Current evidence and acceptance boundaries¶
This page describes the scope and acceptance boundaries of platform execution reports. Each iteration establishes evidence for its actual source; old candidates, historical test counts and development directories do not qualify a new HEAD. The ledger status implemented records source and tool delivery; acceptance follows the tested code identity declared in the report. Original reports retain their own output paths and bind source, configuration, dependencies, tools, command exit codes and artifacts.
See current P2 unsigned software delivery for the complete software plan, SDK, eight candidates and actual public recovery of the latest selected P2 ab532250. Its C++183 analysis combines 109 validated existing results with 74 actual additional evaluations; full interpretation and individual review of all 1234 findings have completed. Independent QA 706ee80 completed ordinary gates and new-SHA Python174 analysis. The 38 findings, comprising 30 notes / 6 warnings / 2 errors, uniquely map to previously reviewed dispositions; seven old findings disappeared and none is new. Current private E f59debf1 pins P2; 17 presets / 116 commands, five real C broker scenarios each in source and installed builds, three recipes and the public SDK walk passed. E completed a normal nonforce push and exact readback of f59debf1; the repository remains private and private main is unchanged. Later D/deployment/FF await actual results. Older P2, SoC/IP and 7590b2d4 records below retain their source identities and historical states. Their pending fields do not override this P2 round, and later commits do not inherit firmware qualification.
Typed platform unification: exact source and execution boundaries¶
The code source P2 is fc01d863c3374643c276195ae19a24e6f8b8c8ee, with tree e6f3d6310fd46265be49d47ef3fd7a4d944a8386, in platform PR 38. External examples E is acb5179ec09e0c2fae1911d32655296df39acedc, with tree 4e4e504c28766f0790dc4cd4dc45e8f9bcc49beb, in examples PR 16. PR state and software execution are separate facts; this section does not claim that either PR has merged.
Candidate typed-unification-fc01d863c337-acb5179ec09e was sealed and actually passed its owned verifier. Its status is software_qualified, covering the six original scopes host_contracts, arm_link, resource_budget, source_sdk, reproducibility and hil_tooling. Its configuration SHA-256 is 0117c83ff7876bf3867338f31caec160c18815a629cb1c44bfe1a4ead410590b. The candidate JSON is 2,366,210 bytes, SHA-256 f1c2af3ac73cb219b41b6d68f1c1b07db108357d0de8a92107ab7b1e8ec1ede6. The original delivery index records the exact ELF/BIN/map byte identities. hil_tooling establishes tooling scope only; physical HIL remains not_executed, signature status is unsigned, and product promotion is not_performed.
R02 completed two independent fresh builds with --network none: four actual configure/build commands all returned 0. ELF/BIN bytes from the two independent outputs are identical; the original result is bit_exact_elf_bin. The selected input is the external example reproduction/assemblies/qiming-baremetal.toml: Qiming F407ZG, baremetal, hse8-pll168, Os, GPIO output and UART1 IRQ events with capacity 32, explicitly selecting the uart-owner component. This result does not extend to other boards, modes or physical timing.
The persistent navigation entry is /workspace/nexus-examples/build/platform-candidate-fc01d863c337-acb5179ec09e-01/delivery-index.json, 4,716 bytes, SHA-256 5e99131826172355a95506b0293c8fe98f75cb07f3b6298f5f3805d6008caf43. Its candidate_portable entry identifies the complete archive of 6,441 files: 434,092,822 bytes, SHA-256 a443e9c3b39528d5d5fbbdd19ee1c065496cd86b8df78cb5380aab4505bf3aa9. finalization_package identifies a separate archive retaining original finalization reports and failed attempts. The /tmp/... paths above are original execution locators and may no longer exist after environment recovery. Restore original bytes through the index and member mapping without rewriting those locators. This host path is not a public download URL.
