Crate u280_hardware_promoter 

Fail-closed core for final HashSigs U280 hardware-evidence promotion.

This crate owns canonical request/result models, exact integer performance arithmetic, complete coordination-history replay checks, private promotion state, and atomic no-overwrite publication. It deliberately does not parse or accept the current Vitis route evidence: the checked-in raw format profile is adaptation-required. AcceptedRouteEvidence now models the exact policy output required from a future descriptor-retaining parser, but its private descriptor guard remains uninhabited, no public or production constructor is reachable, and the public result document remains failure-only. The legacy schema-1 request can never produce a success document.

RTL simulation, generated Verilog, out-of-context synthesis, a routed xclbin, XRT exit status, and synthetic fixtures are not hardware evidence. No API in this source slice can set a hardware-completion claim.

Structs

AcceptedRouteEvidence

One opaque accepted 250 MHz route-policy proof.

AtomicPublication

Private hidden-sibling candidate that has not yet been published.

CoordinationChain

Verified global replay index for one complete genesis-rooted snapshot.

DurablePromotionBurn

Proof that one promotion identity was appended and fsynced before result publication. The retained nonblocking lock is held until this value drops.

PerformanceAssessment

Exact accepted p95 arithmetic. No floating-point or rounded rate is part of the decision.

PreacceptanceJournalRecord

One canonical preacceptance private-state journal record.

PromotionError

One promotion failure with a stable code and contextual explanation.

PromotionFailure

Sealed nonterminal failure record. Its five terminal fields are always false and cannot be set by the caller.

PromotionJournalState

Reconstructed append position and global replay sets for private state.

PromotionRequest

Opaque validated legacy schema-1 promotion request.

PromotionTransactionIdentity

Opaque run/intent/burn identity shared by the request-derived document, durable state burn, and atomic publication transaction.

PublicationReceipt

Receipt for one successful RENAME_NOREPLACE publication.

VerifiedCoordinationBurn

Opaque selected burn proven to be the exact last record and receipt for the requested run. It has no serde implementation or public constructor.

VerifiedCoordinationGrant

One grant binding proven by a complete canonical coordination history.

Enums

FailureCode

Machine-readable reason that a promotion transaction did not complete.

PromotionDocument

The only document shape accepted by atomic publication in this source slice.

Constants

BASELINE_CLOCK_HZ

Clock used to normalize the baseline throughput claim.

MAXIMUM_CAPTURE_CYCLES_PER_RESULT

Maximum p95 capture/core cycles per result.

MAXIMUM_DSPS

Absolute DSP ceiling for the U280 acceptance flow.

MAXIMUM_LUTS

Default LUT ceiling.

MAXIMUM_REGISTERS

Default register ceiling.

MINIMUM_MEASURED_SAMPLES

Minimum number of measured performance samples.

MINIMUM_SIGNATURES_PER_SECOND

Minimum accepted sustained signatures per second.

PERFORMANCE_BATCH

Required performance batch size.

PERFORMANCE_PROFILE

Required HashSigs profile for this hardware-promotion path.

Functions

require_accepted_route

Fails closed until an immutable format probe has produced an exact parser contract and a later clean commit installs that parser.

verify_complete_burn_history

Verifies a complete, bounded, canonical JSONL history from sequence zero.

verify_promotion_journal

Reparses a bounded legacy-plus-preacceptance private journal from genesis.

Type Aliases

PromotionResult

Result type used throughout the promoter core.