor, the least capacity that takes every case of the core set, is
not certified.

The GPU members declare their real limits; the CPU reference declares none.
The FPGA reference design declares 64 cells and, above temperature 0, fields
to +/-524,287, a cost to 1,048,575 and an uncertain span of 8,192; a test holds
those numbers to the engine's own limits over the whole set, its host shortens
a table's run of temperatures before it refuses a window, and the host
certifies its register-level model bit-exact within that capacity on the set
as it stands.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-quantum: main into the landscape capacity rule
Some checks failed
wai-quantum variational and algorithm library / does this change touch it (pull_request) Has been cancelled
Details
wai-quantum verdicts and repairs / verdicts, repairs and the intent set · linux (pull_request) Has been cancelled
Details
wai-quantum verdicts and repairs / the intent set and the verdict under wasm32-wasip2 (wasmtime) (pull_request) Has been cancelled
Details
wai-quantum views in agent hosts / views · the page and its engine (pull_request) Has been cancelled
Details
wai-quantum views in agent hosts / views · a scripted host (pull_request) Has been cancelled
Details
wai-quantum views in agent hosts / does this change touch it (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / shader checks · browser build · wasip2 inertness (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · software Vulkan (linux) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · Metal (macos) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · GPU, Vulkan (jetson-hub) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · GPU, Vulkan (thor) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · integrated GPU, Vulkan (framework-128gb) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · browser WebGPU (macos) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · DX12 and Vulkan (cbio-windows) (pull_request) Has been cancelled
Details
wai-quantum verdicts and repairs / does this change touch it (pull_request) Has been cancelled
Details
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (pull_request) Has been cancelled
Details
wai-sink-android native sink library / every ABI, the AAR, and the instrumented tests in a headless emulator · macos (pull_request) Has been cancelled
Details
wai-sink-swift native sink package / libwai slices, desktop tests, simulator tests · macos (pull_request) Has been cancelled
Details
WAI Studio / does this change touch it (pull_request) Has been cancelled
Details
WAI Studio / the catalogue's actions, the unit tests and the core · linux (pull_request) Has been cancelled
Details
WAI Studio / Studio in Chromium and Firefox · macos (pull_request) Has been cancelled
Details
WAI Studio / Studio in WebKit · linux (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Has been cancelled
Details
wai-sink-swift native sink package / does this change touch it (pull_request) Has been cancelled
Details
wai-sink-android native sink library / does this change touch it (pull_request) Has been cancelled
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach · does this change touch it (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / does this change touch it (pull_request) Has been cancelled
Details
wai-web wasm32 / does this change touch it (pull_request) Has been cancelled
Details
43111aa78b 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-quantum: an answer states a capacity only where one is declared, and the floor's numbers are the core set's
Some checks failed
wai-quantum CUDA member / member · CUDA (jetson-hub) (pull_request) Successful in 1m21s
Details
wai-quantum studio and desktop / desktop app · windows (pull_request) Successful in 9m19s
Details
wai-quantum OpenCL member / member · OpenCL GPU and CPU (jetson-hub) (pull_request) Successful in 30s
Details
wai-quantum energy-landscape jobs / reader, kernels, answers and the stated result · linux, release (pull_request) Successful in 15m56s
Details
wai-quantum docs, course and locales / every command and snippet in the docs · linux (pull_request) Successful in 50m42s
Details
wai-quantum service / service energy · linux packages (pull_request) Successful in 1m19s
Details
wai-quantum portable tensor program / tensor program · GPUs (jetson-hub) (pull_request) Successful in 20s
Details
wai-quantum WebGPU member / member · GPU, Vulkan (thor) (pull_request) Successful in 23m15s
Details
wai-quantum WebGPU member / member · GPU, Vulkan (jetson-hub) (pull_request) Successful in 17m20s
Details
wai-quantum energy-landscape GPU members / members · jetson-hub (pull_request) Failing after 58s
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 2m10s
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 2m56s
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Failing after 5m26s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Failing after 13m45s
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 3m8s
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 2m52s
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 4m52s
Details
wai-quantum HIP member / member · HIP absent (linux-arm64) (pull_request) Successful in 3m29s
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Failing after 14m28s
Details
wai-quantum-landscape-fpga reference design / the board's code on the board's processor's architecture · linux-arm64, release (pull_request) Successful in 3m37s
Details
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Successful in 22m22s
Details
wai-quantum npu-cores member / member · npu-cores absent (linux-arm64) (pull_request) Successful in 1m57s
Details
wai-quantum pulse and dynamics / the same bits · linux-arm64 (pull_request) Successful in 3m1s
Details
wai-quantum tensor-engine member / member · tensor engine absent (linux-arm64) (pull_request) Successful in 1m25s
Details
wai-quantum extension points / the registry and the example · linux-arm64 (pull_request) Successful in 7m7s
Details
wai-quantum variational and algorithm library / parameters, gradients, optimisers, VQE, QAOA and builders · linux-arm64, release (pull_request) Successful in 4m52s
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 28m2s
Details
WAI examples / WAI examples · android-app · linux-arm64 (pull_request) Has been cancelled
Details
wai-quantum energy-landscape jobs / the same bits · linux-arm64 (pull_request) Has been cancelled
Details
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (pull_request) Has been cancelled
Details
75edfe063b 
With none declared, as the reference's, an answer carries no capacity, so the
reference's answers keep their exact bytes: CORPUS_20 and every pinned digest
stand. The schema makes capacity an optional object; the spec and changelog
say it is absent where none is declared.

The floor's table entries are 31 (the dense chains, 16 cells with every pair
coupled, at their hottest) and its uncertain span 61 (the wide-fields chains
at their hottest), as worked out from the core set; the test pins them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-quantum: a declared capacity is held at its edges, a batch is split, and the core set crosses windows
Some checks failed
wai-quantum signal processor / processor and member · signal processor, emulated (pull_request) Successful in 23m18s
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Failing after 10m53s
Details
wai-quantum npu-cores member / member · npu-cores, neural processor (framework-128gb silicon) (pull_request) Successful in 3m29s
Details
wai-quantum docs, course and locales / every command and snippet in the docs · linux (pull_request) Successful in 26m20s
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 2m38s
Details
WAI energy receipts / energy receipts · linux (pull_request) Successful in 30m2s
Details
wai-quantum OpenCL member / member · OpenCL GPU (framework-128gb) (pull_request) Successful in 47s
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 3m28s
Details
wai-quantum CPU vector units / member · vector units, avx2 and avx512 (framework-128gb silicon) (pull_request) Successful in 34s
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 3m17s
Details
wai-quantum portable tensor program / tensor program · integrated GPU (framework-128gb) (pull_request) Successful in 34s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 12m14s
Details
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Successful in 15m5s
Details
wai-quantum-landscape-fpga reference design / the board's code on the board's processor's architecture · linux-arm64, release (pull_request) Successful in 2m1s
Details
wai-quantum npu-cores member / member · npu-cores absent (linux-arm64) (pull_request) Successful in 47s
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Failing after 4m25s
Details
wai-quantum HIP member / member · HIP absent (linux-arm64) (pull_request) Successful in 3m1s
Details
wai-quantum pulse and dynamics / the same bits · linux-arm64 (pull_request) Successful in 2m56s
Details
wai-quantum tensor-engine member / member · tensor engine absent (linux-arm64) (pull_request) Successful in 39s
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Failing after 14m47s
Details
wai-quantum extension points / the registry and the example · linux-arm64 (pull_request) Successful in 4m15s
Details
wai-quantum CUDA member / member · CUDA (thor) (pull_request) Successful in 2m22s
Details
wai-quantum OpenCL member / member · OpenCL GPU and CPU (thor) (pull_request) Successful in 1m36s
Details
wai-quantum variational and algorithm library / parameters, gradients, optimisers, VQE, QAOA and builders · linux-arm64, release (pull_request) Successful in 4m9s
Details
wai-quantum WebGPU member / member · integrated GPU, Vulkan (framework-128gb) (pull_request) Successful in 13m18s
Details
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (pull_request) Successful in 7m20s
Details
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Successful in 23m6s
Details
WAI Studio / Studio in WebKit · linux (pull_request) Successful in 37m14s
Details
wai-quantum command line / command line · linux (pull_request) Failing after 1h0m5s
Details
wai-quantum WebGPU member / member · GPU, Vulkan (thor) (pull_request) Successful in 24m50s
Details
28fa25d932 
The adversarial check of 75edfe063 found faulty members certified bit-exact
by declaring a capacity: a declared number removed fixed vectors, and the set
samples each number at a few points only.