Q02 independently executed all 159 stages of the complete maintained plan with status executed_passed. Its source observations before and after execution match exactly and identify clean P2. The original /tmp/nexus-unification/formal-fc01d863c337-02/report.json is 201,097 bytes, SHA-256 8c67786b80b5fb64cb0f6f216c1dbf4c05ddb84f61ab2ef4542fb0f55e0910a2. The maintained verifier checked every stage, original order, command exit code, plan and source identity. This is one complete Q02 execution, without a composed Q01 prefix. Its original software_qualified=false remains unchanged: a passed software plan is not a sealed candidate.
The complete local examples execution for E passed: 17 presets (1 Native and 16 ARM), 98 actual commands, 39 ELF budget checks and 12 HIL preparations. HIL outputs are prepared_unbound, not connected-board or physical passes. The original /tmp/nexus-examples-typed-fc01d863c337-all-001/execution.json is 15,662 bytes, SHA-256 c89682f4b2b30383dca2c3e845aad6170c6f4271b310886d72deb358b136348b. E actually consumed /tmp/nexus-unification/formal-fc01d863c337-01/sdk; its original command retains that real path and is not rewritten to the Q02 SDK. The failed Q01 plan and the SDK already generated within it have different scopes; passing examples do not retroactively pass the Q01 plan.
R01 preparation independently checked the complete Q01 and Q02 SDK prefixes using the maintained verify_source_sdk, confirming 2,931 source files, identical source-manifest bytes and matching two CMake export files. The result is verified_identical_installed_sdk_bytes. Both manifests are 370,911 bytes, SHA-256 77c5fa4e0eb0c584b195ce92a59e8ac6129dc5d493c3e1184df89a9a5618248d. The original result is /tmp/nexus-unification/candidate-fc01d863c337-acb5179ec09e-01/readiness.json, 8,263 bytes, SHA-256 378fff8b25917b86bf88d4a9e5a2613947e0f4219c6f6c94bc6cf390babfaee0. It retains E’s actual Q01 SDK input; Q02 is this iteration’s sole complete software-plan authority. Identical SDK bytes alone do not establish passing double builds or a qualified candidate.
After recovery, the maintained capabilities.py --candidate query was rerun against a clean P2 checkout and actually returned 0 with source_match=true, but its result is configuration_mismatch. Comparing input sets by path shows the SDK’s additional .nexus-source-sdk.json, SHA-256 77c5fa4e0eb0c584b195ce92a59e8ac6129dc5d493c3e1184df89a9a5618248d. Input-record order also differs; all other configuration semantic fields are equal. Only configuration=validated; the model, ARM image, SDK, candidate and physical-query results remain not_assessed. Matching source does not relax full configuration-identity checks. The new observation is retained at /workspace/nexus/.git/local-recovery/typed-platform-unification/capability-recovery/comparison.json, SHA-256 565993a80527d4e3c2e5af7ca7a00dd4448665023b5cee18560d0ba1050f0d87. To positively verify sealed artifacts, restore the candidate and run candidate.py verify --candidate. That entry and the source-checkout capability association each retain their own scope.
Q01 passed its first 90 stages and failed at stage 91 because the locked clang-tidy directory was absent from the execution PATH; that stage did not complete C static analysis. After correcting the environment and passing version checks, actual C11 probes and doctor, Q02 executed the complete plan again without composing a Q01 prefix. The Q01 failure remains recorded, but its original temporary report and command records were lost during environment recovery and cannot be reverified; they have not been relabeled as successful.
R01 successfully executed prepare-spec, but its helper stopped before starting Docker because its toolchain digest comparison treated the 65-byte installer marker inconsistently. An independent inventory confirmed that all other bytes match the locked archive; the toolchain was unchanged. The finalization archive retains the original R01 records. That failed preparation is separate from R02’s actually completed pair of network-disabled builds.
