Initial import: PALW proof-of-compute runtime for Qwen3.6-35B-A3B (code + docs, no model weights)

.github/workflows/palw-ci.yml

@@ -0,0 +1,182 @@
+name: PALW protocol gates
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      run_nvidia_experimental:
+        description: Run the non-production CUDA transport test on a labelled self-hosted runner
+        required: true
+        default: false
+        type: boolean
+      cuda_architecture:
+        description: Exact real SM architecture for the experimental CUDA build
+        required: true
+        default: 90-real
+        type: choice
+        options:
+          - 80-real
+          - 86-real
+          - 89-real
+          - 90-real
+
+permissions:
+  contents: read
+
+concurrency:
+  group: palw-${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: ${{ github.event_name != 'workflow_dispatch' }}
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  rust-msrv:
+    name: Rust 1.81 protocol core
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Check out sources
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+      - name: Install declared MSRV
+        run: rustup toolchain install 1.81.0 --profile minimal --component rustfmt,clippy
+      - name: Format
+        working-directory: runtime-palw
+        run: cargo +1.81.0 fmt --all -- --check
+      - name: Lint every target
+        working-directory: runtime-palw
+        run: cargo +1.81.0 clippy --locked --all-targets -- -D warnings
+      - name: Test every target
+        working-directory: runtime-palw
+        run: cargo +1.81.0 test --locked --all-targets
+
+  observer-clean-patch:
+    name: Pinned llama.cpp clean patch and native targets
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Check out PALW sources
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+          path: palw
+      - name: Check out the exact upstream llama.cpp commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          repository: ggml-org/llama.cpp
+          ref: 12127defda4f41b7679cb2477a4b0d65ee6a0c8f
+          fetch-depth: 1
+          persist-credentials: false
+          path: llama.cpp
+      - name: Verify and apply the pinned observer patch
+        working-directory: llama.cpp
+        run: |
+          source ../palw/config/runtime-pins.sh
+          test "$(git rev-parse HEAD)" = "${PALW_LLAMA_COMMIT}"
+          test "$(sha256sum ../palw/${PALW_LLAMA_PATCH_REL} | cut -d' ' -f1)" = "${PALW_LLAMA_PATCH_SHA256}"
+          git apply --check ../palw/${PALW_LLAMA_PATCH_REL}
+          git apply ../palw/${PALW_LLAMA_PATCH_REL}
+          git apply --reverse --check ../palw/${PALW_LLAMA_PATCH_REL}
+      - name: Configure deterministic CPU compile contract
+        run: >-
+          cmake -S llama.cpp -B build/llama-observer-ci
+          -DGGML_NATIVE=OFF
+          -DGGML_METAL=OFF
+          -DGGML_CUDA=OFF
+          -DGGML_CPU=ON
+          -DGGML_CPU_KLEIDIAI=OFF
+          -DGGML_ACCELERATE=OFF
+          -DGGML_BLAS=OFF
+          -DGGML_LTO=OFF
+          -DBUILD_SHARED_LIBS=ON
+          -DLLAMA_CURL=OFF
+          -DLLAMA_BUILD_TESTS=OFF
+          -DLLAMA_BUILD_EXAMPLES=OFF
+          -DLLAMA_BUILD_TOOLS=ON
+          -DLLAMA_BUILD_SERVER=ON
+          -DLLAMA_BUILD_APP=OFF
+          -DLLAMA_BUILD_UI=OFF
+          -DLLAMA_USE_PREBUILT_UI=OFF
+          -DLLAMA_OPENSSL=OFF
+          -DLLAMA_BUILD_NUMBER=10015
+          -DLLAMA_BUILD_COMMIT=12127def
+          -DCMAKE_BUILD_TYPE=Release
+      - name: Build every pinned native target
+        run: >-
+          cmake --build build/llama-observer-ci --parallel 2
+          --target llama-palw-observer llama-tokenize llama-cli llama-server
+      - name: Require the pinned runtime version and exact patch state
+        run: |
+          source palw/config/runtime-pins.sh
+          ./build/llama-observer-ci/bin/llama-palw-observer --version | grep -F 'version: 10015 (12127def)'
+          git -C llama.cpp apply --reverse --check ../palw/${PALW_LLAMA_PATCH_REL}
+
+  host-abi-sanitizers:
+    name: CUDA transport host ABI (ASan + UBSan)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Check out sources
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+      - name: Configure host-only contracts
+        run: >-
+          cmake -S runtime-palw/cuda -B build/palw-cuda-sanitize
+          -DPALW_CUDA_TRACE_ENABLE_CUDA=OFF
+          -DBUILD_TESTING=ON
+          -DCMAKE_BUILD_TYPE=Debug
+          -DCMAKE_C_FLAGS=-Wall\ -Wextra\ -Wpedantic\ -Werror\ -fsanitize=address,undefined\ -fno-omit-frame-pointer
+          -DCMAKE_CXX_FLAGS=-Wall\ -Wextra\ -Wpedantic\ -Werror\ -fsanitize=address,undefined\ -fno-omit-frame-pointer
+          -DCMAKE_EXE_LINKER_FLAGS=-fsanitize=address,undefined
+      - name: Build host-only contracts
+        run: cmake --build build/palw-cuda-sanitize --parallel
+      - name: Test ABI, codec, and closed production gate
+        env:
+          ASAN_OPTIONS: detect_leaks=1:abort_on_error=1
+          UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1
+        run: ctest --test-dir build/palw-cuda-sanitize --output-on-failure -L host
+
+  cuda-device-experimental:
+    name: Experimental CUDA device transport (not R32)
+    if: github.event_name == 'workflow_dispatch' && inputs.run_nvidia_experimental
+    runs-on: [self-hosted, linux, x64, nvidia]
+    timeout-minutes: 30
+    env:
+      CUDA_VISIBLE_DEVICES: "0"
+    steps:
+      - name: Check out sources
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+      - name: Record NVIDIA toolchain and device
+        run: |
+          nvcc --version
+          nvidia-smi
+      - name: Require the selected device to match the exact SM class
+        env:
+          EXPECTED_ARCHITECTURE: ${{ inputs.cuda_architecture }}
+        run: |
+          compute_capability="$(nvidia-smi -i 0 --query-gpu=compute_cap --format=csv,noheader,nounits | tr -d '[:space:].')"
+          actual_architecture="${compute_capability}-real"
+          if [[ "${actual_architecture}" != "${EXPECTED_ARCHITECTURE}" ]]; then
+            echo "device 0 architecture ${actual_architecture} does not match ${EXPECTED_ARCHITECTURE}" >&2
+            exit 1
+          fi
+      - name: Configure one exact CUDA architecture
+        run: >-
+          cmake -S runtime-palw/cuda -B build/palw-cuda-device
+          -DPALW_CUDA_TRACE_ENABLE_CUDA=ON
+          -DPALW_CUDA_PRODUCTION_KERNEL_TRACE=OFF
+          -DBUILD_TESTING=ON
+          -DCMAKE_BUILD_TYPE=Release
+          -DCMAKE_CUDA_ARCHITECTURES=${{ inputs.cuda_architecture }}
+      - name: Build experimental CUDA transport
+        run: cmake --build build/palw-cuda-device --parallel
+      - name: Require both real device tests (skip 77 is a failure here)
+        run: |
+          ./build/palw-cuda-device/palw_cuda_trace_device_test
+          ./build/palw-cuda-device/palw_cuda_producer_device_test

.gitignore

@@ -0,0 +1,58 @@
+# ── OS / editor ───────────────────────────────────────────────
+.DS_Store
+
+# ── Python env / caches ───────────────────────────────────────
+.venv/
+.pytest_cache/
+.ruff_cache/
+__pycache__/
+*.py[cod]
+
+# ── Rust build artifacts ──────────────────────────────────────
+# Reproduced with `cargo build --locked` from the committed Cargo.lock.
+runtime-palw/target/
+runtime-palw/target-msrv/
+**/target/
+
+# ── CMake / native build outputs ──────────────────────────────
+build/
+runtime-palw/cuda/build-host-*/
+**/CMakeCache.txt
+**/CMakeFiles/
+
+# ── Vendored llama.cpp ────────────────────────────────────────
+# NOT committed (nested .git + large blobs). Reconstruct deterministically:
+#   git clone https://github.com/ggml-org/llama.cpp.git vendor/llama.cpp
+#   git -C vendor/llama.cpp checkout --detach 12127defda4f41b7679cb2477a4b0d65ee6a0c8f
+#   git -C vendor/llama.cpp apply ../../patches/llama.cpp-palw-full.patch
+# See docs/SETUP.md.
+vendor/
+
+# ── Model weights (fetched at pinned revisions) ───────────────
+# Fetch with scripts/hf_snapshot_download.py; verified against config/runtime-pins.sh hashes.
+models/*
+!models/.gitkeep
+*.gguf
+*.safetensors
+
+# ── Runtime SQLite state (may embed sensitive execution state) ─
+*.sqlite3
+*.sqlite3-wal
+*.sqlite3-shm
+
+# ── Encrypted receipt bundles — NEVER publish ─────────────────
+# .palw.bundle carries secret openings, signing key material, and registry
+# snapshots (AEAD-sealed). Excluded everywhere by policy.
+*.palw.bundle
+
+# ── Receipts: keep only the README-referenced canonical evidence ─
+# Track only the signed canonical receipt (.palw), public JSON (.json), and
+# completion marker (.complete) under final-v5 / final-v6 / final-v7. Everything
+# else (older runs, state DBs, bundles) stays local.
+receipts/*
+!receipts/final-v5/
+!receipts/final-v6/
+!receipts/final-v7/
+receipts/final-v5/palw-state.sqlite3
+receipts/final-v6/palw-state.sqlite3
+receipts/final-v7/palw-state.sqlite3

.python-version

@@ -0,0 +1 @@
+3.12

LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 MISAKA-BTC
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

LICENSES/llama.cpp-MIT.txt

@@ -0,0 +1,29 @@
+The following MIT License applies to ggml-org/llama.cpp, pinned at commit
+12127defda4f41b7679cb2477a4b0d65ee6a0c8f. This repository does not vendor the
+llama.cpp source, but patches/llama.cpp-palw-full.patch redistributes
+modifications to llama.cpp source files (a read-only graph observer and
+experimental CUDA trace hooks) under this license.
+
+--------------------------------------------------------------------------------
+
+MIT License
+
+Copyright (c) 2023-2026 The ggml authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

NOTICE

@@ -0,0 +1,46 @@
+MISAKA PALW runtime for Qwen3.6-35B-A3B
+Copyright 2026 MISAKA-BTC
+
+This product is licensed under the Apache License, Version 2.0 (see LICENSE).
+
+================================================================================
+IMPORTANT — what this project is
+================================================================================
+This repository is a PROOF-OF-COMPUTE RUNTIME that executes an unmodified
+upstream Qwen3.6-35B-A3B mixture-of-experts model as a local compute worker and
+commits the execution as a signed `ComputeReceiptV1`. It does NOT train,
+fine-tune, or otherwise modify the model, and it is NOT itself a new language
+model. Model weights are not distributed in this repository; they are fetched at
+pinned upstream artifacts (see config/runtime-pins.sh). Production Network
+readiness is NOT claimed — see docs/requirements.md for the In-progress
+requirements.
+
+================================================================================
+Third-party components
+================================================================================
+
+1. Qwen3.6-35B-A3B (huihui-ai abliterated release)
+   Base architecture Copyright Alibaba Cloud, licensed under the Apache License,
+   Version 2.0. Abliterated derivative by huihui-ai.
+   https://huggingface.co/huihui-ai/Huihui-Qwen3.6-35B-A3B-Claude-4.7-Opus-abliterated
+   https://ollama.com/huihui_ai/Qwen3.6-abliterated
+   Base metadata revision: ac18882735d037f6074a7630eb68d85db8234c25
+   GGUF artifact: Ollama huihui_ai/Qwen3.6-abliterated:35b-Claude-4.7,
+                  blob sha256 1dc494614bee8a3bc00e79fe5a49da0fc1c36b3b118c4156e223e98e5a0a671b (Q4_K_M)
+   The upstream artifact is executed unmodified. Weights are fetched at the
+   pinned artifacts above and are not redistributed in this repository.
+
+2. llama.cpp (ggml-org/llama.cpp)
+   Copyright (c) 2023-2026 The ggml authors
+   Licensed under the MIT License.
+   https://github.com/ggml-org/llama.cpp
+   Pinned at commit 12127defda4f41b7679cb2477a4b0d65ee6a0c8f.
+   patches/llama.cpp-palw-observer.patch redistributes MODIFICATIONS to llama.cpp
+   source (a read-only graph observer and qwen35moe loader/graph fixes required
+   to run the pinned GGUF) under the MIT License. The llama.cpp source itself is
+   not vendored in this repository; it is reconstructed from the pinned commit
+   (see docs/SETUP.md). The full MIT license text is included at
+   LICENSES/llama.cpp-MIT.txt.
+
+Rust crate dependencies retain their own upstream licenses as declared in
+runtime-palw/Cargo.toml and runtime-palw/Cargo.lock.

README.md

@@ -0,0 +1,271 @@
+# MISAKA PALW Runtime for Qwen3.6-35B-A3B (Claude-4.7, abliterated)
+
+> **What this is — please read first.**
+> This repository is a **proof-of-compute runtime** that runs an **unmodified,
+> upstream Qwen3.6-35B-A3B** mixture-of-experts model as a local worker and
+> commits a signed `ComputeReceiptV1` of the execution. The specific worker is
+> `huihui_ai/Qwen3.6-abliterated:35b-Claude-4.7` (the abliterated
+> `Huihui-Qwen3.6-35B-A3B-Claude-4.7-Opus` release). Earlier revisions of this
+> runtime targeted dense Qwen3-8B; that dense profile has since been removed and
+> Qwen3.6-35B-A3B is now the sole supported model.
+> - It is **not** a newly trained or fine-tuned language model. The runtime is a
+>   wrapper around the upstream model, not a distinct model.
+> - It does **not** contain or distribute model weights — the GGUF is fetched
+>   from the Ollama registry at a pinned blob digest and base metadata from the
+>   pinned Hugging Face revision (see [`config/runtime-pins.sh`](config/runtime-pins.sh)).
+> - The model is **abliterated** (its refusal behavior has been reduced upstream).
+>   This runtime makes no claim about the model's safety properties; it only
+>   attests *that* a pinned computation ran.
+> - It is **not production-ready**. Several protocol requirements
+>   (R13/R21/R23/R24/R26/R27/R32/R35) are still *In progress* and production
+>   Receipt issuance is intentionally fail-closed (see
+>   [`docs/requirements.md`](docs/requirements.md)).
+> - A single self-attested Receipt is **not** a trustless or zero-knowledge
+>   proof of physical GPU execution; the design makes no TEE/ZK claims (see
+>   [`docs/security-model.md`](docs/security-model.md)).
+>
+> Licensed under Apache-2.0 — see [`LICENSE`](LICENSE) and [`NOTICE`](NOTICE).
+> Third-party attribution (Qwen3.6-35B-A3B, llama.cpp) is in [`NOTICE`](NOTICE).
+
+Qwen3.6-35B-A3B（MoE）をローカル計算ワーカーとして実行し、実行内容を
+`ComputeReceiptV1` としてコミットするランタイムです。モデルの学習や
+fine-tuning は行わず、PALW のロジックはすべてランタイム側に置きます。この
+モデルは linear-attention（state-space / gated-delta-net）層と mixture-of-experts
+層を組み合わせたハイブリッド構成のため、MoE/SSM 演算を**忠実な canonical operation**へ写像し
+(`ExpertRoute`/`ExpertGemm`/`SsmConv`/`GatedDeltaNet` 等)、CU は graph 非依存の
+**semantic ルールセット v3** で commit し、各 GEMM を実 Metal kernel dispatch へ束縛します
+(compute-gate track M1-M5、全て実機検証済み)。
+
+このリポジトリは次の三層を分離します。
+
+1. `runtime-palw/`: Receipt、commitment、CU、schedule、検証、永続状態、
+   replica/audit/bond policy
+2. `vendor/llama.cpp/`: commit を固定した Qwen 推論ランタイムと read-only graph observer
+3. `runtime-palw/cuda/`: 実験的な CUDA V1/V2 trace transport（production 非発行）
+
+## 固定する上流 artifact
+
+| Artifact | Upstream | Revision / variant |
+|---|---|---|
+| Base metadata | `huihui-ai/Huihui-Qwen3.6-35B-A3B-Claude-4.7-Opus-abliterated` | `ac18882735d037f6074a7630eb68d85db8234c25` |
+| Local model artifact | Ollama `huihui_ai/Qwen3.6-abliterated:35b-Claude-4.7` | blob `1dc494614bee…a671b`, `Q4_K_M` |
+| Runtime | `ggml-org/llama.cpp` | `12127defda4f41b7679cb2477a4b0d65ee6a0c8f`（PALW patch 適用） |
+
+`Q4_K_M` は Qwen 公式配布 artifact をそのまま使用します。量子化は
+`runtime_class_id` と manifest に含め、別の精度・量子化とは照合しません。
+
+## Quickstart — 自分のハードウェアで Qwen3.6 を測定する
+
+**誰でも自分の Apple Silicon Mac で** pin された Qwen3.6-35B-A3B を実行し、署名済み Receipt を
+発行して別 process で検証できます。現状サポートは **Metal arm64**(Apple Silicon)です。手順の正本は
+[`docs/runbook.md`](docs/runbook.md)。前提: Apple Silicon Mac、約 24GB の unified memory 推奨、
+約 30GB の空き、`git`/CMake/`uv`/`rustup`。
+
+```sh
+# 1. clean checkout から一括導入(llama.cpp @ pinned commit + PALW patch を build、
+#    Ollama registry blob から Qwen3.6 GGUF(約24GB)+ base metadata を取得・照合)
+./scripts/install.sh
+./scripts/verify-install.sh          # 固定 artifact hash / commit / Metal offload を独立検証
+
+# 2. audit key(exact 32 raw bytes)を output の外に一度だけ作成
+AUDIT_KEY="$HOME/.config/misaka-palw/audit-keys/local-audit.key"
+install -d -m 700 "$(dirname "$AUDIT_KEY")"; test ! -e "$AUDIT_KEY"
+(umask 077 && openssl rand 32 > "$AUDIT_KEY"); chmod 600 "$AUDIT_KEY"
+
+# 3. Receipt 発行(prompt は stdin。ここでは例として capital-of-France を 2 token 生成)
+OUT="receipts/manual-$(date +%Y%m%d-%H%M%S)"
+printf '%s' 'The capital of France is' | runtime-palw/target/release/palw-metal-receipt \
+  --prompt-stdin --audit-key-file "$AUDIT_KEY" --output-dir "$OUT" --n-predict 2
+
+# 4. 別 process で検証(status=local_restored / trust_scope=embedded_local_snapshot なら成功)
+ID=$(basename "$OUT"/*.palw .palw)
+runtime-palw/target/release/palw-verify-bundle \
+  --receipt "$OUT/$ID.palw" --bundle "$OUT/$ID.palw.bundle" \
+  --public-json "$OUT/$ID.json" --audit-key-file "$AUDIT_KEY" \
+  --state-db "$OUT/palw-state.sqlite3"
+```
+
+発行される公開 metadata(`<id>.json`)には CU ルールセット v3 の `canonical_compute_units`、
+`semantic_schedule`、実捕捉 `expert_route`、`trace_evidence=metal_kernel`(各 GEMM を実 Metal
+kernel dispatch へ束縛)、および `mint`(常に `eligible=false`、失格理由を自己申告)が含まれます。
+job ID/nonce/salt/signing key は実行ごとに OS CSPRNG で生成されるため Receipt ID は証跡例と一致しません。
+参照 receipt は [`receipts/final-v7/`](receipts/final-v7)。**この Receipt は mint-grade ではなく、
+mainnet 報酬には外部インフラが別途必要です**(下記「セキュリティ上の境界」)。
+
+## 現在の状態
+
+Rust core、Metal graph observer、署名済み Self Local Receipt、schema v4 SQLite
+replay/state registry、adversarial test suite は実装・実行済みです。対象モデルを
+dense Qwen3-8B から hybrid Qwen3.6-35B-A3B（`huihui_ai/Qwen3.6-abliterated:35b-Claude-4.7`）へ
+移行し、Apple M1 Max（Metal、41/41 layer GPU offload）で実機ロード・推論・Receipt
+発行・別 process 検証まで確認しています。
+
+hybrid モデルは linear-attention（SSM / gated-delta-net）層と mixture-of-experts 層を
+持つため、次を追加しました。
+
+- pinned llama.cpp への qwen35moe loader/graph 互換修正（`vendor/llama.cpp/src/models/qwen35moe.cpp`、
+  PALW observer patch に同梱）。3-section mrope、`ssm_dt` naming、per-layer KV-head、
+  bundled vision/MTP tensor、per-layer attention reshape を扱う。
+- Rust adapter の hybrid profile（`AdapterProfile::HybridQwen36A3B`）: dense 演算は正確な
+  canonical operation へ**忠実に**写像する(`MUL_MAT_ID→ExpertGemm`、`ARGSORT→ExpertRoute`、
+  `SSM_CONV→SsmConv`、`GATED_DELTA_NET→GatedDeltaNet`、`L2_NORM→L2Norm`、`SUM_ROWS→Reduction`、
+  `CONCAT/CONT/CPY→TensorCopy`、`UNARY/SCALE/DIV/CLAMP→Elementwise`)。`VIEW`/`RESHAPE`/`PERMUTE`/
+  `TRANSPOSE` は layout-only、未列挙 op は fail-closed。**`Generic` 演算は廃止(M3)。**
+- CU ルールセットは **v3 semantic**(`ComputeUnitRules::v3`): 観測 schedule は commitment-only とし、
+  canonical CU は pinned model 構造 + token 数から算出した graph 非依存の semantic 値を署名 commit。
+  dense Receipt は v1 のまま identity 不変。
+
+Receipt 実装の詳細(observer JSONL v2、adapter 写像、CU 語彙、schedule、manifest、builder/verifier、
+bundle、永続化、CLI 契約、実測値)は
+[`docs/receipt-implementation-qwen36.md`](docs/receipt-implementation-qwen36.md) を正本とします。
+
+**この Receipt は mint-grade ではありません。** `assess_mint_eligibility`(`runtime-palw/src/mint.rs`)
+が全 receipt を `eligible=false, weight=0` と判定し、公開 JSON の `mint` ブロックに自己申告します。
+用途はローカル自己整合 receipt / testnet 計測 / Self-Local 非報酬に限られます。compute-gate track
+(M1-M5、全て実機検証済み)で semantic CU v3 の canonical commitment・`Generic` 廃止・canonical
+semantic schedule 再生成・実 MoE routing 捕捉・**各 GEMM の実 Metal kernel dispatch 束縛
+(`trace_evidence=metal_kernel`、graph-fallback から昇格)** を実装しました。ただし Metal の
+kernel-level trace は launch-geometry 束縛であり、CUDA V3 相当の intra-kernel accumulator proof
+ではないため mint 不適格のまま(honest labeling)。残る失格理由は「Metal kernel-launch-bound sketch,
+not an intra-kernel accumulator proof」/ 非 network-anchored / 非 bonded の 3 件。是正計画は
+[`docs/receipt-review-remediation.md`](docs/receipt-review-remediation.md) を参照してください。
+
+Apple M1 Max（macOS Metal）で hybrid モデルから生成した schema-v4 E2E artifact は
+[`receipts/final-v7/8e2dd34b7609d6d7aeec17bff485eb1ae4db31f66dd899a3c3a3e671656053f9.palw`](receipts/final-v7/8e2dd34b7609d6d7aeec17bff485eb1ae4db31f66dd899a3c3a3e671656053f9.palw)、
+公開測定値は
+[`receipts/final-v7/8e2dd34b7609d6d7aeec17bff485eb1ae4db31f66dd899a3c3a3e671656053f9.json`](receipts/final-v7/8e2dd34b7609d6d7aeec17bff485eb1ae4db31f66dd899a3c3a3e671656053f9.json)
+にあります。Receipt ID は `8e2dd34b…6053f9`、verification bundle ID は `f5b8a296…dcf9db`、
+CU ルールセットは **v3 semantic**（`43a5feef…7870ce`）、`evidence_level=gemm_traced`、
+**`trace_evidence=metal_kernel`**。prompt 5 token + 2 生成 token の実行で observed schedule
+13,770 件(commitment-only)・GEMM sketch 2,466 件(各々実 Metal kernel dispatch へ束縛)・
+**canonical compute units 41,692(v3 semantic)**、`semantic_schedule`(80 expert-route ops)、
+**実捕捉した `expert_route`(240 record)** を committ し、別 process の `palw-verify-bundle` が
+`status=local_restored` / `trust_scope=embedded_local_snapshot` で再検証しました。
+
+dense Qwen3-8B の schema-v4 E2E artifact（Receipt ID `eb51b08c…78131`、bundle
+`359f1bed…096e9`、`receipts/final-v6/`）と schema-v3 artifact（`receipts/final-v5/`）は、
+移行前の検証証跡として履歴保持します。hybrid モデルの Receipt は実行ごとに OS CSPRNG で
+identity を生成するため ID は再現しません（`docs/runbook.md` の手順で生成・検証）。
+
+現行 release CLI が発行する単位は、署名済み `.palw`、認証付き暗号化
+`.palw.bundle`、検証対象の公開 JSON、schema v4 の SQLite state、最後に作成する
+`misaka.palw.receipt-set.v2` completion marker の一式です。秘密 opening、署名済み
+request/assignment、検証用 registry snapshot は公開 JSON ではなく暗号化 bundle に封入します。
+公開 metadata は strict `misaka.palw.public-receipt.v2` で、unknown field を拒否し、保持する
+artifact/observer field を authenticated bundle と照合します。`palw-verify-bundle` がこの一式を
+別 process で復元・再検証します。上記 `final-v5` のDBは旧schema v3であり、当時の検証証跡として
+保持します。schema v4 sourceはsilent migrationを行わず、旧DBをcurrent stateとしてopenしません。
+
+repository-scope の設計・実装・evidence baseline はこの版で固定しますが、これは Production Network
+readiness の完了を意味しません。R13/R21/R23/R24/R26/R27/R35 の未達gateは内部統合と外部境界を
+[`docs/requirements.md`](docs/requirements.md) で分離し、R32 は `In progress` です。以下の CUDA
+producer evidence は移行前 dense Qwen3-8B を対象とした legacy V2 CUDA track の測定記録で、現行 35B の
+main path（Metal、41/41 offload）とは別系統として保持します。Windows WSL2の
+Ubuntu 24.04、RTX 4060 Ti（sm_89）、CUDA Toolkit 13.3.1 / nvcc 13.3.73で、当時の固定 Qwen3-8B GGUFの37/37 layer CUDA
+offloadとbatch 1 graph observerの6/6同一diagnostic streamを確認しました。さらにstandaloneの
+producer-internal FP32 accumulator採取primitiveはsm_89 standalone device gate 7/7と20/20同一diagnostic
+fingerprintを通過しています。vendored llama.cppのQ4_K/Q6_K MMVQ full-K pre-epilogue hookも
+traced llama contextと同じCUDA backendへattachし、FA-off 1-token diagnostic E2Eで253 launch（Q4_K 216 /
+Q6_K 37）を取得します。さらにFA-off eager attentionのQK GEMM 36、softmax 36、PV GEMM 36を同じ
+request-local V3 producerへ統合し、合計361 recordを3回連続で完全取得して同一fingerprintとなること、
+5 work classそれぞれの先頭拒否がfail closedになることを確認しました。
+
+CUDAはadditive 184-byte V2 codec、strict Rust full-stream/dispatch/runtime binder、authority署名と
+runtime/job/schedule/integrationへbindする将来のReceipt V2 evidence candidateに加え、FA-off attentionの
+canonical 3-sublaunch groupingを持つ452-byte V3 schema/binderを実装しています。
+`ComputeReceiptV1`にはこのprovenanceをcommitするfieldがないため、builderとverifierはCUDA
+`KernelSketch`をともにfail closedで拒否します。現行deterministic profileのFA-off eager attentionには
+V3 schema/binderに加え、実QK-score/softmax/value-aggregation work直後の同一stream collectorと
+typed graph associationをsourceへ統合しました。実機361-launch gate、exact mangled entry point、
+runtime CUDA attributes、DSO/fatbin/cubin/section hashを結ぶrelease manifest、361-launchを厳密にbindする
+Receipt/RuntimeManifest/Request/Assignment V2、暗号化Bundle V2、原子的SQLite V2は実装・検証済みです。
+ただしlive C++ smokeはdiagnostic callbackであり、authority提供のcanonical physical-layout IDから
+production署名Receiptを発行する経路ではありません。このため
+`PALW_CUDA_TRACE_PRODUCTION_CAPABLE=0`、`PALW_CUDA_PRODUCER_VENDOR_RUNTIME_INTEGRATED=0`、
+`PALW_CUDA_PRODUCER_RECEIPT_MAPPING_AVAILABLE=0`、`PALW_CUDA_PRODUCER_PRODUCTION_CAPABLE=0`
+のままproduction CUDA Receipt発行は拒否されます。
+要件別の状態は同requirements matrixを正本とします。
+
+Rust crate の宣言 MSRV は 1.81 です。open な transitive range が edition-2024 manifest の
+`zeroize 1.9` / `base64ct 1.8.3` を選ぶと Cargo 1.81 が manifest を読めないため、互換版
+`zeroize 1.8.1` / `base64ct 1.7.3` を exact pin しています。MSRV、host sanitizer、手動
+experimental NVIDIA gate は [`.github/workflows/palw-ci.yml`](.github/workflows/palw-ci.yml)
+にも定義しています。NVIDIA job は production approval や R32 completion を意味しません。
+
+## 開発・検証コマンド
+
+依存ツールとモデル取得用 Python 環境:
+
+```sh
+uv sync --frozen
+```
+
+固定 artifact、4つの llama.cpp target、Metal device を再検証:
+
+```sh
+./scripts/verify-install.sh
+```
+
+Rust 1.81 MSRV core gate と release CLI:
+
+```sh
+rustup toolchain install 1.81.0 --profile minimal --component rustfmt,clippy
+cargo +1.81.0 fmt --manifest-path runtime-palw/Cargo.toml --all -- --check
+cargo +1.81.0 clippy --manifest-path runtime-palw/Cargo.toml --locked --all-targets -- -D warnings
+cargo +1.81.0 test --manifest-path runtime-palw/Cargo.toml --locked --all-targets
+cargo +1.81.0 build --release --locked --manifest-path runtime-palw/Cargo.toml \
+  --bin palw-metal-receipt --bin palw-verify-bundle
+```
+
+現行 MSRV test result は 224 passed、2 ignored（226 discovered）です。ignored 2件は pinned Qwen
+model と Metal observer を必要とする実モデル test で、release build と汚染した親環境を使った
+手動 gate では 2/2 passed です。
+
+実モデル Receipt の生成、SQLite 検査、CUDA host/device gate は
+[`docs/runbook.md`](docs/runbook.md) に記載します。実測証跡は
+[`docs/evidence/metal-smoke-schema-v4-2026-07-15.md`](docs/evidence/metal-smoke-schema-v4-2026-07-15.md)
+と
+[`docs/evidence/cuda-wsl-sm89-2026-07-15.md`](docs/evidence/cuda-wsl-sm89-2026-07-15.md)
+と
+[`docs/evidence/cuda-v3-mmvq-hook-sm89-2026-07-15.md`](docs/evidence/cuda-v3-mmvq-hook-sm89-2026-07-15.md)
+と
+[`docs/evidence/cuda-v3-full-hook-sm89-2026-07-16.md`](docs/evidence/cuda-v3-full-hook-sm89-2026-07-16.md)
+を参照してください。旧 schema-v3 の証跡は
+[`docs/evidence/metal-smoke-2026-07-15.md`](docs/evidence/metal-smoke-2026-07-15.md)
+に履歴として残します。
+
+## セキュリティ上の境界
+
+Receipt は prompt、prompt token IDs、generated token IDs、出力 bytes、opening、private key、
+owner salt を公開しません。Receipt CLI は `--prompt-stdin`、`--audit-key-file`、`--output-dir`
+をすべて必須とし、prompt は UTF-8・非空・最大 1 MiB に限定します。argv で prompt を受ける
+互換入口はありません。Qwen adapter も prompt を tokenizer/native observer の argv に置かず
+専用 stdin pipe で渡し、通常の Receipt 実行では decoded output bytes を IPC JSONL から省略します。
+
+audit key は output directory の外に置く exact 32-byte raw key で、同一 owner、single-link の
+regular file、mode `0400` または `0600` を要求します。output directory は owner-only `0700`、
+bundle と DB は `0600`、公開 `.palw` / JSON / marker は `0644` です。v2 marker は receipt ID、
+bundle ID、公開 JSON の SHA-256 を結ぶ crash-completion signal ですが、秘密鍵付き MAC や
+network authority の署名ではありません。marker 単独を真正性や maturity の根拠にせず、必ず
+bundle verifier と trust policy を通します。
+
+一方、単独ノードが発行する Receipt はそれだけでゼロ知識の計算証明になるものでは
+ありません。PALW の不正耐性は runtime/model digest、署名、k=2 replica、future audit、
+canary、bond/slashing を組み合わせて成立します。Metal の graph fallback は CUDA kernel
+trace ではありません。詳細は [`docs/security-model.md`](docs/security-model.md) を参照してください。
+
+ローカル CLI が実行ごとに生成する scheduler/worker signing key、network ID、job ID は、この
+ローカル証跡を相互に bind するための値です。production network の登録済み scheduler、worker
+credential、beacon service、auditor、payment/escrow authority を表すものではありません。
+replication/future auditに加え、scheduler-signed durable canary、authority-signed bond funding/appeal/
+decision、assignment lock/release/slash/health、authority-confirmed External settlementのschema-v4 coreは
+統合されています。maturityは必要なassignment bondをrelease/linkし、`WorkTicketV2`はmaturity basisと
+External weight grantをbindします。External settlementはterminal confirmation、両bond release、maturity、
+ticketをlocal SQLite transactionでatomicにしますが、実payment railの資金移動そのものとのdistributed
+atomicityは主張しません。これらを運用するproduction authority/governance/payment serviceはrepositoryの
+完了範囲外です。
+
+Work Ticket の maturity は caller が raw flag で登録できません。field/constructor が非公開の
+`MatureEvidence` を Self Local audit の `Mature` state、Self Replicated の typed k=2 pair、または
+authority-confirmed External settlement だけが生成し、SQLite はその証拠、`maturity_basis_id`、
+`mature_epoch`、必要なbond release linkを検査してから一回だけ`WorkTicketV2`へ消費します。

SECURITY.md

@@ -0,0 +1,34 @@
+# Security Policy
+
+MisakaLM3-8B (the PALW runtime) is a cryptographic proof-of-compute project —
+it uses Ed25519 signatures, XChaCha20-Poly1305 authenticated encryption, and a
+bond/slashing protocol. We take security reports seriously.
+
+## Reporting a vulnerability
+
+Please report vulnerabilities **privately** — do not open a public issue.
+
+- **Preferred:** GitHub private security advisory —
+  *Security → Advisories → Report a vulnerability* on this repository.
+- **Email:** info@misakachain.com
+
+Include a description, the affected files/paths, and a reproduction if possible.
+We aim to acknowledge within a few business days.
+
+## Scope and status
+
+This is a **repository-scope research baseline, not a production deployment.**
+Before reporting, please review:
+
+- [`docs/security-model.md`](docs/security-model.md) — threat model and the
+  explicit, documented trust boundaries. In particular, a single self-attested
+  `ComputeReceiptV1` is **not** an independent cryptographic proof that a
+  specific physical GPU executed the work; the design makes no TEE/ZK claims,
+  and replica/audit tiers provide the compensating controls.
+- [`docs/requirements.md`](docs/requirements.md) — requirements still marked
+  *In progress* (R13/R21/R23/R24/R26/R27/R32/R35); production Receipt issuance
+  is intentionally fail-closed while these are unmet.
+
+Reports that restate these documented boundaries as if they were undisclosed
+vulnerabilities may be closed with a pointer here, but genuine deviations from
+the stated model are in scope and welcome.