- Capacity::edges: for each number declared below what a job can reach,
  certification runs vectors at exactly that number, within every other
  number declared, the reference their oracle; hot and cold above 0, so a
  field reached exactly is drawn exactly. A member that declares nothing runs
  the fixed set only, and the reference's answer bytes are unchanged.
- sweeps is a capacity number (a settle's bound, a schedule's length); the
  core set holds 5,000 sweeps on 32 cells within the floor, which cross
  windows by table and by work, and the full set 200,000 sweeps of two cells.
- chains_per_call is a batch, not a limit: certification splits every vector
  and battery workload into calls of the size run time uses (Capacity::batch,
  shared with run.rs), plus one call of exactly that many; words() no longer
  sends such jobs elsewhere, and the floor holds no batch.
- certify reads the capacity once and holds the vectors to that reading.
- The FPGA host's grade lines name the capacity; docs state what the GPU
  members declare; spec §5, §5.1, §7 and §7.1, the schema and the change
  note follow.
- Every fault test also runs declaring its most hostile capacity, behind a
  positive control; the review's probes (p02 to p12, the skeptic's window
  member, the FPGA's random jobs) are kept as tests. vectors.json rebuilt.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The second adversarial check of #678 found ten more fault classes that a
finite set misses, each another axis sampled at a few points. So:

- Capacity::generate makes vectors by rule from any capacity, none included:
  every cell count at and beside a power of two up to what a workload can
  hold (4,096 with none), every cell moving; every call size to 32 and each
  band of a wavefront past it, and a whole batch; the longest row, its whole
  length needed; fields at the wrap points of 16, 24 and 32-bit lanes, alone,
  through couplings and beside the largest cost, at 0, above it and ending at
  0; a corner with every number at its most; a run past draw index 2^24. The
  edges reach a declared table and span exactly, and the field bound at 0 by
  a field alone. Battery workloads at a declared cell count, couplings and
  schedule length read a few blocks of many (BatteryCase::read). The cost is
  bounded and pinned by a test: at most 200 vectors.
- The audit (spec 7.3): the last chain of every call and one chain chosen by
  the job's digest run again on the reference, and every settle within a work
  budget. At the first difference the member is demoted to uncertified, the
  job answered from the reference, and later answers carry member.demoted.
- The reference's sampler skips sweeps at 0 after a fixed point; its bits are
  unchanged.
- The CUDA chains kernel reads its table only within its length: a field past
  it, which only a fault gives, leaves a cell no answer passes, and no illegal
  address poisons the context.
- Text: a decline is the host's; a member run by name claims no grade; the
  FPGA workflow's greps follow the renamed lines; Breaking lines for every API
  break against main.
- Every fault test also runs under realistic capacities; the review's probes
  are kept as tests; spec 5, 5.1, 5.3, 7, 7.1, 7.2 and a new 7.3.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The third adversarial check of #678 found the audit trusting what a member
reports or can predict, and generation falling short at small and declared
capacities.

- The audit checks one chain of every seed's run, and the last of every call,
  in run, replay, sweep and compare. It decides a settle's re-run from the work
  the host asked for, never the sweeps the member reports, and compares the
  reference's settle as far as a 2^24 budget goes. It draws with a host key made
  at start and a count every draw moves on; each audited answer records what it
  checked and a commitment to the key (`audit`).
- A demotion is kept by identity (Member::fingerprint and the id) in
  member::Demotions, in a file where the host names one: the FPGA host does. A
  second certification or another declared capacity does not clear it.
- A kernel graded statistical is placed only where a job asks for it
  ("parity": "statistical").
- Generation: lane vectors packed to what the capacity takes; remainder-band
  ladder sizes quenched; a wave as long as a settle can be for every capacity;
  a corner that moves at 0 and reaches the field bound through a cell's every
  coupling; a coupling sum past a narrow lane; annealing-shaped vectors cold
  enough for a declared span; a battery of exactly the declared cells, and of
  1,023 with none. The cost bounds are constants a test holds over random
  capacities.
- The CUDA out-of-table mark is no longer claimed to mark the answer.
- The round-3 probes are kept as tests; spec 7.1 and 7.3 follow.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-quantum: the change entry names only the breaks the gate finds
Some checks failed
WAI energy receipts / energy receipts · macos (pull_request) Successful in 59m29s
Details
WAI energy receipts / energy receipts · linux (pull_request) Successful in 1h41m31s
Details
wai-quantum CUDA member / member · CUDA (jetson-hub) (pull_request) Successful in 1m51s
Details
wai-quantum OpenCL member / member · OpenCL GPU and CPU (jetson-hub) (pull_request) Successful in 42s
Details
wai-quantum portable tensor program / tensor program · GPUs (jetson-hub) (pull_request) Successful in 27s
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Successful in 3m35s
Details
wai-quantum service / service energy · linux packages (pull_request) Successful in 2m9s
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Failing after 4m59s
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Successful in 7m35s
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 55s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 15m7s
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 48s
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Failing after 11m50s
Details
wai-quantum WebGPU member / member · GPU, Vulkan (jetson-hub) (pull_request) Successful in 24m39s
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 1m52s
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 4m37s
Details
wai-quantum energy-landscape GPU members / members · jetson-hub (pull_request) Failing after 4m16s
Details
wai-quantum HIP member / member · HIP absent (linux-arm64) (pull_request) Successful in 2m54s
Details
wai-quantum-landscape-fpga reference design / the board's code on the board's processor's architecture · linux-arm64, release (pull_request) Successful in 2m44s
Details
wai-quantum pulse and dynamics / the same bits · linux-arm64 (pull_request) Successful in 3m15s
Details
wai-quantum npu-cores member / member · npu-cores absent (linux-arm64) (pull_request) Successful in 1m0s
Details
wai-quantum tensor-engine member / member · tensor engine absent (linux-arm64) (pull_request) Successful in 1m18s
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Failing after 30m25s
Details
wai-quantum variational and algorithm library / parameters, gradients, optimisers, VQE, QAOA and builders · linux-arm64, release (pull_request) Successful in 4m19s
Details
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Successful in 22m1s
Details
wai-quantum extension points / the registry and the example · linux-arm64 (pull_request) Successful in 5m53s
Details
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (pull_request) Successful in 6m12s
Details
WAI examples / WAI examples · android-app · linux-arm64 (pull_request) Failing after 4m30s
Details
wai-quantum energy-landscape jobs / the same bits · linux-arm64 (pull_request) Successful in 7m38s
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Has been cancelled
Details
f290012f4e 
Prepared::statistical is a new field of a struct with private fields, which
the API gate does not count as a break.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
With the CUDA fault fixed, jetson-hub's leg still lost a member: the
RTX 4050 through Vulkan, from the fourth fault on. The disk was not the
cause. The leg compiled and wrote its files, and the same tests failed
twice more with 248 GB free. Nor was the card's memory: at most 630 of
6,141 MiB was in use.

