The docs overstated the case: they called RAPL/NVML/IOReport 'a model, not a
meter' / 'estimates' / 'not physically accurate'. That's wrong. Modern vendor
counters are real on-die/on-board sensor readings, and all measurement is
model-mediated anyway. The distinction the trust ladder actually rests on is
provenance and tamper-evidence, not accuracy: vendor counters are opaque
(undisclosed derivation/error) and reach a verifier through the platform's own
untrusted software with nothing binding the number to the sensor.
Reword energy.rs (module doc, CounterClass, AttestTrust), the example, and
MAPPING §4 accordingly, and rename CounterClass::is_physical() ->
is_independently_rooted() so the code encodes the real property. IntegrityAttested
= an honest relay of the platform's self-report; PhysicallyRooted = a reading
rooted in a dedicated sensor signed at the source. No behavior change; 39 tests.
Co-authored-by: Transaction Science <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
6c77c66e28