config/qwen3.6-35b-a3b-claude-4.7-base-metadata.sha256

@@ -0,0 +1,7 @@
+af5f5d80880bf4e84c3c9d079dc0cb7839be2c4c9c11de7b48045c4458212dc6  README.md
+55d4931433fe502b794226ee7f4d206a6bdd436ac9f80eb7d8ebb4c639f9ea0c  chat_template.jinja
+5e75e90b919ad0707bdb2bc609d25946a6ef27036dc2140620d0e6ea4d0d11ec  config.json
+41b9356101ebf8e7519e150dc811f80c4226e727301fbb032b890f006ed0be83  model.safetensors.index.json
+14932921ca485d458a04dafd8069fbb0a4505622a48208d19ed247115801385b  processor_config.json
+87a7830d63fcf43bf241c3c5242e96e62dd3fdc29224ca26fed8ea333db72de4  tokenizer.json
+a8fd45a0a19ff87cad15511ecb8c576a6907d697018e0f55decb3d1d075a4499  tokenizer_config.json

config/qwen3.6-35b-a3b-claude-4.7-profile.json

@@ -0,0 +1,112 @@
+{
+  "schema": "misaka.palw.model-profile-pin.v2",
+  "profile_name": "Qwen3.6-35B-A3B-Claude-4.7-Opus-abliterated-Q4_K_M-Metal-arm64",
+  "model": {
+    "architecture": "Qwen3_5MoeForConditionalGeneration",
+    "model_type": "qwen3_5_moe",
+    "gguf_architecture": "qwen35moe",
+    "hidden_size": 2048,
+    "attention_heads": 16,
+    "key_value_heads": 2,
+    "layers": 40,
+    "full_attention_interval": 4,
+    "head_dim": 256,
+    "intermediate_size": 512,
+    "shared_expert_intermediate_size": 512,
+    "expert_count": 256,
+    "experts_per_token": 8,
+    "linear_key_head_dim": 128,
+    "linear_value_head_dim": 128,
+    "linear_num_key_heads": 16,
+    "linear_num_value_heads": 32,
+    "linear_conv_kernel_dim": 4,
+    "rope_theta": 10000000,
+    "partial_rotary_factor_millionths": 250000,
+    "vocabulary_size": 248320,
+    "maximum_position_embeddings": 262144,
+    "base_dtype": "bfloat16",
+    "runtime_quantization": "Q4_K_M"
+  },
+  "base_artifact": {
+    "repository": "huihui-ai/Huihui-Qwen3.6-35B-A3B-Claude-4.7-Opus-abliterated",
+    "revision": "ac18882735d037f6074a7630eb68d85db8234c25",
+    "download_scope": "metadata-only",
+    "files": [
+      {
+        "path": "README.md",
+        "sha256": "af5f5d80880bf4e84c3c9d079dc0cb7839be2c4c9c11de7b48045c4458212dc6"
+      },
+      {
+        "path": "chat_template.jinja",
+        "sha256": "55d4931433fe502b794226ee7f4d206a6bdd436ac9f80eb7d8ebb4c639f9ea0c"
+      },
+      {
+        "path": "config.json",
+        "sha256": "5e75e90b919ad0707bdb2bc609d25946a6ef27036dc2140620d0e6ea4d0d11ec"
+      },
+      {
+        "path": "model.safetensors.index.json",
+        "sha256": "41b9356101ebf8e7519e150dc811f80c4226e727301fbb032b890f006ed0be83"
+      },
+      {
+        "path": "processor_config.json",
+        "sha256": "14932921ca485d458a04dafd8069fbb0a4505622a48208d19ed247115801385b"
+      },
+      {
+        "path": "tokenizer.json",
+        "sha256": "87a7830d63fcf43bf241c3c5242e96e62dd3fdc29224ca26fed8ea333db72de4"
+      },
+      {
+        "path": "tokenizer_config.json",
+        "sha256": "a8fd45a0a19ff87cad15511ecb8c576a6907d697018e0f55decb3d1d075a4499"
+      }
+    ]
+  },
+  "inference_artifact": {
+    "repository": "registry.ollama.ai/huihui_ai/Qwen3.6-abliterated",
+    "tag": "35b-Claude-4.7",
+    "revision": "1dc494614bee8a3bc00e79fe5a49da0fc1c36b3b118c4156e223e98e5a0a671b",
+    "path": "Qwen3.6-abliterated-35b-Claude-4.7-Q4_K_M.gguf",
+    "bytes": 23938321728,
+    "sha256": "1dc494614bee8a3bc00e79fe5a49da0fc1c36b3b118c4156e223e98e5a0a671b"
+  },
+  "runtime": {
+    "repository": "https://github.com/ggml-org/llama.cpp.git",
+    "commit": "12127defda4f41b7679cb2477a4b0d65ee6a0c8f",
+    "reported_version": "10015 (12127def)",
+    "supported_profile": "metal-arm64",
+    "build_directory": "vendor/llama.cpp/build-palw",
+    "targets": [
+      "llama-cli",
+      "llama-server",
+      "llama-tokenize",
+      "llama-palw-observer"
+    ],
+    "cmake_cache": {
+      "CMAKE_BUILD_TYPE": "Release",
+      "CMAKE_OSX_ARCHITECTURES": "arm64",
+      "LLAMA_BUILD_NUMBER": "10015",
+      "LLAMA_BUILD_COMMIT": "12127def",
+      "GGML_NATIVE": "OFF",
+      "GGML_METAL": "ON",
+      "GGML_METAL_EMBED_LIBRARY": "ON",
+      "GGML_METAL_SHADER_DEBUG": "ON",
+      "GGML_CPU_KLEIDIAI": "OFF",
+      "GGML_LTO": "OFF",
+      "GGML_CUDA": "OFF",
+      "BUILD_SHARED_LIBS": "ON",
+      "GGML_CPU": "ON",
+      "GGML_ACCELERATE": "ON",
+      "GGML_BLAS": "ON",
+      "GGML_BLAS_VENDOR": "Apple",
+      "LLAMA_BUILD_TESTS": "OFF",
+      "LLAMA_BUILD_EXAMPLES": "OFF",
+      "LLAMA_BUILD_TOOLS": "ON",
+      "LLAMA_BUILD_SERVER": "ON",
+      "LLAMA_BUILD_APP": "OFF",
+      "LLAMA_BUILD_UI": "OFF",
+      "LLAMA_OPENSSL": "OFF",
+      "LLAMA_USE_PREBUILT_UI": "OFF"
+    }
+  }
+}

config/runtime-pins.sh

@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+# shellcheck shell=bash
+# shellcheck disable=SC2034
+#
+# Immutable upstream and build inputs for the supported PALW Metal profile.
+# This file contains public identifiers only. Never add credentials here.
+
+PALW_LLAMA_REPO_URL='https://github.com/ggml-org/llama.cpp.git'
+PALW_LLAMA_COMMIT='12127defda4f41b7679cb2477a4b0d65ee6a0c8f'
+PALW_LLAMA_COMMIT_SHORT='12127def'
+PALW_LLAMA_VERSION='10015'
+PALW_LLAMA_PATCH_REL='patches/llama.cpp-palw-observer.patch'
+PALW_LLAMA_PATCH_SHA256='d155a88b7c11ee74f48011760cb1a37773a694c8cab28258ee108c85e2f9e02c'
+
+# Inference artifact: the exact GGUF blob published by the Ollama registry
+# model huihui_ai/Qwen3.6-abliterated, tag 35b-Claude-4.7. The registry blob
+# digest is the SHA-256 of the GGUF itself, so revision == sha256 here.
+PALW_GGUF_REGISTRY='registry.ollama.ai'
+PALW_GGUF_REPO_ID='huihui_ai/Qwen3.6-abliterated'
+PALW_GGUF_OLLAMA_TAG='35b-Claude-4.7'
+PALW_GGUF_REVISION='1dc494614bee8a3bc00e79fe5a49da0fc1c36b3b118c4156e223e98e5a0a671b'
+PALW_GGUF_FILENAME='Qwen3.6-abliterated-35b-Claude-4.7-Q4_K_M.gguf'
+PALW_GGUF_SIZE='23938321728'
+PALW_GGUF_SHA256='1dc494614bee8a3bc00e79fe5a49da0fc1c36b3b118c4156e223e98e5a0a671b'
+
+PALW_BASE_REPO_ID='huihui-ai/Huihui-Qwen3.6-35B-A3B-Claude-4.7-Opus-abliterated'
+PALW_BASE_REVISION='ac18882735d037f6074a7630eb68d85db8234c25'
+
+PALW_LLAMA_DIR_REL='vendor/llama.cpp'
+PALW_BUILD_DIR_REL='vendor/llama.cpp/build-palw'
+PALW_GGUF_DIR_REL='models/Qwen3.6-abliterated-35b-Claude-4.7'
+PALW_BASE_META_DIR_REL='models/Qwen3.6-35B-A3B-Claude-4.7-base-meta'
+PALW_BASE_META_CHECKSUMS_REL='config/qwen3.6-35b-a3b-claude-4.7-base-metadata.sha256'
+PALW_MODEL_PROFILE_REL='config/qwen3.6-35b-a3b-claude-4.7-profile.json'
+
+PALW_BASE_METADATA_FILES=(
+  'README.md'
+  'chat_template.jinja'
+  'config.json'
+  'model.safetensors.index.json'
+  'processor_config.json'
+  'tokenizer.json'
+  'tokenizer_config.json'
+)
+
+# The first sixteen entries reproduce the successful build-palw configure
+# command. The final five make the effective Apple/Metal defaults explicit and
+# prevent this profile from silently becoming a CUDA build.
+PALW_METAL_CMAKE_ARGS=(
+  '-DCMAKE_BUILD_TYPE=Release'
+  '-DCMAKE_OSX_ARCHITECTURES=arm64'
+  '-DLLAMA_BUILD_NUMBER=10015'
+  '-DLLAMA_BUILD_COMMIT=12127def'
+  '-DGGML_NATIVE=OFF'
+  '-DGGML_METAL=ON'
+  '-DGGML_METAL_EMBED_LIBRARY=ON'
+  '-DGGML_METAL_SHADER_DEBUG=ON'
+  '-DGGML_CPU_KLEIDIAI=OFF'
+  '-DGGML_LTO=OFF'
+  '-DLLAMA_BUILD_TESTS=OFF'
+  '-DLLAMA_BUILD_EXAMPLES=OFF'
+  '-DLLAMA_BUILD_TOOLS=ON'
+  '-DLLAMA_BUILD_SERVER=ON'
+  '-DLLAMA_BUILD_APP=OFF'
+  '-DLLAMA_BUILD_UI=OFF'
+  '-DLLAMA_OPENSSL=OFF'
+  '-DLLAMA_USE_PREBUILT_UI=OFF'
+  '-DGGML_CUDA=OFF'
+  '-DBUILD_SHARED_LIBS=ON'
+  '-DGGML_CPU=ON'
+  '-DGGML_ACCELERATE=ON'
+  '-DGGML_BLAS=ON'
+)
+
+PALW_METAL_CACHE_EXPECTATIONS=(
+  'CMAKE_BUILD_TYPE=Release'
+  'CMAKE_OSX_ARCHITECTURES=arm64'
+  'LLAMA_BUILD_NUMBER=10015'
+  'LLAMA_BUILD_COMMIT=12127def'
+  'GGML_NATIVE=OFF'
+  'GGML_METAL=ON'
+  'GGML_METAL_EMBED_LIBRARY=ON'
+  'GGML_METAL_SHADER_DEBUG=ON'
+  'GGML_CPU_KLEIDIAI=OFF'
+  'GGML_LTO=OFF'
+  'LLAMA_BUILD_TESTS=OFF'
+  'LLAMA_BUILD_EXAMPLES=OFF'
+  'LLAMA_BUILD_TOOLS=ON'
+  'LLAMA_BUILD_SERVER=ON'
+  'LLAMA_BUILD_APP=OFF'
+  'LLAMA_BUILD_UI=OFF'
+  'LLAMA_OPENSSL=OFF'
+  'LLAMA_USE_PREBUILT_UI=OFF'
+  'GGML_CUDA=OFF'
+  'BUILD_SHARED_LIBS=ON'
+  'GGML_CPU=ON'
+  'GGML_ACCELERATE=ON'
+  'GGML_BLAS=ON'
+  'GGML_BLAS_VENDOR=Apple'
+)
+
+PALW_BUILD_TARGETS=(
+  'llama-cli'
+  'llama-server'
+  'llama-tokenize'
+  'llama-palw-observer'
+)
+
+readonly PALW_LLAMA_REPO_URL PALW_LLAMA_COMMIT PALW_LLAMA_COMMIT_SHORT
+readonly PALW_LLAMA_VERSION PALW_LLAMA_PATCH_REL PALW_LLAMA_PATCH_SHA256
+readonly PALW_GGUF_REGISTRY PALW_GGUF_REPO_ID PALW_GGUF_OLLAMA_TAG
+readonly PALW_GGUF_REVISION
+readonly PALW_GGUF_FILENAME PALW_GGUF_SIZE PALW_GGUF_SHA256
+readonly PALW_BASE_REPO_ID PALW_BASE_REVISION PALW_LLAMA_DIR_REL
+readonly PALW_BUILD_DIR_REL PALW_GGUF_DIR_REL PALW_BASE_META_DIR_REL
+readonly PALW_BASE_META_CHECKSUMS_REL PALW_MODEL_PROFILE_REL
+readonly -a PALW_BASE_METADATA_FILES PALW_METAL_CMAKE_ARGS
+readonly -a PALW_METAL_CACHE_EXPECTATIONS PALW_BUILD_TARGETS

docs/SETUP.md

@@ -0,0 +1,81 @@
+# SETUP — リポジトリの再構築手順
+
+このリポジトリは **ソース・ドキュメント・パッチ・検証証跡のみ** を追跡します。
+以下は再現に必要だがサイズ・秘密の理由で追跡しない成果物と、その決定論的な再構築手順です。
+
+| 追跡しないもの | 理由 | 再構築方法 |
+|---|---|---|
+| `vendor/llama.cpp/` | ネストした `.git`（~55MB）と大きな `.gguf` を含む | pinned commit + パッチ（下記 §1） |
+| `models/**` (`*.gguf`, `*.safetensors`) | 数 GB のモデル重み | `scripts/hf_snapshot_download.py`（下記 §2） |
+| `runtime-palw/target*/`, `build/`, `runtime-palw/cuda/build-host-*/` | ビルド生成物 | `cargo` / `cmake`（下記 §3） |
+| `*.sqlite3`, `*.palw.bundle` | 実行時状態・暗号化された秘密素材（署名鍵・opening・registry snapshot） | ローカルにのみ保持。**公開しない** |
+
+すべての固定値は [`../config/runtime-pins.sh`](../config/runtime-pins.sh)（公開識別子のみ、資格情報を含めない）が正本です。
+
+---
+
+## 1. llama.cpp（vendor）の再構築
+
+```sh
+# 固定リビジョンで clone
+git clone https://github.com/ggml-org/llama.cpp.git vendor/llama.cpp
+git -C vendor/llama.cpp checkout --detach 12127defda4f41b7679cb2477a4b0d65ee6a0c8f
+
+# PALW の変更を適用
+git -C vendor/llama.cpp apply ../../patches/llama.cpp-palw-full.patch
+```
+
+パッチは2種類あります。用途で選択してください。
+
+| パッチ | 内容 | 用途 |
+|---|---|---|
+| `patches/llama.cpp-palw-observer.patch` | Metal read-only graph observer のみ（`scripts/install.sh` が SHA256 固定で自動適用） | サポート対象の Metal プロファイル再現 |
+| `patches/llama.cpp-palw-full.patch` | 上記 observer に加え、**実験的 CUDA hooks**（`ggml-cuda/mmvq.cu`・`mmvf.cu`・`softmax.cu`・`ggml-cuda.cu`・`common.cuh` の trace hook、`tools/palw-mmvq-smoke/`、`llama-context` binder）を含む上位集合 | この repo の vendor 作業ツリー（CUDA 証跡採取に使用した状態）を完全再現 |
+
+`llama.cpp-palw-full.patch` は、CUDA 証跡（[`evidence/cuda-v3-full-hook-sm89-2026-07-16.md`](evidence/cuda-v3-full-hook-sm89-2026-07-16.md)）を採取した際の vendor ローカル変更 21 ファイルをそのまま固めたものです。CUDA は実験的経路であり production Receipt を発行しません。
+
+---
+
+## 2. モデル重みの取得（固定リビジョン）
+
+```sh
+python scripts/hf_snapshot_download.py
+```
+
+固定値（[`config/runtime-pins.sh`](../config/runtime-pins.sh)）:
+
+| Artifact | Repo | Revision | 検証 |
+|---|---|---|---|
+| GGUF ランタイム artifact | `huihui_ai/Qwen3.6-abliterated`（Ollama `registry.ollama.ai`, tag `35b-Claude-4.7`） | `1dc494614bee8a3bc00e79fe5a49da0fc1c36b3b118c4156e223e98e5a0a671b` | `Qwen3.6-abliterated-35b-Claude-4.7-Q4_K_M.gguf`, size `23938321728`, SHA256 `1dc494614bee…5a0a671b` |
+| Base metadata | `huihui-ai/Huihui-Qwen3.6-35B-A3B-Claude-4.7-Opus-abliterated` | `ac18882735d037f6074a7630eb68d85db8234c25` | `config/qwen3.6-35b-a3b-claude-4.7-base-metadata.sha256` と照合 |
+
+取得後、`scripts/verify_model_profile.py` がプロファイル定数と GGUF metadata を照合します。
+
+---
+
+## 3. ビルド & 検証
+
+```sh
+# Rust protocol core（MSRV 1.81 固定）
+rustup toolchain install 1.81.0 --profile minimal --component rustfmt,clippy
+cargo +1.81.0 fmt   --manifest-path runtime-palw/Cargo.toml --all -- --check
+cargo +1.81.0 clippy --manifest-path runtime-palw/Cargo.toml --locked --all-targets -- -D warnings
+cargo +1.81.0 test  --manifest-path runtime-palw/Cargo.toml --locked --all-targets
+
+# llama.cpp（Metal observer）+ E2E ヘルパ
+./scripts/install.sh
+./scripts/verify-install.sh
+```
+
+CUDA 実験ゲート（NVIDIA 実機が必要）の詳細は [`requirements.md`](requirements.md) の R32/R35 と
+[`evidence/`](evidence/) を参照してください。
+
+---
+
+## 4. 何が公開されているか（このリポジトリの範囲）
+
+- **含む**: `runtime-palw/`（Rust protocol core + `cuda/` native ソース + tests）、`docs/`、`scripts/`、`config/`、`patches/`、`.github/`、README、`final-v5`/`final-v6` の canonical 証跡（`.palw` / `.json` / `.complete`）
+- **含まない**: モデル重み、vendor チェックアウト、ビルド生成物、SQLite 状態、**暗号化 bundle（`.palw.bundle`）**
+
+このスナップショットは repository-scope の設計・実装・evidence baseline を固定したものであり、
+Production Network readiness を意味しません（[`requirements.md`](requirements.md) 参照）。

docs/architecture.md

@@ -0,0 +1,291 @@
+# PALW Runtime Architecture
+
+## 1. Scope
+
+本実装は Qwen3.6-35B-A3B（hybrid MoE/SSM）の学習済み model artifact と PALW mining logic を分離する。
+model artifact は読み取り専用で開き、Receipt に関係する request、assignment、nonce、
+commitment、署名、永続状態はランタイム側が生成・検証する。model artifact へ書き戻す
+処理は持たない。
+
+現在、実 model からReceipt発行・検証まで接続しているのは Apple arm64 / Metal の Self Local
+graph-fallback pathである。CUDAではWindows WSL2 Ubuntu 24.04上のRTX 4060 Ti（sm_89）へ固定Qwenを37/37 layer
+offloadしたdiagnostic graph observerに加え、same-backend vendored MMVQ V3 1-token diagnostic E2Eも実行済みだが、
+production Receipt issuance pathではない。
+Metal pathもlocal issuance/verification pathであり、production scheduler、network
+admission/transport、beacon delivery、auditor re-execution、payment rail を含む production service
+全体が完成したという意味ではない。CUDA directory は実験 transport を実装するが、production
+issuance gate は閉じている。
+
+## 2. Trust and execution layers
+
+### Layer 1 — Rust wrapper、manifest、Receipt
+
+`palw-metal-receipt` は固定 artifact と host identity から完全な runtime manifest を作る。
+manifest は GGUF と tokenizer artifact root、実際にロードする observer/dylib 群、llama.cpp
+commit と local patch、CMake cache、OS/compiler/device/Metal identity、許可環境変数、固定
+deterministic policy を binding する。
+
+wrapper は必須の `--prompt-stdin` から最大 1 MiB の prompt を読み、argv で prompt を受ける
+`--prompt TEXT` は実装しない。別途、output directory 外に置いた raw 32-byte key file を
+`--audit-key-file` で必須指定する。scheduler key、署名済み `JobRequestV1` と `AssignmentV1`、
+worker key、nonce、salt を OS CSPRNG から生成し、Qwen adapter を呼ぶ。現行 CLI が生成する
+scheduler/worker registry は local fixture であり、production scheduler/governance registry ではない。
+adapter が返したprompt/generated token IDsはprivate local opening、observer evidenceはverification witness
+として保持する。どちらもcanonical Receiptには入れないが、evidenceはbundle public sectionへ含める。
+Receipt 構築後は同じ manifest/evidence/opening で stateless verify、strict canonical round-trip、
+secret scan を行い、成功時だけ canonical envelope、暗号化 verification bundle、公開 JSON、
+durable DB を出力する。
+
+worker Receipt、scheduler request/assignment、future beaconのEd25519 pathは`verify_strict`を使う。
+worker signer、scheduler、beacon authorityのregistryはweak/small-order public keyを拒否し、opaqueな
+verified/accepted typestateより前でkey identityとsignatureを確定する。
+
+### Layer 2 — native graph observer と strict Qwen adapter
+
+固定 commit の llama.cpp に `llama-palw-observer` target を加え、
+`ggml_backend_sched_eval_callback` で実際に scheduler へ渡された graph node を順番に観測する。
+graph mode は metadata だけを読み、sketch mode は `MUL_MAT`/`MUL_MAT_ID` の post-compute tensor
+から固定 logical prefix を read-only copy して 256-bit の lossy graph sketch にする。raw tensor
+値は出力しない。
+
+adapter は shell を使わず observer を起動し、prompt を argv ではなく専用 stdin pipe へ渡す。
+通常の Receipt 実行では `--emit-output-bytes` を指定せず、native JSONL の decoded output bytes
+を空にする。stdout は versioned JSONL、stderr は bounded diagnostic channel として別々に読み、
+prompt/output を error に埋め込まない。tokenizer、observer、host/source identity helper は inherited
+environment を `env_clear` し、`LANG=C` と `LC_ALL=C` だけを復元する。host identity helper は
+absolute executable path を使い、この完全な locale allowlist を manifest に bind する。
+
+JSONL parser は header → event* → result の順序と一意性、schema/version、連続 event sequence、
+Qwen3.6-35B-A3B shape/metadata、deterministic policy、41/41 full offload、prefill/decode step、token count、
+tensor/GEMM shape、sketch width、graph-only trace claim を厳格に検査する。`MUL_MAT`、`RMS_NORM`、
+`ROPE`、`SET_ROWS`、`SOFT_MAX`、`GLU`、`MUL`、`CONT`、`ADD`、`GET_ROWS` を versioned canonical
+operation へ変換し、`VIEW`/`RESHAPE`/`PERMUTE` だけを layout metadata として除外する。GLU の
+ような複合 node は複数 operation に展開する。未知 operation、未価格 operation、overflow、
+欠落/重複 event、CUDA kernel trace を偽る claim は fail-closed である。
+
+### Layer 3 — CUDA trace transport（R32 In progress・非発行）
+
+CUDA directory のlegacy device observer は GEMM/attention final output の固定 tile を同一 stream 上で
+sketch し、checked sequence、shape、tile index、V1 canonical 139-byte record、capacity/commit/copy、
+sticky overflow、permanent poison を実装する。additive V2 transport は、declared origin、accumulator
+stage/dtype、sketch scheme、reduction segment、producer dispatch digest を含むexact 184-byte wire
+recordを定義し、native struct memoryやpaddingをwireとして扱わない。
+
+これとは別にstandaloneの`palw_cuda_producer_capture_accumulator_f32`は、producerが渡すpre-epilogue
+FP32 accumulatorを同じCUDA stream上でsketchする。exact function pointer/attribute、per-launch nonce、
+record/mask/fault、全tile/segment coverageを検査するtrue-accumulator採取primitiveである。Windows WSL2
+Ubuntu 24.04、
+RTX 4060 Ti（sm_89）、CUDA Toolkit 13.3.1 / nvcc 13.3.73でstandalone/grouped CUDA CTest 8/8と
+producer 20/20同一diagnostic fingerprintを確認した。さらにV3 captureはvendored Q4_K/Q6_K non-fused
+MMVQ specializationのfull-K pre-epilogue位置と、FA-off QK-score/softmax/PV work直後へ接続済みである。
+same-backend Qwen 1-token gateは253 MMVQと108 attention sublaunchの合計361/361 record、exact selected-
+specialization attribute、3回同一diagnostic fingerprint、5 work classの選択launch拒否を確認した。
+
+Rust側のV2 decoder/binderはunknown tagと不正なprovenance tupleを拒否し、attentionを含むunfiltered
+全record streamを、連続launch sequence、狭義増加schedule index、canonical tile/segment order、exact
+MMVQ/flash-attention dispatch、CUDA runtime manifestへbindする。raw recordから得る
+`BoundCudaTranscriptV1`はdiagnostic typestateである。さらにauthority署名、network/job/execution/
+assignment、runtime class/manifest、producer integration、operation scheduleとfull transcriptを検証した
+場合だけ、public raw constructorを持たない`AuthorityBoundCudaTranscriptV2`からReceipt V2用
+`AuthorityBoundCudaReceiptEvidenceV2`へproducer-accumulator GEMMを射影できる。attention recordはfull
+transcript commitmentには残るが、GEMM evidenceには昇格しない。
+
+現行`ComputeReceiptV1`にはauthority provenance commitmentがないため、V1 builderとverifierはCUDA
+`KernelSketch`をともに拒否する。FlashAttention-onlyのV2 transportで表せなかった固定QwenのFA-off
+eager attentionに対し、additive 452-byte V3 schema/binderはQK-score MMVF、masked/scaled softmax、
+value-aggregation MMVFのcanonical 3-sublaunch bundleを実装済みであり、各実work直後の同一stream collectorと
+typed graph associationもsourceへ統合済みである。361-launch実機E2E、exact symbol/runtime attributesを
+DSO/fatbin/cubin/ELF sectionへ結ぶrelease manifest、complete expected tableを検証する
+Receipt/RuntimeManifest/Request/Assignment V2、暗号化Bundle V2、SQLite V2は実装・検証済みである。
+live C++ callbackはなおdiagnostic IDを使用するため、authority提供のcanonical operation/plan/
+physical-layout IDからproduction署名Receiptを作る経路には接続していない。
+
+固定Qwenは37/37 layerをCUDA offloadし、batch 1 graph observerの6/6同一diagnostic streamと、vendored
+MMVQ/attention producerのsame-backend 361-record diagnostic E2Eを得た。これはhook coverageを証明するが、
+production authority-connected proofではない。
+`PALW_CUDA_TRACE_PRODUCTION_CAPABLE`、`PALW_CUDA_PRODUCER_VENDOR_RUNTIME_INTEGRATED`、
+`PALW_CUDA_PRODUCER_RECEIPT_MAPPING_AVAILABLE`、`PALW_CUDA_PRODUCER_PRODUCTION_CAPABLE`はすべて0で、
+`PALW_CUDA_PRODUCTION_KERNEL_TRACE=ON`はCMake configure errorのままである。したがってR32は
+`In progress`であり、current CUDA evidenceをproduction Receiptへ昇格してはならない。
+
+## 3. Metal execution data flow
+
+1. model、tokenizer、observer/dylib、build/source/host identity から manifest を構築する。
+2. pinned runtime tokenizer で prompt token IDs を確定し、nonce で salted prompt commitment を作る。
+3. 署名済み job request と assignment を検証し、model/runtime/shape/evidence policy を固定する。
+4. observer を fixed policy（`n_ctx=4096`、batch/ubatch/request batch/thread=1、greedy、repack/
+   Flash Attention/context shift/speculation/tensor parallel 無効）で実行する。
+5. adapter が全 event を operation schedule hash chain、canonical CU counter、graph trace chain へ渡す。
+6. native run 後に manifest を再構築し、実行中の model/runtime artifact 変更がないことを確認する。
+7. token IDs、stop reason、scheduler-signed shared output nonce から output commitment を作る。
+8. owner commitment と job/execution nullifier を作り、worker が canonical `ComputeReceiptV1` を署名する。
+9. verifier が request/assignment/signer、manifest、policy、commitments、CU、schedule、trace、opening を検査する。
+10. caller-owned audit key から domain-separated AEAD subkey を導出し、request/assignment、worker
+    signer record、prompt/output opening、owner salt を XChaCha20-Poly1305 bundle の private sectionへ
+    封入する。public sectionにはreceipt binding、verification epoch、scheduler key snapshot、manifest、
+    execution evidenceだけを置く。
+11. SQLite transaction が receipt ID、execution nullifier、job/slot と original acceptance epoch を
+    一意に予約して `AcceptedReceipt` にする。
+12. WALを`TRUNCATE` checkpointし、DB connectionをdropしてmain DBを`fsync`する。その後、Receipt、
+    bundle、公開JSONをそれぞれ`fsync`し、receipt ID、bundle ID、公開JSON SHA-256を記録するcompletion
+    markerを最後に書き、output directoryを`fsync`する。
+13. Self Local はdurable future-audit transition、Self Replicated はtyped k=2 pair、External はauthority-
+    confirmed funded escrow settlementからだけopaque `MatureEvidence`を生成する。
+14. bonded production pathではmaturity transactionがsourceに必要な1件または2件のassignment bondを
+    releaseし、release IDをsourceへlinkする。link数がjob classのrequired replica数と一致しなければ
+    Work Ticketを発行しない。
+15. SQLite が証拠のnetwork/class/CU、`maturity_basis_id`、optional `weight_grant_id`、`mature_epoch`を
+    保存し、そのepoch以後にsourceを一度だけ`WorkTicketV2`へ変換する。
+
+output directory はowned non-symlink directoryかつmode `0700`、既存ならemptyでなければならない。
+canonical Receipt、公開JSON、completion markerは`0644`、暗号化bundleとDBは`0600`で`create_new`
+する。cross-file write全体は単一transactionではないため、late failure時に未完成artifactが残る
+可能性はあるが、marker-last ruleによりmarkerのないsetをverifierがcompleteとして受理しない。markerは
+unkeyed plain textのcrash-completeness signalで、signature/AEAD authenticationではない。
+
+## 4. Identities
+
+`model_profile_id` は architecture、tokenizer、trained precision と runtime quantization、shape、
+weight/tokenizer/chat-template artifact root を識別する。実際にロードした GGUF 全体の SHA-256、
+PALW artifact root、bytes、配布 revision も manifest に含める。
+
+`runtime_class_id` は backend、runtime commit/source patch、driver/library versions、device class、
+quantization、context/batch/ubatch/thread、sampling、adapter mapping、trace capability を識別する。
+
+`runtime_manifest_hash` は実行時の完全 manifest の canonical digest である。同じ class label でも
+binary、dylib、model、source patch、CMake/host identity が違えば manifest 検証で拒否する。
+
+`request_commitment` と `signed_assignment_id` は Receipt を scheduler authorization へ binding し、
+`job_nullifier` と `execution_nullifier` は別 domain で replay を防ぐ。Receipt signer の public key
+は registry で解決し、canonical body には key ID だけを置く。
+
+`verification_bundle_id` はcomplete encrypted envelopeを識別する。bundle public sectionはworker
+public keyやopeningを公開しない。completion marker v2はreceipt ID、bundle ID、公開JSON SHA-256を
+記録するが、同じowner権限のwriterはJSONとmarkerを一緒に置換できる。authorityはstrict canonical
+Receiptとauthenticated bundleにあり、markerを署名済みprotocol objectとして扱わない。
+
+## 5. Determinism boundary
+
+浮動小数点の bitwise determinism は runtime class 内だけで検証する。Metal/CUDA、異なる GPU、
+driver、compiler、kernel class をまたいだ一致は要求しない。observer callback は read-only でも
+synchronization と timing を変え得るため、observer mode/capability は runtime class の一部である。
+
+現行 Metal Receipt の `graph_fallback` は順序・shape・logical-prefix sketch を commit するが、
+kernel execution の暗号学的 proof ではない。Self Local の重みは future audit なしに確定しない。
+
+## 6. Durable state and external jobs
+
+SQLite registry は WAL、`synchronous=FULL`、foreign key、application ID、schema version 4 を検査する。
+さらにtables/columns/foreign keys/indexだけでなく、全non-internal `sqlite_master`
+`(type,name,tbl_name,sql)`をcanonical化したSHA3-256とcompiled goldenを照合し、同名objectのDDL mutation
+もfail-closedにする。旧schema databaseの暗黙migrationは行わず、unclaimed nonempty DBも拒否する。
+
+receipt、nullifier、job slot、replica pair、maturity source、Work Ticket v2、future-audit selection、signed
+beacon provenance、audit replayに加え、authority-signed bond funding/appeal/decision、assignment bond、
+release、slash/health、signed canary precommit、external escrow/payment command/terminalをtransactionで更新する。
+receiptのoriginal `accepted_at_epoch`、pairの`matched_epoch`、signed beaconのepoch/provenance、audit
+replayのaccepted epochをdurableに保持し、restart restore時にcurrent stateless verification epochと
+区別する。
+
+maturity source に caller-supplied raw marker を受け付ける public API はない。Self Localでは、
+authority-verified signed future beaconを保存した後、selected replayの受理・typed projection比較・
+terminal verdict・passing maturity sourceを一transactionで確定する。non-selected auditもwindow経過と
+maturity sourceを一transactionで確定する。`restore_audit` は保存したsigned beaconをcaller-supplied
+network authority registryで再検証し、selection/challengeを再計算する。selected pass/mismatch terminalは
+beacon rowだけのrestoreを`AuditReplayRequired`で拒否し、`restore_selected_audit_with_replay`がdurable
+audit state/challenge、canonical replay、全identity/epochを照合する。さらにprojection verdictを再計算し、
+match bit、submission commitment、completed epochをstored terminal outcomeへ再照合する。
+
+`MatureEvidence` のfieldと低水準constructorは非公開で、durable Self Local auditのexact mature
+state、Self Replicated `MatchedReplicaPair`、authority-confirmed External settlementだけが生成経路である。
+`WorkTicketV2`はsourceに加えてaudit/pair/settlementの`maturity_basis_id`と、Externalだけに必須の
+authority-signed `weight_grant_id`をbindする。ticket発行epochの前倒しとsource再消費を拒否する。
+
+bond authorityはnetwork-scoped Ed25519 key、validity/revocation、funding/appeal/decision capabilityを検査する。
+verified fundingだけがdurable accountをcreditし、scheduler-signed assignmentだけがfundsをlockする。
+bonded Receiptは`accept_bonded`でactive exact lockを要求する。auditによるpassing maturity（canaryが
+ある場合はterminal completion以後へ遅延）とk=2 pair maturityは、必要なassignmentを同じtransactionで
+release/linkし、ticket issuerはlink countを再検査する。
+typed audit mismatch/timeoutとcanary mismatch/receipt timeoutはslash、pending appeal balance、worker healthを
+同じtransactionで更新する。immutable targetを持つ複数claimのallocationはfinalized max-envelopeとpending
+extensionへorder-independentに再計算し、v1 Equivocation追加penaltyは0である。authority-signed appealには
+durable verification/acceptance epoch基準のdecision deadlineがあり、signed epochとaccepted epochの両方が
+期限内のuphold/reverseか、期限経過後のdeterministic default-upholdでterminalになる。unappealed slashも
+appeal deadline後だけfinalizeする。
+
+canaryはscheduler-signed precommit、exact signed request/assignment、bond lockを先にdurable保存する。
+`accept_canary`はnormal Receipt acceptanceと`ReceiptSubmitted`をatomicにし、valid openingのpassは
+terminalだけをcommit、mismatchはworker slashへ接続する。receipt deadline欠落はworker fault/slash、
+receipt受理後のopening deadline欠落はscheduler faultとしてworker bondをslashしない。passと
+OpeningMissingではbondをmaturityまで保持し、pending canary中のmaturityを拒否する。terminal canaryが
+あるsourceのmature epochはcanary completion以後へ遅延し、そのmaturity transactionだけがbondを
+`Mature` release/linkする。External Replicatedをhidden canaryにすることはv1で禁止する。
+
+External Replicatedはauthority-signed exact funding attestationとfunded demand-weight grantからdurable
+escrowを作り、scheduler-signed requestとk=2 pairをbindする。local payment commandを準備した後、authority-
+verified terminal confirmationだけがterminalを確定できる。`SettlementPrepared` transitionは両worker bondが
+activeでpending/upheld/default-final slashなしとpreflightする。`SettlementPrepared`または
+`RefundPrepared`以後のnon-replay slashをcut offする。
+settlement pathはconfirmation、maturity source、
+両worker bondのrelease/link、source consumption、`WorkTicketV2`を一つのSQLite transactionでcommitする。
+refund pathはstate 1..3からexpiry後にpairの有無を問わず進め、terminalとeligible assignment bond releaseを
+一つのSQLite transactionでcommitする。pending claimのbondは解決までreleaseせず、maturity/ticketを生成しない。
+ただし実payment rail上の資金移動とSQLite transactionはdistributed atomicではない。external authorityのfinality claimとkey governanceが
+crate外のtrust boundaryである。
+
+## 7. Restart verification and trust scopes
+
+verification bundle はXChaCha20-Poly1305（256-bit key、192-bit random nonce、128-bit tag）を使い、
+canonical public section、receipt/public/nonceへbindしたAAD、encrypted private sectionを1つのstrict
+envelopeにする。audit keyそのものとprivate signing-key seedはserializeしない。key fileはexact 32
+bytes、nonzero、owner一致、single-link regular file、mode `0400`または`0600`を要求し、output/protected
+artifactとのcolocation、symlink、inode alias、path raceを拒否する。
+
+local restart APIはbundle内のembedded scheduler/worker snapshotでstateless verificationをやり直した
+うえで、既存DB rowのcanonical Receipt、runtime instance、original acceptance epochへexact restore
+する。CLIはReceipt/bundle/公開JSON/DBが同じowned `0700` directoryにexpected filename/modeで存在する
+こと、marker v2とtyped公開JSON `misaka.palw.public-receipt.v2`全体がverified Receiptとauthenticated bundle manifest/evidenceへ一致
+することも検査する。保持する`artifacts`と`observer_summary`を含む全fieldを照合し、unknown fieldは
+objectの全階層で拒否する。DBにrowがなければinsertへfallbackしない。このmodeはlocal continuityの検証であり、
+embedded snapshotをnetwork authorityとして第三者へ昇格しない。
+
+default bundle restoreはoriginal acceptance時のhistorical verification epochを使う。future beacon後の
+audit restoreには`verify_bundle_and_restore_at_epoch`を使い、caller-selected epochをhistorical値以上かつ
+beacon以上へ進める。epoch rollbackは拒否し、durable original acceptance epochは上書きしない。このlocal
+fresh pathはembedded key snapshotsを使い、bundle作成後のrevocationを学習できない。productionではcurrent
+external trust rootsを必須にする`verify_bundle_and_restore_at_epoch_with_trust`を使う。現行
+`palw-verify-bundle` CLIはdefault historical pathだけを呼び、fresh epochはlibrary/service APIで指定する。
+
+第三者向けstateless APIはexpected network、外部scheduler registry、外部worker registry、独立に
+approvedされたmanifest hashを必須にし、embedded snapshotとのexact一致も検査する。default APIは
+historical epoch、`verify_bundle_stateless_at_epoch_with_trust`はrollbackしないcaller-selected fresh epochで
+署名/validityを検証する。このstateless pathはDB acceptanceを行わない。既存DB continuityも同時に必要な
+production restartは`verify_bundle_and_restore_at_epoch_with_trust`を使う。それでもnetwork admissionは
+別のservice decisionである。
+
+## 8. Build and CI boundary
+
+Rust protocol core は edition 2021、MSRV 1.81 を宣言する。Cargo 1.81 が edition-2024 manifest を
+読めない transitive-resolution drift を防ぐため、crypto graph の `zeroize 1.8.1` と
+`base64ct 1.7.3` を exact pin し、Clippy/test/release build は lockfile を必須にする。
+
+CI は push/PR の pinned llama.cpp clean-checkout patch apply/CPU target build gate、Rust 1.81 all-target
+gate、Linux host ABI sanitizer gateと、手動self-hosted NVIDIA experimental gateに分離する。NVIDIA jobは
+skip code 77をfailureとするが、production capabilityを無効のまま実験transportだけをtestする。
+したがってCI successとR32 production acceptanceは別のstateであり、workflowやhost fixtureからCUDA
+Receipt発行権限を推論しない。
+
+現行sourceのRust all-target gateは224 passed / 2 ignored（226 discovered）である。WSL sm_89ではstandalone/grouped CUDA
+suite 8/8とproducer device binary 20/20同一fingerprintに加え、vendored MMVQ/attention same-backend
+Qwen diagnostic E2Eで361/361 record、3回同一fingerprint、5 work-class negativeを確認した。exact
+release manifestも最終DSOに対してcreate/verify一致した。この実測はexperimental hook goalを完了するが、
+production authority acceptanceではない。
+
+production scheduler/network transport、governance-backed scheduler/worker/beacon/bond/external key
+distribution、finalized beacon delivery、independent auditor execution/opening delivery、実payment railと
+authority serviceはこのrepositoryに含まれない。durable coreへ自動接続済みのslash proofはaudit mismatch/
+timeoutとcanary mismatch/receipt timeoutであり、invalid-manifest、equivocation、duplicate-executionの
+production proof constructor/orchestrationは未統合である。CUDAのstandalone true-accumulator primitive、vendored
+MMVQ/FA-off attention hook、same-backend 361-launch diagnostic E2E、release manifest、Receipt/Bundle/
+SQLite V2は成立した。残るproduction範囲は、authority-derived canonical IDを使うlive callback、
+deployed trust root、signed Receipt発行、独立restoreまでのfull-stream production E2Eである。