Each discovery made its own wgpu instance. That host's NVIDIA Vulkan
driver (595.99) lists its card to a process's first ten instances and
not after, even with every one dropped. At that moment it logs
NV_ERR_NO_MEMORY for a host-memory allocation. A process that looks
again, as the device tests do for every test and every faulted kernel,
found the card gone; the order of the tests only decided where.

On jetson-hub, one process discovering 60 times:
- an instance a discovery: the card is found 10 times, then not again;
- one instance for the process: the card is found 60 times.

Discovery now takes the process's one instance.
a_member_is_found_however_often_the_host_looks discovers twelve times
in one process and wants the same members each time. On the Framework
(AMD, through Vulkan) and Thor (NVIDIA), the device tests, it among
them, pass twice each. The workflow expects 9 device tests where it
expected 8.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A fourth adversarial check of the landscape capacity rule (#678) confirmed 22 findings. This
commit fixes them and keeps each probe as a test.

Generation (spec §7.1):
- Ladder sizes in a remainder band also run hot and then one sweep at 0, the final sweep an
  engine runs after hot ones.
- The wave comes to rest within a declared sweep limit, where it was dropped before.
- The widest wave is also stopped at its bound while it still moves: past 2^9, 2^10 and
  2^11 sweeps, and one sweep before it would rest.
- The battery's alike cells follow a declared cell count, up to 4,096.
- The uncertain span is reached where a table limit is the narrower, and where no span is
  declared.
- The workloads a capacity adds to the battery hold each block at a 10^-8 chance of failing
  a correct sampler, and read only a few blocks.

The audit (spec §7.3):
- Every call checks its last chain and one chain of each run it holds, drawn afresh, so
  timing the host tells a member nothing about the next call.
- The re-runs are spread across the host's cores.
- An answer no longer carries a key digest that nothing could open.
- The text states what the settle audit catches past its budget, and the wall-time cost.

The demotion store reads its file at every certification. It merges each demotion under a
file lock, writing it to a file of its own and renaming that into place. It fails closed:
where the file is corrupt, unreadable or unwritable, or the FPGA host has no HOME, it logs
the reason and grades no kernel bit-exact.

"parity": null is the default. §2 and §3 list parity, audit and member.demoted.

This also carries #673's one WebGPU instance per process, so the NVIDIA driver keeps
listing its Vulkan adapter.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-quantum: the per-call draw's probe runs chains that come to rest apart, and §7.3 gives the wall time over two runs
Some checks failed
WAI Studio / Studio in WebKit · linux (pull_request) Successful in 21m44s
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Failing after 11m1s
Details
wai-quantum command line / command line · linux (pull_request) Successful in 40m43s
Details
WAI energy receipts / energy receipts · macos (pull_request) Successful in 1h10m33s
Details
wai-quantum energy-landscape GPU members / members · jetson-hub (pull_request) Successful in 13m26s
Details
WAI examples / WAI examples · android-app · linux-arm64 (pull_request) Successful in 8m8s
Details
wai-quantum CUDA member / member · CUDA (jetson-hub) (pull_request) Successful in 2m9s
Details
wai-quantum OpenCL member / member · OpenCL GPU and CPU (jetson-hub) (pull_request) Successful in 49s
Details
wai-quantum service / service energy · linux packages (pull_request) Successful in 2m26s
Details
wai-quantum portable tensor program / tensor program · GPUs (jetson-hub) (pull_request) Successful in 35s
Details
wai-quantum energy-landscape jobs / the same bits · linux-arm64 (pull_request) Successful in 7m25s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 8m43s
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 41s
Details
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Successful in 19m4s
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 16s
Details
wai-quantum WebGPU member / member · GPU, Vulkan (jetson-hub) (pull_request) Successful in 30m35s
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 43s
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 24m55s
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 2m28s
Details
wai-quantum HIP member / member · HIP absent (linux-arm64) (pull_request) Successful in 1m32s
Details
wai-quantum-landscape-fpga reference design / the board's code on the board's processor's architecture · linux-arm64, release (pull_request) Successful in 1m37s
Details
wai-quantum npu-cores member / member · npu-cores absent (linux-arm64) (pull_request) Successful in 41s
Details
wai-quantum tensor-engine member / member · tensor engine absent (linux-arm64) (pull_request) Successful in 53s
Details
wai-quantum pulse and dynamics / the same bits · linux-arm64 (pull_request) Successful in 2m7s
Details
wai-quantum variational and algorithm library / parameters, gradients, optimisers, VQE, QAOA and builders · linux-arm64, release (pull_request) Successful in 3m3s
Details
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (pull_request) Successful in 3m25s
Details
wai-quantum extension points / the registry and the example · linux-arm64 (pull_request) Successful in 4m33s
Details
WAI energy receipts / energy receipts · linux (pull_request) Successful in 2h46m46s
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 2h8m45s
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 2h12m53s
Details
054017bc82 
The cheat that copies a call's last chain went unseen on a six-cell job whose chains often
came to rest in the same state; on a ring of 32 cells they do not.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
A fifth adversarial check of the landscape capacity rule (#678) confirmed 15 findings. This
commit fixes them and keeps each probe as a test (review5_* in landscape_conformance).

The demotion store:
- At every certification it writes, syncs and removes a file as large as its next rewrite,
  so a folder that stopped taking writes, a full disk or a file-size limit grades nothing
  bit-exact.
- An empty WAI_LANDSCAPE_DEMOTIONS is as if unset, and a path naming no file is a broken
  store.
- A linked store is its target's, and a link to nothing fails closed.
- Its lock is waited for at most 5 s; past that, that certification grades nothing
  bit-exact, and the next waits again.
- A rewrite keeps the file's mode and removes files a crashed writer left.

Generation:
- The wave is stopped one sweep before its rest.
- A settle of two-cell units that moves for 2n - 10 sweeps is stopped past 2^9 to 2^12
  sweeps and at its last moving sweep.
- The final sweep at 0 runs at odd, even and middle remainders of a partial warp and
  workgroup, after two, three and a cold sweep above 0, on cells tied at the cost so that
  it moves them.

The battery:
- Its alike cells reach every cell a workload can hold (4,096 with none), every cell read,
  with a second count at a partial group's most.
- The workloads a capacity adds run in calls ending in a partial warp, held by a
  likelihood-ratio bound from the method of types, which holds whatever the law.

