Current evidence and acceptance boundaries¶
This nine-core CPU/Arch/Core/OS-runtime/platform iteration must rerun verification. Old candidates, historical test counts and development directories cannot qualify new HEAD. Ledger implemented means source/tools exist; acceptance reads the corresponding HEAD execution reports. Final execution is external in nexus-delivery/<HEAD>/; every report binds source, configuration, dependencies, tools, command exit codes and artifacts.
Scope |
Current execution entry |
Qualification boundary |
|---|---|---|
Native/Core/OS/components |
|
Actual software ownership, threads and fault behavior; no MCU electrical qualification |
GoogleTest/GoogleMock |
|
Complete discovery and actual unfiltered execution, fresh XML, zero skips; not automatic proof of historical editing order |
Cortex-M CPU mechanisms |
|
Nine-core macros/ABI/objects/instructions/atomic dependencies; production cache/MPU/SAU models; no expanded SoC/Board or hardware support |
CPU runtime / kernel |
|
Compilation/ELF audit of public |
Generator |
|
Platform/CPU-runtime TOML, frozen IR, explicit optional features/ABI, maintained Native factory types, resource conflicts, bad input and stale bundles |
Tool gates |
|
Actual negative paths, stable staging, report identities and execution exit codes |
STM/GD register models |
|
Actual production TUs; memory/line drain, EN-disable refusal, late IRQ, borrow/isolation, calibration/stabilization |
Three-board base configurations |
Six ARM presets |
Actual startup/vector/provider linking, ELF/BIN/map and budgets |
H743/U575 reference vertical slices |
|
Each empty/selected × baremetal/FreeRTOS, actual vectors/resources/retention; H743 additionally checks pre-RAM power entry, without proving actual MCU execution |
Optional RAM placement |
|
F407 CCM and GD ADDSRAM/TCM link/initialization domains; no power-loss/reset retention proof |
Advanced-controller fixtures |
|
Maintained controller types, DMA, block RX/trigger and actual multicontroller ARM linking; explicitly software Boards |
Minimum-resource matrix |
|
60 three-board O2/Os/O3 ± LTO images; 18 empty-GC checks; actual face/ops storage costs |
External examples |
Independent |
Native execution, ten ARM configurations and twenty ELFs after exact pinning; external product implementation |
Source SDK |
|
Clean version, source closure/identity, relocated C/C++ Native/Runtime consumers and STM/GD firmware linking |
Offline reproduction/candidates |
|
Two independent network-none builds with matching source/config/tool/ELF identities and required scope |
HIL |
|
Fixtures prepared; no connected devices; all physical results |
Canonical SoC commit, actual complete gates, offline candidates and remaining acceptance are in SoC extension execution; early baseline records retain original-version evidence. Versioned datasheet/manual/errata indexes establish provenance only; actual silicon revision and mode-specific workaround applicability are separately accepted. soc_costs.py retains actual ELF/disassembly/tool calls and comparable profiles; size differences across backends/routes/capacities are not same-configuration optimization, and instruction counts are not measured cycles.
tools/hil/soc_acceptance.py provides nineteen plan/capture/validate contracts for SOC-37–55. Plan yields only prepared_unbound; reference G474/H743/U575 cannot bypass reference-only admission through renaming or recomputed metadata hashes. Actual station/tools, protocols, instruments, continuous nonempty samples and reviewed limits determine results. Physical Flash power cuts additionally require external erase-aligned test layouts outside every firmware LOAD.
Development directories build/controller-routes-factory/ and build/minimal-factory-resources/ retain separate attempts/raw commands without overwriting earlier runs. Resource numbers describe only corresponding ELFs and must be rerun after source changes. MSP is explicitly reserved, heap=0; unused memory regions are not automatically resident merely because the chip contains them. Assembly/ELF bytes cannot replace actual cycles/IRQ latency.
CPU/runtime development execution is in /workspace/nexus-all-cortex-evidence, retaining separate raw CPU-facts/schema, atomic-publication/RMW, nine-core register-model, optional-feature compilation and real-kernel-context audit reports. Public reports record actual commands, exits, tools and hashes; pass counts/features are read from execution, not inherited from prior counts or one combination. Source/installed Runtime consumers and complete-platform consumers establish separate evidence. Runtime has no concrete startup/SoC/Board/factory and cannot replace full-platform consumption or candidate sealing.
RED logs are in tools/testing/evidence/; GREEN is actual framework execution. Migration of already-correct contracts is explicitly marked; production behavior is not changed merely to manufacture RED. Commit hooks check staged snapshots/index trees at start/end, reject behavior changes during execution and publish no new success summary on failure.
Formal software qualification requires clean source/dependencies, exact tools/configuration, nonzero fresh tests, matching ELF/BIN/map, current budgets, independent source-SDK consumption and offline double-build. Exact support scope is authoritative; software-fixture connectors are not inherited by reference Boards.
All physical timing, precision, waveform, reset, power-cut and sustained-load items remain unexecuted. FP/MVE context switching, IRQ latency, cache/DMA coherence, MPU/SAU and security-world cooperation also lack physical acceptance. Optional restricted-MPU-task and split-runtime software execution cannot establish physical isolation. Actual HIL must record PCB, chip UID, probe/serial/power, station, budgets and the same candidate image.