docs/cuda-receipt-v2-design.md

@@ -0,0 +1,121 @@
+# CUDA Producer Transcript → Receipt V2 設計
+
+## 現在の安全境界
+
+CUDA transport V2 の `ProducerAccumulator` は自己申告tagであり、それ単体はproducer由来の証明ではない。
+また `ComputeReceiptV1` にはauthority証跡をcommitするfieldがない。このためRust側でも次をhard gateとする。
+
+- CUDA `KernelSketch` を `build_signed_receipt` へ渡してもV1 Receiptを発行しない。
+- workerがV1 bodyを手組み・署名してもstateless verifierが拒否する。
+- Metal/開発用 `GraphFallback` とCUDA production provenanceは別のまま維持する。
+
+## 実装済みtypestate
+
+```text
+RawCudaTraceRecordV2
+  -> bind_cuda_trace_v2
+BoundCudaTranscriptV1
+  -> authority署名 + registry/runtime/job/schedule/full-stream検証
+AuthorityBoundCudaTranscriptV2
+  -> deterministic mapping v1
+AuthorityBoundCudaReceiptEvidenceV2
+```
+
+`AuthorityBoundCudaTranscriptV2` と `AuthorityBoundCudaReceiptEvidenceV2` にはpublic raw constructorがない。
+authority verificationは次を同時にbindする。
+
+- network、job nullifier、execution nullifier
+- signed assignment ID、runtime instance ID、assignment epoch範囲
+- exact runtime class ID、complete runtime manifest hash
+- operation schedule commitmentと全scheduled GEMM/attentionのexact coverage
+- full unfiltered CUDA transcript commitment
+- reviewed producer hook source/binary、entry-point table、accumulator extraction policyから成るintegration ID
+- authority keyのnetwork、validity、revocation、exact integration/runtime approval
+
+射影時はproducer-accumulator GEMMだけを `KernelSketch` eventへ変換する。attention final-output recordは
+GEMM evidenceへ昇格させないが、signed full-transcript commitmentには残る。raw `u64` sketch laneはbit patternを
+保ったまま既存のcanonical `i64` laneへ写像する。
+
+vendored llama.cppのQ4_K/Q6_K MMVQ producerはV3 full-K pre-epilogue hookへ接続済みである。
+same-backend Qwen 1-token diagnostic E2Eは253/253 record、3回同一fingerprintと選択launch拒否の
+fail-closedを確認した。続いてFA-off QK/softmax/PVも接続し、253 MMVQ + 108 attention = 361 recordを
+3回同一fingerprintで取得した。Q4/Q6/QK/softmax/PV各先頭の拒否もfail closedである。
+
+## V2の非互換とV3 schemaの現状
+
+現行PALW deterministic Qwen profileは `flash_attention=false` で、実scheduleはeager/decomposed
+`Attention` を含む。一方、CUDA V2が表現できるattention dispatchは
+`CudaDispatchV1::LlamaFlashAttention` だけである。`bind_cuda_trace_v2` はattention launchがあるのに
+runtimeがFA-offなら拒否し、authority layerは全scheduled GEMM/attention indexのexact coverageを要求する。
+
+したがって次のどちらも通らない。
+
+- `LlamaFlashAttention` recordをFA-off runtimeへbindする。
+- attention recordを省略してGEMMだけをauthority-bound transcriptにする。
+
+これはlegacy V2の意図したfail-closed状態であり、現行V2 candidateをproduction Qwen Receiptに
+使用可能とは扱わない。この非互換に対し、additive V3は452-byte record、eager/decomposed attentionの
+exact shape/stage、1 scheduled `Attention`に対するQK-score MMVF、masked/scaled softmax、
+value-aggregation MMVFのcanonical 3-sublaunch grouping、strict schedule/runtime binderを実装済みである。
+
+実eager-attention 3 entry point直後のV3 collectorとtyped graph associationはsourceへ接続済みである。
+361-launch実機E2E、strict expected table、actual runtime attributes、exact entry symbolとDSO/fatbin/cubinを
+結ぶrelease-manifest照合、Receipt V2のstateless bindingは実装・検証済みである。ただしlive C++ smokeは
+diagnostic IDを生成し、authority-derived canonical physical-layout IDを受け取るproduction callbackではない。
+したがってcurrent smokeをproduction Qwen Receiptに使用可能とは扱わない。flash attentionをproduction
+deterministic policyで明示的に有効化する
+別案でも、再現性・algorithm identity・schedule/CU semanticsを別runtime classとして再承認する必要がある。
+
+## 実装済みReceipt V2 schema
+
+現行V1へauthority証跡を後付けすると、証跡を捨てても同じReceipt body/rootを作れてしまう。そこで次を
+V1とtype-confusionしない新しいconsensus schemaとして実装した。
+
+1. `ComputeReceiptV2.receipt_version = 2`
+2. `trace_provenance_kind`（少なくとも `NoneOrGraph` / `CudaProducerAuthorityV1`）
+3. `trace_provenance_commitment`
+4. `RuntimeManifestV2` の `producer_integration_id` と `trace_provenance_policy_id`
+5. scheduler request/assignmentが選ぶrequired provenance policy
+6. `SignedReceiptV2` envelope discriminator（V1 bodyとのtype confusionを避ける）
+7. FA-off用eager/decomposed attention dispatchとsublaunch grouping
+
+`trace_provenance_commitment` は実装済みのdomain-separated valueで、次をcommitする。
+
+- authority attestation ID / authority key ID
+- producer integration ID
+- full bound transcript commitment
+- mapping version
+- projected trace scheme ID / root / event count
+
+verification bundle V2はsigned authority envelope、raw V3 stream、expected launch table、six-entry release
+table、producer integration descriptorを含み、secret openingをXChaCha20-Poly1305で暗号化する。verifierは
+current registryを外部trust rootとして解決し、公式`verify_stateless_v2`でtypestateを再構築する。
+SQLite V2はcomplete proof bytes、provenance commitment、network epoch watermarkを原子的に保存し、restart時に
+body-to-proof binding、replay、rollback、exact restore rowを再検査する。
+
+matcher、audit、maturity、WorkTicketはV1/V2を暗黙に同一視せず、V2 production policyが要求されたjobでは
+authority-bound provenanceのstateless/durable verification完了を必須にする。
+
+## 実装済みadversarial gate
+
+- missing / duplicate / reordered / metadata-mutated raw record拒否
+- exact dispatch、SM、kernel binary/algorithm identity差分拒否
+- forged authority signature、unknown/revoked/out-of-window key拒否
+- cross-network / cross-job / cross-assignment / cross-runtime replay拒否
+- runtime class、manifest、producer integration、schedule、transcript差分拒否
+- scheduled GEMM/attentionの欠落拒否
+- FA-off runtimeへの唯一のV2 attention dispatch (`LlamaFlashAttention`) binding拒否
+- final-output GEMMのproducer evidence昇格拒否
+- raw CUDA `KernelSketch` のV1 builder/verifier bypass拒否
+
+## 残るproduction blocker
+
+- authority registry/governance/KMSサービスとproduction key lifecycle
+- authority-derived canonical operation/plan/physical-layout IDをlive C++ approval callbackへ渡すbridge
+- live raw transcriptから署名Receipt V2を発行し、deployed trust rootで独立restoreするproduction E2E
+- checked-in release manifestとpolicyを承認するgovernance lifecycle
+- NVIDIA実機でのfull-stream fault injectionと認可済みrepeatability/reproducibility matrix
+
+authority署名は「登録authorityがこのexact transcriptとintegrationを承認した」ことを証明するが、authority自身が
+producer内部値を正しく観測したことを純粋なEd25519署名だけで暗号学的に証明するものではない。脅威モデルが
+authority compromiseを含む場合は、GPU/host attestation、TEE、または独立再実行proofを追加する。

docs/evidence/cuda-v3-full-hook-sm89-2026-07-16.md

@@ -0,0 +1,204 @@
+# CUDA V3 full Qwen hook and V2 receipt evidence — SM89 — 2026-07-16
+
+## Scope and status
+
+This is the repository evidence for the completed experimental CUDA goal on a
+Windows/WSL2 RTX 4060 Ti host:
+
+- a real pinned Qwen3-8B Q4_K_M model executes all 253 quantized MMVQ launches
+  for one evaluated token through the vendored V3 producer hook;
+- the flash-attention-off path executes all 72 attention GEMMs (36 QK and 36
+  PV), plus 36 grouped softmax capture launches, through the vendored producer;
+- the exact selected CUDA entry points, runtime function attributes, containing
+  cubins, fatbin, and loaded DSO are content-addressed by a strict release
+  manifest;
+- Receipt, RuntimeManifest, Request/Assignment, encrypted Bundle, and atomic
+  SQLite persistence V2 bind and reverify the complete 361-launch profile; and
+- production issuance remains deliberately unavailable. All capability macros
+  remain zero and the production CMake configuration fails closed.
+
+This evidence does not claim a production CUDA Receipt. The live smoke result
+explicitly reports `diagnostic_only=true` and `receipt_authority=false`. It also
+does not claim multi-token/KV-continuation, FA-on, another GPU architecture, or
+another model/weight profile.
+
+No Tailscale address, SSH credential, GPU UUID, or signing secret is recorded in
+this artifact.
+
+## Fixed model, host, and build
+
+| Item | Recorded value |
+| --- | --- |
+| Host | Windows 11 / WSL2 Ubuntu |
+| GPU | NVIDIA GeForce RTX 4060 Ti |
+| CUDA architecture | `sm_89` |
+| CUDA compiler | NVCC 13.3.73 |
+| Model | `Qwen3-8B-Q4_K_M.gguf` |
+| Model SHA-256 | `d98cdcbd03e17ce47681435b5150e34c1417f50b5c0019dd560e4882c5745785` |
+| Build type | Release |
+| Build directory | `/root/qwen-8.0/build/llama-palw-full-sm89-v2` |
+| Loaded CUDA DSO | `bin/libggml-cuda.so` |
+| Loaded DSO SHA-256 | `389bda6116c50eea8aebb9e1fcca1cc0145ab7245cb01d688024856c947f8e6f` |
+
+The final CMake cache fixes `CMAKE_CUDA_ARCHITECTURES=89`, `GGML_CUDA=ON`,
+`GGML_CUDA_PALW_TRACE=ON`, `GGML_CUDA_FA=OFF`, `GGML_CUDA_GRAPHS=OFF`, and
+`GGML_CUDA_NCCL=OFF`.
+
+## Full real-model launch gate
+
+The final smoke executable loaded the real 5,027,783,488-byte model, attached a
+fresh request-local producer context, disabled flash attention, evaluated one
+token at position zero, finalized the stream, and canonically encoded every V3
+record.
+
+Three independent positive invocations with the release-manifest cubin digests
+all exited successfully with the following identical result:
+
+| Field | Run 1 | Run 2 | Run 3 |
+| --- | ---: | ---: | ---: |
+| Total launches | 361 | 361 | 361 |
+| Accepted | 361 | 361 | 361 |
+| Records | 361 | 361 | 361 |
+| Committed after finalize | 361 | 361 | 361 |
+| Quantized MMVQ | 253 | 253 | 253 |
+| Q4_K MMVQ | 216 | 216 | 216 |
+| Q6_K MMVQ | 37 | 37 | 37 |
+| Attention QK GEMM | 36 | 36 | 36 |
+| Attention softmax | 36 | 36 | 36 |
+| Attention PV GEMM | 36 | 36 | 36 |
+| Canonical-record FNV-1a 64 | `22f3a57e3640a8c6` | `22f3a57e3640a8c6` | `22f3a57e3640a8c6` |
+
+Thus the 72 FA-off attention GEMMs are exactly the 36 QK plus 36 PV launches.
+The additional 36 softmax launches make the complete attention producer stream
+108 records and the complete MMVQ-plus-attention stream 361 records.
+
+The FNV-1a value is a compact same-stack diagnostic reproducibility check. The
+cryptographic artifact identity is supplied separately by the SHA-256 release
+manifest; FNV-1a is not used as receipt authority.
+
+## Actual CUDA entry-point authority manifest
+
+The release manifest was generated on the RTX host from the final loaded DSO
+using CUDA 13.3 `cuobjdump`. The manifest parser independently extracts the
+embedded cubins, requires an exact mangled-symbol match, parses the raw ELF
+sections, and hashes the containing cubin plus symbol-scoped text and
+`.nv.info` sections.
+
+| Entry | Cubin SHA-256 | Registers | Max threads | Static shared bytes | Local bytes |
+| --- | --- | ---: | ---: | ---: | ---: |
+| Q4_K MMVQ | `3f9bfb88b5898b7d59b7fc39a01d7fda3b8ce4e270605b2d4cf29465907dfb64` | 40 | 128 | 384 | 0 |
+| Q6_K MMVQ | `3f9bfb88b5898b7d59b7fc39a01d7fda3b8ce4e270605b2d4cf29465907dfb64` | 40 | 128 | 384 | 0 |
+| Attention QK | `f04b5d1fb574c3558384bb37f261bc63be926cc0bef584b7a527977bd31b7237` | 40 | 1024 | 0 | 0 |
+| Attention softmax | `31d368e4cffc8668bf678aebae93fd79d9b5a4fed626b2a1ce615efa77ce6903` | 22 | 1024 | 0 | 0 |
+| Attention PV | `f04b5d1fb574c3558384bb37f261bc63be926cc0bef584b7a527977bd31b7237` | 34 | 1024 | 0 | 0 |
+| Grouped collector | `09bb6b85776ba02de3b9e5aa457d090208ab25cb276ed63021020ebadc804435` | 44 | 1024 | 0 | 0 |
+
+Every entry reported SM architecture, binary version, and PTX version 89. The
+Q4/Q6 entries share one containing cubin, as do QK/PV; their exact symbols and
+scoped ELF sections remain distinct.
+
+The canonical artifacts are:
+
+- [`cuda-v3-release-kernel-manifest-sm89-2026-07-16.json`](cuda-v3-release-kernel-manifest-sm89-2026-07-16.json)
+- [`cuda-v3-runtime-entrypoint-info-sm89-2026-07-16.json`](cuda-v3-runtime-entrypoint-info-sm89-2026-07-16.json)
+
+Recorded identities:
+
+| Identity | Value |
+| --- | --- |
+| Release manifest ID (SHA3-256 protocol domain) | `4ededc7c257e13becbf74ebeecdff6c7bfe8ba84d550a6e07aa6cca52d9c7ce7` |
+| DSO `.nv_fatbin` SHA-256 | `0654f8f423f059dccb94abf098fca2b47f106dcc6581f575756e6a985c6fa35c` |
+| Loaded DSO SHA-256 | `389bda6116c50eea8aebb9e1fcca1cc0145ab7245cb01d688024856c947f8e6f` |
+
+Creating and then independently verifying the manifest against the same final
+DSO both returned the exact manifest ID above. The checked-in manifest bytes
+have SHA-256
+`849917d9def741ed7920661a57fbcdc16cb32e0c18836d1f454aa0c3e66133bf`,
+identical to the file copied back from the RTX host.
+
+The checked-in artifact is also a compile-time Rust integration fixture. The
+strict `CudaReleaseKernelManifestV1` decoder validates its exact six-entry
+authority requirement table, and the Receipt V2 end-to-end test uses that real
+validated table to build, sign, and reverify the complete 361-launch receipt at
+the next epoch. This gate also records the valid CUDA packaging case where an
+extracted, uncompressed cubin is larger than the compressed `.nv_fatbin` bytes;
+all cubins remain nonempty and every scoped section is bounded by its expanded
+cubin size.
+
+## Fail-closed launch gates
+
+Five negative invocations rejected the first occurrence of each work class.
+Every invocation stopped llama decoding with the expected failure status; no
+rejected or later launch was accepted.
+
+| Reject index | Expected class | Accepted before rejection | Records before rejection |
+| ---: | --- | ---: | ---: |
+| 0 | Q4_K | 0 | 0 |
+| 1 | Q6_K | 1 | 1 |
+| 3 | Attention QK | 3 | 3 |
+| 4 | Attention softmax | 4 | 4 |
+| 5 | Attention PV | 5 | 5 |
+
+Each result reported `status=expected_failure` and the matching
+`rejected_class`. This complements the standalone CUDA device fault tests and
+proves that every vendored work path honors the request-local approval boundary.
+
+## Receipt, manifest, bundle, and persistence V2
+
+The Rust V2 flow is deliberately distinct from V1 and binds all of the
+following before producing a verified typestate:
+
+- signed RuntimeManifest, Request, Assignment, and Receipt V2 domains;
+- network, epoch, authority lifetime, revocation, assignment, worker, job, and
+  execution identities;
+- the approved six-entry release table, exact cubin digests, work/capture roles,
+  runtime CUDA attributes, and launch geometry;
+- the exact ordered 361-launch transcript and its 216/37/36/36/36 class counts;
+- Qwen3-8B, Q4_K_M, SM89, FA-off, batch-one, one-token policy;
+- schedule, canonical compute units, output commitment, and stable projected
+  authority provenance.
+
+Bundle V2 stores the full raw transcript and external trust material, encrypts
+secret openings with XChaCha20-Poly1305, and reuses the official stateless V2
+verifier as its only acceptance authority. SQLite V2 has a separate PAL2 schema
+and application ID and atomically stores jobs, receipts, and bundles. It rejects
+receipt, execution, assignment, and job-slot replay; stale network epochs;
+rollback; torn transactions; schema mutation; and non-exact restore rows.
+
+The integrated Rust gate discovered 226 tests and completed with 224 passed and
+two ignored pre-existing Metal real-model tests. The CUDA V3, release-manifest,
+protocol V2, receipt V2 flow, encrypted-bundle, restart, and SQLite V2 tests all
+ran and passed. Additional gates passed:
+
+- `cargo fmt --all -- --check`;
+- `cargo clippy --locked --all-targets -- -D warnings`;
+- rustdoc with `RUSTDOCFLAGS=-D warnings`;
+- Rust 1.81 `cargo check --locked --all-targets`;
+- Python release-manifest tests: 4/4;
+- Apple host ABI/header/producer/bridge/closed-gate CTests: 5/5; and
+- RTX SM89 ABI, device producer, grouped collector, manifest, and closed-gate
+  CTests: 8/8 with no skipped GPU test.
+
+## Production issuance remains closed
+
+The following public capability values remain exactly zero:
+
+```text
+PALW_CUDA_TRACE_PRODUCTION_CAPABLE=0
+PALW_CUDA_PRODUCER_VENDOR_RUNTIME_INTEGRATED=0
+PALW_CUDA_PRODUCER_RECEIPT_MAPPING_AVAILABLE=0
+PALW_CUDA_PRODUCER_PRODUCTION_CAPABLE=0
+PALW_CUDA_LLAMA_MMVQ_RECEIPT_MAPPING_AVAILABLE=0
+PALW_CUDA_LLAMA_MMVQ_PRODUCTION_CAPABLE=0
+```
+
+Configuring `PALW_CUDA_PRODUCTION_KERNEL_TRACE=ON` still fails with
+`PALW CUDA production kernel trace is unavailable`, and the closed-gate CTest
+passes on both host and RTX builds.
+
+Before a future production gate can open, the diagnostic C++ approval callback
+must consume authority-provided canonical operation/plan/physical-layout IDs,
+the live raw transcript must be passed into the Rust verifier and signed-receipt
+flow, and the resulting bundle must be independently restored under deployed
+trust roots. General multi-token/KV continuation and additional approved
+hardware/model profiles require separate evidence.

docs/evidence/cuda-v3-mmvq-hook-sm89-2026-07-15.md

@@ -0,0 +1,188 @@
+# CUDA V3 vendored MMVQ hook SM89 diagnostic evidence — 2026-07-15
+
+## Scope and status
+
+This is the repository evidence for a one-token, flash-attention-off diagnostic
+run through the vendored llama.cpp Q4_K/Q6_K MMVQ producer hook on an RTX 4060
+Ti. It establishes all of the following on the recorded stack:
+
+- the dense Qwen3-8B Q4_K_M graph exposes exactly 253 supported quantized MMVQ
+  launches for one evaluated token;
+- the request-local bridge associates those launches in order with the exact
+  graph operation token, weight allocation, shape, and quantization;
+- the selected Q4_K and Q6_K producer specializations execute the V3 full-K
+  pre-epilogue FP32 accumulator capture and finalize one canonical V3 record per
+  launch; and
+- an injected association rejection stops the request at the selected launch
+  without accepting later work.
+
+This evidence is deliberately **diagnostic only**. Both positive and negative
+results report `diagnostic_only=true` and `receipt_authority=false`. It does not
+establish a complete attention transcript, production kernel-binary authority,
+or a production CUDA Receipt. R13, R32, and R35 therefore remain `In progress`.
+
+The earlier layer-offload, graph-observer, and standalone-producer device gates
+remain recorded separately in
+[`cuda-wsl-sm89-2026-07-15.md`](cuda-wsl-sm89-2026-07-15.md).
+No Tailscale address, SSH credential, or GPU UUID is recorded here.
+
+## Fixed inputs and build
+
+| Item | Recorded value |
+| --- | --- |
+| GPU | NVIDIA GeForce RTX 4060 Ti |
+| Compute capability | 8.9 (`sm_89`) |
+| CUDA compiler | NVCC 13.3.73 |
+| Vendored llama.cpp base commit | `12127defda4f41b7679cb2477a4b0d65ee6a0c8f` |
+| Model | `Qwen3-8B-Q4_K_M.gguf` |
+| Remote build directory | `/root/qwen-8.0/build/llama-palw-hook-sm89-v1` |
+| Loaded CUDA backend | `bin/libggml-cuda.so` |
+| Loaded CUDA backend SHA-256 | `e8b357569b5845596775226b226eea77b2d3cd34eadc43207820e3c9f3fd6115` |
+
+The executable was built with the experimental `GGML_CUDA_PALW_TRACE` path and
+ran with all model layers assigned to the single CUDA backend, batch and ubatch
+equal to one, and flash attention disabled. The relevant invocation was:
+
+```sh
+LD_LIBRARY_PATH=/root/qwen-8.0/build/llama-palw-hook-sm89-v1/bin \
+  /root/qwen-8.0/build/llama-palw-hook-sm89-v1/bin/llama-palw-mmvq-smoke \
+  --model /root/qwen-8.0/models/Qwen3-8B/Qwen3-8B-Q4_K_M.gguf \
+  --kernel-binary-sha256 \
+  e8b357569b5845596775226b226eea77b2d3cd34eadc43207820e3c9f3fd6115
+```
+
+The SHA-256 above is the whole loaded `libggml-cuda.so`, supplied explicitly to
+the diagnostic tool. It is useful for identifying this build artifact, but it
+is not an independently attested digest of the exact selected cubin/fatbin entry
+point and is not a production manifest-authority assertion.
+
+## Positive one-token gate
+
+The tool first used an untraced discovery context and then attached a fresh V3
+producer context to the exact CUDA backend used by the traced llama context. An
+approval callback required the next preapproved weight pointer, shape, and
+quantization and a unique non-null graph operation token. The backend queried
+`cudaFuncGetAttributes` from the same Q4_K or Q6_K specialization passed to the
+V3 exact launch wrapper. Finalization validated record coverage and identity,
+then encoded each record with the 452-byte canonical V3 codec before computing
+the diagnostic FNV-1a value.
+
+Three independent positive invocations all exited successfully with the same
+values:
+
+| Field | Run 1 | Run 2 | Run 3 |
+| --- | ---: | ---: | ---: |
+| `discovered` | 253 | 253 | 253 |
+| `q4_k` | 216 | 216 | 216 |
+| `q6_k` | 37 | 37 | 37 |
+| `approved` | 253 | 253 | 253 |
+| `accepted` | 253 | 253 | 253 |
+| `records` | 253 | 253 | 253 |
+| `committed` after finalize | 253 | 253 | 253 |
+| `producer_faults` | 0 | 0 | 0 |
+| `poisoned` | false | false | false |
+| canonical-record FNV-1a 64 | `6618cafb2d66fc5c` | `6618cafb2d66fc5c` | `6618cafb2d66fc5c` |
+
+The 253 records decompose exactly into 216 Q4_K and 37 Q6_K MMVQ launches. This
+is one record per approved MMVQ launch in the smoke profile; it is not a claim
+that the uninstrumented attention sublaunches are represented.
+
+The exact selected-specialization diagnostics were also identical for Q4_K and
+Q6_K:
+
+| Attribute | Q4_K | Q6_K |
+| --- | ---: | ---: |
+| SM architecture | 89 | 89 |
+| CUDA binary version | 89 | 89 |
+| PTX version | 89 | 89 |
+| Registers per thread | 40 | 40 |
+| Maximum threads per block | 128 | 128 |
+| Static shared memory bytes | 384 | 384 |
+| Local memory bytes | 0 | 0 |
+
+The bridge additionally checked nonzero, exact producer-variant, work-entry,
+and capture-implementation identities against every finalized record. Those
+source/dispatch-derived identifiers and the runtime attributes constrain this
+diagnostic execution, but only a reviewed release manifest and authority can
+turn them into an approved production identity.
+
+The repeated `6618cafb2d66fc5c` value demonstrates same-stack diagnostic
+repeatability for these three invocations. FNV-1a is only a compact diagnostic
+fingerprint; it is not a cryptographic transcript commitment and does not prove
+cross-driver, cross-GPU, or independently reproduced equality.
+
+## Negative association gate
+
+The same executable was run with zero-based `--reject-index 17`. The approval
+callback deliberately returned `PALW_CUDA_TRACE_IDENTITY_MISMATCH` for that
+association. Indices 0 through 16 were accepted; index 17 and every later launch
+were not. The process exited zero only because all fail-closed oracle conditions
+matched:
+
+| Field | Observed value |
+| --- | ---: |
+| `status` | `expected_failure` |
+| `reject_index` | 17 |
+| llama decode status | -3 |
+| producer unbind status | 8 (`PALW_CUDA_TRACE_IDENTITY_MISMATCH`) |
+| `accepted` | 17 |
+| `records` | 17 |
+| committed records | 0 |
+| fault callbacks | 1 |
+| producer device faults | 0 |
+| producer poisoned | false |
+
+This is specifically a scheduler/backend association failure. The single fault
+callback reported an association mismatch, no rejected launch was enqueued, and
+the producer remained unpoisoned because no asynchronous CUDA or device-view
+fault occurred. The result proves ordered fail-closed cancellation at this
+boundary; it does not substitute for separate device-fault and asynchronous
+error-injection gates.
+
+## Complementary final verification gates
+
+The source state used for this evidence also passed the following non-smoke
+gates:
+
+- Rust/Cargo 1.81.0 with `--locked`: 182 passed and 2 real-model tests ignored
+  (184 discovered). The passed tests were library 131, adversarial 12, bonded
+  maturity 3, canary durability 2, core flow 3, CUDA V2 contract 13, CUDA V3
+  contract 7, external bonded settlement 2, and restart/bundle 9.
+- `cargo fmt --check`, Clippy with warnings denied, and rustdoc with warnings
+  denied all passed.
+- The normal host CUDA-contract build passed 5/5 CTests.
+- The AppleClang ASan+UBSan host build passed the same 5/5 CTests with no
+  sanitizer report.
+- The RTX 4060 Ti SM89 build passed 7/7 CTests with no skipped device test.
+
+These gates validate the codecs, bridge ABI, host failure contracts, standalone
+device primitives, and Rust binding rules around the smoke run. They do not add
+the missing attention or production-authority coverage listed below.
+
+## What remains before production completion
+
+This gate closes the experimental vendored MMVQ-hook diagnostic item only. It
+does not close any of the following:
+
+1. Wire the V3 FA-off eager-attention decomposition into the actual QK GEMM,
+   masked/scaled softmax, and PV GEMM producer launches and
+   prove complete ordered coverage.
+2. Build the live expected-sublaunch table from the authoritative Qwen schedule
+   and bind the complete MMVQ-plus-attention V3 stream through the Rust authority
+   typestate. The smoke tool's discovery callback is diagnostic scaffolding.
+3. Content-address and independently attest the actual release cubin/fatbin and
+   reviewed entry-point table, then bind them to the runtime manifest, authority
+   registry, governance, and key lifecycle. The whole-DSO hash above is not that
+   proof.
+4. Implement and independently verify the CUDA Receipt/Manifest/Request/Bundle/
+   SQLite V2 mapping and persistence path. CUDA evidence remains forbidden in a
+   `ComputeReceiptV1` issuance path.
+5. Pass full-stream fault injection plus approved replica, clean-rebuild,
+   cross-driver, and supported-hardware reproducibility matrices.
+
+Until those gates close, `PALW_CUDA_LLAMA_MMVQ_RECEIPT_MAPPING_AVAILABLE`,
+`PALW_CUDA_LLAMA_MMVQ_PRODUCTION_CAPABLE`,
+`PALW_CUDA_PRODUCER_RECEIPT_MAPPING_AVAILABLE`,
+`PALW_CUDA_PRODUCER_PRODUCTION_CAPABLE`, and
+`PALW_CUDA_TRACE_PRODUCTION_CAPABLE` remain zero. Production Receipt issuance
+must remain fail-closed.