The audit's re-runs take at most a quarter of the host's cores, 4 at most over the
process, at a low priority. §7.3 states its cost as work.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-quantum: the battery test's mutants declare 32 cells, so they meet the whole fixed battery and not 4,096 alike cells
Some checks failed
wai-quantum views in agent hosts / views · the page and its engine (pull_request) Has been cancelled
Details
wai-quantum views in agent hosts / views · a scripted host (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / does this change touch it (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / shader checks · browser build · wasip2 inertness (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · software Vulkan (linux) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · Metal (macos) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · GPU, Vulkan (jetson-hub) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · GPU, Vulkan (thor) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · integrated GPU, Vulkan (framework-128gb) (pull_request) Has been cancelled
Details
wai-quantum WebGPU member / member · browser WebGPU (macos) (pull_request) Has been cancelled
Details
wai-sink-android native sink library / does this change touch it (pull_request) Has been cancelled
Details
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (pull_request) Has been cancelled
Details
wai-sink-android native sink library / every ABI, the AAR, and the instrumented tests in a headless emulator · macos (pull_request) Has been cancelled
Details
wai-sink-swift native sink package / does this change touch it (pull_request) Has been cancelled
Details
wai-sink-swift native sink package / libwai slices, desktop tests, simulator tests · macos (pull_request) Has been cancelled
Details
WAI mbt2018_mean integer decode (regenerated vectors) / does this change touch it (pull_request) Has been cancelled
Details
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Has been cancelled
Details
WAI Studio / does this change touch it (pull_request) Has been cancelled
Details
WAI Studio / the catalogue's actions, the unit tests and the core · linux (pull_request) Has been cancelled
Details
WAI Studio / Studio in Chromium and Firefox · macos (pull_request) Has been cancelled
Details
WAI Studio / Studio in WebKit · linux (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach · does this change touch it (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Has been cancelled
Details
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Has been cancelled
Details
wai-web wasm32 / does this change touch it (pull_request) Has been cancelled
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Has been cancelled
Details
wai-int-module WAISM module of record / does this change touch it (pull_request) Successful in 13s
Details
wai-int-module WAISM module of record / linux · both checkers, wasmtime (Cranelift, Winch), Wasmi and Node (pull_request) Has been skipped
Details
wai-int-module WAISM module of record / linux-arm64 · both checkers, wasmtime (Cranelift, Winch), Wasmi and Node (pull_request) Has been skipped
Details
wai-int-module WAISM module of record / the module of record in Chromium (pull_request) Has been skipped
Details
1efbe6653c 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The CUDA sampling kernel takes main's fault word: a lookup past its table stops the call
with an error, where this branch had marked the cell.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
wai-quantum: the store rewrites its file at each certification as a demotion would, keeps a demotion in a file of its own, and generation reaches settles past 2^13 and late two-cycles
Some checks failed
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Successful in 4m56s
Details
wai-quantum docs, course and locales / every command and snippet in the docs · linux (pull_request) Successful in 19m58s
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Failing after 9m9s
Details
wai-quantum CUDA member / member · CUDA (thor) (pull_request) Successful in 1m57s
Details
wai-quantum OpenCL member / member · OpenCL GPU and CPU (thor) (pull_request) Successful in 51s
Details
WAI conformance / cargo-class corpora · linux (pull_request) Successful in 27m50s
Details
WAI Studio / Studio in WebKit · linux (pull_request) Successful in 12m40s
Details
wai-quantum CUDA member / member · CUDA (jetson-hub) (pull_request) Successful in 1m44s
Details
wai-quantum OpenCL member / member · OpenCL GPU and CPU (jetson-hub) (pull_request) Successful in 40s
Details
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Successful in 21m21s
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 15s
Details
wai-quantum service / service energy · linux packages (pull_request) Successful in 2m6s
Details
wai-quantum portable tensor program / tensor program · GPUs (jetson-hub) (pull_request) Successful in 28s
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 54s
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 30m54s
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 2m35s
Details
wai-quantum-landscape-fpga reference design / the member against the model of the logic, and the logic against the model · linux, release (pull_request) Successful in 38m3s
Details
wai-quantum HIP member / member · HIP absent (linux-arm64) (pull_request) Successful in 1m40s
Details
wai-quantum-landscape-fpga reference design / the board's code on the board's processor's architecture · linux-arm64, release (pull_request) Successful in 1m19s
Details
wai-quantum npu-cores member / member · npu-cores absent (linux-arm64) (pull_request) Successful in 35s
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Failing after 4m40s
Details
wai-quantum pulse and dynamics / the same bits · linux-arm64 (pull_request) Successful in 1m59s
Details
wai-quantum WebGPU member / member · GPU, Vulkan (thor) (pull_request) Successful in 23m22s
Details
wai-quantum tensor-engine member / member · tensor engine absent (linux-arm64) (pull_request) Successful in 28s
Details
wai-quantum variational and algorithm library / parameters, gradients, optimisers, VQE, QAOA and builders · linux-arm64, release (pull_request) Successful in 2m15s
Details
wai-quantum command line / command line · linux (pull_request) Successful in 51m43s
Details
wai-quantum extension points / the registry and the example · linux-arm64 (pull_request) Successful in 5m11s
Details
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (pull_request) Successful in 4m2s
Details
wai-quantum WebGPU member / member · GPU, Vulkan (jetson-hub) (pull_request) Successful in 25m32s
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Failing after 2h11m29s
Details
72829ec4ca 
A sixth adversarial check of the landscape capacity rule (#678) confirmed 13 findings
(1 medium, 12 low). This commit fixes them and keeps each probe as a test (review6_* in
landscape_conformance, and run::tests::the_audit_s_threads_are_capped_over_the_process_and_run_low).

The demotion store:
- Each certification rewrites the store's file as it is, the way a demotion does: a file of
  its own as large as the largest rewrite a demotion can make, synced, cut back and renamed
  over the file. A file another user owns in a sticky folder, one marked uchg or uappnd
  (chflags) or immutable (chattr +i), a long identity and a store written compact now grade
  nothing bit-exact. A reason is kept to its first 1,024 bytes (STORE_REASON_BYTES), so the
  rewrite's size is bounded.
- A demotion is written at once to a file of its own beside the store
  (.<name>.demotion.<hex>.json), with no lock to wait for, which every certification reads,
  and then merged under the exclusive lock. A lock held past 5 s leaves it in its own file
  until a later demotion merges it: it is kept, not dropped.
- The store's temporary files are matched exactly (.<name>.<write|probe|demotion>.<n>.<n>.tmp),
  made with create_new and held locked by their writer. One unchanged for 10 s that no
  writer holds is removed at the next certification or demotion (STORE_STALE_AFTER), so a
  killed certification's probe goes, and no store removes another's file.
- Links are followed link by link; a link in a world-writable sticky folder is not followed,
  and no file of the store's is opened through a link (O_NOFOLLOW, and the opened file
  checked against the path). A file with two names (a hard link) is refused.

Generation:
- Units of three cells that move to sweep 11u - 59 (14,956 on 4,095 cells) are stopped past
  2^9 to 2^13 sweeps, each on as few units as still move there, and at their last move;
  units of two where couplings are scarce. The claim of a longest-moving settle is gone.
  Stale(8182), Stale(10000), Stale(14955) and a 13-bit counter lose the settle grade.
- The same units beside an alternating pair end in a two-cycle at sweep 449, the first of a
  later batch of 64, and at 4,101, where 9- to 12-bit counters read the other phase.

The battery:
- Its added workloads run in calls of 63 down to 17 chains, every partial warp and
  workgroup; a call's partial group wrong at 34 to 62, or at even counts, loses statistical.
- Section 7.2 states what the likelihood-ratio bound misses (a law some 10% off, a count of
  cells the battery does not run), a test holds each statement, and every answer from a
  kernel graded statistical says so (member::STATISTICAL_GRADE).