Code execution identity P2 and the documentation commit are recorded separately. Documentation edits, builds and publication create no new platform software qualification. A formal schema-2 documentation package sets explicit qualification_references only after the actual candidate verifies. The package’s own documentation_source and build receipts identify its documentation source; a referenced candidate retains its original P2 identity.
local_ci.py verified the complete Q02 report read-only and actually returned 0. The result /tmp/nexus-unification/root/local-ci-full-verified.json is 2,385 bytes, SHA-256 2bb9bbcfb51c61d26f49435b4dc6cb3650cdae340db55d7e8c4aea7386e991ca. Publishing nexus/local-software-plan to the exact P2 SHA was rejected by GitHub with HTTP 403 because the connection lacks statuses:write. The original /tmp/nexus-unification/local-status-fc01d863.json receipt has publication unconfirmed; it is 3,872 bytes, SHA-256 4fa133eb62e7767048450743710f9ec292d349dbcaf3faaf062e258508992f2a. An independent server readback found no statuses for that SHA, so neither successful publication nor a green remote status is claimed. Local verification does not impersonate Actions jobs, a release workflow or enabled branch protection.
Historical SoC/IP layout execution¶
Software execution for this SoC/IP refactor binds code commit P 92e669233957a2e450a528394e8f4dd0794c7049, with tree 6e38d4c43d59330a0a9a9b7cac21f591d9c2719f. Platform PR 36 was merged as c79fd9672a9fe56379744d834cfccd822bc40be1, whose tree equals P; external examples PR 15 was merged as bd3b90f135600b6405459347cb9e2cff5692d2e3, retaining the formal P pin. The 48-item refactor ledger records per-item results and original evidence. The maintained 159-stage plan has actual coverage through two executions on the same P: A’s retained complete results for the first 90 stages, plus B’s complete execution of the original remaining 69 stages.
An execution-environment restart interrupted A’s static analysis. A’s original report remains running, without source_after; a separate interruption observation records source and boot identities observed later, and the restart cause is not established. B fully reran static analysis using the original suffix plan and returned executed_passed. Exact stages, order, command exit codes and source identities were checked; this was not a single complete-plan pass, and A’s completion state was not reconstructed. Independent relocated SDK consumption, sixteen ARM configurations and thirty-two main-matrix ELFs from the external examples, eleven resource comparisons and two fresh, network-none offline builds each have their own results. Candidate sealing for the existing six scopes and the owned verifier passed, with candidate status software_qualified; the signature remains unsigned, product promotion was not performed, and physical HIL is not_executed.
This documentation update records only P’s software evidence. The document’s own identity comes from source and the actual execution receipts in its corresponding documentation-build.json; a documentation commit does not inherit or replace P’s software qualification. Failed and interrupted attempts retain their original status and evidence. A/B coverage is not relabeled as one executed_passed run, and partial work in an interrupted stage is not counted as completed execution.