docs/evidence/cuda-v3-release-kernel-manifest-sm89-2026-07-16.json

@@ -0,0 +1,420 @@
+{
+  "authority_payload": {
+    "entries": [
+      {
+        "cubin": {
+          "elf_flags": 100686084,
+          "sha256": "f04b5d1fb574c3558384bb37f261bc63be926cc0bef584b7a527977bd31b7237",
+          "size": 4229392,
+          "target_arch": "sm_89"
+        },
+        "label": "attention_pv",
+        "runtime_attributes": {
+          "binary_version": 89,
+          "local_memory_bytes": 0,
+          "max_threads_per_block": 1024,
+          "num_regs": 34,
+          "ptx_version": 89,
+          "sm_arch": 89,
+          "static_shared_memory_bytes": 0
+        },
+        "scoped_sections": [
+          {
+            "alignment": 4,
+            "flags": 66,
+            "name": ".nv.constant0._Z13mul_mat_vec_fI6__halfS0_Li1ELi128ELb0ELb0EEvPKT_PKfPKi31ggml_cuda_mm_fusion_args_devicePfi5uint3iiiSA_iiiSA_iiii",
+            "sha256": "076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560",
+            "size": 512,
+            "storage": "raw",
+            "type": 1
+          },
+          {
+            "alignment": 4,
+            "flags": 64,
+            "name": ".nv.info._Z13mul_mat_vec_fI6__halfS0_Li1ELi128ELb0ELb0EEvPKT_PKfPKi31ggml_cuda_mm_fusion_args_devicePfi5uint3iiiSA_iiiSA_iiii",
+            "sha256": "06f0e251abee94e479087c5853edcb658b1237de93ed1f561d755774e3c2e5ab",
+            "size": 500,
+            "storage": "raw",
+            "type": 1879048192
+          },
+          {
+            "alignment": 16,
+            "flags": 67,
+            "name": ".nv.shared._Z13mul_mat_vec_fI6__halfS0_Li1ELi128ELb0ELb0EEvPKT_PKfPKi31ggml_cuda_mm_fusion_args_devicePfi5uint3iiiSA_iiiSA_iiii",
+            "size": 0,
+            "storage": "nobits",
+            "type": 8
+          },
+          {
+            "alignment": 128,
+            "flags": 6,
+            "name": ".text._Z13mul_mat_vec_fI6__halfS0_Li1ELi128ELb0ELb0EEvPKT_PKfPKi31ggml_cuda_mm_fusion_args_devicePfi5uint3iiiSA_iiiSA_iiii",
+            "sha256": "1f6a2a6fc1112e02fdec8773ac7bd1055c41e85ae3254e02e12ab487237d4c62",
+            "size": 3584,
+            "storage": "raw",
+            "type": 1
+          }
+        ],
+        "semantic_binding": {
+          "capture_implementation_id": "c0a50513fee0ef0470636bf28a61c2f2b901c9cff650bdd2f58bd2fdc2921542",
+          "kernel_binary_digest_sha256": "f04b5d1fb574c3558384bb37f261bc63be926cc0bef584b7a527977bd31b7237",
+          "producer_variant_id": "e028f4560714ce35de86dc9346f7a23322951bffaa6d96d0f38ccbe6761f6a61",
+          "role": "work",
+          "work_entry_point_id": "e9d7c24faf7167a4ace7ec61bf721d8eb02e1f368a0293c798fcf12596c12d72"
+        },
+        "symbol": "_Z13mul_mat_vec_fI6__halfS0_Li1ELi128ELb0ELb0EEvPKT_PKfPKi31ggml_cuda_mm_fusion_args_devicePfi5uint3iiiSA_iiiSA_iiii"
+      },
+      {
+        "cubin": {
+          "elf_flags": 100686084,
+          "sha256": "f04b5d1fb574c3558384bb37f261bc63be926cc0bef584b7a527977bd31b7237",
+          "size": 4229392,
+          "target_arch": "sm_89"
+        },
+        "label": "attention_qk",
+        "runtime_attributes": {
+          "binary_version": 89,
+          "local_memory_bytes": 0,
+          "max_threads_per_block": 1024,
+          "num_regs": 40,
+          "ptx_version": 89,
+          "sm_arch": 89,
+          "static_shared_memory_bytes": 0
+        },
+        "scoped_sections": [
+          {
+            "alignment": 4,
+            "flags": 66,
+            "name": ".nv.constant0._Z13mul_mat_vec_fI6__halffLi1ELi64ELb0ELb0EEvPKT_PKfPKi31ggml_cuda_mm_fusion_args_devicePfi5uint3iiiSA_iiiSA_iiii",
+            "sha256": "076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560",
+            "size": 512,
+            "storage": "raw",
+            "type": 1
+          },
+          {
+            "alignment": 4,
+            "flags": 64,
+            "name": ".nv.info._Z13mul_mat_vec_fI6__halffLi1ELi64ELb0ELb0EEvPKT_PKfPKi31ggml_cuda_mm_fusion_args_devicePfi5uint3iiiSA_iiiSA_iiii",
+            "sha256": "569beed4bcfdfde971aa30c94dcd9739ad8fd1a3cc1197041a59d400dc7dfe1b",
+            "size": 500,
+            "storage": "raw",
+            "type": 1879048192
+          },
+          {
+            "alignment": 16,
+            "flags": 67,
+            "name": ".nv.shared._Z13mul_mat_vec_fI6__halffLi1ELi64ELb0ELb0EEvPKT_PKfPKi31ggml_cuda_mm_fusion_args_devicePfi5uint3iiiSA_iiiSA_iiii",
+            "size": 0,
+            "storage": "nobits",
+            "type": 8
+          },
+          {
+            "alignment": 128,
+            "flags": 6,
+            "name": ".text._Z13mul_mat_vec_fI6__halffLi1ELi64ELb0ELb0EEvPKT_PKfPKi31ggml_cuda_mm_fusion_args_devicePfi5uint3iiiSA_iiiSA_iiii",
+            "sha256": "e50f5e46cc7fc13848b9fe520014bed2a52e79745c5c7204a3236a0e5f707a8c",
+            "size": 6400,
+            "storage": "raw",
+            "type": 1
+          }
+        ],
+        "semantic_binding": {
+          "capture_implementation_id": "c0a50513fee0ef0470636bf28a61c2f2b901c9cff650bdd2f58bd2fdc2921542",
+          "kernel_binary_digest_sha256": "f04b5d1fb574c3558384bb37f261bc63be926cc0bef584b7a527977bd31b7237",
+          "producer_variant_id": "0a299134085c7b67bfee9351427fa45a409c684b6533a70d9f41eacdcf805bb4",
+          "role": "work",
+          "work_entry_point_id": "f1112882f6d45fe2975c0012269229bbb3f5e21cdedfd0c085ccf3f53694b183"
+        },
+        "symbol": "_Z13mul_mat_vec_fI6__halffLi1ELi64ELb0ELb0EEvPKT_PKfPKi31ggml_cuda_mm_fusion_args_devicePfi5uint3iiiSA_iiiSA_iiii"
+      },
+      {
+        "cubin": {
+          "elf_flags": 100686084,
+          "sha256": "31d368e4cffc8668bf678aebae93fd79d9b5a4fed626b2a1ce615efa77ce6903",
+          "size": 195152,
+          "target_arch": "sm_89"
+        },
+        "label": "attention_softmax",
+        "runtime_attributes": {
+          "binary_version": 89,
+          "local_memory_bytes": 0,
+          "max_threads_per_block": 1024,
+          "num_regs": 22,
+          "ptx_version": 89,
+          "sm_arch": 89,
+          "static_shared_memory_bytes": 0
+        },
+        "scoped_sections": [
+          {
+            "alignment": 4,
+            "flags": 66,
+            "name": ".nv.constant0._Z12soft_max_f32ILb1ELi256ELi256EfEvPKfPKT2_S1_Pf15soft_max_params",
+            "sha256": "076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560",
+            "size": 512,
+            "storage": "raw",
+            "type": 1
+          },
+          {
+            "alignment": 4,
+            "flags": 64,
+            "name": ".nv.info._Z12soft_max_f32ILb1ELi256ELi256EfEvPKfPKT2_S1_Pf15soft_max_params",
+            "sha256": "282f4482caa1aa8436716905e3ceaaf3e730f51e7daa48514f20788bc2032a37",
+            "size": 312,
+            "storage": "raw",
+            "type": 1879048192
+          },
+          {
+            "alignment": 16,
+            "flags": 67,
+            "name": ".nv.shared._Z12soft_max_f32ILb1ELi256ELi256EfEvPKfPKT2_S1_Pf15soft_max_params",
+            "size": 0,
+            "storage": "nobits",
+            "type": 8
+          },
+          {
+            "alignment": 128,
+            "flags": 6,
+            "name": ".text._Z12soft_max_f32ILb1ELi256ELi256EfEvPKfPKT2_S1_Pf15soft_max_params",
+            "sha256": "c63ad88792a49ace599f83e605d084cac913a598beca77e4c49540fdf3a598aa",
+            "size": 4480,
+            "storage": "raw",
+            "type": 1
+          }
+        ],
+        "semantic_binding": {
+          "capture_implementation_id": "c0a50513fee0ef0470636bf28a61c2f2b901c9cff650bdd2f58bd2fdc2921542",
+          "kernel_binary_digest_sha256": "31d368e4cffc8668bf678aebae93fd79d9b5a4fed626b2a1ce615efa77ce6903",
+          "producer_variant_id": "e74e46185a1164792446404386c2cf2ed3ae7f6c6726d72e26b1009d7e89c0cc",
+          "role": "work",
+          "work_entry_point_id": "eb58357f1b039704e68c9c71d9fda49f356b69bc234d18a64914f597caf4cffb"
+        },
+        "symbol": "_Z12soft_max_f32ILb1ELi256ELi256EfEvPKfPKT2_S1_Pf15soft_max_params"
+      },
+      {
+        "cubin": {
+          "elf_flags": 100686084,
+          "sha256": "09bb6b85776ba02de3b9e5aa457d090208ab25cb276ed63021020ebadc804435",
+          "size": 103016,
+          "target_arch": "sm_89"
+        },
+        "label": "grouped_collector",
+        "runtime_attributes": {
+          "binary_version": 89,
+          "local_memory_bytes": 0,
+          "max_threads_per_block": 1024,
+          "num_regs": 44,
+          "ptx_version": 89,
+          "sm_arch": 89,
+          "static_shared_memory_bytes": 0
+        },
+        "scoped_sections": [
+          {
+            "alignment": 4,
+            "flags": 66,
+            "name": ".nv.constant0._ZN56_GLOBAL__N__26eae2a6_23_producer_accumulator_cu_094d79ac35collect_grouped_final_output_f32_v3EPKfm33palw_cuda_producer_device_view_v337palw_cuda_producer_actual_identity_v3",
+            "sha256": "f4bd841308415de6ed2727462cd66a7333ac8155b4e8e95de0220355189c785c",
+            "size": 648,
+            "storage": "raw",
+            "type": 1
+          },
+          {
+            "alignment": 4,
+            "flags": 66,
+            "name": ".nv.constant2._ZN56_GLOBAL__N__26eae2a6_23_producer_accumulator_cu_094d79ac35collect_grouped_final_output_f32_v3EPKfm33palw_cuda_producer_device_view_v337palw_cuda_producer_actual_identity_v3",
+            "sha256": "106f52bc7d694dadb285f10109d0ce66a4ed1b6751fbc72c1752fec69980f796",
+            "size": 128,
+            "storage": "raw",
+            "type": 1
+          },
+          {
+            "alignment": 4,
+            "flags": 64,
+            "name": ".nv.info._ZN56_GLOBAL__N__26eae2a6_23_producer_accumulator_cu_094d79ac35collect_grouped_final_output_f32_v3EPKfm33palw_cuda_producer_device_view_v337palw_cuda_producer_actual_identity_v3",
+            "sha256": "2a4fe8a0afa52783b1bd49ce5a830a5079112ff9dfa79652195829fa16ea182c",
+            "size": 204,
+            "storage": "raw",
+            "type": 1879048192
+          },
+          {
+            "alignment": 128,
+            "flags": 6,
+            "name": ".text._ZN56_GLOBAL__N__26eae2a6_23_producer_accumulator_cu_094d79ac35collect_grouped_final_output_f32_v3EPKfm33palw_cuda_producer_device_view_v337palw_cuda_producer_actual_identity_v3",
+            "sha256": "37a0bca9a5e01be7a1595146e6b92938499be614bd8ca155ff9781b70121eb4b",
+            "size": 75008,
+            "storage": "raw",
+            "type": 1
+          }
+        ],
+        "semantic_binding": {
+          "capture_implementation_id": "c0a50513fee0ef0470636bf28a61c2f2b901c9cff650bdd2f58bd2fdc2921542",
+          "kernel_binary_digest_sha256": "09bb6b85776ba02de3b9e5aa457d090208ab25cb276ed63021020ebadc804435",
+          "producer_variant_id": null,
+          "role": "capture",
+          "work_entry_point_id": null
+        },
+        "symbol": "_ZN56_GLOBAL__N__26eae2a6_23_producer_accumulator_cu_094d79ac35collect_grouped_final_output_f32_v3EPKfm33palw_cuda_producer_device_view_v337palw_cuda_producer_actual_identity_v3"
+      },
+      {
+        "cubin": {
+          "elf_flags": 100686084,
+          "sha256": "3f9bfb88b5898b7d59b7fc39a01d7fda3b8ce4e270605b2d4cf29465907dfb64",
+          "size": 97838152,
+          "target_arch": "sm_89"
+        },
+        "label": "q4_k",
+        "runtime_attributes": {
+          "binary_version": 89,
+          "local_memory_bytes": 0,
+          "max_threads_per_block": 128,
+          "num_regs": 40,
+          "ptx_version": 89,
+          "sm_arch": 89,
+          "static_shared_memory_bytes": 384
+        },
+        "scoped_sections": [
+          {
+            "alignment": 4,
+            "flags": 66,
+            "name": ".nv.constant0._Z13mul_mat_vec_qIL9ggml_type12ELi1ELb0ELb0EEvPKvS2_PKi31ggml_cuda_mm_fusion_args_devicePfj5uint3jjjS7_jjjS7_jjjj33palw_cuda_producer_device_view_v3",
+            "sha256": "030dd256c2a1dda892b0e57157ec52f9ae5fd1e054d0c66380fae1cb6c09c477",
+            "size": 696,
+            "storage": "raw",
+            "type": 1
+          },
+          {
+            "alignment": 4,
+            "flags": 66,
+            "name": ".nv.constant2._Z13mul_mat_vec_qIL9ggml_type12ELi1ELb0ELb0EEvPKvS2_PKi31ggml_cuda_mm_fusion_args_devicePfj5uint3jjjS7_jjjS7_jjjj33palw_cuda_producer_device_view_v3",
+            "sha256": "27ecd0a598e76f8a2fd264d427df0a119903e8eae384e478902541756f089dd1",
+            "size": 4,
+            "storage": "raw",
+            "type": 1
+          },
+          {
+            "alignment": 4,
+            "flags": 64,
+            "name": ".nv.info._Z13mul_mat_vec_qIL9ggml_type12ELi1ELb0ELb0EEvPKvS2_PKi31ggml_cuda_mm_fusion_args_devicePfj5uint3jjjS7_jjjS7_jjjj33palw_cuda_producer_device_view_v3",
+            "sha256": "3898ea58f7ecc3b16c1f753686bd08c3d24fdd296e7bb8ec0be6fd1ec87d08fa",
+            "size": 456,
+            "storage": "raw",
+            "type": 1879048192
+          },
+          {
+            "alignment": 4,
+            "flags": 67,
+            "name": ".nv.shared._Z13mul_mat_vec_qIL9ggml_type12ELi1ELb0ELb0EEvPKvS2_PKi31ggml_cuda_mm_fusion_args_devicePfj5uint3jjjS7_jjjS7_jjjj33palw_cuda_producer_device_view_v3",
+            "size": 384,
+            "storage": "nobits",
+            "type": 8
+          },
+          {
+            "alignment": 128,
+            "flags": 6,
+            "name": ".text._Z13mul_mat_vec_qIL9ggml_type12ELi1ELb0ELb0EEvPKvS2_PKi31ggml_cuda_mm_fusion_args_devicePfj5uint3jjjS7_jjjS7_jjjj33palw_cuda_producer_device_view_v3",
+            "sha256": "6a2373c1b75fc5baf98f68bddcbf8cb5de0b25044b78076044c2c86cf579fbd0",
+            "size": 55680,
+            "storage": "raw",
+            "type": 1
+          }
+        ],
+        "semantic_binding": {
+          "capture_implementation_id": "b9d5fdda45db7cec8c8652fc60ee97a02bb09e83dfee57f2fc2ec52c51abdeb7",
+          "kernel_binary_digest_sha256": "3f9bfb88b5898b7d59b7fc39a01d7fda3b8ce4e270605b2d4cf29465907dfb64",
+          "producer_variant_id": "bb8334a8f131c5e9bad2902ad4d2e48bbcd2ee6a622feef4b5bb1bb24784e8cb",
+          "role": "work",
+          "work_entry_point_id": "e67572587d81ebab610881fd51059998702fab2fbd1f5102812be46181fb79b5"
+        },
+        "symbol": "_Z13mul_mat_vec_qIL9ggml_type12ELi1ELb0ELb0EEvPKvS2_PKi31ggml_cuda_mm_fusion_args_devicePfj5uint3jjjS7_jjjS7_jjjj33palw_cuda_producer_device_view_v3"
+      },
+      {
+        "cubin": {
+          "elf_flags": 100686084,
+          "sha256": "3f9bfb88b5898b7d59b7fc39a01d7fda3b8ce4e270605b2d4cf29465907dfb64",
+          "size": 97838152,
+          "target_arch": "sm_89"
+        },
+        "label": "q6_k",
+        "runtime_attributes": {
+          "binary_version": 89,
+          "local_memory_bytes": 0,
+          "max_threads_per_block": 128,
+          "num_regs": 40,
+          "ptx_version": 89,
+          "sm_arch": 89,
+          "static_shared_memory_bytes": 384
+        },
+        "scoped_sections": [
+          {
+            "alignment": 4,
+            "flags": 66,
+            "name": ".nv.constant0._Z13mul_mat_vec_qIL9ggml_type14ELi1ELb0ELb0EEvPKvS2_PKi31ggml_cuda_mm_fusion_args_devicePfj5uint3jjjS7_jjjS7_jjjj33palw_cuda_producer_device_view_v3",
+            "sha256": "030dd256c2a1dda892b0e57157ec52f9ae5fd1e054d0c66380fae1cb6c09c477",
+            "size": 696,
+            "storage": "raw",
+            "type": 1
+          },
+          {
+            "alignment": 4,
+            "flags": 66,
+            "name": ".nv.constant2._Z13mul_mat_vec_qIL9ggml_type14ELi1ELb0ELb0EEvPKvS2_PKi31ggml_cuda_mm_fusion_args_devicePfj5uint3jjjS7_jjjS7_jjjj33palw_cuda_producer_device_view_v3",
+            "sha256": "b1b0bee5378188f5250138bcce25855f2617f9c55b20b9628e13d367c47404a9",
+            "size": 8,
+            "storage": "raw",
+            "type": 1
+          },
+          {
+            "alignment": 4,
+            "flags": 64,
+            "name": ".nv.info._Z13mul_mat_vec_qIL9ggml_type14ELi1ELb0ELb0EEvPKvS2_PKi31ggml_cuda_mm_fusion_args_devicePfj5uint3jjjS7_jjjS7_jjjj33palw_cuda_producer_device_view_v3",
+            "sha256": "4459a5f5a9d38602c300a8aae11b4f61928cf9613f7520ad41fbf7c3332f5ed6",
+            "size": 456,
+            "storage": "raw",
+            "type": 1879048192
+          },
+          {
+            "alignment": 4,
+            "flags": 67,
+            "name": ".nv.shared._Z13mul_mat_vec_qIL9ggml_type14ELi1ELb0ELb0EEvPKvS2_PKi31ggml_cuda_mm_fusion_args_devicePfj5uint3jjjS7_jjjS7_jjjj33palw_cuda_producer_device_view_v3",
+            "size": 384,
+            "storage": "nobits",
+            "type": 8
+          },
+          {
+            "alignment": 128,
+            "flags": 6,
+            "name": ".text._Z13mul_mat_vec_qIL9ggml_type14ELi1ELb0ELb0EEvPKvS2_PKi31ggml_cuda_mm_fusion_args_devicePfj5uint3jjjS7_jjjS7_jjjj33palw_cuda_producer_device_view_v3",
+            "sha256": "726ad5b5ce0788fdf358ee8840ae9eb57950ff9b54be15bb1ca3939ea034cd28",
+            "size": 55808,
+            "storage": "raw",
+            "type": 1
+          }
+        ],
+        "semantic_binding": {
+          "capture_implementation_id": "b9d5fdda45db7cec8c8652fc60ee97a02bb09e83dfee57f2fc2ec52c51abdeb7",
+          "kernel_binary_digest_sha256": "3f9bfb88b5898b7d59b7fc39a01d7fda3b8ce4e270605b2d4cf29465907dfb64",
+          "producer_variant_id": "855c0d09acbf494b388b172d67026ea35760d37bfbce7e60725943850f847040",
+          "role": "work",
+          "work_entry_point_id": "f7c95ceb945af4fc2c510ce2b9e879362fa4fc2effae66b1b7d0f3b3272c3250"
+        },
+        "symbol": "_Z13mul_mat_vec_qIL9ggml_type14ELi1ELb0ELb0EEvPKvS2_PKi31ggml_cuda_mm_fusion_args_devicePfj5uint3jjjS7_jjjS7_jjjj33palw_cuda_producer_device_view_v3"
+      }
+    ],
+    "hash_algorithm": "sha256",
+    "library": {
+      "filename": "libggml-cuda.so.0.16.0",
+      "nv_fatbin": {
+        "sha256": "0654f8f423f059dccb94abf098fca2b47f106dcc6581f575756e6a985c6fa35c",
+        "size": 35595224
+      },
+      "sha256": "389bda6116c50eea8aebb9e1fcca1cc0145ab7245cb01d688024856c947f8e6f",
+      "size": 64330104
+    },
+    "schema": "misaka.palw.cuda-release-kernel-manifest.v1",
+    "schema_version": 1,
+    "target_arch": "sm_89"
+  },
+  "manifest_id_sha3_256": "4ededc7c257e13becbf74ebeecdff6c7bfe8ba84d550a6e07aa6cca52d9c7ce7",
+  "provenance": {
+    "cuobjdump_version": "cuobjdump: NVIDIA (R) fat binary listing tool\nCopyright (c) 2005-2026 NVIDIA Corporation\nBuilt on Tue_Jun_09_02:43:40_PM_PDT_2026\nCuda compilation tools, release 13.3, V13.3.73\nBuild cuda_13.3.r13.3/compiler.38244171_0"
+  }
+}

docs/evidence/cuda-v3-runtime-entrypoint-info-sm89-2026-07-16.json

@@ -0,0 +1,90 @@
+{
+  "entries": [
+    {
+      "binary_version": 89,
+      "capture_implementation_id": "b9d5fdda45db7cec8c8652fc60ee97a02bb09e83dfee57f2fc2ec52c51abdeb7",
+      "label": "q4_k",
+      "local_memory_bytes": 0,
+      "max_threads_per_block": 128,
+      "num_regs": 40,
+      "producer_variant_id": "bb8334a8f131c5e9bad2902ad4d2e48bbcd2ee6a622feef4b5bb1bb24784e8cb",
+      "ptx_version": 89,
+      "role": "work",
+      "sm_arch": 89,
+      "static_shared_memory_bytes": 384,
+      "work_entry_point_id": "e67572587d81ebab610881fd51059998702fab2fbd1f5102812be46181fb79b5"
+    },
+    {
+      "binary_version": 89,
+      "capture_implementation_id": "b9d5fdda45db7cec8c8652fc60ee97a02bb09e83dfee57f2fc2ec52c51abdeb7",
+      "label": "q6_k",
+      "local_memory_bytes": 0,
+      "max_threads_per_block": 128,
+      "num_regs": 40,
+      "producer_variant_id": "855c0d09acbf494b388b172d67026ea35760d37bfbce7e60725943850f847040",
+      "ptx_version": 89,
+      "role": "work",
+      "sm_arch": 89,
+      "static_shared_memory_bytes": 384,
+      "work_entry_point_id": "f7c95ceb945af4fc2c510ce2b9e879362fa4fc2effae66b1b7d0f3b3272c3250"
+    },
+    {
+      "binary_version": 89,
+      "capture_implementation_id": "c0a50513fee0ef0470636bf28a61c2f2b901c9cff650bdd2f58bd2fdc2921542",
+      "label": "attention_qk",
+      "local_memory_bytes": 0,
+      "max_threads_per_block": 1024,
+      "num_regs": 40,
+      "producer_variant_id": "0a299134085c7b67bfee9351427fa45a409c684b6533a70d9f41eacdcf805bb4",
+      "ptx_version": 89,
+      "role": "work",
+      "sm_arch": 89,
+      "static_shared_memory_bytes": 0,
+      "work_entry_point_id": "f1112882f6d45fe2975c0012269229bbb3f5e21cdedfd0c085ccf3f53694b183"
+    },
+    {
+      "binary_version": 89,
+      "capture_implementation_id": "c0a50513fee0ef0470636bf28a61c2f2b901c9cff650bdd2f58bd2fdc2921542",
+      "label": "attention_softmax",
+      "local_memory_bytes": 0,
+      "max_threads_per_block": 1024,
+      "num_regs": 22,
+      "producer_variant_id": "e74e46185a1164792446404386c2cf2ed3ae7f6c6726d72e26b1009d7e89c0cc",
+      "ptx_version": 89,
+      "role": "work",
+      "sm_arch": 89,
+      "static_shared_memory_bytes": 0,
+      "work_entry_point_id": "eb58357f1b039704e68c9c71d9fda49f356b69bc234d18a64914f597caf4cffb"
+    },
+    {
+      "binary_version": 89,
+      "capture_implementation_id": "c0a50513fee0ef0470636bf28a61c2f2b901c9cff650bdd2f58bd2fdc2921542",
+      "label": "attention_pv",
+      "local_memory_bytes": 0,
+      "max_threads_per_block": 1024,
+      "num_regs": 34,
+      "producer_variant_id": "e028f4560714ce35de86dc9346f7a23322951bffaa6d96d0f38ccbe6761f6a61",
+      "ptx_version": 89,
+      "role": "work",
+      "sm_arch": 89,
+      "static_shared_memory_bytes": 0,
+      "work_entry_point_id": "e9d7c24faf7167a4ace7ec61bf721d8eb02e1f368a0293c798fcf12596c12d72"
+    },
+    {
+      "binary_version": 89,
+      "capture_implementation_id": "c0a50513fee0ef0470636bf28a61c2f2b901c9cff650bdd2f58bd2fdc2921542",
+      "label": "grouped_collector",
+      "local_memory_bytes": 0,
+      "max_threads_per_block": 1024,
+      "num_regs": 44,
+      "producer_variant_id": null,
+      "ptx_version": 89,
+      "role": "capture",
+      "sm_arch": 89,
+      "static_shared_memory_bytes": 0,
+      "work_entry_point_id": null
+    }
+  ],
+  "schema": "misaka.palw.cuda-runtime-entrypoint-info.v1",
+  "target_arch": "sm_89"
+}

docs/evidence/cuda-wsl-sm89-2026-07-15.md

@@ -0,0 +1,175 @@
+# CUDA WSL2 SM89 Experimental Evidence — 2026-07-15
+
+## Scope and status
+
+This is the canonical repository evidence for the experimental CUDA gate run on
+a Windows/WSL2 RTX 4060 Ti host. It establishes that the pinned Qwen artifact
+runs with full CUDA layer offload, that the diagnostic graph observer is exactly
+repeatable on this stack, and that the standalone producer primitive captures a
+real pre-epilogue FP32 accumulator on an SM89 device.
+
+It is **not** a production CUDA Receipt. The vendored llama.cpp Qwen producer is
+not instrumented, the deterministic FA-off attention path is not representable
+by the current V2 dispatch schema, and all production capability macros and the
+production CMake gate remain closed. R32 therefore moves from `Blocked` to
+`In progress`, not to `Complete`.
+
+No Tailscale address, SSH credential, or GPU UUID is recorded in this artifact.
+
+## Fixed host and toolchain
+
+| Item | Observed value |
+| --- | --- |
+| Host path | Windows 11 + WSL2 Ubuntu 24.04.4 LTS |
+| WSL kernel | 6.18.33.2 |
+| GPU | NVIDIA GeForce RTX 4060 Ti, 8,188 MiB |
+| Compute capability | 8.9 (`sm_89`) |
+| NVIDIA driver | 610.62 |
+| CUDA toolkit package | 13.3.1 |
+| NVCC | 13.3.73 |
+| CUDA architecture gate | exactly `89-real` |
+| llama.cpp commit | `12127defda4f41b7679cb2477a4b0d65ee6a0c8f` |
+| llama.cpp version | `10015 (12127def)` |
+
+The build used `/usr/local/cuda/bin/nvcc` and did not rely on a compiler-default
+or multi-architecture fatbin selection. `cuobjdump --list-elf` reported only
+`sm_89.cubin` entries for both device-test executables.
+
+## Pinned model artifact
+
+| Item | Value |
+| --- | --- |
+| Repository | `Qwen/Qwen3-8B-GGUF` |
+| Revision | `7c41481f57cb95916b40956ab2f0b139b296d974` |
+| File | `Qwen3-8B-Q4_K_M.gguf` |
+| Size | 5,027,783,488 bytes |
+| SHA-256 | `d98cdcbd03e17ce47681435b5150e34c1417f50b5c0019dd560e4882c5745785` |
+
+llama.cpp identified 399 tensors: 145 F32, 217 Q4_K, and 37 Q6_K.
+All 37/37 model layers were offloaded to the RTX GPU. The CUDA model buffer was
+4,455.34 MiB and the CUDA KV buffer was 576 MiB in the recorded probe.
+
+## Deterministic diagnostic Qwen observer
+
+The dedicated observer was invoked with a public `PALW` stdin prompt, two
+predicted tokens, all GPU layers, and `observer=sketch`. Its enforced header
+reported greedy sampling (`temperature=0`, `top_p=1`, `top_k=0`), request batch,
+`n_batch`, and `n_ubatch` all equal to one, parallel/tensor parallel equal to one,
+one CPU thread, context 4096, no context shift, no speculation, no tensor repack,
+and flash attention disabled. CUDA graphs, graph fusion, and graph optimization
+were also disabled for this diagnostic run.
+
+Observed result:
+
+- 4,338 total observer events: 2,892 prefill and 1,446 decode;
+- 975 graph GEMM events across three evaluated tokens;
+- six independent runs produced exactly the same event stream and result line;
+- event-stream SHA-256:
+  `e8ec2574076a46d29a83d2016e657cadb12600ccca0246320d6f32a16c7b0ba3`;
+- result-line SHA-256:
+  `6a22c1547efa9d5ba8b0478d11d82b2b817455eee35a7d4eeb2f66c5af9444cd`;
+- retained observer JSONL SHA-256:
+  `8884b72be183e704b7238da9734d675bde764fe11b60a17038a69aefd0251ac3`;
+- observer executable SHA-256:
+  `f84b67ea4ee5a36a2bd2b04823bbf0ee9abdd47329704457ffa3e5d96e79c38a`;
+- loaded `libggml-cuda` SHA-256:
+  `680dc8a64ffc1a35658f6fcc71809d3e0afb11de968abf0d4ba7931c14d8b49a`.
+
+This observer still reports `cuda_kernel_trace=false`: its 975 GEMM records are
+graph-level diagnostic fallback evidence, not true producer-accumulator records.
+
+The exact measured composition explains the remaining coverage gap:
+
+| Operation path | Three-token count | Per token |
+| --- | ---: | ---: |
+| Q4_K quantized linear MMVQ candidate | 648 | 216 |
+| Q6_K quantized linear MMVQ candidate | 111 | 37 |
+| All quantized linear MMVQ | 759 | 253 |
+| FA-off eager-attention F16 `MUL_MAT` | 216 | 72 |
+| Total | 975 | 325 |
+
+An MMVQ producer hook can cover the 253 quantized linear GEMMs per token, but it
+cannot claim the 72 eager-attention GEMMs per token.
+
+## Standalone true producer-accumulator primitive
+
+The standalone test producer computes segmented dot-product accumulators in
+CUDA registers, calls `palw_cuda_producer_capture_accumulator_f32` before an
+independently variable epilogue/final store, and directly emits canonical V2
+tile-by-K-segment evidence. It validates exact function pointer and
+`cudaFuncGetAttributes`, immutable injected device view, per-launch nonce,
+compiled entry-point/variant identity, 32 exactly-once samples, duplicate/missing
+masks, host-retained metadata, stream/device binding, and codec grid limits.
+
+The final CUDA source-tree aggregate is:
+
+```text
+2fda921624a095687e45aab9afb5ea32c48ca648727c6c5c6f1a923abbd9dc4f
+```
+
+It is calculated by hashing every regular file under `runtime-palw/cuda` in
+byte-sorted pathname order, then SHA-256 hashing the resulting `shasum -a 256`
+lines.
+
+An independent clean build in `build/palw-cuda-device-root-final` produced:
+
+- CTest: 6/6 passed, zero skipped (host 4, V1 device 1, producer device 1);
+- standalone producer executable: 20/20 independent executions passed;
+- all 20 logs had SHA-256
+  `bd5c1f458c7b4f81a1bd76414896de253f61d6b6f99426eefc3b51d9491673e6`;
+- all 20 runs reported diagnostic fingerprint `c1a38ed138200874`;
+- V1 device-test executable SHA-256:
+  `401241589d908a92e4bc1f83b90346eb896096e65bcae9b4102f1153ee99bc04`;
+- producer device-test executable SHA-256:
+  `e9bb2ad7beb104bdba82a013bbfe9dd4271f36c79d09b10f380c840ced695a8e`;
+- `libpalw_cuda_trace.a` SHA-256:
+  `8aef058ce12b746a683d037d70c72c3401940aa7136e46b8340f88229b0c5b9e`.
+
+A separate build directory from the same source aggregate produced different
+whole-binary/library SHA-256 values while passing the same 6/6 and 20/20 gates.
+Consequently this evidence does **not** claim byte-for-byte build reproducibility;
+the build-directory/toolchain provenance difference remains to be isolated and
+the approved release artifact must be content-addressed explicitly.
+
+The final adversarial review found and closed two pre-release defects: a caller
+could previously change the injected-view argument position at launch, and a
+codec-invalid grid-Y value could be accepted until finalization. The launch now
+uses only the ABI position/count retained at `prepare`, and pure descriptor
+validation shares the codec limits (`grid_x <= 2,147,483,647`,
+`grid_y <= 65,535`). The review found no remaining P1/P2 issue within the stated
+experimental trusted-ABI boundary.
+
+## Host and Rust gates
+
+- AppleClang warning-as-error host CTests: 4/4 passed.
+- AppleClang ASan+UBSan host CTests: 4/4 passed with no report.
+- Rust 1.81.0: 173 passed, 2 ignored (175 discovered).
+- Rust CUDA trace contract: 13/13 passed.
+- `cargo fmt --check`, Clippy `-D warnings`, and rustdoc `-D warnings` passed.
+- `ComputeReceiptV1` builder and verifier both reject CUDA `KernelSketch`.
+- Authority verification binds network/job/execution/assignment, runtime,
+  producer integration, complete schedule/transcript, validity and revocation;
+  its projection is candidate evidence for a future Receipt V2 only.
+
+## Remaining completion gates
+
+1. Instrument the pinned llama.cpp Q4_K and Q6_K unfused MMVQ specializations at
+   the true full-K pre-epilogue accumulator point and report the actual selected
+   dispatch from request-local state.
+2. Version the transport/dispatch contract for FA-off eager/decomposed attention
+   sublaunch grouping, or approve and revalidate a separate deterministic FA-on
+   runtime class.
+3. Bind reviewed hook source, compiled hook/entry-point table, actual loaded
+   cubin, extraction policy, and runtime manifest through production authority
+   governance and key lifecycle.
+4. Implement Receipt/Manifest/Request/Bundle/SQLite V2 and an independent
+   verifier that retains the authority provenance commitment.
+5. Run vendored-Qwen full-stream fault injection and approved replica/cross-driver
+   reproducibility matrices.
+
+Until all five are complete,
+`PALW_CUDA_PRODUCER_VENDOR_RUNTIME_INTEGRATED`,
+`PALW_CUDA_PRODUCER_RECEIPT_MAPPING_AVAILABLE`,
+`PALW_CUDA_PRODUCER_PRODUCTION_CAPABLE`, and
+`PALW_CUDA_TRACE_PRODUCTION_CAPABLE` remain zero, and
+`PALW_CUDA_PRODUCTION_KERNEL_TRACE=ON` must fail at CMake configure time.