The audit:
- The crate docs and the change entry say the job's own thread runs its share at the job's
  priority, beside the low-priority audit threads; an audit thread whose priority cannot be
  lowered says so once. A test, run with the module's tests on Linux and in the bits job on
  Linux arm64 and macOS, holds the cap, setpriority's result and the priority read back, and
  that every thread is given back. The bits job also runs the store's tests on those
  platforms' file systems.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
dcharlot closed this pull request 2026-11-09 15:58:11 -05:00
Some checks failed
WAI examples / WAI examples · does this change touch them (pull_request) Successful in 21s
Details
jouleclaw public surface must stay documented / Public-surface audit (jouleclaw-rs) (pull_request) Successful in 45s
Details
WAI breaking changes and the conformance runner / WAI breaking · does this change touch WAI (pull_request) Successful in 35s
Details
joule-code conformance gate / joule-moq-relay, its own energy on a counter (macos) (pull_request) Successful in 56s
Details
wai-quantum energy-landscape GPU members / does this change touch it (pull_request) Successful in 11s
Details
wai-quantum energy-landscape jobs / does this change touch it (pull_request) Successful in 15s
Details
jouleclaw fabrics / cuda (linux, RTX 4050 + Vulkan loader) (pull_request) Successful in 57s
Details
jouleclaw fabrics / metal (macOS, Apple GPU) (pull_request) Successful in 1m28s
Details
jouleclaw fabrics / vulkan (linux, RTX 4050 + Vulkan loader) (pull_request) Successful in 28s
Details
wai-quantum wasmQ / does this change touch it (pull_request) Successful in 13s
Details
WAI breaking changes and the conformance runner / WAI breaking · wire, record and API against main · linux (pull_request) Failing after 1m10s
Details
wai-quantum wasmQ / the reference modules rebuild to their modules of record · linux (pull_request) Successful in 33s
Details
joule-code conformance gate / joule-moq-relay, every target (pull_request) Successful in 3m5s
Details
wai-quantum wasmQ / profile, engines, reference modules, adversarial, vectors · macos (pull_request) Successful in 1m49s
Details
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 4m5s
Details
joule-code conformance gate / Build + round-trip C1-C4 vectors (pull_request) Successful in 4m18s
Details
wai-quantum on every processor / emulated · aarch64-unknown-linux-gnu (pull_request) Successful in 3m45s
Details
wai-quantum wasmQ / interpreter and vectors under wasm32-wasip2 (wasmtime) (pull_request) Successful in 3m35s
Details
wai-quantum on every processor / emulated · i686-unknown-linux-gnu (pull_request) Successful in 4m41s
Details
wai-quantum wasmQ / profile, engines, reference modules, adversarial, vectors · linux (pull_request) Successful in 4m19s
Details
wai-quantum on every processor / emulated · riscv64gc-unknown-linux-gnu (pull_request) Successful in 5m0s
Details
wai-quantum on every processor / emulated · armv7-unknown-linux-gnueabihf (pull_request) Successful in 5m38s
Details
joule-code conformance gate / joule-moq-ingest, every target (pull_request) Successful in 7m22s
Details
WAI breaking changes and the conformance runner / WAI breaking and conform · their tests, and the independent verifiers through wai conform · linux (pull_request) Successful in 6m28s
Details
wai-quantum on every processor / emulated · powerpc64le-unknown-linux-gnu (pull_request) Successful in 6m12s
Details
wai-quantum energy-landscape GPU members / members · mac-studio (pull_request) Successful in 7m4s
Details
wai-quantum energy-landscape jobs / native against WebAssembly, over many seeds (pull_request) Successful in 6m50s
Details
wai-quantum energy-landscape jobs / the same bits · macos (pull_request) Successful in 6m57s
Details
wai-quantum on every processor / emulated · sparc64-unknown-linux-gnu (pull_request) Successful in 7m13s
Details
wai-quantum on every processor / emulated · s390x-unknown-linux-gnu (pull_request) Successful in 7m21s
Details
wai-quantum energy-landscape GPU members / members · framework-128gb (pull_request) Successful in 7m26s
Details
WAI examples / WAI examples · android-app · linux-arm64 (pull_request) Successful in 8m20s
Details
wai-quantum on every processor / emulated · powerpc64-unknown-linux-gnu (pull_request) Successful in 8m5s
Details
wai-quantum on every processor / emulated · loongarch64-unknown-linux-gnu (pull_request) Successful in 10m35s
Details
wai-quantum energy-landscape jobs / reader, kernels, answers and the stated result · linux, release (pull_request) Successful in 11m4s
Details
WAI examples / WAI examples · portable · linux (pull_request) Successful in 12m5s
Details
wai-quantum WebGPU member / member · DX12 and Vulkan (cbio-windows) (pull_request) Successful in 12m14s
Details
wai-quantum energy-landscape jobs / the same bits · linux-arm64 (pull_request) Successful in 12m37s
Details
wai-quantum energy-landscape GPU members / members · jetson-hub (pull_request) Successful in 14m32s
Details
WAI examples / WAI examples · the archive, the readiness check, the browser and Apple · macos (pull_request) Successful in 16m18s
Details
wai-quantum energy-landscape jobs / the module under wasm32-wasip2 (wasmtime) (pull_request) Successful in 16m28s
Details
joule-moq-remote host agent / joule-moq-remote · does this change touch it (pull_request) Successful in 9s
Details
joule-moq-remote host agent / joule-moq-remote, every target (linux-arm64) (pull_request) Has been skipped
Details
joule-moq-remote host agent / joule-moq-remote, every target (macos) (pull_request) Has been skipped
Details
joule-moq-web browser client / joule-moq-web · does this change touch it (pull_request) Successful in 12s
Details
joule-moq-room room service / joule-moq-room · does this change touch it (pull_request) Successful in 12s
Details
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Has been skipped
Details
joule-moq-room room service / joule-moq-room, every target (pull_request) Has been skipped
Details
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 9s
Details
wai-app and Create / wai-app · does this change touch it (pull_request) Successful in 14s
Details
wai-audit collector and player integration / does this change touch it (pull_request) Successful in 11s
Details
wai cross-architecture byte-equality / does this change touch it (pull_request) Successful in 12s
Details
WAI operation catalogue / does this change touch it (pull_request) Successful in 12s
Details
wai-app and Create / wai-app · tests, clippy, the line language's verifier (linux) (pull_request) Has been skipped
Details
wai-app and Create / wai-app · Create, browser end-to-end (macos) (pull_request) Has been skipped
Details
wai cross-architecture byte-equality / linux-aarch64 (pull_request) Has been skipped
Details
wai cross-architecture byte-equality / linux-x86_64 (pull_request) Has been skipped
Details
wai cross-architecture byte-equality / macos-arm64 (reference) (pull_request) Has been skipped
Details
wai cross-architecture byte-equality / windows-x86_64 (pull_request) Has been skipped
Details
WAI conformance / does this change touch it (pull_request) Successful in 9s
Details
WAI energy receipts / does this change touch it (pull_request) Successful in 16s
Details
wai formal verification (integer core) / does this change touch it (pull_request) Successful in 12s
Details
WAI HTTP delivery / WAI HTTP · does this change touch it (pull_request) Successful in 11s
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 0/3 (pull_request) Has been skipped
Details
wai-fleet service / does this change touch it (pull_request) Successful in 13s
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 1/3 (pull_request) Has been skipped
