mesh §3.2: the fidelity floor was checked against the route table, not the serve #183

Merged

dcharlot merged 2 commits from feat/mesh-fidelity-provenance into main 2026-10-10 09:56:29 -04:00

Conversation 0 Commits 2 Files changed 6 +362 -5

2026-10-09

David Charlot

mesh: the gguf engine constructs ServeOutcome too, behind its own feature ...

`standards workspaces build + test / mesh-rs` failed on this branch: adding
`delivered_fidelity` to `ServeOutcome` reached seven places in mesh, and I
updated five. The two I missed are both in `mesh-engine-gguf`, inside
`#[cfg(feature = "gguf")]`, so no default build on this machine compiles them
— only the matrix entry's `feature_tests: -p mesh-engine-gguf --features
gguf` does, which is why CI found it and local verification did not.

Both engines decode greedily from whatever model was loaded and form no
after-the-fact view of what they delivered, so they report `None`: the field's
documented historical shape, skipped on the wire, with `fidelity_met` falling
back to the advertised rating. That is exactly where these engines already
stood, so this is the absence-as-tag doing its job rather than a new claim.

Checked every other feature in the workspace for the same blind spot —
`mesh-core`/`mesh-meter --features hw-meter`, `mesh-openai --features server`,
`mesh-engine-gguf --features metal` and `--features rayon` — and `gguf` was
the only one broken. The workspace's tests pass, and so do the gguf feature
tests as CI runs them.

Co-Authored-By: Claude Opus 5 <[email protected]>

faf2d76f52

• View at this point in history

2026-10-09 08:51:31 -04:00

Transaction Science

mesh §3.2: the fidelity floor was checked against the route table, not the serve ...

A Mesh request carries two bounds and only one of them was held to a standard of
honesty. Energy has a provenance model whose coupling §3.3 requires be enforced
before sealing — "the rule that keeps 'measured' honest". Fidelity had none.

`serve` computed `fidelity_met` at step 2, from `route.chosen_fidelity`, which is
`ServingEngine::fidelity` — documented as "the fidelity level this engine is
**rated** to deliver". The engine ran at step 3 and the receipt was built at step
4 from the step-2 value, so nothing the engine returned could change it. A
backend admitted at F3 that degraded at serve time sealed `fidelity_met: 1`
against an F3 floor, and the receipt looked ordinary.

The engine could not have been asked, either: `ServeOutcome` is counters only —
tokens in/out/accepted, cache hits, speculative proposals — with no fidelity
signal and no degradation signal. So the figure could not have been anything but
a table lookup.

`ServeOutcome` gains `delivered_fidelity: Option<Fidelity>`, and `fidelity_met`
is derived from it when present. Two figures, two different claims: the
advertisement is what the route table promised before the work and the basis the
router admitted the backend on; the delivered level is what the party that did
the work says it served. Both are sealed, as a pair, so a divergence is
attributable to a named backend rather than merely showing up as a failed floor.

Enforced, not just recorded: a backend reporting **above** its rating is refused
(`MeshError::FidelityAboveRating`) rather than clamped. It would be claiming a
basis the route decision never rested on, and clamping would hide a misconfigured
or dishonest engine behind a plausible receipt — the exact failure the field
exists to expose.

What this does not claim, stated in the spec rather than implied: a delivered
figure is still the backend's own account. It is better grounded than a table
entry written before the work and it is not an independent assessment of the
output — Mesh does not score responses. What the pair buys is that the divergence
becomes visible.

Additive, and `mesh/1` stays byte-stable. The two fields travel together or not
at all: their purpose is the comparison, and the advertisement alone adds nothing
a verifier lacks from `backend`. Carrying neither is exactly what a receipt
sealed before the fields existed means, so the published pack is unchanged — the
drift check proves it, and it caught two earlier drafts of this change that were
not additive (the reference engine reporting unconditionally, then
`fidelity_advertised` emitted on its own). `ReferenceEngine` therefore keeps the
historical shape by default, with `reporting_delivered_fidelity()` to exercise
the field; a real engine that can degrade needs no switch.

SPEC gains §3.2.1 with the four MUSTs, §5's `ServeOutcome` sketch and §6.1's
wire table updated.

mesh-rs workspace: 57 passed, clippy clean.

Co-Authored-By: Claude Opus 5 <[email protected]>

ce8a8b20a0

• View at this point in history

2026-10-09 02:51:33 -04:00