docs/evidence/metal-hybrid-qwen36-2026-07-19.md

@@ -0,0 +1,90 @@
+# Metal E2E evidence — Qwen3.6-35B-A3B (Claude-4.7, abliterated), 2026-07-19
+
+このメモは、dense Qwen3-8B から hybrid Qwen3.6-35B-A3B へ移行した後の Metal arm64 実機
+E2E（Receipt 発行 → 別 process 検証）の一次証跡である。
+
+## Host / runtime
+
+- Apple M1 Max、macOS（Metal 4）、`uname -m = arm64`
+- pinned llama.cpp `12127defda4f41b7679cb2477a4b0d65ee6a0c8f` + PALW observer patch
+  （`patches/llama.cpp-palw-observer.patch`、SHA-256
+  `d155a88b7c11ee74f48011760cb1a37773a694c8cab28258ee108c85e2f9e02c`）
+- `llama-palw-observer` は model load 時に `qwen35moe` / 40 layer / 2048 hidden / 248320
+  vocab を検証。`load_tensors: offloaded 41/41 layers to GPU` を確認。
+
+## Model artifact
+
+- GGUF: Ollama `huihui_ai/Qwen3.6-abliterated:35b-Claude-4.7`、blob/SHA-256
+  `1dc494614bee8a3bc00e79fe5a49da0fc1c36b3b118c4156e223e98e5a0a671b`、23,938,321,728 bytes（`Q4_K_M`）
+- Base metadata（7 files）: HF `huihui-ai/Huihui-Qwen3.6-35B-A3B-Claude-4.7-Opus-abliterated`
+  rev `ac18882735d037f6074a7630eb68d85db8234c25`
+
+## 出力健全性（off-mode 差分）
+
+prompt `The capital of France is`（token `[760, 6511, 314, 9338, 369]`）→ 生成
+` Paris, a city renowned for its iconic`（8 token）。全 41 layer GPU offload。
+
+## 発行 Receipt（sketch-mode、Metal kernel-bound）
+
+- output dir: `receipts/final-v7/`
+- Receipt ID: `8e2dd34b7609d6d7aeec17bff485eb1ae4db31f66dd899a3c3a3e671656053f9`
+- Verification bundle ID: `f5b8a2968c4ea266b2cbbabf351a171e0fa2581984eff63362de2640fcdcf9db`
+- public JSON schema: `misaka.palw.public-receipt.v2`、observer JSONL schema **v2**
+- CU ruleset: **v3 semantic**、`43a5feef177b389f976361b22ac9d57da65815261282005bc78d1666a37870ce`
+- `job_class=self_local`、`evidence_level=gemm_traced`、**`trace_evidence=metal_kernel`**
+  (M5 で graph-fallback から昇格。各 GEMM を実 Metal compute pipeline + launch geometry へ束縛)
+- `mint`: `eligible=false`、`weight=0`、`class=local_self_consistent_v0_1`
+- `mint.ineligible_reasons`: **「Metal kernel-launch-bound sketch, not an intra-kernel accumulator
+  proof」/ 非 network-anchored / 非 bonded の 3 件**(M3 で generic、M5 で graph-fallback の失格理由は
+  解消。Metal trace は launch-geometry 束縛で CUDA V3 相当の accumulator proof ではないため mint 不適格の
+  まま — honest labeling)。`mint.mainnet_ready=false`
+- `prefill_tokens=5`、`decode_tokens=2`、`prefill_graph_steps=5`、`decode_graph_steps=1`
+- `schedule_event_count=13770`（commitment-only）、`gemm_events=trace_event_count=2466`
+- **`canonical_compute_units=41692`（v3 semantic、署名 commit）** ＝ `semantic_compute_units_v3`。
+  graph 非依存 / fragmentation-proof、verifier が `prefill/decode` から再計算・照合。
+- `semantic_schedule`: commitment `e6fc731e…`、`expert_route_ops=80`、`attention_ops=20`
+  (verifier が pinned architecture から独立再生成して照合)
+- **`expert_route`: root `5e4ea70b…`、`route_event_count=240`**(observer が `ffn_moe_topk` を
+  post-compute で読み戻した実 MoE routing。封緘 bundle へ commit し公開 JSON へ再構成)
+- 公開 artifact SHA-256:
+  - `<id>.palw`: `b602203cc781c67d8c45c915b29edcef30a1aca22f52a7482693f2551f493dca`
+  - `<id>.json`: `2bc670c2de4147fa150126cc36a5f35b5c0600f0835b334e3d36de58ccbf5154`
+- prompt / prompt token IDs / generated token IDs / opening / signing key / owner salt は
+  公開 `.palw` / `.json` に含まれない（secret-leakage scan 済み）。
+
+## 別 process 検証
+
+`palw-verify-bundle` が `.palw` / `.palw.bundle` / `.json` / `palw-state.sqlite3` を復元・再検証し、
+`status=local_restored`、`trust_scope=embedded_local_snapshot`、`receipt_id` / `bundle_id`
+一致（exit 0）。
+
+## Hybrid 対応の要点
+
+- pinned llama.cpp の qwen35moe loader/graph は 3-section mrope、`ssm_dt` naming、
+  per-layer KV-head（layer 0 は linear-attention で `n_head_kv=0`）、bundled vision/MTP
+  tensor、full-attention reshape の per-layer head 数を扱うよう修正。
+- Rust adapter（`AdapterProfile::HybridQwen36A3B`）: 全演算を**忠実な canonical operation**へ写像
+  — `MUL_MAT_ID→ExpertGemm`、`ARGSORT→ExpertRoute{top_k=8}`、`SSM_CONV→SsmConv`、
+  `GATED_DELTA_NET→GatedDeltaNet`、`L2_NORM→L2Norm`、`SUM_ROWS→Reduction`、
+  `CONCAT/CONT/CPY→TensorCopy`、`UNARY/SCALE/DIV/CLAMP→Elementwise`、`VIEW`/`RESHAPE`/`PERMUTE`/
+  `TRANSPOSE` は layout-only。**`Generic` は不使用**。未列挙 op は fail-closed。plain `MUL_MAT` のみ
+  accumulator sketch を採取。
+- observer（schema v2）は `ffn_moe_topk`（I32）を post-compute で読み戻し、per-token 選択 expert を
+  "route" record として emit。adapter が commitment chain へ fold し `expert_route_root` を封緘。
+- **ggml-metal 計装（M5）**: `ggml_metal_palw_set_dispatch_hook` が全 Metal dispatch を pipeline 名 +
+  launch geometry で報告。observer は各 GEMM を ASK→POST window 内の最後���非 `_id` matmul dispatch
+  (`kernel_mul_mv_*`)へ束縛(実機で 200/200 window・411/411 GEMM を確認、0 anomaly)。adapter は
+  kernel 名 + threads-per-threadgroup を `kernel_id`、threadgroup grid を tile へ束ね
+  `TraceEvidenceKind::MetalKernel` を commit。verifier が `TraceCapability::MetalKernel` と照合。
+- 0-element の recurrent state cache tensor は observer が no-compute として skip。
+- 観測 patch: `patches/llama.cpp-palw-observer.patch`、SHA-256
+  `d155a88b7c11ee74f48011760cb1a37773a694c8cab28258ee108c85e2f9e02c`。
+
+## 限界
+
+Metal の kernel-level trace（`trace_evidence=metal_kernel`）は **launch-geometry 束縛**であり、
+CUDA V3 の intra-kernel accumulator sketch とは異なる(より弱い)。そのため `MetalKernel` は
+`KernelSketch` とは**別の evidence kind**として commit し、CUDA 相当を主張しない(honest labeling)。
+mint は依然不適格(「kernel-launch-bound, not accumulator proof」)。単独ノードの Receipt はそれだけで
+ゼロ知識の計算証明ではない。network/hardware/model-Genesis 依存の未達 gate
+R13/R21/R23/R24/R26/R27/R32/R35 は [`../requirements.md`](../requirements.md) の通り。

docs/evidence/metal-smoke-2026-07-15.md

@@ -0,0 +1,336 @@
+# Metal Smoke / Receipt Evidence — 2026-07-15
+
+> **Historical schema-v3 evidence.** This page records the `final-v5` run and its historical
+> test counts; it is not the current schema-v4 acceptance baseline. See
+> [`metal-smoke-schema-v4-2026-07-15.md`](metal-smoke-schema-v4-2026-07-15.md) for current evidence.
+
+Host: Mac Studio `Mac13,1`, Apple M1 Max (24 GPU cores), 32 GiB unified memory,
+macOS 26.5 arm64 build `25F71`, Metal 4.
+
+## Pinned artifacts
+
+- llama.cpp commit: `12127defda4f41b7679cb2477a4b0d65ee6a0c8f`
+- llama.cpp version: `10015 (12127def)`
+- model repo/revision: `Qwen/Qwen3-8B-GGUF@7c41481f57cb95916b40956ab2f0b139b296d974`
+- base metadata revision: `Qwen/Qwen3-8B@b968826d9c46dd6066d109eabc6255188de91218`
+- model file: `Qwen3-8B-Q4_K_M.gguf`
+- model bytes: `5,027,783,488`
+- model SHA-256: `d98cdcbd03e17ce47681435b5150e34c1417f50b5c0019dd560e4882c5745785`
+- Hub LFS SHA-256/size、local digest/size、revision sidecar は一致した。
+- official base metadata 8ファイルの SHA-256 と profile shape/dtype は固定値と一致した。
+
+Binary SHA-256:
+
+- `llama-cli`: `98d1680585d450e25a9a4352b33defd04447e9b344e9251ab3e7935e4bf0f57d`
+- `llama-server`: `ad2946371ae4abe62115dc514dee11f4655ed117d718b714b338b00d82e039e0`
+- `llama-tokenize`: `8caaa7f2fb7c74344169cfdec40d6d5f83ee924320534d877128e8cf84a4ef23`
+- `llama-palw-observer`: `c35ee95d261bbb7689199338fa9444b58d03f057cc164e97c4bd6698d456a166`
+  (114,720 bytes; fixed upstream commit と local PALW observer patch を含む)
+
+`./scripts/verify-install.sh` は origin/commit、model/base metadata、profile、CMake cache、上記4
+target の version/hash、Metal device、37/37 offload、one-token probe を通過した。
+
+## Basic Metal runtime result
+
+- Metal device は `MTL0: Apple M1 Max` として検出された。
+- 37/37 model layers が GPU へ offload された。
+- CLI one-token inference は exit 0。測定された prompt processing は 80.5 token/s だった。
+- HTTP server `/health` は `{"status":"ok"}` を返した。
+- `/tokenize` で test text `PALW deterministic receipt` は
+  `[73342, 54, 72349, 22567]` になった。
+
+同一 request を cache 無効、temperature 0、top-k 0、top-p 1、seed 0、prediction bound 16 で
+2回実行した。両方が同じ stop type `limit` と token IDs を返した。
+
+```text
+[271, 73342, 54, 8375, 271, 32313, 11, 358,
+ 1184, 311, 7071, 700, 1246, 311, 5486, 419]
+```
+
+これはこの prompt/runtime instance の repeatability evidence であり、cross-driver、cross-device、
+Metal/CUDA 間の bitwise determinism を証明しない。
+
+## Native observer fixed policy
+
+現行 binary の header で次を確認した。
+
+```text
+n_ctx=4096
+n_batch=1
+n_ubatch=1
+request_batch=1
+parallel_sequences=1
+threads=1
+threads_batch=1
+tensor_repack=false
+flash_attention=false
+context_shift=false
+speculation=false
+```
+
+prompt は `--prompt-stdin` で専用 pipe から渡した。通常の Receipt path は
+`--emit-output-bytes` を指定せず、result の `output_bytes=[]` / `output_n_bytes=0` を要求する。
+以下の非干渉比較だけは token IDs に加えて decoded bytes を比較する QA gate のため、明示的な
+output-byte retention を使った。
+
+## Current observer non-interference matrix
+
+### Short prompt
+
+test prompt `PALW`、`n_predict=2` を `off`、`graph`、`sketch` の各 mode で実行した。
+全 process が exit 0 で、次が完全一致した。
+
+- prompt token IDs: `[73342, 54]`
+- generated token IDs: `[19114, 374]`
+- decoded output bytes: `[69, 76, 76, 32, 105, 115]`
+- stop reason: `n_predict`
+
+| Mode | Native events | Post-compute sketches |
+|---|---:|---:|
+| `off` | 0 | 0 |
+| `graph` | 4,338 | 0 |
+| `sketch` | 4,338 | 975 |
+
+同じ short prompt を再度全 mode で実行し、同じ token IDs、bytes、stop reason を得た。
+
+### Longer prompt
+
+test prompt `PALW deterministic receipt observer non interference`、`n_predict=4` でも全 mode が一致した。
+
+- prompt token IDs: `[73342, 54, 72349, 22567, 22067, 2477, 31217]`
+- generated token IDs: `[271, 785, 7286, 498]`
+- decoded output bytes: `[10, 10, 84, 104, 101, 32, 99, 111, 110, 99, 101, 112, 116, 32, 121, 111, 117]`
+- events: off `0`、graph/sketch `14,460`
+- sketches: off/graph `0`、sketch `3,250`
+
+short 975件と longer 3,250件の全 sketch は `bits=256`、64桁 hexadecimal だった。header の
+`cuda_kernel_trace` は false で、全 event の `kernel_trace.available=true` は0件、
+`backend=cuda` も0件だった。この matrix は現行 Metal runtime class で callback の output
+non-interference を示す。graph fallback を CUDA kernel trace や暗号学的 proof へ昇格させる
+証拠ではなく、callback synchronization が timing を変え得る点も残る。
+
+final publication 前の追加 QA は prompt `PALW observer non interference`、`n_predict=2` を使い、
+親 process に GPU/thread/library/token 関連の誤誘導 environment を設定したまま実行した。child は
+allowlist 以外を消去し、off/graph/sketch の token IDs、decoded bytes、stop reason は完全一致した。
+native event は off `0`、graph `8,676`、sketch `8,676` だった。sketch sample count はこの追加 run
+では保存していないため主張しない。
+
+## Signed Self Local Receipt E2E
+
+release `palw-metal-receipt` は pinned tokenizer と current observer を実行し、実行前後 manifest
+一致、strict adapter、全 operation pricing、署名済み request/assignment、Receipt build、stateless
+verification、canonical round-trip、secret scan、SQLite acceptance を一度の fail-closed path で完了した。
+その後の CLI hardening で `--prompt-stdin`、`--audit-key-file`、`--output-dir` を必須とし、
+prompt の非空 UTF-8 / 1 MiB 上限を inference 前に検査するようにした。argv で prompt を受ける
+互換 option はない。tokenizer/native observer へも専用 stdin pipe で渡す。
+
+現行 publication contract は署名済み `.palw`、公開 JSON、XChaCha20-Poly1305 で認証付き暗号化した
+`.palw.bundle`、schema-v3 `palw-state.sqlite3`、最後に fsync する
+`misaka.palw.receipt-set.v2` completion marker の一式である。audit key は output directory 外の exact
+32-byte raw file（owner-only `0400` / `0600`）、output directory は `0700`、bundle/DB は `0600`、
+公開 `.palw` / JSON / marker は `0644` を要求する。公開 JSON schema は strict
+`misaka.palw.public-receipt.v2` である。
+
+正本 artifact:
+
+- output directory: `../../receipts/final-v5`（absolute:
+  `<REPO>/receipts/final-v5`）、mode `0700`、uid `<UID>`
+- Receipt ID: `ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68`
+- verification bundle ID: `6fd4e57a6cbcd6fc1d9138989960b627c9ee4817bc3ac4ce889a1a1b41d7d63b`
+- canonical envelope:
+  [`../../receipts/final-v5/ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68.palw`](../../receipts/final-v5/ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68.palw)
+  — 713 bytes、mode `0644`、SHA-256
+  `b43cf66c6fe4803e03355a4c1658a3466d1efacc0121759b01b5a9c431251f38`
+- encrypted verification bundle:
+  [`../../receipts/final-v5/ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68.palw.bundle`](../../receipts/final-v5/ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68.palw.bundle)
+  — 337,257 bytes、mode `0600`、SHA-256
+  `4b40cefba773142f83cd04f047e952732c5f087b09a6ee8511a9eda99ca1acf2`
+- public metrics:
+  [`../../receipts/final-v5/ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68.json`](../../receipts/final-v5/ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68.json)
+  — 3,427 bytes、mode `0644`、SHA-256
+  `3aa158cacd9c790a85f550e232e1b5b3a5c3f1d81aaa0c5b56b57bb08f1dca22`
+- completion marker:
+  [`../../receipts/final-v5/ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68.complete`](../../receipts/final-v5/ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68.complete)
+  — 262 bytes、mode `0644`、SHA-256
+  `58d43673f80fa29cd9cab8837d5156ecd4ba42a1d6ab1aacb43365145ea16e39`
+- durable state:
+  [`../../receipts/final-v5/palw-state.sqlite3`](../../receipts/final-v5/palw-state.sqlite3)
+  — 126,976 bytes、mode `0600`、SHA-256
+  `0b1774f89d8fbcd2f0f88771477a173bbae5135b71b5439a090d31f167528702`
+
+全5 artifact は uid `<UID>`、link count `1` で、相互に異なる inode だった。audit key は
+`$HOME/.config/misaka-palw/audit-keys/qwen3-8b-final-20260715.key` の exact 32 bytes、mode
+`0600`、uid `<UID>`、link count `1` を検査した。key bytes は publication set に含めない。
+
+Public E2E metrics:
+
+| Field | Value |
+|---|---:|
+| prompt/prefill tokens | 4 |
+| generated/decode tokens | 2 |
+| prefill graph steps | 4 |
+| decode graph steps | 1 |
+| canonical scheduled operations | 4,890 |
+| authenticated GEMM groups | 1,625 |
+| graph-trace events | 1,625 |
+| canonical compute units | 12,135 |
+
+Identity/root evidence:
+
+- runtime manifest hash: `2b9c3cd05942f16b36ab348bc71033c33e8f7aa6872ce4c0c0fcac3ba0212bc1`
+- model profile ID: `0c58c66b03bb471a248cb36be954b42945c6694c148370e6852f674ff98e64d4`
+- runtime class ID: `5b2fd7a56d73aa9757e516f92cbc7b4d43995ebe9ed27e445b9b7ab4cd8c7bc9`
+- shape profile ID: `c4f8ae70ab6fda2707d841a64d79d36cff58509ea7f228eb4c93b693e630d674`
+- schedule commitment: `6ee6163863df1a9a715bb42dc89d7431c13e0cb2538d022d074ca07c11aabab7`
+- graph trace root: `ebfd5d143ee57b1db20751ae4d241479fa9447cd5fcc7052fccce129604b78bc`
+- model PALW root: `ad7d0e950531195bc2cf84f112fee6487777f78120c9a809cf9306c7a7a8684f`
+- tokenizer PALW root: `63839f0ab58084bbaa108a877e52bebd685b2c0616fcfab684a08354dee713dd`
+- trace evidence: `graph_fallback`; required evidence level: `gemm_traced`
+
+strict parser が受理した evidence から layout-only metadata を除く 4,890 canonical operation を
+versioned CU table で価格付けした。global LM head の optional layer representation も受理対象を
+狭めた���示 rule として検証され、unknown/unsupported/unpriced operation はない。公開 JSON parser は
+unknown field を拒否し、retained `artifacts` / `observer_summary` を含む全 field を authenticated
+receipt、bundle manifest/evidence、固定 privacy policy と一致させる。
+
+canonical envelope と encrypted bundle の pre-write scan は prompt text、prompt/generated token
+sequence、output nonce、owner salt、scheduler/worker private key bytes の平文出現を検査し、いずれも
+検出しない。private request/assignment、opening、owner salt、検証用 signer record は bundle の
+authenticated ciphertext に封入する。公開 JSON は prompt/generated tokens、output bytes、nonce、
+salt、private keys を serialized=false と記録し、その全 field を verifier が authenticated receipt、
+bundle manifest/evidence、固定 privacy policy と照合する。提出 prompt に対する published artifact
+directory の fixed-string search も必須である。
+
+SQLite verification result:
+
+```text
+PRAGMA application_id   -> 1346456663 (PALW)
+PRAGMA user_version     -> 3
+PRAGMA integrity_check  -> ok
+PRAGMA foreign_key_check -> no rows
+receipts                 -> 1
+jobs                     -> 1
+pairs / pair_members     -> 0 / 0
+future_audits            -> 0
+audit_replays            -> 0
+mature_sources           -> 0
+work_tickets             -> 0
+slash_records            -> 0
+external_escrows         -> 0
+```
+
+現行 state contract は `PRAGMA user_version=3`、full `sqlite_master` DDL fingerprint、foreign keys、
+`synchronous=FULL`、WAL checkpoint/truncate を要求する。completion marker 作成前に main DB と全
+artifact/directory entry を fsync するため、portable publication は残存 `-wal` / `-shm` に依存しない。
+legacy schema v1 は暗黙 migrate せず fail-closed に拒否する。
+
+別 process の verifier は exit 0 で次を返した。checkpoint 後に `-wal` / `-shm` は残っていない。
+
+```text
+status=local_restored
+trust_scope=embedded_local_snapshot
+receipt_id=ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68
+bundle_id=6fd4e57a6cbcd6fc1d9138989960b627c9ee4817bc3ac4ce889a1a1b41d7d63b
+```
+
+v2 marker は receipt ID、bundle ID、公開 JSON byte 列の SHA-256 を bind する crash-completion signal
+である。keyed MAC や network authority の署名ではなく、directory を変更できる同一 user は再計算
+できるため、marker 単独では authenticity、authorization、maturity を証明しない。separate verifier
+は exact filenames、same private directory、owner/mode/link/inode、bounded read、marker、bundle AEAD、
+公開 JSON、durable acceptance をまとめて検査する。CLI の local restore は encrypted embedded
+registry snapshot との continuity であり、production network trust root の代替ではない。
+
+`pairs=0`、`future_audits=0`、`work_tickets=0` は Self Local Receipt が発行・受理済みでも、
+replication や future audit/challenge maturity をまだ通していないことと整合する。
+
+## Rust and adversarial gates
+
+crate の宣言 MSRV は Rust 1.81 である。実際に toolchain 1.81.0 を install して最初に locked
+dependency graph を検査したところ、open transitive range が `zeroize 1.9` と `base64ct 1.8.3`
+を選び、その edition-2024 Cargo manifest を Cargo 1.81 が parse できない不一致を発見した。
+`Cargo.toml` に `zeroize = "=1.8.1"` と `base64ct = "=1.7.3"` を exact pin し、lockfile を
+downgrade した後、次を current tree で実行した。
+
+```sh
+rustup toolchain install 1.81.0 --profile minimal --component rustfmt,clippy
+cd runtime-palw
+cargo +1.81.0 fmt --all -- --check
+cargo +1.81.0 clippy --locked --all-targets -- -D warnings
+cargo +1.81.0 test --locked --all-targets
+```
+
+- library unit tests: 104 passed、2 ignored real-model tests
+- `tests/adversarial.rs`: 11 passed
+- `tests/core_flow.rs`: 3 passed
+- `tests/restart_bundle.rs`: 9 passed
+- total: **127 passed, 2 ignored**（129 discovered）
+- fmt: passed
+- locked all-target Clippy with warnings denied: passed
+
+strict public JSON v2 hygiene change と final-v5 発行後に上記 Rust gate をすべて再実行し、同じ結果を得た。
+ignored 2件は pinned Qwen model/Metal observer を必要とする実モデル test である。release build を
+使い、親 process の GPU/thread/Hugging Face/dynamic-loader environment を意図的に汚染した手動 gate
+では child environment isolation を含めて 2/2 passed した。Clippy pedantic の
+`module_name_repetitions` は versioned public protocol API 名を module 外でも自己記述的にする
+意図的な naming policy としてだけ allow し、それ以外の warning は `-D warnings` で拒否した。
+
+adversarial suite は全 consensus Receipt field、全 request/assignment field、signature/envelope、
+nonce/prompt/output/runtime/network binding、schedule reorder/insert/delete、CU/evidence mismatch、dummy
+signer/assignment、fork/credential/runtime instance、k=2 self/duplicate/reuse、serialized secret leakage、
+replay cardinality を mutation し、fail-closed rejection を確認した。
+
+Work Ticket regression gate は `MatureEvidence` の field/low-level constructor が非公開であることに
+加え、Self Local audit の typed `Mature` state、Self Replicated pair、External escrow settlement だけを
+public 生成経路とする。各 evidence は audit eligible epoch、pair matched epoch、settlement epoch を
+封入する。durable registration は accepted receipt/pair の network/class/CU と照合し、ticket issue は
+その exact epoch より前を拒否する。raw maturity marker と caller-supplied epoch の public bypass はない。
+
+これは core protocol/state-machine の test evidence であり、production service の完了証跡ではない。
+External escrow は payment rail、durable monetary balance/authority、settlement/refund/slash との原子的
+連携を持たない。future audit は production beacon delivery、auditor、re-execution executor を持たず、
+canary/bond は in-memory state を中心とし、durable balance、health bridge、automatic slash、appeal、
+atomic debit を持たない。demand bonus も整数 weight/cap/terms の core 演算までで、funded demand
+authority と payment settlement は未接続である。ローカル CLI が生成する scheduler/worker key、
+network/job ID を production network 登録 identity と解釈しない。
+
+## CUDA host-only sanitizer evidence
+
+この Apple host には `nvcc` と NVIDIA device がないため、CUDA implementation/device CTest は
+compile/run していない。host-only build の CTest は 3/3 passed した。さらに
+`build/palw-cuda-sanitize` を AppleClang 21、Debug、
+`-Wall -Wextra -Wpedantic -Werror -fsanitize=address,undefined -fno-omit-frame-pointer` で構成した。
+
+macOS のこの ASan runtime は leak detection を support せず、`detect_leaks=1` 試行は環境理由で
+abort した。`ASAN_OPTIONS=detect_leaks=0:abort_on_error=1` と
+`UBSAN_OPTIONS=halt_on_error=1` で host CTest を再実行し、同じ3/3 が sanitizer report なしで通過した。
+
+1. C++ ABI / canonical codec contract
+2. C header contract
+3. production non-issuance nested CMake gate
+
+production gate は `PALW_CUDA_PRODUCTION_KERNEL_TRACE=ON` を意図どおり reject した。現在の CUDA
+transport は final-output sketch であり、true partial accumulator、exact kernel identity、NVIDIA
+実機 evidence がない。よってこの host-only result を R32 completion または CUDA Receipt 発行の
+根拠には使用しない。
+
+## CI definitions
+
+[`../../.github/workflows/palw-ci.yml`](../../.github/workflows/palw-ci.yml) は YAML parse gate を通過し、
+次を定義する。remote Actions run はこの host では実行していない。
+
+- push/pull request: Ubuntu 24.04 へ Rust 1.81.0 を install し、上記 fmt、locked all-target
+  Clippy/test を再実行する MSRV job。
+- push/pull request: Linux で host-only CUDA ABI/codec/closed-production-gate を ASan+UBSan、
+  leak detection、warning-as-error 付きで実行する job。
+- manual dispatch only: `self-hosted, linux, x64, nvidia` runner と exact real SM architecture で
+  experimental CUDA device transport を build/test する job。device 0 の実 compute capability と
+  selected `*-real` architecture の一致も configure 前に要求する。
+
+manual NVIDIA job は device executable を直接実行するため、return code 77 は CTest skip ではなく
+failure になる。一方で `PALW_CUDA_PRODUCTION_KERNEL_TRACE=OFF` かつ job 名が `not R32` であり、
+成功しても final-output transport の実験 test にすぎない。CI definition 自体の追加も remote run
+成功を示さないため、この evidence は R32/R35 completion を主張しない。
+
+全 checkout は action SHA を固定し credential persistence を無効化する。automatic run は同じ
+event/ref で cancel 可能だが、manual NVIDIA run は event 名で別 concurrency group に置き、push に
+よる途中 cancel を受けない。

docs/evidence/metal-smoke-schema-v4-2026-07-15.md

@@ -0,0 +1,75 @@
+# Metal Schema-v4 Receipt Evidence — 2026-07-15
+
+この文書は current source から Apple M1 Max で生成した schema-v4 Self Local Receipt set と、
+同じ tree に対する検証 gate の記録である。current canonical set は
+[`../../receipts/final-v6/`](../../receipts/final-v6/) に置く。以前の schema-v3 実行は
+[`metal-smoke-2026-07-15.md`](metal-smoke-2026-07-15.md) に historical evidence として残す。
+
+## Install / device gate
+
+`scripts/install.sh` と `scripts/verify-install.sh` の full device gate は、固定した Qwen3-8B GGUF、
+official base metadata、llama.cpp commit `12127defda4f41b7679cb2477a4b0d65ee6a0c8f`、4 build target の
+revision/hash を照合した。Metal device は Apple M1 Max、Qwen3-8B の 37/37 layers を GPU へ offloadし、
+one-token probe まで通過した。
+
+## Current canonical Receipt set
+
+- Receipt ID: `eb51b08c3b86ef5df2cdebcfa9fcef812ec72197b3ad40ae2c5ba68cf4278131`
+- verification bundle ID: `359f1bedaeefc1e140bf8c0dbba11582cb5cc0be428dcd95bc6077721f8096e9`
+
+| Artifact | Bytes | SHA-256 |
+|---|---:|---|
+| [`eb51…8131.palw`](../../receipts/final-v6/eb51b08c3b86ef5df2cdebcfa9fcef812ec72197b3ad40ae2c5ba68cf4278131.palw) | 713 | `85ecb4281a1cb4abf26d6e3e70c84bfb3cc2a6dad80e2022ea4a356165345a75` |
+| [`eb51…8131.json`](../../receipts/final-v6/eb51b08c3b86ef5df2cdebcfa9fcef812ec72197b3ad40ae2c5ba68cf4278131.json) | 3,427 | `03bee886144a2c64dd5f4d2207f86c748f5a3e7891b43f82f077f051342c3d0b` |
+| [`eb51…8131.palw.bundle`](../../receipts/final-v6/eb51b08c3b86ef5df2cdebcfa9fcef812ec72197b3ad40ae2c5ba68cf4278131.palw.bundle) | 403,066 | `b475193fcfe1aea3189066790f925cc3682d2ff5a48cdfa061d62db85d0cff78` |
+| [`eb51…8131.complete`](../../receipts/final-v6/eb51b08c3b86ef5df2cdebcfa9fcef812ec72197b3ad40ae2c5ba68cf4278131.complete) | 262 | `f3dc4e142eb602977c1ac065d51297418c8dca3967b6cdb53eb0dfb447d5c77b` |
+| [`palw-state.sqlite3`](../../receipts/final-v6/palw-state.sqlite3) | 282,624 | `8a740c342a12c83ae211edfa8776b93a14ea9369e3d7bd19a1e780e0724c471e` |
+
+公開 JSON は strict `misaka.palw.public-receipt.v2` で、prefill 5 tokens、decode 2 tokens、
+5,868 canonical operations、1,950 GEMM events、14,562 canonical CUを記録する。主要 binding は次のとおり。
+
+- operation schedule commitment: `ad5b7b98c81354be64a9021cb7a20838ccf9d555576fc0743c79286ea29681f6`
+- GEMM trace root: `53c906957957aa34cd5c66fc9ad8c863e541732ead6728e3125d78dff6c133f1`
+- runtime manifest hash: `5920accc3a0a0529c5f0c0a4050d6bf00d4d8fdf2b9772b64af2b4fdac2b84dd`
+- model profile ID: `0c58c66b03bb471a248cb36be954b42945c6694c148370e6852f674ff98e64d4`
+- runtime class ID: `c38307d57c847f3c276247411c563daf50fc7576cf1f6488ab29fe9a56970c5c`
+- shape profile ID: `c4f8ae70ab6fda2707d841a64d79d36cff58509ea7f228eb4c93b693e630d674`
+
+## Separate verification and durable state
+
+`palw-verify-bundle` を別 process で実行し、exit 0、`status=local_restored`、
+`trust_scope=embedded_local_snapshot` を得た。これは暗号化 bundle 内の発行時 registry snapshot との
+local continuity であり、外部 network authority や後日の revocation を独立に証明しない。
+
+SQLite は application ID `PALW` (`1346456663`)、schema version 4、`integrity_check=ok`、
+foreign-key violationなしだった。receipt/job は1/1、pair、audit、WorkTicket、slash、external settlement
+関連 state はすべて0である。portable set は最終検証後に `-wal` / `-shm` sidecarを持たない。
+
+## Rust / CUDA gates
+
+Rust/Cargo 1.81.0 で `fmt --check`、`check --locked --all-targets`、
+`clippy --locked --all-targets -D warnings`、`test --locked --all-targets` を通過した。通常 suite は
+**166 passed, 2 ignored**（168 discovered）。pinned model と Metal observer を要求する ignored 2件は、
+release build と親環境汚染 gate を有効にした手動実モデル実行で **2/2 passed** した。したがって実行済み
+test は合計168件だが、通常 gate の表記は166 passed / 2 ignoredのままとする。
+
+CUDA host-only gate は通常 build 3/3、AppleClang ASan+UBSan 3/3を通過し、production enable configure は
+意図どおり拒否された。この host に `nvcc` / NVIDIA device はないため device E2E は未実施であり、
+これらはR32 completion evidenceではない。現行 CUDA observerはtrue producer accumulatorとproduction
+exact kernel identityを証明せず、CUDA production Receipt発行はfail-closedのままである。
+
+上記はこのMetal Receiptを固定した時点のgateである。その後のRTX 4060 Ti/SM89
+実験 gate、standalone true-accumulator primitive、現行Rust test数は
+[`cuda-wsl-sm89-2026-07-15.md`](cuda-wsl-sm89-2026-07-15.md) が正本である。Metal Receiptの
+canonical ID/bytesはこの追加検証で変更しない。
+
+## Scope
+
+この証跡は current schema-v4 local Receipt publication、復元、durable acceptance と、Metal runtime classの
+local E2Eを示す。graph fallbackをCUDA kernel traceと同一��せず、local ephemeral signer/embedded snapshotを
+production network authority、maturity、payment railの証明として扱わない。scheduler、beacon、auditor、bond、
+external authority/paymentのproduction service未実装範囲は
+[`../requirements.md`](../requirements.md) の `In progress` / `Blocked` を維持する。repository-scope の
+baselineを固定したことはProduction Network readinessを意味せず、R13/R21/R23/R24/R26/R27/R35の未達gateは
+内部統合と外部境界をrequirementsで分離する。R32はこの証跡固定時にはhard `Blocked`
+だったが、後続SM89 gateで外部hardware blockerが解消したため現行statusは `In progress`である。