Details
wai-fleet service / service · linux (pull_request) Has been skipped
Details
WAI HTTP delivery / HTTP corpus · falsify mutations 2/3 (pull_request) Has been skipped
Details
wai-fleet service / service · macos (pull_request) Has been skipped
Details
WAI HTTP delivery / HTTP corpus · falsify patches 0/3 (pull_request) Has been skipped
Details
wai formal verification (integer core) / every harness in one shard (pull_request) Has been skipped
Details
WAI HTTP delivery / HTTP corpus · falsify patches 1/3 (pull_request) Has been skipped
Details
wai formal verification (integer core) / kani (arith) (pull_request) Has been skipped
Details
WAI HTTP delivery / HTTP corpus · falsify patches 2/3 (pull_request) Has been skipped
Details
wai formal verification (integer core) / kani (isqrt512) (pull_request) Has been skipped
Details
WAI HTTP delivery / HTTP corpus · every patch and mutation in exactly one shard (pull_request) Has been skipped
Details
wai formal verification (integer core) / kani (plan) (pull_request) Has been skipped
Details
WAI HTTP delivery / HTTP corpus · verified both ways, and the differential (pull_request) Has been skipped
Details
wai formal verification (integer core) / kani (sound) (pull_request) Has been skipped
Details
WAI HTTP delivery / cache rules · controls and labelled caches (pull_request) Has been skipped
Details
wai formal verification (integer core) / kani (stage) (pull_request) Has been skipped
Details
wai formal verification (integer core) / kani (rans64-t2) (pull_request) Has been skipped
Details
wai formal verification (integer core) / kani (stage-long) (pull_request) Has been skipped
Details
wai formal verification (integer core) / kani (integer-core) (pull_request) Has been skipped
Details
WAI JPEG-AI whole decode (pinned inputs, required) / does this change touch it (pull_request) Successful in 16s
Details
wai key · Windows / does this change touch it (pull_request) Successful in 13s
Details
wai-key-proxy / does this change touch it (pull_request) Successful in 15s
Details
wai-ledger service / does this change touch it (pull_request) Successful in 12s
Details
wai key · Windows / wai key and the toolchain's tests · windows (pull_request) Has been skipped
Details
wai-key-proxy / proxy · linux (pull_request) Has been skipped
Details
WAI JPEG-AI whole decode (pinned inputs, required) / fetch pinned JPEG-AI inputs → whole decode + pixel hash, required (pull_request) Has been skipped
Details
wai-ledger service / service · linux (pull_request) Has been skipped
Details
wai-ledger service / service · macos (pull_request) Has been skipped
Details
wai-ops-gpu integer operators on GPUs / does this change touch it (pull_request) Successful in 17s
Details
wai-ops-npu integer operators on neural processors / does this change touch it (pull_request) Successful in 16s
Details
WAI neural decoders end-to-end / does this change touch it (pull_request) Successful in 19s
Details
WAI neural sink gates / does this change touch it (pull_request) Successful in 18s
Details
WAI neural sink gates / model-free refusals of the neural sink (pull_request) Has been skipped
Details
WAI neural sink gates / the neural-processor path refuses a bit-exact decode (macOS) (pull_request) Has been skipped
Details
WAI neural sink gates / the exact JPEG-AI decoder reports its path (pinned inputs, required) (pull_request) Has been skipped
Details
wai-ops-gpu integer operators on GPUs / builds · no adapter is not a pass (linux) (pull_request) Has been skipped
Details
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Has been skipped
Details
wai-ops-npu integer operators on neural processors / neural processor (framework-128gb silicon) (pull_request) Has been skipped
Details
wai-ops-npu integer operators on neural processors / builds · no device is not a pass (linux-arm64) (pull_request) Has been skipped
Details
WAI neural decoders end-to-end / synthetic fixtures → Rust decode → reference (±4) (pull_request) Has been skipped
Details
wai-pack / wai-pack · does this change touch it (pull_request) Successful in 12s
Details
wai-quantum command line / does this change touch it (pull_request) Successful in 14s
Details
wai-ops integer operators / does this change touch it (pull_request) Successful in 16s
Details
wai-quantum contract / does this change touch it (pull_request) Successful in 13s
Details
wai-pack / wai-pack · linux (pull_request) Has been skipped
Details
wai-pack / wai-pack · linux-arm64 (pull_request) Has been skipped
Details
wai-pack / wai-pack · macos (pull_request) Has been skipped
Details
wai-pack / wai-pack · independent verifier (Python) (pull_request) Has been skipped
Details
wai-pack / wai-pack · the floor through a media prober (pull_request) Has been skipped
Details
wai-pack / wai-pack · dependency licences (pull_request) Has been skipped
Details
wai-ops integer operators / linux-aarch64 (pull_request) Has been skipped
Details
wai-ops integer operators / linux-x86_64 (pull_request) Has been skipped
Details
wai-ops integer operators / macos-arm64 (pull_request) Has been skipped
Details
wai-ops integer operators / wasm32-wasip2 (wasmtime) (pull_request) Has been skipped
Details
wai-ops integer operators / wasm32 under Node (pull_request) Has been skipped
Details
wai-ops integer operators / independent checker (Python) (pull_request) Has been skipped
Details
wai-quantum docs, course and locales / does this change touch it (pull_request) Successful in 11s
Details
wai-quantum signal processor / does this change touch it (pull_request) Successful in 14s
Details
wai-quantum dataflow member / does this change touch it (pull_request) Successful in 16s
Details
wai-quantum CUDA member / does this change touch it (pull_request) Successful in 17s
Details
wai-quantum editors / does this change touch it (pull_request) Successful in 9s
Details
wai-quantum resource estimation / does this change touch it (pull_request) Successful in 13s
Details
wai-quantum FPGA member / does this change touch it (pull_request) Successful in 14s
Details
wai-quantum other formats / does this change touch it (pull_request) Successful in 17s
Details
wai-quantum HIP member / does this change touch it (pull_request) Successful in 16s
Details
wai-quantum for JavaScript / does this change touch it (pull_request) Successful in 14s
Details
wai-quantum-landscape-fpga reference design / does this change touch it (pull_request) Successful in 18s
Details
wai-quantum OpenQASM reader / does this change touch it (pull_request) Successful in 17s
Details
wai-quantum Metal member / does this change touch it (pull_request) Successful in 12s
Details
wai-quantum npu-cores member / does this change touch it (pull_request) Successful in 13s
Details
wai-quantum neural-processor member / does this change touch it (pull_request) Successful in 16s
Details
wai-quantum OpenCL member / does this change touch it (pull_request) Successful in 17s
Details
wai-quantum pulse and dynamics / does this change touch it (pull_request) Successful in 16s
Details
wai-quantum for Python / does this change touch it (pull_request) Successful in 12s
Details
wai-quantum error correction and mitigation / does this change touch it (pull_request) Successful in 12s
Details
wai-quantum-qpu / does this change touch it (pull_request) Successful in 14s
Details
wai-quantum extension points / does this change touch it (pull_request) Successful in 14s
Details
wai-quantum service / does this change touch it (pull_request) Successful in 11s
Details
wai-quantum matrix-extension member / does this change touch it (pull_request) Successful in 14s
Details
wai-quantum studio and desktop / does this change touch it (pull_request) Successful in 13s
Details
wai-quantum tensor-engine member / does this change touch it (pull_request) Successful in 13s
