Three reference estimators priced work by a coefficient no host
calibrated and graded the figure ModelBased:
- sandbox-exec-microvm: with no live CPU counter, vCPU-seconds × the
reference 12,000 µJ/vCPU-second (a nominal work-unit cost), and the
accelerator's "coarse proxy" (that cost × 10);
- sandbox-exec-wasm: fuel × the reference 20,000 µJ per million fuel;
- sandbox-meter StorageActivity (from_samples, from_volume): ops and
bytes × nominal NVMe-class pJ coefficients documented as "calibrated".
By the family's ladder (JCP SPEC §5.1) a model earns ModelBased by a
calibration on the host; a nominal coefficient is the whole of such a
model, so the figure is an estimate.
- MicroVmConfig.calibrated and WasmConfig.fuel_cost_calibrated (both
false by default) keep a ModelBased path for a cost the operator
calibrated on the host, as spec/receipts.md's "calibrated table"
describes; the accelerator proxy is Estimator either way. Neither config
is constructed outside its crate.
- Tests that pinned the over-claim now pin Estimator:
cpu_only_run_meters_modelbased (renamed ..._an_estimate),
a_cpu_counter_that_held_across_a_run_is_not_a_measured_zero, power.rs's
two RAPL fallback tests, runs_a_unit_and_meters_cpu_energy,
storage_globs_enforced_through_execution, contention_is_loaded_minus_
baseline. New tests: a fallback is a model only at a host-calibrated
cost (CPU) and never for the proxy (accelerator); the same for the fuel
cost; both storage constructors are estimates.
- boot_microvm example's 15 W/vCPU fallback is Estimator too.
- SPEC §6.3, spec/receipts.md, SECURITY.md, README and sandbox-meter's
Provenance docs say a nominal or assumed coefficient is Estimator.
No vector changes: sandbox-conformance passes every class, file-backed
vectors included, and conformance/v1 is untouched (its builders use
fixed constructors, none of these estimators).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
490a592223