docs/protocol-v1.md

@@ -0,0 +1,954 @@
+# MISAKA PALW Receipt Protocol V1
+
+本書は `runtime-palw` の現行 Rust 実装を wire protocol の正本として記述する。ここにない
+production 承認、決済連携、attestation を Receipt から推論してはならない。実装と本書が
+一致しない場合は Receipt を発行しない。
+
+## 1. Primitive types
+
+- `Hash32`、commitment、ID、`NetworkId`: 固定 32 byte
+- `u16` / `u32` / `u64` / `i64`: big endian。`i64` は two's-complement
+- `bool`: `u8(0)` または `u8(1)`
+- enum: variant tag `u8` の後に variant 固有 payload
+- Ed25519 public key: 32 byte、signature: 64 byte、algorithm tag: `0`
+- `Option<T>`: `u8(0)`、または `u8(1) || encode(T)`
+
+`NetworkId` は UTF-8 名ではなく `Hash32` である。consensus encoding へ `usize`、float、map、
+JSON text、platform enum、暗黙の default を直接入れない。
+
+Receipt、scheduler message、future beacon、canary precommit、bond/external authority evidenceのEd25519
+verificationは`verify_strict`を使う。small-order/weak public keyはworker signer、scheduler、beacon、bond、
+external authorityのregistry recordとして拒否し、key IDが一致してもauthorization identityとして扱わない。
+
+## 2. Canonical encoding
+
+```text
+LP(x)       = u64be(len(x)) || x
+bytes(x)    = LP(x)
+string(s)   = LP(utf8(s))
+vector(xs)  = u64be(count(xs)) || encode(xs[0]) || ...
+```
+
+固定長 hash は LP を付けず 32 byte を直接書く。struct は本書に記した順で field を連結する。
+decoder は未知の version/tag、truncated/trailing bytes、invalid UTF-8、非canonical bool/option、
+上限超過を拒否し、decode 後の再encodeが入力と一致しなければ拒否する。現行 reader の blob
+上限は 64 MiB、item count 上限は 16,777,216 である。
+
+## 3. Domain-separated hash
+
+```text
+H(tag, part_0, ..., part_n) = SHA3-256(
+    LP("MISAKA/PALW") ||
+    LP(utf8(tag)) ||
+    u16be(schema_version) ||
+    LP(part_0) || ... || LP(part_n)
+)
+```
+
+part count 自体は入らないが、すべての part が LP されるため partition は曖昧にならない。
+raw concatenation と domain の流用は禁止する。core V1 が使用する domain は次のとおり。
+
+```text
+model-artifact-leaf/v1    model-artifact-node/v1
+model-profile/v1          runtime-class/v1          runtime-manifest/v1
+shape-profile/v1          cu-ruleset/v1
+job-request/v1            assignment/v1             signer-key/v1
+prompt/v1                 output/v1                 owner/v1
+job-nullifier/v1          execution-nullifier/v1
+schedule-init/v1          schedule-step/v1           schedule-final/v1
+gemm-trace-scheme/v1      gemm-trace-init/v1         gemm-trace-step/v1
+gemm-trace-final/v1
+receipt-body/v1           receipt-id/v1              receipt-signature/v1
+replica-match/v1          pair-id/v1
+future-beacon/v1          audit-policy/v1
+audit-selection/v1        audit-challenge/v1
+audit-replay-result/v1    audit-replay-submission/v1
+work-ticket/v2            local-maturity-basis/v2    canary/v1
+canary-precommit/v1       durable-slash-offense/v2   bond-release/v1
+bond-funding-attestation/v1  slash-appeal/v1         slash-decision/v1
+slash-default-uphold/v1   external-escrow/v1         external-payment-command/v1
+external-funding-attestation/v1  external-demand-weight-grant/v1
+external-terminal-confirmation/v1
+llama-cuda-dispatch/v1    cuda-kernel-entry/v1
+verification-bundle-receipt/v1   verification-bundle-public/v1
+verification-bundle-aad/v1       verification-bundle-aead-key/v1
+verification-bundle-id/v1
+```
+
+`request/v1` は generic helper `commit_request` に残るが、署名済み `JobRequestV1` の ID には
+使用しない。job request の唯一の domain は `job-request/v1` である。deterministic policy と
+Qwen Metal profile はさらに `lora-set/v1`、`control-vector-set/v1`、
+`thinking-policy/v1`、`workspace-policy/v1`、`thread-policy/v1`、
+`qwen-native-observer-mapping/v1` 等の artifact domain を runtime identity の内側で使う。
+
+## 4. Artifact and model identity
+
+artifact は slash-separated relative path の辞書順で処理する。空、absolute、末尾 `/`、空要素、
+`.`、`..`、backslash、非UTF-8、重複、symlink、非regular file は拒否する。
+
+```text
+leaf_i = H(
+    "model-artifact-leaf/v1",
+    utf8(relative_path_i),
+    u64be(file_size_i),
+    file_bytes_i
+)
+```
+
+file は streaming hash するが上式と同じ framing である。各 level の leaf/node が奇数なら
+末尾を複製し、`H("model-artifact-node/v1", left, right)` で二分木を作る。artifact は空に
+できない。
+
+`ModelProfile` canonical order:
+
+1. `architecture: string`
+2. `base_repository: string`
+3. `immutable_revision: string`
+4. `topology: u8` (`0=Dense`, `1=MixtureOfExperts`)
+5. `tokenizer: string`
+6. `weight_artifact_root: Hash32`
+7. `tokenizer_artifact_root: Hash32`
+8. `chat_template_digest: Hash32`
+9. `special_tokens_digest: Hash32`
+10. `hidden_size: u32`
+11. `attention_heads: u32`
+12. `kv_heads: u32`
+13. `head_dim: u32`
+14. `layer_count: u32`
+15. `intermediate_size: u32`
+16. `rope: string`
+17. `rope_theta: u64`
+18. `rope_scaling_millionths: u64`
+19. `native_context_tokens: u32`
+20. `vocabulary: u32`
+21. `precision: string`
+
+```text
+model_profile_id = H("model-profile/v1", encode(ModelProfile))
+```
+
+全 string、artifact hash、次元、RoPE integer parameter は nonzero/nonempty でなければならない。
+`hidden_size / attention_heads == head_dim`、`attention_heads % kv_heads == 0` も検査する。
+Q4 GGUF は fixed inference artifact であり、学習済み base revision と量子化 artifact の双方を
+profile に bind する。
+
+## 5. Runtime class, deterministic policy, and manifest
+
+`BackendKind` canonical encoding:
+
+- `0=CUDA`: `cuda_version, driver_version, cublas_version, sm_architecture`（各 string）、
+  `cublas_policy_digest: Hash32`
+- `1=Metal`: `metal_version, driver_build, gpu_family, language_version`（各 string）、
+  `metallib_digest: Hash32`
+- `2=CPU`: `isa_class, blas_version`（各 string）、`affinity_policy_digest: Hash32`
+
+`TraceCapability`: `0=None`, `1=GraphFallback`, `2=KernelSketch`。
+
+`RuntimeClass` canonical order:
+
+1. `backend: BackendKind`
+2. `runtime_version: string`
+3. `runtime_source_repository: string`
+4. `runtime_source_commit: string`
+5. `runtime_binary_digest: Hash32`
+6. `dirty_patch_digest: Hash32`
+7. `operating_system: string`
+8. `host_architecture: string`
+9. `device_class: string`
+10. `accelerator_api: string`
+11. `compiler_version: string`
+12. `build_flags_digest: Hash32`
+13. `kernel_binary_digest: Hash32`
+14. `kernel_algorithm_digest: Hash32`
+15. `accelerator_count: u32`
+16. `tensor_parallel: u32`
+17. `split_policy: string`
+18. `quantization: string`
+19. `kv_cache_precision: string`
+20. `flash_attention: bool`
+21. `tensor_repack: bool`
+22. `context_size: u32`
+23. `batch_size: u32`
+24. `micro_batch_size: u32`
+25. `thread_count: u32`
+26. `trace_capability: TraceCapability`
+27. `deterministic_policy: DeterministicPolicy`
+
+`DeterministicPolicy` の nested canonical order は
+`temperature_millionths:u32, top_p_millionths:u32, top_k:u32, batch_size:u32,
+tensor_parallel:u32, parallel_sequences:u32, context_shift_enabled:bool,
+speculative_decoding_enabled:bool, dynamic_fit_enabled:bool, random_seed:u64,
+kernel_graph_id:Hash32, quantization_artifact_id:Hash32, lora_adapters_digest:Hash32,
+control_vectors_digest:Hash32, thinking_policy_digest:Hash32, workspace_policy_digest:Hash32,
+thread_policy_digest:Hash32` である。
+
+V1 strict policy は temperature 0、top-p 1,000,000、top-k 0、batch/tensor-parallel/
+parallel-sequences各1、context shift/speculative/dynamic fit無効を要求する。
+
+```text
+runtime_class_id = H("runtime-class/v1", encode(RuntimeClass))
+```
+
+Qwen Metal profile の `kernel_graph_id` は pinned llama.cpp commit、
+`qwen_adapter_mapping_id_v1()`、native graph variant、prefill/decode serialization policyを
+まとめて hash する。したがって graph-to-CU mapping の変更も runtime class を変更する。
+
+`ShapeProfile` canonical order は `batch_size:u32, max_context_tokens:u32,
+max_decode_tokens:u32, max_prefill_tokens:u32`。batch は1、各上限は nonzero、prefill/decode
+各上限は context 以下とする。
+
+`RuntimeManifest` canonical order:
+
+1. `manifest_version: u16` (=1)
+2. `model_profile: ModelProfile`
+3. `runtime_class: RuntimeClass`
+4. `shape_profile: ShapeProfile`
+5. `model_artifact_digest: Hash32`
+6. `model_artifact_size: u64`
+7. `runtime_device_digest: Hash32`
+8. `loaded_libraries_digest: Hash32`
+9. `environment_allowlist_digest: Hash32`
+10. `build_provenance_digest: Hash32`
+11. `schedule_schema_version: u16` (=1)
+12. `trace_schema_version: u16` (=1)
+13. `cu_ruleset_id: Hash32`
+14. `trace_scheme_id: Hash32`
+
+`model_artifact_digest == model_profile.weight_artifact_root`、batch/context、CU ruleset を相互検査し、
+`runtime_manifest_hash = H("runtime-manifest/v1", encode(RuntimeManifest))` とする。
+
+現行Qwen Metal issuanceはtokenizer、observer、host/source identity childのinherited environmentを消去し、
+`LANG=C`、`LC_ALL=C`だけを設定する。host/source identity helperはabsolute executable pathを使い、この
+exact mapを`environment_allowlist_digest`へbindする。親processの追加environmentはcompute childへ継承しない。
+
+## 6. Scheduler-signed request and assignment
+
+`JobClass`: `0=SelfLocal`, `1=SelfReplicated`, `2=ExternalReplicated`。
+`EvidenceLevel`: `0=Wrapper`, `1=RuntimeObserved`, `2=GemmTraced`。replicated class は
+`GemmTraced` を要求する。
+
+`ExecutionConstraintsV1` order:
+
+1. `model_profile_id: Hash32`
+2. `runtime_class_id: Hash32`
+3. `shape_profile_id: Hash32`
+
+`JobRequestV1` canonical order:
+
+1. `version: u16` (=1)
+2. `network_id: Hash32`
+3. `scheduler_job_id: Hash32`
+4. `job_class: JobClass`
+5. `prompt_commitment: Hash32`
+6. `shared_output_nonce: Hash32`
+7. `constraints: ExecutionConstraintsV1`
+8. `required_evidence_level: EvidenceLevel`
+9. `issued_epoch: u64`
+10. `expires_epoch: u64`
+11. `external_escrow_reference: Option<Hash32>`
+
+`ExternalReplicated` は nonzero escrow reference が必須、それ以外は `None` が必須。
+
+```text
+request_commitment = H("job-request/v1", encode(JobRequestV1))
+```
+
+`AssignmentV1` canonical order:
+
+1. `version: u16` (=1)
+2. `network_id: Hash32`
+3. `request_commitment: Hash32`
+4. `scheduler_job_id: Hash32`
+5. `job_class: JobClass`
+6. `replica_slot: u8`
+7. `worker_credential_id: Hash32`
+8. `runtime_instance_id: Hash32`
+9. `assignment_id: Hash32`
+10. `issued_epoch: u64`
+11. `expires_epoch: u64`
+
+```text
+assignment_commitment = H("assignment/v1", encode(AssignmentV1))
+```
+
+assignment は network/request/job/class を request と一致させ、validity interval を request 内へ
+包含させる。Self Local は slot 0、replicated は slot 0/1 のみ。
+
+request/assignment envelope は同じ orderを使う。
+
+```text
+u16be(envelope_version=1) ||
+LP(canonical_body) ||
+scheduler_key_id:Hash32 ||
+u8(signature_algorithm=0) ||
+signature:64-byte
+```
+
+signature message はそれぞれ `request_commitment` / `assignment_commitment` そのもの。
+`scheduler_key_id = H("signer-key/v1", scheduler_public_key)`。network-scoped registry は key の
+valid-from/through、revocation、message epoch、weak-key rejectionを検査し、signatureはstrict Ed25519で
+検証する。miner が job ID、nonce、slot、assignment IDを自己生成したものは authorization record に
+ならない。現行local Receipt CLIが自己生成するscheduler key/snapshotはfixture boundaryであり、
+production scheduler/governance authorizationを表さない。
+
+## 7. Prompt, output, owner, and nullifiers
+
+prompt text は commit しない。tokenizerの正確な prompt token列を次で commit する。
+
+```text
+PromptTokens = u64be(count) || concat(u32be(token_id_i))
+prompt_commitment = H(
+    "prompt/v1", network_id, scheduler_job_id,
+    shared_output_nonce, PromptTokens
+)
+```
+
+`StopReason`:
+
+- `0=EndOfSequence(u32 eos_token_id)`
+- `1=LengthLimit`
+- `2=ContextLimit`
+- `3=StopSequence(Hash32 stop_sequence_digest)`
+
+`Cancelled` variant は存在しない。cancelled execution から Receipt を発行しない。現行request
+schemaにはstop-sequence list fieldがないため、`StopSequence` digestが特定requestの設定へbindして
+いるかをverifierが別途検査する実装もまだない。
+
+```text
+CanonicalOutput =
+    u64be(token_count) || concat(u32be(generated_token_id_i)) || encode(stop_reason)
+
+output_commitment = H(
+    "output/v1", network_id, job_nullifier,
+    shared_output_nonce, CanonicalOutput
+)
+```
+
+k=2 の両slotは signed request の同じ nonceを使う。nonce、prompt IDs、output IDs、owner salt は
+Receipt bodyへ載せず、stateless verifier への private opening とする。
+
+```text
+owner_commitment = H(
+    "owner/v1", network_id, owner_salt, owner_ed25519_public_key
+)
+
+signer_key_id = H("signer-key/v1", owner_ed25519_public_key)
+
+job_nullifier = H(
+    "job-nullifier/v1", network_id, scheduler_job_id,
+    request_commitment, u8(job_class)
+)
+
+execution_nullifier = H(
+    "execution-nullifier/v1", job_nullifier, assignment_id,
+    u8(replica_slot), worker_credential_id, runtime_instance_id
+)
+```
+
+owner commitment に worker credential は含めない。registry の `SignerRecord` が public key、
+owner commitment、worker credential の対応を供給する。owner salt は registry recordにも含めない。
+
+## 8. Canonical operations and CU
+
+`DType`: `0=Fp32`, `1=Fp16`, `2=Bf16`, `3=Int8`, `4=Int4`。
+`QuantizationClass`: `0=None`, `1=Q4K`, `2=Q4KM`, `3=Q5KM`, `4=Q8_0`,
+`5=Iq4Xs`, `255=Artifact(Hash32)`。
+
+`GemmShape` order は `m:u32, n:u32, k:u32, batch:u32, dtype:DType,
+quantization:QuantizationClass`。
+
+`ComputeOperation` wire tags と payload:
+
+| Tag | Variant | Canonical payload order |
+|---:|---|---|
+| 0 | `Gemm` | `GemmShape` |
+| 1 | `Attention` | `query_tokens:u32, key_value_tokens:u32, heads:u32, head_dim:u32, batch:u32, causal:bool` |
+| 2 | `LayerNorm` | `elements:u32, batch:u32` |
+| 3 | `RmsNorm` | `elements:u32, batch:u32` |
+| 4 | `Rotary` | `tokens:u32, heads:u32, head_dim:u32` |
+| 5 | `ExpertRoute` | `tokens:u32, experts:u32, top_k:u32` |
+| 6 | `KvCacheRead` | `bytes:u64` |
+| 7 | `KvCacheWrite` | `bytes:u64` |
+| 8 | `Silu` | `elements:u64` |
+| 9 | `ElementwiseMultiply` | `elements:u64` |
+| 10 | `Softmax` | `elements:u64` |
+| 11 | `ElementwiseAdd` | `elements:u64` |
+| 12 | `TensorCopy` | `bytes:u64` |
+| 13 | `EmbeddingLookup` | `elements:u64` |
+
+Dense modelでは `ExpertRoute` を拒否する。Qwen adapter mapping V1 は `MUL_MAT`、`RMS_NORM`、
+`ROPE`、`SET_ROWS`、`SOFT_MAX`、`GLU`、`MUL`、`CONT`、`ADD`、`GET_ROWS` を上記 operationへ
+変換し、`VIEW/RESHAPE/PERMUTE`だけを layout metadata として除外する。その他は fail-closed。
+
+`ComputeUnitRules::v1()` は全variantを integer-only、checked `u128`、明示ceil、minimum 1で
+再計算する。ruleset descriptor の hash が `cu_ruleset_id`。observer申告の cost は受け取らない。
+
+## 9. Ordered operation schedule
+
+`ExecutionPhase`: `0=Prefill`、`1=Decode(u32 step)`。
+`ScheduledOperation` canonical order:
+
+1. `index: u64`（0から連続）
+2. `phase: ExecutionPhase`
+3. `layer_id: Option<u32>`（`None` は global LM head 等）
+4. `operation: ComputeOperation`
+
+```text
+s0 = H("schedule-init/v1", job_nullifier, shape_profile_id, cu_ruleset_id)
+si = H("schedule-step/v1", s(i-1), u64be(i), encode(event_i))
+schedule_root = H("schedule-final/v1", sn, u64be(event_count))
+```
+
+index、chain、decode stepの単調性、model layer range、Dense/MoE制約を verifier が再検査する。
+挿入、削除、並べ替えはCU合計が同じでもrootを変える。
+
+## 10. GEMM trace
+
+`TraceEvidenceKind` の wire tag は `0=Absent`, `1=GraphFallback`, `2=KernelSketch`。
+`trace_scheme_id_v1` は
+`H("gemm-trace-scheme/v1", fixed_scheme_descriptor)` である。
+
+`AccumulatorSketch` は `i64be lane[4]`。`TileIndex` は `m:u32, n:u32, k:u32`。
+`GemmTraceEvent` canonical order:
+
+1. `index: u64`
+2. `schedule_index: u64`
+3. `kernel_sequence: u64`
+4. `tile_linear_index: u32`
+5. `tile_count: u32`
+6. `evidence_kind: TraceEvidenceKind`
+7. `phase: ExecutionPhase`
+8. `layer_id: Option<u32>`（`None` は global LM head）
+9. `kernel_id: Hash32`
+10. `shape: GemmShape`
+11. `tile: TileIndex`
+12. `accumulator_sketch: [i64;4]`
+
+```text
+t0 = H("gemm-trace-init/v1", job_nullifier, trace_scheme_id)
+ti = H("gemm-trace-step/v1", t(i-1), u64be(i), encode(trace_event_i))
+trace_root = H(
+    "gemm-trace-final/v1", tn,
+    u64be(trace_event_count), u64be(gemm_group_count)
+)
+```
+
+各scheduled GEMMは1つのcontiguous groupとなる。groupのschedule indexは狭義増加、全event index/
+kernel sequenceは0から連続、group内metadataは一致、kernel IDはnonzero、全groupで evidence kindを
+混在させない。`GraphFallback` は各GEMM exactly 1 synthetic tile、`KernelSketch` は1個以上の
+native tileを許す。trace group数はschedule内GEMM数と一致し、各eventのschedule index、phase、
+optional layer、shapeを元scheduleと照合する。
+
+現行 Qwen Metal adapter が発行できる trace は `GraphFallback` だけであり、CUDA claimへ昇格しない。
+CUDA C ABIは既存final-output V1 recordに加え、declared origin、accumulator stage/dtype、sketch scheme、
+reduction segment、producer variant IDを持つexact 184-byte V2 wire recordを定義する。Rustのstrict
+decoder/binderは全unfiltered record streamをexpected launch sequence、schedule、tile/segment order、exact
+MMVQ/flash-attention dispatch、CUDA runtime manifestへbindする。raw `ProducerAccumulator`はtransport上の
+declared tagにすぎず、`BoundCudaTranscriptV1`はdiagnostic typestateである。
+さらにadditive V3は452-byte recordと、FA-off attentionのQK-score MMVF、masked/scaled softmax、
+value-aggregation MMVFからなるcanonical 3-sublaunch grouping、strict schedule/runtime binderを実装する。
+
+別のauthority layerはsigned attestationをnetwork/job/execution/assignment、runtime class/manifest、
+producer integration、operation schedule、full unfiltered transcriptへexact bindし、public raw constructorを
+持たない`AuthorityBoundCudaTranscriptV2`を作る。そこからproducer-accumulator GEMMだけを
+`AuthorityBoundCudaReceiptEvidenceV2`へdeterministically射影する。attention
+final-output recordはsigned full-transcript commitmentに残すがGEMM evidenceへは昇格しない。
+
+`ComputeReceiptV1`にはauthority provenance commitmentがないため、V1 builderはCUDA
+`KernelSketch`の発行を拒否し、workerがV1 bodyを手組み・署名してもverifierが拒否する。standaloneの
+true FP32 producer-accumulator採取primitiveはRTX 4060 Ti sm_89でdevice suite 7/7と20/20同一
+diagnostic fingerprintを確認した。最終grouped suiteは8/8である。vendored llama.cppのQ4_K/Q6_K MMVQと
+FA-off QK/softmax/PV producerも接続済みで、same-backend Qwen 1-token diagnostic E2Eは361/361 record、
+3回同一fingerprint、5 work-class rejectionを確認した。ただしproduction Receipt authorityではない。
+
+現行deterministic profileはFA-offで、legacy V2が表すattention dispatchは
+`LlamaFlashAttention`だけである。この非互換に対するV3 sublaunch/grouping schema/binderは実装済みだが、
+実eager-attention 3-stage hook、361-launch実機E2E、release manifest、Receipt/Bundle/SQLite V2も
+実装・検証済みである。live callbackへのauthority-derived canonical expected table接続は未完了である。public headerは
+`PALW_CUDA_TRACE_PRODUCTION_CAPABLE=0`、`PALW_CUDA_PRODUCER_VENDOR_RUNTIME_INTEGRATED=0`、
+`PALW_CUDA_PRODUCER_RECEIPT_MAPPING_AVAILABLE=0`、`PALW_CUDA_PRODUCER_PRODUCTION_CAPABLE=0`で、production
+CMake optionもfailするため、R32は`In progress`でもproduction CUDA `KernelSketch` Receiptを発行してはならない。
+
+## 11. Compute Receipt and signature
+
+`ComputeReceiptV1` は正確に30 fieldで、canonical orderは次のとおり。
+
+1. `receipt_version: u16` (=1)
+2. `network_id: Hash32`
+3. `request_commitment: Hash32`
+4. `scheduler_job_id: Hash32`
+5. `signed_assignment_id: Hash32`（assignment body の `assignment_id`）
+6. `replica_slot: u8`
+7. `model_profile_id: Hash32`
+8. `runtime_class_id: Hash32`
+9. `runtime_manifest_hash: Hash32`
+10. `shape_profile_id: Hash32`
+11. `cu_ruleset_id: Hash32`
+12. `trace_scheme_id: Hash32`
+13. `trace_evidence: TraceEvidenceKind`
+14. `operation_schedule_commitment: Hash32`
+15. `schedule_event_count: u64`
+16. `canonical_compute_units: u64`
+17. `prefill_tokens: u32`
+18. `decode_tokens: u32`
+19. `output_commitment: Hash32`
+20. `gemm_trace_root: Hash32`
+21. `trace_event_count: u64`
+22. `owner_commitment: Hash32`
+23. `worker_credential_id: Hash32`
+24. `job_nullifier: Hash32`
+25. `execution_nullifier: Hash32`
+26. `job_class: JobClass`
+27. `evidence_level: EvidenceLevel`
+28. `timestamp: u64`（informational only）
+29. `issued_epoch: u64`
+30. `expires_epoch: u64`
+
+body-local evidence invariants:
+
+- `Wrapper`: schedule count、trace count、CUは0、trace kindはAbsent
+- `RuntimeObserved`: schedule countとCUはnonzero、trace countは0、trace kindはAbsent
+- `GemmTraced`: schedule count、trace count、CUはnonzero、trace kindはnon-Absent
+- replicated class: evidence levelはGemmTraced
+
+trace無しでも `gemm_trace_root` は zero ではなく、同jobで初期化した empty trace root である。
+
+```text
+body_id = H("receipt-body/v1", network_id, encode(body))
+receipt_id = H("receipt-id/v1", network_id, encode(body))
+signature_message = H("receipt-signature/v1", network_id, encode(body))
+```
+
+`SignedReceiptV1` canonical order:
+
+```text
+u16be(envelope_version=1) ||
+LP(encode(body)) ||
+signer_key_id:Hash32 ||
+u8(signature_algorithm=0) ||
+ed25519_signature:64-byte
+```
+
+現行 `receipt_id` は署名byteを含まず、同じbodyなら同じIDである。signature は worker keyで上記
+messageを署名する。verifier は signer registry、scheduler-derived assignment authorization、
+manifest、private prompt/output opening、schedule/CU/traceをすべて照合する。signer registryはnonzero
+owner/credentialとnon-weak keyだけを受け、Receipt signatureはstrict Ed25519で検証する。
+
+## 12. Stateless verification and durable acceptance
+
+stateless path:
+
+1. signed envelope と body をstrict canonical decode
+2. body structure、network、assignment epoch
+3. scheduler署名検証済み authorization recordとの全binding
+4. worker signer key、owner commitment、credential、Receipt signature
+5. model/runtime/manifest/shape/CU/trace identity
+6. job/execution nullifier再導出
+7. token shape bounds
+8. schedule、CU、traceをwitnessから再計算
+9. prompt/output private openingとtoken countを再計算
+
+型は `UnverifiedReceipt -> StatelesslyVerifiedReceipt`。その後 `StateStore::accept` が SQLite
+transactionで replay/cardinality keyを予約した場合だけ `AcceptedReceipt` になる。Matcher と
+canary submission は `AcceptedReceipt` を要求する。first acceptance時のstateless
+`verified_at_epoch`をdurable `accepted_at_epoch`として保存する。restart後の`restore_accepted`は新しい
+stateless verification epochとoriginal acceptance epochを区別し、canonical signed Receiptとauthorized
+runtime instanceがstored rowとexact一致するときだけtypestateを復元する。stored acceptanceはbody
+issued/expiry内かつcurrent `verified_at_epoch`以下でなければならず、rollbackを拒否する。
+
+durable storeはapplication ID `PALW`、schema version 4、foreign keys、WAL、`synchronous=FULL`を要求する。
+exact table set/column order/foreign-key count/indexに加え、non-internal `sqlite_master`の全
+`(type,name,tbl_name,sql)`をcanonical encodeしたSHA3-256 fingerprintをcompiled goldenと照合する。
+旧schemaのsilent migrationとobjectを持つunclaimed DBは拒否する。receiptのaccepted epoch、pairのmatched
+epoch、signed future beaconのclaimed epoch、audit replayのissued/accepted epochは8-byte big-endian
+BLOBとして保存する。beacon verification時のcaller current epochは別columnへ固定せず、restore時の
+current `AcceptedReceipt.verified_at_epoch`でregistry validity/revocationとともに再検証する。
+
+## 13. Replica matching
+
+`MatchProjectionV1` canonical order:
+
+1. `job_nullifier`
+2. `request_commitment`
+3. `job_class`
+4. `model_profile_id`
+5. `runtime_class_id`
+6. `runtime_manifest_hash`
+7. `shape_profile_id`
+8. `cu_ruleset_id`
+9. `canonical_compute_units`
+10. `prefill_tokens`
+11. `decode_tokens`
+12. `operation_schedule_commitment`
+13. `schedule_event_count`
+14. `output_commitment`
+15. `trace_scheme_id`
+16. `trace_evidence`
+17. `gemm_trace_root`
+18. `trace_event_count`
+
+network、scheduler job ID、assignment/slot、owner/credential/runtime instance/execution nullifier、
+evidence level、timestamp/epoch、signature はprojectionに入らない。ただしjob nullifierとrequest
+commitmentはnetwork-boundであり、durable pair保存時には両memberのnetworkをexplicitに照合する。
+2 Receipt は未失効、slot集合`{0,1}`、異なるexecution、signer key、credential、owner、assignment、
+runtime instanceでなければならない。pairing `current_epoch`は両bodyのissued epoch、両receiptのoriginal
+accepted epochとcurrent stateless verified epoch以上、両expiry以下でなければならない。
+
+```text
+match_commitment = H("replica-match/v1", encode(projection))
+pair_id = H(
+    "pair-id/v1", network_id,
+    min(execution_nullifier_a, execution_nullifier_b),
+    max(execution_nullifier_a, execution_nullifier_b),
+    match_commitment
+)
+```
+
+`MatchedReplicaPair` はpairing呼出し時の`current_epoch`をprivate `matched_epoch`として保持する。
+このepochはprojection/pair IDには入らないが、Self Replicated用のpublic maturity constructorが
+`MatureEvidence.mature_epoch`へ封入する。durable pair recordのcanonical bytesには`matched_epoch`を
+含め、memberのstored issued/accepted/expiry epochと再照合する。
+
+## 14. Audit, Work Ticket, canary, bond, and external identities
+
+`FutureBeaconV1` canonical orderは`version:u16 (=1), network_id:Hash32, epoch:u64,
+value:Hash32`。`beacon_id = H("future-beacon/v1", encode(body))`。signed envelopeは次のorderである。
+
+```text
+u16be(envelope_version=1) ||
+LP(encode(FutureBeaconV1)) ||
+authority_key_id:Hash32 ||
+u8(signature_algorithm=0) ||
+ed25519_signature:64-byte
+```
+
+signature messageは`beacon_id`。network-scoped authority registryはbeacon epochのvalidity、verification
+epoch時点のrevocation、key ID、weak keyを検査し、strict Ed25519成功後だけraw constructorを持たない
+`VerifiedFutureBeacon`へ昇格する。claimed beacon epochはverification epoch以下でなければならない。
+
+future audit selection:
+
+```text
+sample = H(
+    "audit-selection/v1", network_id, receipt_id,
+    u64be(beacon_epoch), beacon
+)
+selected iff sample_as_big_endian_u256 < selection_threshold:Hash32
+
+challenge_id = H(
+    "audit-challenge/v1", network_id, receipt_id, sample
+)
+```
+
+`AuditRecord::new`はexact `AcceptedReceipt`を受け、network、receipt ID、body issued epoch、durable
+accepted epoch、scheduler job、job nullifier、request commitmentをbindする。beacon epochはissued epochと
+accepted epochの両方より後でなければならない。v1 policyはselection threshold `2^252`（一様digestの
+1/16）、response window 2 epoch、challenge window 5 epochの固定値で、全値を`audit-policy/v1` IDへ
+commitする。
+
+`StateStore::store_audit_selection`はpolicy ID、original issued/accepted epoch、canonical signed beacon、
+beacon ID/value/authority key ID、challenge/deadlineまたはnon-selected mature epochを保存する。restore時は
+current authority registryでsigned beaconを再検証し、sample/challenge/deadlineを再計算する。
+
+selected replayはdistinctな`StatelesslyVerifiedReceipt`をaudit専用にacceptする。same network/job/requestを
+要求し、receipt/execution/assignment/runtime instance/signer key/worker credential/owner commitmentはoriginal
+と異ならなければならない。replay issued epochはbeaconより後、durable replay accepted epochはissued/
+current stateless verified epoch以上かつdeadline以下である。`VerifiedReplayVerdict`が両
+`MatchProjectionV1`を比較してresult commitmentとmatch outcomeを作るため、callerはraw
+`projection_matches:bool`を注入できない。
+
+selected pathはaudit replay identityの一回予約、terminal mismatchまたはpass、pass時のSelf Local
+maturity sourceを1 SQLite transactionで確定する。non-selected pathもwindow maturityとsourceを1
+transactionで確定する。beacon delivery/finality、auditor assignment、model re-execution、opening配送は
+このwire/state coreの外部service boundaryである。
+
+`restore_audit`はnon-replay state/terminalをrestoreするが、selected pass/mismatch terminalは
+`AuditReplayRequired`で拒否する。この場合は`restore_selected_audit_with_replay`を使い、durable audit
+state/challenge、stored canonical replay、全identity/epochを照合する。さらにprojection verdictを再計算し、
+match bit、submission commitment、completed epochをstored terminal outcomeへexact比較する。
+
+`WorkTicketV2` のIDを除くcanonical body orderは次のとおり。
+
+1. `version:u16 (=2)`
+2. `network_id:Hash32`
+3. `source_id:Hash32`
+4. `maturity_basis_id:Hash32`
+5. `weight_grant_id:Option<Hash32>`
+6. `job_class:JobClass`
+7. `weight_policy_version:u32`
+8. `canonical_compute_units:u64`
+9. `weight_bps:u32`
+10. `weighted_compute_units:u64`
+11. `issued_epoch:u64`
+
+```text
+weighted_CU = ceil(CU * weight_bps / 10_000)
+ticket_id = H("work-ticket/v2", network_id, encode(ticket_body_without_ticket_id))
+```
+
+V1 default weight は Self Local challenge 2,500、audit pass 5,000、replicated 10,000、external
+demand bonus最大5,000 bps。これは算術/型変換の実装値であり、production network admission の
+証明ではない。
+
+`MatureEvidence` はwire objectではなく、fieldと低水準constructorを非公開にしたtyped gateである。
+生成経路、`maturity_basis_id`、`mature_epoch`は次の3つだけ。
+
+- Self Local: exact `AcceptedReceipt + AuditRecord::Mature`。domain `local-maturity-basis/v2`で
+  audit basis/epochをbindし、audit stateが保持するmature epochを使う
+- Self Replicated: `MatchedReplicaPair`。pair IDをmaturity basis、pairのmatched epochを使う
+- External Replicated: authority-verified terminal settlement。confirmation IDをmaturity basis、authority-
+  signed grant IDを必須weight grant、confirmation epochをmature epochとして使う
+
+`StateStore::register_mature_evidence(&MatureEvidence)` はstored receipt/pairのnetwork、class、CUとopaque
+evidenceを照合し、Self Localではstored durable auditのstate/basis/epochも照合する。External evidenceは
+このAPIから拒否し、後述のsettlement transactionだけが登録できる。primary Self Local audit pathと
+Self Replicated pathは、source登録と同じtransactionで必要な1件/2件のactive assignment bondを`Mature`
+releaseし、`mature_source_assignments`へrelease IDをlinkする。unbonded/不足/terminal lockならtransactionを
+rollbackする。ticket issuerもjob classのrequired replica数とlink数を再検査する。
+`issue_work_ticket` は `issued_epoch >= mature_epoch` を要求し、SQLite ticket pathも保存epochに対して
+同じ条件を検査してから1 sourceをatomicに消費する。既消費sourceの通常pathは`SourceAlreadyConsumed`、
+External settlementのexact replayはstored ticketを返す。
+
+canary expected projection commitment:
+
+```text
+H("canary/v1", network_id, canary_id, request_commitment,
+  u64be(opening_epoch), canary_salt, encode(expected_match_projection))
+```
+
+`CanaryPrecommitBodyV1`は `version, network_id, canary_id, scheduler_job_id, request_commitment,
+signed_assignment_id, worker_credential_id, expected_commitment, created_epoch, receipt_deadline_epoch,
+opening_epoch, opening_deadline_epoch` をcanonical encodeし、
+`precommit_id = H("canary-precommit/v1", encode(body))`をschedulerがEd25519署名する。strict envelopeは
+body、scheduler key ID、algorithm、signatureを持つ。scheduler registryのnetwork、key validity/revocation、
+strict signatureと、exact signed request/assignment/worker bindingを検査した後だけ
+`VerifiedCanaryPrecommit`になる。External Replicated canaryはv1で禁止する。
+
+windowは `assignment.issued <= created <= receipt_deadline <= assignment.expires < opening_epoch <=
+opening_deadline`。canary markerはReceiptにない。verified precommitはactive bonded assignmentとcanonical
+signed envelopeをschema-v4 DBへ保存する。`accept_canary`はbonded normal Receipt acceptanceと
+`ReceiptSubmitted`を同じtransactionでcommitする。valid opening passはterminalだけをcommitし、valid
+commitmentのprojection mismatchはtyped `CanaryFailure` slashをatomicに適用する。receipt deadline経過は
+worker faultでslashし、receipt受理後のopening deadline経過はscheduler faultとしてworkerをslashしない。
+passとOpeningMissingではassignment bondをactiveのまま保持する。pending canaryがあるsourceのmaturityは
+拒否し、terminal後はmature epochをcanary completion epoch以上へ遅延する。Self Localでは遅延後のepochで
+`local-maturity-basis/v2`も再計算する。その後のmaturity transactionがbondを`Mature` releaseしてsourceへ
+linkするため、canary terminal単独ではWork Ticketを発行できない。
+
+in-memory helperのslash offense:
+
+```text
+Evidence = u64be(unique_sorted_count) || concat(sorted_unique_evidence_id)
+offense_id = H(
+    "slash-offense/v1", network_id, worker_credential_id,
+    assignment_id, u8(reason), u32be(policy_version), Evidence
+)
+```
+
+reason tagは `1=InvalidManifest`, `2=AuditMismatch`, `3=Equivocation`,
+`4=DuplicateExecution`, `5=CanaryFailure`, `6=AuditTimeout`。
+
+durable slashはcaller-selected attachment集合ではなくcrate-private `TypedSlashEvidence`のprimary proofを
+authority identityに使う。
+
+```text
+offense_id = H(
+    "durable-slash-offense/v2", network_id, worker_credential_id,
+    assignment_id, u8(reason), primary_proof_id, u32be(policy_version)
+)
+```
+
+audit mismatch/timeoutとcanary mismatch/receipt timeoutはproof IDをstate transition自身から導出して、
+slash claim、derived allocation、assignment remainder、pending appeal bucket、health eventを同じtransactionで
+更新する。claimはinitial assignment amountからreason別bpsをceilしたimmutable targetを持つ。v1の
+Equivocation追加penaltyは0である。複数claimを単純���算せず、finalized（signed/default uphold）targetの
+max-envelopeを先に割り当て、pending claimはそのenvelopeを超えるextensionだけを受ける。同じassignmentへの
+late equal/weaker claimのallocationは既存envelopeに覆われるなら0、stronger claimはdeltaだけとなる。
+reverse後も全claimから再計算するため、ingestion順序でslash総額は変わらない。standard policyのappeal
+windowはdurable `applied_epoch`から100 epoch。nonappealed slashはinclusive deadlineの後だけfinalizeする。
+typed proofが示す`fault_event_epoch`とstoreがclaimを受理する`applied_epoch`は別で、
+`locked_epoch <= fault_event_epoch <= applied_epoch`とaccount transition epochの単調性を要求する。
+
+partial claimのremainderはactive lockとして残る。pendingまたはuphold/default-final claimを持つassignmentは
+maturity/Work Ticketの根拠にならない。全claim解決後、audit mismatch/
+timeout terminalはclaimがreverseされても残額を`SlashResolved` releaseする。canary mismatch/receipt-timeout
+terminalはmatching `CanaryFailure` claimがuphold/default-finalの場合だけ同releaseを許し、External refundも
+release terminalになる。reversed canary claimだけではreleaseしない。未使用または
+acceptedだがunpairedのSelf Replicated assignmentだけは、pending canary/slashがなくsigned expiryを過ぎた
+場合に`Expired` releaseできる。paired、Self Local、その他used assignmentはこのexpiry bypassを持たない。
+pendingで全targetをallocateしたstate 2にもdistinct late claimを保存できるが、fully finalized/exhaustedの
+state 3は新claimを拒否する。terminal epoch/proofは全immutable claimをoffense ID順に並べ、各effective epochの
+maxと完全なterminal fact setから導出する。audit/canary terminalとExternal prepared/terminal stateは
+後出しclaimのcutoffであり、特にExternal `SettlementPrepared`または`RefundPrepared`以後は新しい
+non-replay slashを受けない。
+
+bond funding、slash appeal、slash decisionはそれぞれversion 1 canonical bodyとsigned envelopeを持つ。
+funding bodyはnetwork/worker/funding event/asset/exact amount/finalized epoch、appeal bodyはnetwork/worker/
+offense/assignment/appeal ID/submitted epoch、decision bodyはnetwork/appeal/offense/outcome/decided epochを
+bindする。network-scoped bond authority registryはkey validity/revocation、funding/appeal/decision capability、
+weak key、strict Ed25519を検査し、raw constructorを持たないverified typestateだけをstoreへ渡す。
+
+appeal submissionはstored pending slashとinclusive appeal deadlineを照合する。signed `submitted_epoch`と
+registry verification epochの両方が`applied_epoch..=appeal_deadline`内でなければならず、後者をdurable
+`accepted_epoch`として保存する。decision deadlineは`accepted_epoch + 100`である。authority-signed
+`Uphold`/`Reverse`はsigned `decided_epoch`とdecision verification/acceptance epochの両方がdeadline以下で
+だけ受理し、claim statusを更新してassignment全claimのallocationをatomicに再計算する。期限を過ぎても
+decisionがなければ`finalize_stale_slash_appeal(current_epoch > decision_deadline)`がdomain-separated
+default decisionを作ってdeterministically upholdする。offenseごとのappealは1件だけで、first stored
+signed/default decisionが勝つ。stored canonical appeal/decisionのexact replayは期限後もidempotent、distinct
+second appealやconflicting later decisionはfatalである。
+
+`ExternalEscrowTermsV1` canonical order は `version:u16, network_id, escrow_nonce,
+funding_authorization_id, prompt_commitment, ExecutionConstraintsV1, required_reward:u64,
+demand_bonus_amount:u64, demand_bonus_bps:u32, protocol_fee:u64, failure_reserve:u64,
+issued_epoch:u64, expires_epoch:u64`。
+
+```text
+escrow_reference = H("external-escrow/v1", encode(terms))
+```
+
+external authorityはnetwork-scoped Ed25519 keyにfunding、demand-weight、terminal capabilityを分離する。
+key validity/revocation、weak key、strict signatureを検査し、次のraw constructorを持たないtypestateを作る。
+
+- `VerifiedFundingAttestation`: escrow reference、funding authorization ID、asset、exact finalized amount/epoch
+- `VerifiedDemandWeightGrant`: escrow/funding attestation、grant/policy/asset、funded bonus amount/bps、
+  issued/expiry interval（v1 bonus上限5,000 bps）
+- `VerifiedTerminalConfirmation`: escrow、payment command、rail confirmation、asset、exact settlement/refund
+  distribution、confirmed epoch
+
+schema-v4 durable external pathはexact funding+grantから`Funded` escrowを作り、scheduler-signed
+External request、typed k=2 pair、stable payment commandへ進む。settlement confirmationはcommand/distribution/
+pair/asset/epochを照合し、terminal state、maturity source、両worker assignment bondのrelease/link、
+`WorkTicketV2` insert、source consumptionを一SQLite transactionでcommitする。refund commandはstate 1..3
+（`Funded|Assigned|EvidenceReady`）からterms expiry後に作成でき、pairの有無を問わない。refund confirmationは
+terminalとeligible assignment bond releaseを一SQLite transactionでcommitし、maturity/ticketを作らない。
+pending slash claimを持つbondは解決までreleaseせず、解決後に残額だけをreleaseできる。exact confirmation replayは
+idempotentで、逆terminal、amount、identityのconflictを拒否する。
+
+settlement commandを`SettlementPrepared`へcommitする同じ`BEGIN IMMEDIATE` transactionで、pair両assignmentが
+active state 0かつpending/upheld/default-final slash claimなしであることをpreflightする。
+`SettlementPrepared`と`RefundPrepared`（state 4/5）はどちらもnon-replayのlate slashを拒否するため、
+terminal準備とslashの順序で結果が変わらない。
+
+これはexternal authorityが「rail上のfinality」を正しく署名するというtrust boundaryである。crateは
+payment railを操作せず、rail transactionとSQLite commitのdistributed atomicityを主張しない。
+
+## 15. Encrypted verification bundle and restart restoration
+
+`VerificationBundleV1`はcanonical Receiptのprivate openingをrestart後もstrict verifyするためのartifactで、
+Receipt wire format自体は変更しない。audit keyはcaller-owned raw 32 bytes、nonzeroで、bundleには含めない。
+
+public sectionのcanonical order:
+
+1. `version:u16 (=1)`
+2. `receipt_binding:Hash32`
+3. `receipt_id:Hash32`
+4. `verification_epoch:u64`
+5. scheduler key snapshot: `network_id, verifying_key, valid_from_epoch, valid_through_epoch,
+   revoked_at_epoch:Option<u64>`
+6. `LP(RuntimeManifest canonical bytes)`
+7. `LP(portable ExecutionEvidence canonical bytes)`（schedule/CU/trace witness）
+
+worker public keyはpublic sectionへ置かない。private sectionのcanonical order:
+
+1. `LP("MISAKA/PALW/PRIVATE-OPENING")`, `version:u16 (=1)`, `public_digest:Hash32`
+2. `LP(SignedJobRequestV1)`, `LP(SignedAssignmentV1)`
+3. worker `verifying_key`, `owner_commitment`, `worker_credential_id`
+4. `output_nonce`, `u64be(prompt_token_count)`, `u32be(prompt_token_id_i)*`
+5. `LP(CanonicalOutput)`（generated token IDsとstop reason）
+6. `owner_salt`
+
+private signing-key seedはどのsectionにもserializeしない。
+
+```text
+receipt_binding = H("verification-bundle-receipt/v1", canonical_signed_receipt)
+public_digest   = H("verification-bundle-public/v1", canonical_public_section)
+aead_key        = H("verification-bundle-aead-key/v1", raw_audit_key)
+aad = H(
+    "verification-bundle-aad/v1",
+    "XCHACHA20-POLY1305;KEY=256;NONCE=192;TAG=128",
+    receipt_binding, public_digest, nonce, canonical_public_section
+)
+```
+
+envelope canonical order:
+
+```text
+LP("MISAKA/PALW/VERIFICATION-BUNDLE") ||
+u16be(version=1) || u16be(cipher=1) ||
+receipt_binding || public_digest || nonce:24-byte ||
+LP(canonical_public_section) || LP(XChaCha20-Poly1305 ciphertext_and_tag)
+```
+
+nonceはOS CSPRNGのnonzero 192-bit値、AEAD keyは256 bit、tagは128 bit。envelopeは64 MiB、public
+sectionは48 MiB、private plaintextは16 MiBを上限とし、strict decode/re-encode、receipt/public binding、
+AEAD authenticationを検査する。
+
+```text
+bundle_id = H("verification-bundle-id/v1", canonical_complete_envelope)
+```
+
+local restart pathはembedded scheduler/worker snapshotsを使ってcomplete stateless verificationを再実行し、
+既存schema-v4 DB rowのcanonical Receipt/runtime instance/original acceptance epochへexact restoreする。
+missing DB rowを新規acceptしない。これはlocal continuity modeであり、embedded snapshotはthird-party
+network authorityではない。
+
+bundle public sectionのhistorical `verification_epoch`はoriginal acceptance時点をbindする。
+`verify_bundle_and_restore_at_epoch`はcaller-selected current epochがhistorical値以上であることを要求し、
+同じbundle/openingをfresh epochで再検証したうえでoriginal durable acceptance epochを保持してrestoreする。
+ただし、このlocal APIはembedded snapshotsを使うためbundle作成後のrevocationを学習できない。future audit
+restoreではcurrent epochをbeacon以上にする。rollbackは拒否する。現行
+`palw-verify-bundle` CLIはhistorical default pathで、fresh epoch overrideはlibrary APIだけが公開する。
+
+external stateless pathはexpected network、independent scheduler registry、independent signer registry、
+approved manifest hashを必須にし、embedded snapshotとのexact equalityも検査する。default APIはhistorical
+epoch、`verify_bundle_stateless_at_epoch_with_trust`はrollbackしないcaller-selected fresh epochで検証する。
+DB reservationを行わず、network acceptanceを主張しない。production restartではcurrent external trust rootsと
+既存DB continuityを同時に検査する`verify_bundle_and_restore_at_epoch_with_trust`を使う。
+
+Receipt CLIは`--prompt-stdin --audit-key-file RAW_32_BYTE_KEY`を必須とし、`--prompt TEXT`を受けない。
+key fileはoutput directory外のowner-owned single-link regular file、mode `0400`/`0600`、exact 32 bytesで
+なければならない。issuance output directoryは`0700`、Receipt/公開JSON/completion markerは`0644`、
+bundle/DBは`0600`。DB WALを`TRUNCATE` checkpointしてmain DBを`fsync`し、各artifactを`fsync`した後、
+`misaka.palw.receipt-set.v2` markerへ`receipt_id`、`bundle_id`、公開JSON bytesのSHA-256を記録して最後に
+書き、directoryを`fsync`する。local verifier CLIは`--public-json`も必須とし、protected artifactsが同じ
+owned `0700` directoryにexpected filename/modeで存在すること、marker、typed公開JSON
+`misaka.palw.public-receipt.v2`全体を検査する。
+保持する`artifacts`と`observer_summary`はauthenticated bundle manifest/evidenceから再構成してexact照合し、
+extra JSON fieldはobjectの全階層で拒否する。
+marker-lastはpartial setをcompleteとして受理しないためのgateであり、cross-file atomic transactionでも
+authenticity proofでもない。markerはunkeyed plain textなのでsame-owner writerはJSONとmarkerを一緒に
+置換できるが、改変JSONはReceipt/bundleとの照合に失敗する。canonical Receipt/authenticated bundleだけが
+protocol authorityである。
+
+## 16. Security and issuance boundary
+
+trace root は approved observer が報告したeventへのcommitmentであり、単独のproof of executionでは
+ない。intended production safety modelはpinned build、signed assignment、independent replica、future
+audit、bond/slashing、durable uniquenessを組み合わせるが、個別primitive/state machineの存在はそれらが
+operationally統合済みであることを意味しない。
+
+schema-v4 coreはscheduler-signed canary precommit、authority-signed bond funding/appeal/decision、durable
+assignment lock/release/slash/health、authority-signed external funding/grant/terminalを実装する。bonded receipt
+acceptance、audit/canaryのtyped slash、maturity時bond release/link、WorkTicketV2 gate、External terminalから
+maturity/ticketまでのlocal atomic transactionも実装済みである。
+
+ただしproduction scheduler/network transport、governance-backed scheduler/worker/beacon/bond/external key
+distribution、finalized beacon delivery、independent auditor execution/opening delivery、実payment railと
+authority serviceはこのrepositoryにない。署名済みfunding/terminalは外部factのauthenticated statementで
+あり、crate単体が実collateralやrail movementを独立証明するものではない。railとSQLiteはdistributed
+atomic transactionではない。durable slashへ自動接続済みのproofはaudit mismatch/timeoutとcanary
+mismatch/receipt timeoutで、invalid-manifest、equivocation、duplicate-executionのproduction proof
+constructor/orchestrationは未統合である。legacy in-memory `BondLedger`/`CanaryRecord`/`ExternalEscrow` helperの
+raw mutation APIをproduction authority pathとして使ってはならない。
+
+現時点で実モデルReceiptを発行できるのはApple Metal `GraphFallback` runtime classである。CUDAは
+RTX 4060 Ti sm_89 / CUDA Toolkit 13.3.1 / nvcc 13.3.73で固定Qwen 37/37 layer offload、graph observer
+6/6、standalone true-accumulator primitiveの最終grouped device suite 8/8とproducer 20/20同一fingerprintに
+加え、vendored MMVQ/FA-off attention same-backend 1-token diagnostic E2Eで361/361 recordと3回同一
+fingerprintを実測済みである。exact entry/cubin/DSO release manifest、Receipt/RuntimeManifest/Request/
+Assignment V2、暗号化Bundle V2、SQLite V2も実装・検証済みである。これはproduction `KernelSketch`
+acceptanceではなく、authority-derived canonical IDを使うlive callbackとauthority governanceは未完了である。
+V1 builder/verifierとproduction macro/CMake gateはfail closedを維持するため、
+これらが完了するまでproduction CUDA Receipt/Work Ticketを発行しない。TEE attestationやZK/VCは
+実装範囲外である。