Details
wai-quantum portable tensor program / does this change touch it (pull_request) Successful in 12s
Details
wai-quantum variational and algorithm library / does this change touch it (pull_request) Successful in 10s
Details
wai-quantum WebGPU member / does this change touch it (pull_request) Successful in 14s
Details
wai-quantum verdicts and repairs / does this change touch it (pull_request) Successful in 17s
Details
wai-quantum CPU vector units / does this change touch it (pull_request) Successful in 18s
Details
wai-quantum views in agent hosts / does this change touch it (pull_request) Successful in 17s
Details
wai-sink-android native sink library / does this change touch it (pull_request) Successful in 14s
Details
WAI Studio / does this change touch it (pull_request) Successful in 15s
Details
WAI mbt2018_mean integer decode (regenerated vectors) / does this change touch it (pull_request) Successful in 16s
Details
wai-sink-swift native sink package / does this change touch it (pull_request) Successful in 20s
Details
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Has been skipped
Details
wai-vector vector graphics / does this change touch it (pull_request) Successful in 11s
Details
wai-vector vector graphics / linux-aarch64 (pull_request) Has been skipped
Details
wai-vector vector graphics / linux-x86_64 (pull_request) Has been skipped
Details
wai-vector vector graphics / macos-arm64 (pull_request) Has been skipped
Details
wai-vector vector graphics / wasm32-wasip2 (wasmtime) (pull_request) Has been skipped
Details
wai-vector vector graphics / wasm32 under Node (pull_request) Has been skipped
Details
wai-vector vector graphics / wasm32 in three browser engines (pull_request) Has been skipped
Details
wai-vector vector graphics / fuzz, peak allocation, comparison count (pull_request) Has been skipped
Details
wai-vector vector graphics / independent checker (Python) (pull_request) Has been skipped
Details
wai-web wasm32 / does this change touch it (pull_request) Successful in 16s
Details
wai-web reach builds / wai-web reach · does this change touch it (pull_request) Successful in 19s
Details
wai-audit collector and player integration / collector, player integration and the browser end to end · macos (pull_request) Successful in 1m32s
Details
WAI conformance / cross-arch byte-equality · macos (pull_request) Successful in 24s
Details
WAI energy receipts / energy receipts · macos (pull_request) Failing after 1m21s
Details
WAI conformance / codec wrappers · fuzz smoke, text decode limits, C entry points, provenance, the semantic path (pull_request) Successful in 1m45s
Details
wai-quantum dataflow member / member · dataflow device absent (macos) (pull_request) Successful in 18s
Details
wai-quantum editors / editors · macos (pull_request) Successful in 1m22s
Details
wai-quantum command line / command line · macos (pull_request) Successful in 2m6s
Details
wai-quantum FPGA member / member · FPGA datapath, simulated (macos) (pull_request) Successful in 1m16s
Details
wai-quantum Metal member / member · Metal (macos) (pull_request) Successful in 32s
Details
wai-quantum OpenCL member / member · OpenCL GPU (macos) (pull_request) Successful in 27s
Details
wai-quantum pulse and dynamics / the same bits · macos (pull_request) Successful in 1m13s
Details
wai-quantum-qpu / credentials in the keychain (macos) (pull_request) Successful in 29s
Details
wai-quantum for Python / python · macos (pull_request) Successful in 2m32s
Details
wai-quantum matrix-extension member / member · matrix extension absent (macos) (pull_request) Successful in 12s
Details
wai-quantum portable tensor program / tensor program · Metal and the arm64 CPU (macos) (pull_request) Successful in 20s
Details
wai-quantum neural-processor member / member · neural processor (macos) (pull_request) Successful in 4m29s
Details
standards workspaces build + test / macOS energy backends (pull_request) Successful in 10m35s
Details
wai-quantum CPU vector units / member · vector unit absent (macos) (pull_request) Successful in 16s
Details
WAI conformance / fast integer kernels, every x86_64 kernel set (AVX-512 silicon) (pull_request) Successful in 3m6s
Details
wai-quantum WebGPU member / member · browser WebGPU (macos) (pull_request) Successful in 1m38s
Details
wai-quantum WebGPU member / member · Metal (macos) (pull_request) Successful in 2m30s
Details
wai-quantum service / service · macos (pull_request) Successful in 4m5s
Details
wai-quantum studio and desktop / desktop app · macos (pull_request) Successful in 3m53s
Details
wai-quantum HIP member / member · HIP (framework-128gb) (pull_request) Successful in 1m8s
Details
wai-quantum npu-cores member / member · npu-cores, neural processor (framework-128gb silicon) (pull_request) Successful in 1m20s
Details
wai-quantum OpenCL member / member · OpenCL GPU (framework-128gb) (pull_request) Successful in 30s
Details
WAI conformance / cargo-class corpora · macos (pull_request) Successful in 14m0s
Details
wai-quantum portable tensor program / tensor program · integrated GPU (framework-128gb) (pull_request) Successful in 18s
Details
wai-sink-android native sink library / every ABI, the AAR, and the instrumented tests in a headless emulator · macos (pull_request) Successful in 5m16s
Details
WAI Studio / Studio in Chromium and Firefox · macos (pull_request) Successful in 8m2s
Details
wai-audit collector and player integration / collector · linux (pull_request) Successful in 1m23s
Details
wai-quantum studio and desktop / desktop app · windows (pull_request) Successful in 9m32s
Details
WAI conformance / cross-arch byte-equality · linux (pull_request) Successful in 53s
Details
WAI conformance / faces from keypoints under wasm32-wasip2 (wasmtime) (pull_request) Successful in 1m41s
Details
wai-quantum contract / the policy is linked, and the deprecations page reads (pull_request) Successful in 8s
Details
wai-quantum docs, course and locales / the Studio's words in every locale · linux (pull_request) Successful in 11s
Details
wai-quantum WebGPU member / member · integrated GPU, Vulkan (framework-128gb) (pull_request) Successful in 8m40s
Details
WAI conformance / quantum core and corpus under wasm32-wasip2 (wasmtime) (pull_request) Successful in 3m40s
Details
wai-quantum CPU vector units / member · vector units, avx2 and avx512 (framework-128gb silicon) (pull_request) Successful in 20s
Details
wai-quantum signal processor / processor and member · signal processor, emulated (pull_request) Failing after 39s
Details
wai-sink-swift native sink package / libwai slices, desktop tests, simulator tests · macos (pull_request) Successful in 14m44s
Details
wai-quantum dataflow member / member · dataflow device, simulated (pci 1e52:401e) (pull_request) Successful in 2m6s
Details
wai-quantum CUDA member / member · CUDA absent (linux) (pull_request) Successful in 1m34s
Details
wai-quantum FPGA member / member · FPGA simulation absent (linux) (pull_request) Successful in 32s
Details
WAI energy receipts / energy receipts · linux (pull_request) Failing after 4m43s
Details
wai-quantum other formats / the set under wasm32-wasip2 (wasmtime) (pull_request) Successful in 2m0s
Details
wai-quantum editors / editors · linux (pull_request) Successful in 3m11s
Details
wai-quantum dataflow member / member · dataflow device, simulated (pci 1e52:b140) (pull_request) Successful in 5m28s
Details
wai-quantum Metal member / member · Metal absent (linux) (pull_request) Successful in 28s
Details
WAI operation catalogue / the catalogue and every door · linux (pull_request) Successful in 9m56s
Details
wai-quantum OpenQASM reader / corpus under wasm32-wasip2 (wasmtime) (pull_request) Successful in 48s
Details