Scope |
Maintained execution entry |
Qualification boundary |
|---|---|---|
Native/Core/OS/components |
|
Actual software ownership, threads and fault behavior; no MCU electrical qualification |
GoogleTest／GoogleMock |
|
Complete discovery and actual unfiltered execution, fresh XML, zero skips; not automatic proof of historical editing order |
Cortex-M CPU mechanisms |
|
Nine-core macros/ABI/objects/instructions/atomic dependencies; production cache/MPU/SAU models; no expanded SoC/Board or hardware support |
CPU runtime / kernel |
|
Compilation/ELF audit of public |
Generator |
|
Platform/CPU-runtime TOML, frozen IR, explicit optional features/ABI, maintained Native factory types, resource conflicts, bad input and stale bundles |
Tool gates |
|
Actual negative paths, stable staging, report identities and execution exit codes |
STM/GD register models |
|
Actual production TUs; memory/line drain, EN-disable refusal, late IRQ, borrow/isolation, calibration/stabilization |
Three-board base configurations |
Six ARM presets |
Actual startup/vector/provider linking, ELF/BIN/map and budgets |
H743/U575 reference vertical slices |
|
Each empty/selected × baremetal/FreeRTOS, actual vectors/resources/retention; H743 additionally checks pre-RAM power entry, without proving actual MCU execution |
Optional RAM placement |
|
F407 CCM and GD ADDSRAM/TCM link/initialization domains; no power-loss/reset retention proof |
Advanced-controller fixtures |
|
Maintained controller types, DMA, block RX/trigger and actual multicontroller ARM linking; explicitly software Boards |
Minimum-resource matrix |
|
60 three-board O2/Os/O3 ± LTO images; 18 empty-GC checks; actual face/ops storage costs |
External examples |
Independent |
This round’s formal P pin has Native execution, sixteen ARM configurations and thirty-two main-matrix ELFs ( |
Source SDK |
|
Clean version, source closure/identity, relocated C/C++ Native/Runtime consumers and STM/GD firmware linking |
Offline reproduction/candidates |
|
Two independent network-none builds with matching source/config/tool/ELF identities and required scope |
HIL |
|
Fixtures prepared; no connected devices; all physical results |
Canonical commits, gates and candidate evidence from the earlier SoC extension iteration are in the SoC extension execution record; the earlier baseline record retains its original version’s evidence. These historical results keep their original source scope and do not qualify this refactor. Versioned datasheet/manual/errata indexes establish provenance only; actual silicon revisions and workaround applicability for each mode require separate acceptance. soc_costs.py retains actual ELF/disassembly/tool invocations and comparable profiles. It does not interpret size differences across backends, routes or capacities as same-configuration optimization, or instruction counts as measured cycles.
tools/hil/soc_acceptance.py provides nineteen plan/capture/validate contracts for SOC-37–55. Plan yields only prepared_unbound; reference G474/H743/U575 cannot bypass reference-only admission through renaming or recomputed metadata hashes. Actual station/tools, protocols, instruments, continuous nonempty samples and reviewed limits determine results. Physical Flash power cuts additionally require external erase-aligned test layouts outside every firmware LOAD.
Earlier development execution directories build/controller-routes-factory/ and build/minimal-factory-resources/ retain independent attempts and original commands without overwriting old runs. Resource numbers describe only the corresponding ELF; source changes require new execution. MSP is explicitly reserved and heap=0; unused memory domains do not become resident merely because a chip has them. Assembly and ELF bytes do not substitute for actual cycles/IRQ latency.
The earlier CPU/runtime development execution directory is /workspace/nexus-all-cortex-evidence. It retains original reports for CPU facts/schema, atomic publication/RMW, nine-core register models, optional-feature compilation and real kernel-context audits. Published reports record actual commands, exit codes, tools and hashes; passing counts and feature scope come from the execution results, without inheriting earlier numbers or a different combination. Source/installed Runtime consumers and full-platform consumers establish separate evidence: the former have no concrete startup, SoC, Board or factory, and cannot replace the latter or candidate sealing.
RED logs are in tools/testing/evidence/; GREEN is actual framework execution. Migration of already-correct contracts is explicitly marked; production behavior is not changed merely to manufacture RED. Commit hooks check staged snapshots/index trees at start/end, reject behavior changes during execution and publish no new success summary on failure.
Formal software qualification requires clean source/dependencies, exact tools/configuration, nonzero fresh tests, matching ELF/BIN/map, current budgets, independent source-SDK consumption and offline double-build. Exact support scope is authoritative; software-fixture connectors are not inherited by reference Boards.
All physical timing, precision, waveform, reset, power-cut and sustained-load items remain unexecuted. FP/MVE context switching, IRQ latency, cache/DMA coherence, MPU/SAU and security-world cooperation also lack physical acceptance. Optional restricted-MPU-task and split-runtime software execution cannot establish physical isolation. Actual HIL must record PCB, chip UID, probe/serial/power, station, budgets and the same candidate image.