docs/receipt-implementation-qwen36.md

@@ -0,0 +1,656 @@
+# MISAKA PALW Receipt 実装仕様 — Qwen3.6-35B-A3B (hybrid MoE)
+
+本書は、対象モデルを dense Qwen3-8B から hybrid **Qwen3.6-35B-A3B**
+(`huihui_ai/Qwen3.6-abliterated:35b-Claude-4.7`、abliterated) へ移行した後の
+`ComputeReceiptV1` 発行・検証パイプラインの実装仕様である。記述は現行 Rust/C++
+ソースを正本とし、実装と本書が一致しない場合は Receipt を発行しない
+([`protocol-v1.md`](protocol-v1.md) と同じ原則)。本書に無い production 承認・決済連携・
+attestation を Receipt から推論してはならない。
+
+対象モデルは linear-attention(state-space / gated-delta-net)層と mixture-of-experts
+層を組み合わせた hybrid 構成であり、dense Qwen3-8B 用の厳格な canonical operation
+mapping では表現できない演算を含む。そのため本移行では **(1)** pinned llama.cpp への
+qwen35moe loader/graph 互換修正、**(2)** dense vocabulary に対応の無い演算を output-element
+数で committ する generic operation と CU ルールセット v2、**(3)** profile 駆動の hybrid
+adapter/manifest、を追加した。移行完了後、dense Qwen3-8B 経路（profile / manifest builder /
+constants / tests）は撤去され、Qwen3.6-35B-A3B が唯一の対象モデルとなった。
+
+行番号 anchor は執筆時点のものであり、正本はソースである。
+
+> **compute-gate track 更新(2026-07-19、実機検証済み)。** 上記 (2) の「generic operation + CU
+> ルールセット v2」は**後続の compute-gate track で置換された**。現行 receipt は **(M1)** CU を
+> semantic ルールセット v3 で canonical commit(`canonical_compute_units = 41692`)、**(M3)** generic
+> 演算を廃止し全 MoE/SSM op を忠実な canonical 演算(`ExpertGemm`/`ExpertRoute`/`SsmConv`/
+> `GatedDeltaNet`/`L2Norm`/`Reduction`/`Elementwise`)へ写像、**(M2)** canonical semantic schedule を
+> 再生成・commit、**(M4/#6)** observer が実 MoE routing(`ffn_moe_topk`)を捕捉し `expert_route_root`
+> を封緘 bundle へ commit(observer schema v2)、**(M5/#5)** ggml-metal を計装して各 GEMM を実 Metal
+> kernel dispatch + launch geometry へ束縛し `trace_evidence=metal_kernel` を commit(graph-fallback
+> から昇格、実機で 200/200・411/411 検証)。§0–§2 の一部記述(CU v2 / generic / SCHEMA_VERSION 1 /
+> MUL_MAT_ID=metadata / graph_fallback)は旧版で、現行の正確な値は §10・§11 と
+> [`receipt-review-remediation.md`](receipt-review-remediation.md) を参照。**6 つの compute gate は
+> 全て実機検証済み。** Metal の kernel-level trace は launch-geometry 束縛であり CUDA V3 相当の
+> intra-kernel accumulator proof ではない(honest labeling、mint は依然不適格)。
+
+---
+
+## 0. 全体アーキテクチャとデータフロー
+
+三層構成:
+
+1. `vendor/llama.cpp/`(commit 固定 + PALW patch): 推論ランタイムと read-only graph observer
+   `llama-palw-observer`。
+2. `runtime-palw/`(Rust): adapter、canonical CU、schedule、commitment、manifest、receipt
+   builder/verifier、verification bundle、schema-v4 SQLite。
+3. `config/` / `patches/`: 固定 artifact pin、model profile pin、llama.cpp patch。
+
+Receipt 発行(`palw-metal-receipt`)のデータフロー:
+
+```
+prompt(stdin)
+  │
+  ├─ build_qwen36_35b_metal_manifest ─────────► RuntimeManifest(MoE topology, CU v3 semantic)
+  │
+  ├─ llama-tokenize ──────────────────────────► prompt_token_ids
+  │
+  ├─ llama-palw-observer --observer sketch ───► JSONL(header/event*/result)
+  │       │(read-only graph callback、sketch)
+  │       ▼
+  │   qwen_adapter(HybridQwen36A3B)
+  │       │  header 検証 + op→ComputeOperation 写像 + GEMM sketch
+  │       ▼
+  │   RuntimeObserver → ExecutionEvidence(schedule + GEMM trace + CU total, ruleset=v3 semantic)
+  │
+  ├─ build_signed_receipt ────────────────────► ComputeReceiptV1(署名)
+  ├─ verify_stateless(cu_rules=v3) ───────────► 自己検証
+  ├─ seal_verification_bundle(XChaCha20) ─────► <id>.palw.bundle
+  ├─ StateStore(schema v4).accept ────────────► palw-state.sqlite3
+  └─ 書き出し: <id>.palw / <id>.json / <id>.palw.bundle / <id>.complete
+```
+
+別 process 検証(`palw-verify-bundle`)は artifact set・完了 marker を検査し、bundle を復号・
+再検証(`verify_bundle_and_restore`)して `status=local_restored` /
+`trust_scope=embedded_local_snapshot` を出力する。
+
+---
+
+## 1. 対象モデルと固定 artifact
+
+正本: [`config/runtime-pins.sh`](../config/runtime-pins.sh)(公開識別子のみ、末尾で全て `readonly`)。
+
+### 1.1 推論 GGUF(Ollama registry blob)
+
+| 変数 | 値 |
+|---|---|
+| `PALW_GGUF_REGISTRY` | `registry.ollama.ai` |
+| `PALW_GGUF_REPO_ID` | `huihui_ai/Qwen3.6-abliterated` |
+| `PALW_GGUF_OLLAMA_TAG` | `35b-Claude-4.7` |
+| `PALW_GGUF_REVISION` = `PALW_GGUF_SHA256` | `1dc494614bee8a3bc00e79fe5a49da0fc1c36b3b118c4156e223e98e5a0a671b` |
+| `PALW_GGUF_FILENAME` | `Qwen3.6-abliterated-35b-Claude-4.7-Q4_K_M.gguf` |
+| `PALW_GGUF_SIZE` | `23938321728`(bytes) |
+
+Ollama registry の blob digest は GGUF 本体の SHA-256 に等しいため `revision == sha256`。
+content 検証だけで pin 全体の照合になる。
+
+### 1.2 base metadata(Hugging Face、7 files)
+
+`PALW_BASE_REPO_ID = huihui-ai/Huihui-Qwen3.6-35B-A3B-Claude-4.7-Opus-abliterated`、
+`PALW_BASE_REVISION = ac18882735d037f6074a7630eb68d85db8234c25`。
+files: `README.md`、`chat_template.jinja`、`config.json`、`model.safetensors.index.json`、
+`processor_config.json`、`tokenizer.json`、`tokenizer_config.json`。
+sha256 は [`config/qwen3.6-35b-a3b-claude-4.7-base-metadata.sha256`](../config/qwen3.6-35b-a3b-claude-4.7-base-metadata.sha256)
+および profile pin の `base_artifact.files[]` と一致する。
+
+### 1.3 llama.cpp
+
+`PALW_LLAMA_COMMIT = 12127defda4f41b7679cb2477a4b0d65ee6a0c8f`(build 10015)、
+patch = [`patches/llama.cpp-palw-observer.patch`](../patches/llama.cpp-palw-observer.patch)、
+`PALW_LLAMA_PATCH_SHA256 = d155a88b7c11ee74f48011760cb1a37773a694c8cab28258ee108c85e2f9e02c`。
+Metal build は `-DGGML_METAL=ON -DGGML_CUDA=OFF`、`arm64`、target
+`llama-cli/llama-server/llama-tokenize/llama-palw-observer`。
+
+### 1.4 Ollama download 経路(`install.sh :: download_gguf_if_needed`)
+
+1. `gguf_content_matches`(存在 + size + sha256)が成立すれば再利用。
+2. mismatch する既存 file は上書きせず die。
+3. URL = `https://$PALW_GGUF_REGISTRY/v2/$PALW_GGUF_REPO_ID/blobs/sha256:$PALW_GGUF_REVISION`
+   (OCI/Docker registry の blob-by-digest endpoint)。
+4. `curl -fSL -C -`(再開可能)で `.partial` に取得。
+5. size と sha256 を照合してから `mv` で atomic に確定。
+6. base metadata は従来通り HF(`hf_snapshot_download.py`、token を strip し Xet を無効化)。
+
+---
+
+## 2. 決定論的実行と native observer
+
+正本: `vendor/llama.cpp/tools/palw-observer/palw-observer.cpp`(以下 OBS)。単一リクエストの
+非対話 runner で、public な `llama`/`ggml` API のみ使用。versioned JSONL を stdout に、
+llama/ggml のログを stderr に書く。
+
+### 2.1 強制される決定論的実行ポリシー
+
+`n_ctx = PALW_CONTEXT_TOKENS = 4096`、`n_batch = n_ubatch = 1`、`n_seq_max = 1`、
+`n_threads = n_threads_batch = 1`、greedy sampler、`flash_attn = DISABLED`、
+`type_k = type_v = F16`、`split_mode = NONE`、`use_mmap = true`。context 初期化後に
+実 context を読み直し、この不変条件を満たさなければ exit 3。prompt は `--prompt-stdin`
+専用 pipe で渡し(argv に置かない)、prefill/decode とも 1 token ずつ `llama_batch_get_one`
+で評価する。`prompt_tokens + n_predict > 4096` は context-shift せず失敗。
+
+### 2.2 model profile gate(`validate_qwen36_35b_a3b_profile`)
+
+model load 直後に、`general.architecture == "qwen35moe"`、`n_layer == 40`、`n_embd == 2048`、
+`n_vocab == 248320`、decoder-only(encoder 無し)のみ受理。不一致は header/result を一切
+emit せず exit 3。
+
+### 2.3 JSONL プロトコル
+
+`SCHEMA_NAME = "misaka.palw.runtime_observer"`、`SCHEMA_VERSION = 2`(route record 追加)。1 実行は
+**header 1** → **event 0..N** → **result 1**。各行は個別に flush。
+
+- **header**: `observer`(off/graph/sketch)、`trace_variant`、`cuda_kernel_trace:false`、
+  `model{path,description,tensor_size_bytes,parameter_count,file_type,n_ctx_train,n_embd,
+  n_layer,n_head,n_head_kv,n_vocab,rope_type,rope_freq_scale_train,metadata[]}`、
+  `runtime{ggml_version,ggml_commit,system_info,supports_gpu_offload,requested_gpu_layers,
+  devices[]}`、`execution_policy{...上記決定論ポリシー...}`、
+  `observation_policy{read_only:true, graph_metadata_stage:"ask", sketch_bits:256,
+  sketch_probe:"gemm_output_contiguous_prefix_64", raw_activation_values_published:false,
+  tile_variant:"graph_fallback_logical_prefix_v1", kernel_trace_claim:"none"}`。
+- **event**: `event_seq`(単調増加、最終値 = result の `event_count`)、`phase`
+  (prefill/decode)、`phase_step`、`stage`(ask_metadata / post_compute_sketch)、`layer`
+  (名前から導出、無ければ null)、`categories[]`、`tensor{name,op,type,shape[4],n_bytes}`、
+  `sources[]`。MUL_MAT には `gemm{variant:"ggml_graph_op_v1",m,n,k,batch_shape}`。sketch
+  時のみ `sketch{}`/`tile{}`/`kernel_trace{}`。
+- **result**: `status`、`stop_reason`(n_predict/eog/…)、`prompt_token_ids[]`、
+  `generated_token_ids[]`、`output_bytes[]`(`--emit-output-bytes` 時のみ非空)、
+  `output_n_bytes`、`event_count`。
+
+### 2.4 observer モードと sketch scheme
+
+- `off`: callback 無し、event 0。
+- `graph`: 各非空 valid node に対し `ask_metadata` を 1 件 emit。tensor data は一切読まない。
+- `sketch`: 非 MUL_MAT node は `ask_metadata`。`MUL_MAT` node のみ post-compute で
+  `ggml_backend_tensor_get` により先頭最大 64 要素を読み、**sign/bucket sketch** を採取して
+  `post_compute_sketch` を emit。
+
+sketch(`sign_bucket_256_v1`): 各要素を 1 nibble(bit3 = 符号、bit0..2 = 3-bit 絶対値
+bucket)にし、64 nibble = **256 bit**。bucket 境界は `0, 2⁻⁸, 2⁻⁴, 2⁻², 1, 4, 16, ∞`。生の
+活性値は決して serialize しない。`kernel_trace{available:false, backend:"none",
+claim:"not_a_cuda_kernel_trace"}` を常に付し、graph 観測を CUDA kernel 証拠へ昇格しない。
+
+### 2.5 observer 側の hybrid 対応(3 点)
+
+1. **`is_gemm` を `GGML_OP_MUL_MAT` のみに限定**。`GGML_OP_MUL_MAT_ID`(indirect expert
+   GEMM)は sketch せず通常の metadata node として emit する。
+2. **0-element(recurrent state cache)tensor を skip**。gated-delta-net / SSM 層は初期状態が
+   空の state cache を gather し、合法な 0-element node を生む。これは compute を伴わないため
+   error にせず skip。
+3. **`validate_tensor` が空 tensor を許容**(name/type/op の範囲検査後に短絡)。
+
+### 2.6 qwen35moe.cpp loader/graph 修正(5 点)
+
+pinned commit `12127def` の `src/models/qwen35moe.cpp` は本モデルを load/run できないため、
+PALW comment 付きで以下を修正(observer patch に同梱):
+
+1. **3-section mrope zero-pad**: `rope.dimension_sections` を可変配列として読み、size 3 or 4 を
+   許容して zero-fill+copy。新しい HF→GGUF 変換の `[t,h,w]`(末尾 0 省略)を受理。
+2. **`ssm_dt` bias の suffix 両対応**: `blk.N.ssm_dt.bias` を `TENSOR_NOT_REQUIRED` で試し、
+   無ければ suffix 無し `blk.N.ssm_dt` を required で load。
+3. **KV 射影幅に `n_embd_k_gqa_max()`**: `LLAMA_LOAD_LOCALS` は layer 0 から `n_embd_k/v_gqa`
+   を導出するが、layer 0 は linear-attention 層で `n_head_kv==0`。full-attention trunk 層と
+   MTP 層の tensor 生成で per-layer 最大値を使う。
+4. **sibling tensor(`v.*` / `mtp.*`)の計上**: Ollama 同梱 GGUF は vision tower と(MTP 未
+   有効時)MTP sub-model を同梱する。text runtime はこれらを構築しないため、該当 prefix の
+   tensor 分だけ `n_created`/`size_data` を調整し `done_getting_tensors` を通す。存在する
+   tensor のみ 1 回ずつ計上するため、text tensor の欠落は依然として検出される。
+5. **`build_layer_attn` の per-layer `n_head(il)`/`n_head_kv(il)`**: graph base は layer 0 から
+   head 数を初期化するため、full-attention の Q/K/V reshape と RoPE を per-layer 値で shadow。
+
+---
+
+## 3. Rust adapter — hybrid 経路
+
+正本: `runtime-palw/src/qwen_adapter.rs`。`AdapterProfile { HybridQwen36A3B }`(唯一の profile)
+を `NativeParseConfig`/`NativeRunConfig` の `profile` field で選択し、
+`parse_native_jsonl_with_stderr` が header 検証 / event 変換 / vocab 上限を hybrid 経路で処理する。
+旧 dense 経路は撤去済み。
+
+### 3.1 hybrid 定数と識別子
+
+`QWEN36_35B_LAYERS=40`、`QWEN36_35B_VOCAB=248320`、`QWEN36_35B_EMBED=2048`、
+`QWEN36_35B_CONTEXT=262144`、`QWEN36_35B_PARAMETERS=35_951_822_704`、
+`QWEN36_ARCHITECTURE="qwen35moe"`、共有の `Q4_K_M_FILE_TYPE=15`、`QWEN_RUNTIME_CONTEXT=4096`。
+
+`qwen36_adapter_mapping_id_v1()` は domain `"qwen36-native-observer-mapping/v1"` の
+`domain_hash`。payload は各 op の写像を列挙し `cu-ruleset=v2;graph-fallback-only` を含む。dense
+の `"qwen-native-observer-mapping/v1"`(`soft_max=attention`)とは別 hash。
+
+### 3.2 header 検証(`validate_header_hybrid`)
+
+deterministic execution policy と observation policy は **dense と同一**の厳格さで検証する。
+model-shape だけを MoE 向けに一般化する:
+
+- `parameter_count == 35_951_822_704`、`file_type == 15`、`n_ctx_train == 262144`、
+  `n_embd == 2048`、`n_layer == 40`、`n_vocab == 248320`、`rope_freq_scale_train == 1.0`。
+- **dense と違い `n_head`/`n_head_kv`/`rope_type` は pin しない**(MoE は per-layer で可変、
+  layer-0 KV-head を制約しない)。
+- 必須 metadata: `general.architecture=qwen35moe`、`general.file_type=15`、
+  `general.quantization_version=2`、`qwen35moe.context_length=262144`、
+  `qwen35moe.embedding_length=2048`、`qwen35moe.block_count=40`、
+  `qwen35moe.expert_count=256`、`qwen35moe.expert_used_count=8`。dense と逆に **expert
+  metadata を要求**する(dense は expert metadata を拒否)。
+- graph/sketch 時は `supports_gpu_offload && requested_gpu_layers==999 && GPU device 存在`。
+
+### 3.3 op → canonical operation 写像(`convert_event_hybrid`)
+
+各 ggml op を canonical `ComputeOperation` へ写像する。dense と異なり、正確な canonical
+対応がある演算はそれへ、対応の無い演算は `Generic{op_class, elements}` へ写す。fail-closed。
+
+| ggml op | canonical operation |
+|---|---|
+| `MUL_MAT` | `Gemm`(`convert_gemm_hybrid`、sketch 採取) |
+| `RMS_NORM` | `RmsNorm { elements=shape[0], batch=Πshape[1..] }` |
+| `ROPE` | `Rotary { head_dim=shape[0], heads=shape[1], tokens=Πshape[2..] }` |
+| `SOFT_MAX` | `Softmax { elements=Πshape }`(dense は Attention 再構成) |
+| `GLU` | `Silu{elements}` + `ElementwiseMultiply{elements}` |
+| `MUL` | `ElementwiseMultiply { elements }` |
+| `ADD` | `ElementwiseAdd { elements }` |
+| `GET_ROWS` | `EmbeddingLookup { elements }` |
+| `SET_ROWS` | `KvCacheWrite { bytes = tensor.n_bytes }` |
+| `CONT` \| `CPY` | `TensorCopy { bytes = tensor.n_bytes }` |
+| `VIEW` \| `RESHAPE` \| `PERMUTE` \| `TRANSPOSE` | layout-only(schedule に載せない) |
+| その他 | `Generic { op_class=hybrid_generic_op_class(op), elements=Πshape }`。未列挙は拒否 |
+
+`hybrid_generic_op_class`(不変な op→u32 表): `MUL_MAT_ID=1`、`UNARY=2`、`SCALE=3`、
+`L2_NORM=4`、`SUM_ROWS=5`、`DIV=6`、`CLAMP=7`、`ARGSORT=8`、`SSM_CONV=9`、
+`GATED_DELTA_NET=10`、`CONCAT=11`。これ以外は `None` → `InvalidEvent`(fail-closed)。
+
+### 3.4 GEMM 変換(`convert_gemm_hybrid`)
+
+`gemm{}` metadata の相互整合(`m==left.shape[1]`、`n==right.shape[1]`、`k==left.shape[0]`、
+`left.shape[0]==right.shape[0]`、output shape 一致)を検証する。dense と異なり **固定 geometry
+や dtype allowlist は課さない**。quantization は `left.kind` から `q4_K→Q4KM`、`q6_K→Q6K`、
+その他→`None`。sketch 時は `validate_graph_fallback_sketch`(sketch/tile/kernel_trace の値を
+厳格検証)後、64 hex を 4 lane の big-endian `i64` へ復元し `on_gemm_group` で trace に記録。
+kernel_id domain は `"qwen36-graph-fallback-probe/v1"`。
+
+### 3.5 GPU offload marker とプライバシ
+
+`scan_stderr_markers` は `"offloaded N/N layers to gpu"` を **N が正で左右一致なら任意の N** で
+検出する(dense 37/37、hybrid 41/41 を model 非依存で受理)。不一致は
+`IncompleteGpuOffload`。prompt は `OsStr` の stdin のみ、error payload は `&'static str`/数値
+のみ、`QwenObserverOutput` は `Debug` 未実装、`zeroize_private_material` が prompt/生成
+token/QA bytes を zeroize。
+
+---
+
+## 4. 正準演算語彙と CU ルールセット
+
+正本: `runtime-palw/src/compute_units.rs`。
+
+### 4.1 `ComputeOperation`(canonical serialize discriminant)
+
+`0 Gemm(GemmShape)`、`1 Attention`、`2 LayerNorm`、`3 RmsNorm`、`4 Rotary`、`5 ExpertRoute`、
+`6 KvCacheRead`、`7 KvCacheWrite`、`8 Silu`、`9 ElementwiseMultiply`、`10 Softmax`、
+`11 ElementwiseAdd`、`12 TensorCopy`、`13 EmbeddingLookup`、**`14 Generic{op_class:u32,
+elements:u64}`**(本移行で追加)。0..5 は `u32` 次元、6..13 は単一 `u64`。追加は additive で
+既存 variant の byte は不変。
+
+`Generic` は「dense に cost 規則の無い演算(gated-delta-net、SSM conv、MoE routing 等)を
+意味を歪めず、output 要素数で忠実に committ する」ための variant。`op_class` は演算種別の
+安定 ID、cost は output 要素数のみに依存する。**v2 のみが pricing し、v1 は拒否する**ため
+既存 dense receipt と ruleset identity は不変。
+
+### 4.2 CU ルールセット v1/v2
+
+`CU_RULESET_VERSION_V1=1`、`CU_RULESET_VERSION_V2=2`。`ruleset_id()` は
+`domain_hash("cu-ruleset/vX", X, [payload])`。payload の唯一の差分は v2 が `ceil;min1` の前に
+**`generic=2/4096;`** を挿入する点(domain も `/v2`)。よって
+`v1().ruleset_id() != v2().ruleset_id()`。`matching_ruleset_id(&Hash32)` は `[v1(),v2()]` から
+一致する ruleset を返す(本移行で追加、bundle 経路が使用)。
+
+cost 式(`cost()`、`scaled_cost = max(1, ceil(work·units/reference))`、全て checked):
+
+| op | work | reference | units |
+|---|---|---|---|
+| `Gemm` | m·n·k·batch | 4096³ | 120 |
+| `Attention` | q·kv·heads·head_dim·batch | 4096·4096·32·128 | 80 |
+| `LayerNorm`/`RmsNorm` | elements·batch | 4096 | 8 |
+| `Rotary` | tokens·heads·head_dim | 4096 | 4 |
+| `ExpertRoute` | tokens·experts·top_k | 4096 | 16 |
+| `KvCacheRead`/`Write`/`TensorCopy` | bytes | 1 MiB | 1 |
+| `Silu`/`ElementwiseMultiply`/`ElementwiseAdd` | elements | 4096 | 2 |
+| `Softmax` | elements | 4096 | 4 |
+| `EmbeddingLookup` | elements | 4096 | 1 |
+| **`Generic`** | elements | 4096 | 2 (**v2 限定**、v1 は `UnsupportedOperation`) |
+
+`ComputeUnitCounter.record` は cost を checked-add し、overflow 時は state を変えず
+`CostError::Overflow`(fail-closed)。
+
+---
+
+## 5. Model profile pin と RuntimeManifest 構築
+
+正本: `runtime-palw/src/qwen_profile.rs`、`runtime-palw/src/manifest.rs`、
+[`config/qwen3.6-35b-a3b-claude-4.7-profile.json`](../config/qwen3.6-35b-a3b-claude-4.7-profile.json)。
+
+### 5.1 profile pin(schema v2)
+
+`schema = "misaka.palw.model-profile-pin.v2"`、
+`profile_name = "Qwen3.6-35B-A3B-Claude-4.7-Opus-abliterated-Q4_K_M-Metal-arm64"`。
+`model{}` は MoE の全 shape(architecture `Qwen3_5MoeForConditionalGeneration`、model_type
+`qwen3_5_moe`、gguf_architecture `qwen35moe`、hidden 2048、heads 16、kv 2、layers 40、
+head_dim 256、intermediate 512、expert_count 256、experts_per_token 8、rope_theta 10000000、
+vocab 248320、max_pos 262144、bfloat16、Q4_K_M、ほか linear_* 等)を持つ。`base_artifact`
+は 7 files(各 sha256)、`inference_artifact` は Ollama repo/tag/**64-hex blob revision**/bytes/
+sha256、`runtime` は commit と cmake_cache。deserialize struct は serde `deny_unknown_fields`
+(`HybridProfilePin`/`HybridModelPin`/`HybridInferenceArtifactPin`。dense との差は `tag` field)。
+
+### 5.2 `validate_hybrid_pin`
+
+schema/profile_name 一致、model 全 shape 一致、`download_scope=="metadata-only"`、
+`supported_profile=="metal-arm64"`、`targets` に `llama-palw-observer`、`commit.len()==40`、
+`base.revision.len()==40`、**`inference.revision.len()==64`**(Ollama blob digest)、
+`inference.bytes!=0`。metadata files は 7 件で各 sha256 を streaming 照合
+(`verify_base_metadata_hybrid`)。
+
+### 5.3 `build_qwen36_35b_metal_manifest`
+
+host(arm64、8 field 非空)と environment(`LANG`/`LC_ALL` のみ)を検証し、GGUF の size/sha256、
+tokenizer(`tokenizer.json`+`tokenizer_config.json` の 2 件)を artifact 化する。以下の digest を
+`domain_hash` で計算し RuntimeManifest に committ する(dense と domain string が異なる主要点):
+
+- `chat_template_digest`(`chat-template/v1`): **`chat_template.jinja` file bytes**
+  (dense は tokenizer_config 内の文字列)。
+- `special_tokens_digest`(`special-token-semantics/v1`): tokenizer_config + config.json
+  (generation は `Value::Null`)。
+- `kernel_graph_id`(`qwen36-35b-llama-graph/v1`): commit + `qwen36_adapter_mapping_id_v1()`
+  + `ggml_sched_ask_metadata_v1` + prefill/decode 直列。
+- `kernel_algorithm_digest`(`kernel-algorithm-policy/v1`): 末尾に `;moe-hybrid;cu-ruleset=v2`。
+- ほか `loaded_libraries_digest`、`build_flags_digest`、`dirty_patch_digest`、
+  `environment_allowlist_digest`、`runtime_device_digest`、`runtime_program_digest`、
+  `build_provenance_digest`。
+
+`ModelProfile` は **topology = MixtureOfExperts**、`kv_heads=2`、**`head_dim=256`(hidden/heads
+= 2048/16 = 128 とは decouple)**、`rope="Qwen3.5-iMRoPE"`、`native_context_tokens=262144`、
+`vocabulary=248320`。`RuntimeClass` は Q4_K_M、flash-attn off、`context_size=4096`、batch=1。
+`RuntimeManifest.cu_ruleset_id = ComputeUnitRules::v2().ruleset_id()`。
+
+### 5.4 manifest validator の緩和(hybrid を受理する 2 点)
+
+- `ModelProfile::validate` は旧来の `head_dim == hidden/heads` 検査を**削除**した。head_dim を
+  独立 field として committ し cross-check しないため、`head_dim=256` と `2048/16=128` が
+  共存できる。`hidden % heads == 0`(2048%16)、`heads % kv == 0`(16%2)は維持。
+- `RuntimeManifest::validate` は `cu_ruleset_id` が **v1 または v2** の ruleset_id なら受理する。
+
+---
+
+## 6. Receipt body・commitment・署名
+
+正本: `runtime-palw/src/receipt.rs`、`runtime-palw/src/builder.rs`、`runtime-palw/src/observer.rs`。
+
+### 6.1 `ComputeReceiptV1`(署名される canonical wire 順)
+
+30 field を固定順で encode し、その byte 列が全 digest(`signing_digest`/`body_id`/
+`receipt_id`)の入力になる。主要 field: `receipt_version(=1)`、`network_id`、
+`request_commitment`、`scheduler_job_id`、`signed_assignment_id`、`replica_slot`、
+`model_profile_id`、`runtime_class_id`、`runtime_manifest_hash`、`shape_profile_id`、
+**`cu_ruleset_id = evidence.cu_ruleset_id()`**、`trace_scheme_id`、`trace_evidence`、
+`operation_schedule_commitment`、`schedule_event_count`、`canonical_compute_units`、
+`prefill_tokens`、`decode_tokens`、`output_commitment`、`gemm_trace_root`、`trace_event_count`、
+`owner_commitment`、`worker_credential_id`、`job_nullifier`、`execution_nullifier`、`job_class`、
+`evidence_level`、`timestamp`、`issued_epoch`、`expires_epoch`。
+
+`validate_structure` は署名前後で 17 digest の非零、`prefill_tokens!=0`、
+`issued<=expires`、job_class ごとの replica_slot 範囲、evidence_level ごとの count 整合
+(GemmTraced は schedule/trace/CU が全て非零かつ `trace_evidence!=Absent`)を検査する。
+
+### 6.2 `build_signed_receipt`
+
+`manifest.validate`、CUDA KernelSketch 拒否、scheduler 署名(request+assignment)検証、worker
+credential binding、request constraints と manifest ID の一致、evidence↔shape/job binding、
+prompt opening と `prefill_tokens` 一致、output count 一致、を検査後に commitment
+(`commit_prompt_tokens`/`commit_output`/`commit_owner`/`derive_job_nullifier`/
+`derive_execution_nullifier`)を計算し、body を Ed25519 署名(`signing_digest` は network-id
+salt 付き canonical bytes)。builder は `cu_ruleset_id` を **evidence の値そのまま** committ する
+(独自に ruleset を再導出しない)。
+
+### 6.3 evidence 生成(`RuntimeObserver` → `ExecutionEvidence`)
+
+observer は `job_nullifier`/`shape_profile_id`/`ComputeUnitRules`/`EvidenceLevel` に束縛される。
+`schedule = OperationSchedule::new(..., rules.ruleset_id())`、trace は GemmTraced 時のみ生成。
+状態機械は `AwaitingPrefill→Prefill→Decode{step}`、decode step は厳密連番、任意の event error で
+恒久 poison。`finalize_with_generated_tokens` は `generated == decode_tokens+1`(先頭 token は
+prefill logits から sample)を要求。GemmTraced 不変条件として **schedule の GEMM 数 ==
+trace group 数**。`ExecutionEvidence.cu_ruleset_id = counter.rules().ruleset_id()`(本移行では
+v2)がそのまま receipt へ流れる。
+
+---
+
+## 7. Stateless 検証(`verify_stateless`)
+
+正本: `runtime-palw/src/verifier.rs`。`VerificationContext { network_id, current_epoch,
+manifest, cu_rules, signer_registry, assignment_authorizations }` を取り、順に:
+
+1. `validate_structure`、network/epoch。
+2. assignment 解決と全 field binding、assignment policy(`required_evidence_level==evidence_level`)。
+3. signer 解決、owner/worker commitment、**Ed25519 署名**(weak-key 拒否 + `verify_strict`)。
+4. `manifest.validate`、CUDA KernelSketch 拒否。
+5. `model_profile_id`/`runtime_class_id`/`runtime_manifest_hash`/`shape_profile_id` を manifest
+   から独立再計算して照合。
+6. **CU-ruleset triple-bind**: `body.cu_ruleset_id == context.cu_rules.ruleset_id()` **かつ**
+   `== manifest.cu_ruleset_id`(不一致は `CuRulesetMismatch`)。本移行では三者とも v2。
+7. `trace_scheme_id` bind、`job_nullifier`/`execution_nullifier` の再導出照合、`verify_shape`。
+8. `verify_execution_evidence`: evidence metadata・schedule integrity/commitment 照合後、
+   **`context.cu_rules` で schedule を最初から再 pricing** し `canonical_compute_units` を
+   照合(claim を信用しない)。per-entry で layer 範囲、dense topology の expert-route 拒否、
+   decode phase 順序を検査。GemmTraced は `verify_trace`(trace binding、capability 一致、
+   GEMM 数 == trace group 数、per-event の schedule 対応)。
+9. output nonce / prompt opening / output opening / output count。
+
+hybrid では topology が MixtureOfExperts のため expert-route の dense 拒否は発火しない(なお
+本 adapter は `MUL_MAT_ID` を `Generic` に写すので ExpertRoute op 自体を生成しない)。
+
+---
+
+## 8. Verification bundle と ruleset 選択の 3 修正
+
+正本: `runtime-palw/src/verification_bundle.rs`。
+
+### 8.1 `seal_verification_bundle`
+
+owner opening を照合し、**封印前に receipt を完全に再 stateless 検証**する(state-store は
+変更しない)。公開部 `BundlePublicV1`(receipt_binding、receipt_id、verification_epoch、
+scheduler-key record、`manifest.canonical_bytes()`、`PortableEvidenceV1`)は認証済み cleartext。
+秘密部 `BundlePrivateV1`(署名済み request/assignment、signer record、output opening =
+output_nonce + prompt/output token IDs、owner salt)は **XChaCha20-Poly1305** で AEAD 暗号化
+(AAD で receipt_binding/public_digest/nonce/public_bytes を束縛、AEAD 鍵は audit key の
+`domain_hash` 派生で raw key を直接使わない)。`bundle_id` は完全な暗号化 envelope 全体の
+`domain_hash`。
+
+### 8.2 CU ルールセット選択の 3 修正(v2 対応)
+
+| # | 位置 | 修正 |
+|---|---|---|
+| 1 | seal 経路 | `cu_rules = ComputeUnitRules::matching_ruleset_id(&context.manifest.cu_ruleset_id)`(旧: v1 固定) |
+| 2 | `verify_bundle_stateless_inner` | `matching_ruleset_id(&bundle.public.manifest.cu_ruleset_id)`(旧: v1 固定) |
+| 3 | `PortableEvidenceV1::encode_canonical` | ruleset **version** を evidence に合わせて書く(`matching_ruleset_id(evidence.cu_ruleset_id()).map_or(0, version)`。旧: v1 固定)。decode は `for_version` で読む |
+
+これらが無いと、v2 evidence が bundle 内で v1 として round-trip し `CuRulesetMismatch` になる。
+併せて `manifest.rs` の validate が v1|v2 を受理し、`matching_ruleset_id` を追加した。producing CLI
+は `ComputeUnitRules::v2()` を bind する。
+
+### 8.3 portable evidence の round-trip
+
+encode は version・level・prefill/decode・**ruleset version**・job_nullifier・shape_profile_id・
+schedule entries・trace groups・claimed CU・claimed ruleset を書く。decode は `RuntimeObserver`
+で schedule/trace/CU を **再導出**(serialize 済み total を信用しない)し、再構成 evidence の
+`canonical_compute_units`/`cu_ruleset_id` が claimed と一致することを要求する。bounds:
+`MAX_EVIDENCE_EVENTS=250000`、`MAX_BUNDLE_BYTES=64MiB`。
+
+---
+
+## 9. 永続化(SQLite schema v4)と CLI 契約
+
+### 9.1 StateStore(schema v4)
+
+`APPLICATION_ID="PALW"`、`SCHEMA_VERSION=4`。`open` は parent dir 解決 + `SQLITE_OPEN_NOFOLLOW`、
+`foreign_keys=ON`、`synchronous=FULL`、`journal_mode=WAL`、application/schema 照合、および
+`sqlite_master` の **DDL fingerprint**(SHA3-256 golden 照合)。`accept` は `BEGIN IMMEDIATE` で
+duplicate receipt / duplicate execution_nullifier / job-class 整合 / slot 充填を強制し、
+`jobs`(PK `(network_id,job_nullifier)`、WITHOUT ROWID)と `receipts`(PK `receipt_id`、
+`execution_nullifier` UNIQUE、`UNIQUE(network_id,job_nullifier,replica_slot)`、FK RESTRICT)へ
+transaction で insert する。復元経路 `restore_accepted` は read-only で既存 row を byte 照合する。
+
+### 9.2 `palw-metal-receipt`(発行 CLI)
+
+必須: `--prompt-stdin`、`--audit-key-file`(**exact 32 raw bytes**、owner-only single-link
+`0400`/`0600`、output dir 外)、`--output-dir`(新規/空、owner-only `0700`)。任意: `--n-predict`
+(`1..=1024`、default 2)。prompt は UTF-8 非空 ≤1 MiB。run flow は §0 の通り。`canonical_source_patch`
+は `tools/CMakeLists.txt` と `src/models/qwen35moe.cpp` の modified、`tools/palw-observer/` の
+untracked のみを許容する(他は拒否 = fail-closed)。出力 artifact:
+
+| file | mode | 内容 |
+|---|---|---|
+| `<id>.palw` | 0644 | 署名済み canonical receipt |
+| `<id>.json` | 0644 | 公開 metadata(`misaka.palw.public-receipt.v2`、strict field) |
+| `<id>.palw.bundle` | 0600 | XChaCha20 暗号化 bundle |
+| `palw-state.sqlite3` | 0600 | schema v4 state |
+| `<id>.complete` | 0644 | `misaka.palw.receipt-set.v2` 完了 marker(**最後**に fsync 付きで作成) |
+
+### 9.3 `palw-verify-bundle`(検証 CLI)
+
+必須: `--receipt`/`--bundle`/`--public-json`/`--audit-key-file`/`--state-db`。artifact set の
+mode/owner/single-link/同一 private dir、完了 marker の binding、bounded read、`decode_strict`、
+`validate_artifact_names`(receipt_id は bundle 由来)、`verify_bundle_and_restore`(§8 の復号・
+再検証・schema-v4 復元)、`verify_public_metadata`(公開 JSON を authenticated 値と field 単位で
+照合)。正常時 `status=local_restored` / `trust_scope=embedded_local_snapshot`。この trust scope
+は bundle 内 registry snapshot による continuity を示すのみで、network authority の代替ではない。
+
+---
+
+## 10. E2E 実測(reference receipt)
+
+Apple M1 Max(macOS Metal 4、arm64)。observer は load 時に qwen35moe/40/2048/248320 を検証し
+`offloaded 41/41 layers to GPU`。出力健全性: `The capital of France is`
+(`[760,6511,314,9338,369]`)→ ` Paris, a city renowned for its iconic`。
+
+reference artifact は [`receipts/final-v7/`](../receipts/final-v7)、evidence 詳細は
+[`docs/evidence/metal-hybrid-qwen36-2026-07-19.md`](evidence/metal-hybrid-qwen36-2026-07-19.md)。
+公開 receipt(`misaka.palw.public-receipt.v2`)の主要値:
+
+| field | 値 |
+|---|---|
+| `receipt_id` | `8e2dd34b7609d6d7aeec17bff485eb1ae4db31f66dd899a3c3a3e671656053f9` |
+| `verification_bundle_id` | `f5b8a2968c4ea266b2cbbabf351a171e0fa2581984eff63362de2640fcdcf9db` |
+| `cu_ruleset_id`(**v3 semantic**) | `43a5feef177b389f976361b22ac9d57da65815261282005bc78d1666a37870ce` |
+| `job_class` / `evidence_level` / `trace_evidence` | `self_local` / `gemm_traced` / **`metal_kernel`** |
+| `prefill_tokens` / `decode_tokens` | `5` / `2` |
+| `prefill_graph_steps` / `decode_graph_steps` | `5` / `1` |
+| `schedule_event_count`(= canonical_operations、commitment-only) | `13770` |
+| `trace_event_count`(= gemm_events) | `2466` |
+| `canonical_compute_units`(**v3 semantic、署名 commit**) | `41692` |
+| `semantic_compute_units_v3`(= canonical_compute_units) | `41692` |
+| `semantic_schedule.commitment` / `.expert_route_ops` | `e6fc731e…` / `80` |
+| `expert_route.root` / `.route_event_count`(実捕捉) | `5e4ea70b…` / `240` |
+| `mint.eligible` / `mint.weight` / `mint.mainnet_ready` | `false` / `0` / `false` |
+| `mint.ineligible_reasons` | Metal kernel-launch-bound / 非 network-anchored / 非 bonded の 3 件(generic+graph-fallback は解消) |
+| `model_profile_id` | `b6b83a274a889fc5dfa2044b9158111b3849f880a05eb7ebcf560d036515d472` |
+| `runtime_class_id` | `8f6f536118a72be70dab2028535c3bb95e3de9a3bac0e9b81cf78677ae902a9c` |
+| `artifacts.llama_commit` / `model_bytes` | `12127def…` / `23938321728` |
+
+privacy: prompt / prompt token IDs / 生成 token IDs / opening / signing key / owner salt は公開
+`.palw` / `.json` に**含まれない**(全 9 flag が非公開/暗号化)。別 process の `palw-verify-bundle`
+が `status=local_restored`、`trust_scope=embedded_local_snapshot`、receipt_id/bundle_id 一致、
+exit 0 で再検証済み。発行は実行ごとに OS CSPRNG で identity を生成するため receipt_id は再現しない。
+
+---
+
+## 11. セキュリティ境界・正直な限界
+
+- **この Receipt は mint-grade ではない。** 現行の `evidence_level=gemm_traced` /
+  `trace_evidence=graph_fallback` は**強い計算証明ではない**。`runtime-palw/src/mint.rs` の
+  `assess_mint_eligibility` が現行 runtime の全 receipt を `eligible=false, weight=0,
+  class="local_self_consistent_v0_1"` と判定し、公開 JSON の `mint` ブロックに失格理由と共に
+  自己申告する(`palw-verify-bundle` が再構成して照合)。用途は「ローカル自己整合 receipt /
+  testnet 計測 / Self-Local 非報酬」に限られる。mint-grade 化の是正計画は
+  [`receipt-review-remediation.md`](receipt-review-remediation.md) を参照���
+- Metal の graph-fallback sketch は **CUDA kernel trace ではない**。
+- 単独ノードが発行する Receipt は、それだけでゼロ知識の計算証明ではない。PALW の不正耐性は
+  runtime/model digest、署名、k=2 replica、future audit、canary、bond/slashing の組み合わせで
+  成立する。
+- **`Generic` 演算は廃止済み(M3)。** hybrid の全 MoE/SSM op を忠実な canonical 演算へ写像
+  (`MUL_MAT_ID→ExpertGemm`、`ARGSORT→ExpertRoute`、`SSM_CONV→SsmConv`、`GATED_DELTA_NET→GatedDeltaNet`、
+  `L2_NORM→L2Norm`、`SUM_ROWS→Reduction`、`CONCAT→TensorCopy`、`UNARY/SCALE/DIV/CLAMP→Elementwise`)。
+  実機 receipt の schedule は `contains_generic_operation()==false`。
+- **Semantic CU v3 は canonical commitment(M1、mainnet compute measure)。** `semantic_cu.rs` の
+  `qwen36_semantic_compute_units(prefill, generated)` は CU を **observed graph からではなく pinned
+  model 構造 + token 数**から算出(active-parameter FLOPs + causal attention 項、丸めは最後に 1 回)。
+  現行 receipt の `canonical_compute_units` は **この semantic 値(41692)を `cu_ruleset_id=v3` で署名
+  commit** する(v2 の graph 値ではない)。fragmentation-proof / backend 非依存で、verifier は
+  `prefill_tokens`/`decode_tokens` から同値を再計算・照合。
+- **canonical semantic schedule(M2、#7 構造半分)。** `semantic_schedule.rs` が pinned architecture +
+  token 数から canonical op schedule と commitment を決定的に再生成し、公開 JSON `semantic_schedule`
+  に束縛。verifier が独立再生成して照合。
+- **実 MoE routing の捕捉(M4/#6)。** observer が `ffn_moe_topk`(I32)を post-compute で読み戻し、
+  per-token 選択 expert を封緘 bundle の `expert_route_root` へ commit、公開 JSON `expert_route` として
+  発行・再構成。実機で 240 route record を捕捉。
+- **kernel-level trace(#5、M5、完了・実機検証済み)。** ggml-metal を計装して各 GEMM を実 Metal
+  kernel dispatch + launch geometry へ束縛(200/200・411/411、0 anomaly)。`trace_evidence=metal_kernel`
+  (graph-fallback から昇格)、`TraceEvidenceKind/TraceCapability::MetalKernel` を新設し verifier が照合。
+  **launch-geometry 束縛であり CUDA V3 相当の intra-kernel accumulator proof ではない**ため
+  `KernelSketch` とは別 kind で commit(over-claim しない)。mint 失格理由は「Metal kernel-launch-bound
+  sketch, not an intra-kernel accumulator proof」に置換(mint 不適格のまま)。accumulator-level は
+  Metal shader 計装が残件。
+- **mainnet-readiness。** `assess_mainnet_readiness` が compute / network / hardware / model-Genesis の
+  全 gate を列挙し、外部 gate を Met と偽らない。現状 `mint.mainnet_ready=false`。mainnet 報酬適格性は
+  deployed network authority / global nullifier / epoch beacon / bond authority / 複数世代実機 /
+  公式モデル Genesis を要し、この repository の完了範囲外である(remediation の外部ブロック項参照)。
+- 未達 gate R13/R21/R23/R24/R26/R27/R32/R35 は [`requirements.md`](requirements.md) の通り
+  `In progress`。本移行はこれらの production 完了を意味しない。
+
+### 既知の drift とテスト網羅(2026-07-19 時点)
+
+- **hybrid adapter の専用 unit test** は fixture test を追加済み(`hybrid_generic_op_class` 表、
+  mapping id 識別、MoE/SSM op 写像、unknown op fail-closed、q6_K trace、dense header 拒否)。
+  CU fragmentation invariant や公式 Transformers との differential 等の残りは
+  [`receipt-review-remediation.md`](receipt-review-remediation.md) の follow-up。
+- `validate_hybrid_pin` は dense と異なり `base_artifact`/`inference_artifact` の repository
+  文字列を pin せず、deserialize する MoE/linear-attention の追加 dim(`linear_*`、
+  `shared_expert_intermediate_size`、`full_attention_interval`、`partial_rotary_factor_millionths`)
+  を committ manifest には使わない(`deny_unknown_fields` 受理のためだけに存在)。
+
+---
+
+## 12. 再現手順
+
+```sh
+# 1. 導入(GGUF は Ollama registry、base metadata は HF)
+./scripts/install.sh
+
+# 2. Rust gate(MSRV 1.81)
+cd runtime-palw
+cargo +1.81.0 fmt --all -- --check
+cargo +1.81.0 clippy --locked --all-targets -- -D warnings
+cargo +1.81.0 test --locked --all-targets
+cargo +1.81.0 build --release --locked --bin palw-metal-receipt --bin palw-verify-bundle
+cd ..
+
+# 3. Receipt 発行(audit key は 32-byte raw、output dir 外に一度だけ作成)
+OUT="receipts/manual-$(date +%Y%m%d-%H%M%S)"
+AUDIT_KEY="$HOME/.config/misaka-palw/audit-keys/local-audit.key"
+install -d -m 700 "$(dirname "$AUDIT_KEY")"; test ! -e "$AUDIT_KEY"
+(umask 077 && /usr/bin/openssl rand 32 > "$AUDIT_KEY"); chmod 600 "$AUDIT_KEY"
+runtime-palw/target/release/palw-metal-receipt \
+  --prompt-stdin --audit-key-file "$AUDIT_KEY" --output-dir "$OUT" --n-predict 2 \
+  < /path/to/private-prompt.txt
+
+# 4. 別 process 検���
+RECEIPT="$(find "$OUT" -maxdepth 1 -type f -name '*.palw' -print)"; ID="$(basename "$RECEIPT" .palw)"
+runtime-palw/target/release/palw-verify-bundle \
+  --receipt "$OUT/$ID.palw" --bundle "$OUT/$ID.palw.bundle" \
+  --public-json "$OUT/$ID.json" --audit-key-file "$AUDIT_KEY" \
+  --state-db "$OUT/palw-state.sqlite3"
+# 期待: status=local_restored / trust_scope=embedded_local_snapshot / exit 0
+```
+
+GGUF の SHA-256 を発行前後に 4 回計算するため、1 回の発行は約 5 分要する(24GB × 4)。
+これは hang ではない。