wai-quantum neural-processor member / member · neural processor absent (linux) (pull_request) Successful in 22s
Details
wai-quantum OpenCL member / member · OpenCL absent (linux) (pull_request) Successful in 33s
Details
wai-quantum for JavaScript / javascript · linux (pull_request) Successful in 3m35s
Details
wai-quantum docs, course and locales / the course and the command line's languages · linux (pull_request) Successful in 7m38s
Details
wai-quantum pulse and dynamics / reader, simulator and pulse jobs under wasm32-wasip2 (wasmtime) (pull_request) Successful in 1m21s
Details
wai-quantum-qpu / clients against their contracts (linux) (pull_request) Successful in 1m8s
Details
wai-quantum contract / API compatibility · linux (pull_request) Successful in 9m34s
Details
wai-quantum matrix-extension member / member · matrix extension, emulated (aarch64 Linux) (pull_request) Successful in 23s
Details
wai-quantum pulse and dynamics / reader, simulator and pulse jobs · linux, release (pull_request) Successful in 2m10s
Details
wai-quantum other formats / readers, writers and the set · linux (pull_request) Successful in 5m51s
Details
wai-quantum resource estimation / estimation and calibration · linux, release (pull_request) Successful in 6m38s
Details
wai-quantum extension points / the registry under wasm32-wasip2 (wasmtime) (pull_request) Successful in 2m3s
Details
wai-quantum OpenQASM reader / reader and corpus · linux (pull_request) Successful in 4m38s
Details
wai-quantum error correction and mitigation / codes, decoders, texts and mitigation · linux, release (pull_request) Successful in 3m13s
Details
wai-quantum CPU vector units / member · vector unit, rvv 1024-bit (riscv64, emulated) (pull_request) Successful in 23s
Details
wai-quantum for Python / python · linux (pull_request) Successful in 4m16s
Details
wai-quantum extension points / the registry and the example · linux (pull_request) Successful in 3m36s
Details
wai-quantum contract / schemas and the committed tool lists · linux (pull_request) Successful in 11m37s
Details
wai-quantum portable tensor program / tensor program · CPU, mutants, GPU builds (pull_request) Successful in 1m26s
Details
wai-quantum CPU vector units / member · vector unit, sve 128-bit (aarch64, emulated) (pull_request) Successful in 37s
Details
wai-quantum CPU vector units / member · vector unit, rvv 128-bit (riscv64, emulated) (pull_request) Successful in 34s
Details
wai-quantum variational and algorithm library / parameters, gradients, optimisers, VQE, QAOA and builders · linux, release (pull_request) Successful in 2m7s
Details
wai-quantum CPU vector units / member · vector unit, sve 2048-bit (aarch64, emulated) (pull_request) Successful in 40s
Details
wai-quantum CPU vector units / member · vector unit, avx2 (x86_64 silicon) (pull_request) Successful in 38s
Details
wai-quantum CPU vector units / member · vector unit, sve 512-bit (aarch64, emulated) (pull_request) Successful in 1m12s
Details
wai-quantum views in agent hosts / views · the page and its engine (pull_request) Failing after 28s
Details
wai-quantum verdicts and repairs / the intent set and the verdict under wasm32-wasip2 (wasmtime) (pull_request) Successful in 1m21s
Details
WAI Studio / the catalogue's actions, the unit tests and the core · linux (pull_request) Successful in 1m3s
Details
wai-quantum WebGPU member / member · software Vulkan (linux) (pull_request) Successful in 3m30s
Details
wai-quantum verdicts and repairs / verdicts, repairs and the intent set · linux (pull_request) Successful in 2m22s
Details
wai-quantum service / service · linux (pull_request) Successful in 5m53s
Details
WAI conformance / v2 vocabulary · manifests validate as stated (pull_request) Successful in 1m17s
Details
wai-quantum studio and desktop / studio · browser (pull_request) Failing after 6m26s
Details
wai-web reach builds / wai-web reach builds · the package of record, every output as recorded (pull_request) Successful in 3m1s
Details
standards workspaces build + test / joule-code-rs (joule-code/joule-code-rs, joule-code-rs, linux-arm64, true) (pull_request) Successful in 7m16s
Details
wai-quantum WebGPU member / shader checks · browser build · wasip2 inertness (pull_request) Successful in 6m57s
Details
wai-quantum views in agent hosts / views · a scripted host (pull_request) Successful in 5m6s
Details
wai-quantum tensor-engine member / member · tensor engine, the kernel toolchain's simulator (linux) (pull_request) Successful in 8m19s
Details
wai-quantum studio and desktop / desktop app · linux (pull_request) Successful in 8m40s
Details
wai-web reach builds / wai-web reach builds · this tree's wai-web, every rung on its engine line (pull_request) Successful in 4m56s
Details
wai-quantum docs, course and locales / every command and snippet in the docs · linux (pull_request) Successful in 19m58s
Details
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Failing after 9m9s
Details
wai-quantum CUDA member / member · CUDA (thor) (pull_request) Successful in 1m57s
Details
wai-quantum OpenCL member / member · OpenCL GPU and CPU (thor) (pull_request) Successful in 51s
Details
WAI conformance / cargo-class corpora · linux (pull_request) Successful in 27m50s
Details
WAI Studio / Studio in WebKit · linux (pull_request) Successful in 12m40s
Details
wai-quantum CUDA member / member · CUDA (jetson-hub) (pull_request) Successful in 1m44s
Details
wai-quantum OpenCL member / member · OpenCL GPU and CPU (jetson-hub) (pull_request) Successful in 40s
Details
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Successful in 21m21s
Details
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 15s
Details
wai-quantum service / service energy · linux packages (pull_request) Successful in 2m6s
Details
wai-quantum portable tensor program / tensor program · GPUs (jetson-hub) (pull_request) Successful in 28s
Details
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 54s
Details
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 30m54s
Details
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 2m35s
Details
wai-quantum-landscape-fpga reference design / the member against the model of the logic, and the logic against the model · linux, release (pull_request) Successful in 38m3s
Details
wai-quantum HIP member / member · HIP absent (linux-arm64) (pull_request) Successful in 1m40s
Details
wai-quantum-landscape-fpga reference design / the board's code on the board's processor's architecture · linux-arm64, release (pull_request) Successful in 1m19s
Details
wai-quantum npu-cores member / member · npu-cores absent (linux-arm64) (pull_request) Successful in 35s
Details
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Failing after 4m40s
Details
wai-quantum pulse and dynamics / the same bits · linux-arm64 (pull_request) Successful in 1m59s
Details
wai-quantum WebGPU member / member · GPU, Vulkan (thor) (pull_request) Successful in 23m22s
Details
wai-quantum tensor-engine member / member · tensor engine absent (linux-arm64) (pull_request) Successful in 28s
Details
wai-quantum variational and algorithm library / parameters, gradients, optimisers, VQE, QAOA and builders · linux-arm64, release (pull_request) Successful in 2m15s
Details
wai-quantum command line / command line · linux (pull_request) Successful in 51m43s
Details
wai-quantum extension points / the registry and the example · linux-arm64 (pull_request) Successful in 5m11s
Details
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (pull_request) Successful in 4m2s
Details
wai-quantum WebGPU member / member · GPU, Vulkan (jetson-hub) (pull_request) Successful in 25m32s
Details
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Failing after 2h11m29s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Transaction-Science/open-standards!678
No description provided.