docs/receipt-review-remediation.md

@@ -0,0 +1,214 @@
+# Receipt security review — remediation plan
+
+本書は、Qwen3.6-35B-A3B hybrid receipt 実装に対する外部レビュー(16 項目)への対応方針を
+正直に記録する。レビューの結論は妥当であり、本書もそれを採用する。
+
+> **ローカル Receipt v0.1 として freeze 可。PALW mint-grade Receipt としては freeze 不可。**
+
+`trace_evidence = graph_fallback` は依然 **kernel trace ではない**(#5、下記 external/remaining)。
+ただし後述の compute-gate track により、CU は graph-independent な semantic commitment になり、
+`Generic` 演算は廃止され、MoE expert routing は実捕捉されるようになった。
+
+## compute-gate track — 実機検証済み(2026-07-19、Apple M1 Max)
+
+「mainnet 報酬用途まで進めて」の goal に対し、この repository で完結できる **in-repo compute gate** を
+実装し、すべて Metal 実機で発行→別 process 検証まで確認した。**捏造していない。**
+
+- **M1 — semantic CU v3 を canonical commitment 化(#2 の実体)。** receipt の
+  `canonical_compute_units` は v2 graph 値(104628)ではなく **semantic 値(41692)を `cu_ruleset_id=v3`
+  で署名 commit**する。observer/verifier/portable-evidence が同一 helper で束縛し、verifier は
+  `prefill/decode` から再計算。`compute.semantic_cu` gate が honest に Met。
+- **M2 — canonical semantic schedule 再生成(#7 の構造半分)。** `semantic_schedule.rs` が pinned
+  architecture + token 数から canonical op schedule と commitment(`e6fc731e…` 参照)を決定的に再生成、
+  authenticated public receipt に束縛。verifier が独立再生成し照合。
+- **M3 — `Generic` 演算の廃止(#3)。** hybrid の全 MoE/SSM op を **忠実な canonical 演算**へ写像
+  (`MUL_MAT_ID→ExpertGemm`、`ARGSORT→ExpertRoute{top_k=8}`、`SSM_CONV→SsmConv`、
+  `GATED_DELTA_NET→GatedDeltaNet`、`L2_NORM→L2Norm`、`SUM_ROWS→Reduction`、`CONCAT→TensorCopy`、
+  `UNARY/SCALE/DIV/CLAMP→Elementwise`)。実 op stream(ARGSORT=256 experts、MUL_MAT_ID=8 experts-used
+  で検証)に接地。`contains_generic_operation()==false` となり mint の generic 失格理由が消える。
+- **M4/#6 — 実 MoE routing の observer 捕捉。** observer が `ffn_moe_topk`(I32)を post-compute で
+  読み戻し、per-token 選択 expert を "route" record として emit(schema v2)。adapter が各 routing を
+  commitment chain へ fold し `expert_route_root` を封緘 bundle へ束縛、公開 JSON の `expert_route`
+  として発行・再構成。実機で **240 route record** を捕捉(例: layer0 token0 →
+  `[112,107,106,181,238,57,43,200]`)。
+
+**6 つの compute gate は全て実機検証済み(#5 も完了):**
+- **#5 Metal kernel-level trace(M5、完了・実機検証済み)。** ggml-metal を計装
+  (`ggml_metal_palw_set_dispatch_hook`)して全 Metal dispatch を pipeline 名 + launch geometry で捕捉し、
+  各 GEMM を ASK→POST window 内の実 matmul dispatch へ束縛(実機で 200/200 window・411/411 GEMM、
+  0 anomaly で健全性を確認)。`trace_evidence=metal_kernel`(graph-fallback から昇格)、
+  `TraceEvidenceKind::MetalKernel` / `TraceCapability::MetalKernel` を新設。`compute.kernel_level_trace`
+  は Met、mint の「graph-fallback」失格理由は解消。**ただし launch-geometry 束縛であり CUDA V3 相当の
+  intra-kernel accumulator proof ではない**ため、`KernelSketch` とは別 kind として commit し
+  (over-claim しない)、mint 失格理由は「Metal kernel-launch-bound sketch, not an intra-kernel
+  accumulator proof」に置換(依然 mint 不適格)。より強い accumulator-level は Metal shader 計装が残件。
+
+### #5 Metal kernel-level trace — 調査済み実装スペック(未実装、on-device 反復が必要)
+
+vendored ggml-metal を調査した結果、honest な kernel-level trace の具体経路と blocker を確定した
+(hand-wave ではない)。
+
+- **決定論的に commit 可能な唯一の kernel-level 信号は launch geometry**(dispatch した Metal
+  pipeline 名 + threadgroup/grid 次元)。GPU timestamp / hardware counter は run ごとに変動し
+  reproducible でないため commit 不可。
+- **捕捉点**: `ggml/src/ggml-metal/ggml-metal-ops.cpp :: ggml_metal_op_mul_mat` の
+  `ggml_metal_encoder_set_pipeline` / `ggml_metal_encoder_dispatch_threadgroups(enc, tg0..2, tptg0..2)`
+  (~line 570/589)。pipeline は `ggml_metal_pipelines_get(ppls, name)` で name 既知。
+- **必要な変更(observer tool だけでなく ggml-metal *backend library* の改変)**:
+  1. ggml-metal に per-dispatch hook API(`ggml_metal_palw_set_dispatch_hook(fn, ctx)`)を追加し、
+     `ggml_metal_op_mul_mat` から `{pipeline_name, tg0..2, tptg0..2, seq}` を callback。
+  2. observer が hook を登録し、eval callback の ask→post 区間で発生した dispatch を当該 node に
+     相関付けて **kernel-level sample(per-dispatch geometry)** として emit。
+  3. Rust: Metal runtime class の `TraceCapability` を `KernelSketch` にし、observer が
+     `TraceEvidenceKind::KernelSketch`(group あたり複数 sample)を emit。verifier は
+     capability↔evidence を照合。
+  4. `libggml-metal.dylib` を再ビルド(observer 単体より広い)。
+- **blocker(誠実な理由で本 session 内で安全に完了・検証できない)**: eval-callback の node 粒度と
+  Metal の実 dispatch 粒度は 1:1 保証が無い(fuse / 並行 encoding の可能性)。この相関を誤ると
+  **偽の kernel-level 主張**になり得る。正しさは on-device の反復検証を要する。**相関の健全性が
+  実機で確証できるまで `TraceEvidenceKind::KernelSketch` へ切替えない**(graph_fallback のまま)。
+  stub で KernelSketch を emit することは**しない**。
+
+## この変更で実施した是正(done now、初期)
+
+- **mint-eligibility ゲートと weight 0 の明示(レビュー #1 の最小版)。** `runtime-palw/src/mint.rs`
+  に `assess_mint_eligibility(trace_evidence, contains_generic)` を追加。現行 runtime が発行する
+  receipt は常に `eligible=false, weight=0, class="local_self_consistent_v0_1"` となり、
+  失格理由(graph-fallback、generic、非 network-anchored、非 bonded)を列挙する。公開 JSON に
+  `mint` ブロックとして自己申告し、`palw-verify-bundle` が authenticated 値から再構成して照合する。
+  これにより `gemm_traced` という肩書きを mint-grade と誤認する事故を防ぐ。**EvidenceLevel enum
+  自体の rename(#1 の完全版)は wire/consensus 変更のため v2 で行う(下記 planned)。**
+- **Semantic CU ルールセット v3(レビュー #2 の中核、graph-independent 化)。**
+  `runtime-palw/src/semantic_cu.rs` に `qwen36_semantic_compute_units(prefill, generated)` を追加。
+  CU を **observed graph からではなく pinned model 構造 + token 数**から算出する:
+  `CU = ceil((per_token_active_flops·N + attn_flops_per_kv·N(N+1)/2) / 1e6)`、N=prefill+generated。
+  active-parameter FLOPs(全 attention/delta 射影 + 8 routed + 1 shared expert + delta state +
+  output head)+ causal attention 項。**fragmentation-proof(graph 分割で不変)/ backend 非依存**で、
+  verifier は receipt の `prefill_tokens`/`decode_tokens` だけから同値を再計算できる(公開 JSON の
+  `semantic_compute_units_v3` として自己申告・照合)。`ComputeUnitRules::v3()` は per-op pricing を
+  拒否し独立の `ruleset_id` を持つ。**これは #2「CU を profile から独立算出」の実体である**が、
+  現行 receipt の canonical CU を v3 へ切り替える(v2→v3 の commitment 変更)は planned。
+- **mainnet-readiness ゲート。** `mint.rs::assess_mainnet_readiness` が compute / network / hardware /
+  model-Genesis の全 gate を列挙し、達成(Met)/ in-repo pending / 外部ブロック(ExternalNetwork /
+  ExternalHardware / ExternalModelGenesis)を厳密に分類する。**外部 gate を Met と偽らない。**
+  現状 `ready=false`(公開 JSON の `mint.mainnet_ready=false`)。
+- **hybrid adapter の直接 unit test(レビュー #16 の一部)。** `hybrid_generic_op_class` 表、
+  mapping id の識別、MoE/SSM op → canonical 写像、unknown op の fail-closed、q6_K trace、
+  dense header の拒否を fixture test 化。
+
+## 現行 runtime の判定(mint gate)
+
+```
+graph-fallback trace           → mint 不可(kernel proof でない)  ← #5 未達で残存
+embedded local snapshot        → mint 不可(network-anchored でない)  ← 外部
+ephemeral 署名 identity        → mint 不可(bonded credential でない)  ← 外部
+```
+（「Generic 演算を含む」失格理由は M3 で解消。実機 receipt の `mint.ineligible_reasons` は上記 3 件のみ。）
+
+運用レベル(レビューの表を採用):
+
+| レベル | 条件 | Work weight |
+|---|---|---|
+| Local prototype | 現行 graph-fallback | 0 |
+| Testnet telemetry | 現行 graph-fallback + signed assignment | 0 |
+| Testnet replica | challenge + k=2 + semantic CU v3 | 低 |
+| Mint candidate | route/state trace + exact schedule + global nullifier | 1.0 候補 |
+| Mainnet | cross-runtime audit, bond, canary, 全 gate 通過 | governed |
+
+## 是正方針(全 16 項目)
+
+### A. in-repo で実施可能な follow-up(次段)
+
+- **#2 Generic pricing 廃止 → semantic CU v3。** **[アルゴリズム実装済み]** `semantic_cu.rs` が
+  `model_profile + prefill/generated token` から FLOP ベースで CU を独立算出する(attention / delta /
+  routed+shared expert / delta state / output head を active-parameter FLOPs で価格付け、丸めは最後に
+  1 回)。fragmentation-proof / backend 非依存。receipt は公開 JSON に `semantic_compute_units_v3` を
+  自己申告する。**残(planned):** receipt の canonical CU commitment を v2(graph)から v3(semantic)へ
+  切り替え、`Generic` を CU=0 の commitment-only へ降格、verifier が canonical CU を semantic 値で
+  bind する(現在は informational な自己申告 + verifier 再計算照合まで)。
+- **#3 主要計算の trace。** `MUL_MAT_ID`(Expert GEMM)、ExpertRoute Top-K、shared expert、
+  Gated DeltaNet state を trace 対象に含める。`trace_scheme_id` を `hybrid-execution-trace/v2` に
+  更新し、現 `gemm_trace_root` スロットへ統合 root
+  `H(gemm_root || expert_route_root || deltanet_state_root || schedule_root)` を格納。API/文書上は
+  `execution_trace_root` と呼ぶ。observer に router 出力を捕捉する観測モードを追加する必要がある。
+- **#5(in-repo 部分)完全な architecture profile を `model_profile_id` へ committ。** 現在
+  deserialize のみで committ していない `linear_*` / `shared_expert_intermediate_size` /
+  `full_attention_interval` / `partial_rotary_factor` に加え、delta/attention layer bitmap、
+  routed=8 + shared=1 の構成、`tensor_inventory_root` を profile v2 として commit。validation は
+  architecture 別に分岐し、`head_dim == hidden/heads` の緩和を dense validator へ波及させない。
+- **#7 `decode_tokens` の意味を明確化。** wire は `decode_tokens = generated_token_count`、
+  `decode_eval_steps = decode_tokens - 1`(先頭 token は prefill logits から sample)。0/1 token
+  境界の test を追加(observer.rs に既存の等価 test あり)。
+- **#8 offload 判定の強化。** hybrid profile に `expected offload units = 41` を固定し、任意の
+  N/N を受理しない。ただし stderr marker は自己申告 telemetry であり mint validity へは使わない
+  (現行は既に mint 不可なので影響は無いが、tightening として実施予定)。
+- **#9 replica output commitment 規則の凍結。** A/B 比較のため、共有 `output_salt =
+  H(job_assignment || epoch_challenge)` 方式、または独立 salt + matcher が opening を突き合わせて
+  `ReplicaMatchCertificate` を発行する方式の**どちらか**を明文化する。
+- **#12 暗号化 bundle の情報分離と KDF 強化。** 公開部を root/commitment/count のみにし、個別
+  schedule entry・sketch・expert route は暗号化部へ移す。per-bundle subkey を HKDF で
+  `network || receipt_id || schema_version` を context に導出、nonce は bundle ごとに OS CSPRNG、
+  audit key ID と rotation epoch を保存、master 漏洩で全履歴が解読されない per-job data key。
+  現行の `domain_hash(audit_key)` は KDF として不十分と明記。
+- **#16(残り)テスト網羅の完成(mint 前 gate)。** 全 op mapping fixture、unknown op 拒否、
+  巨大 shape/overflow、event 欠落・重複・順序変更、`MUL_MAT_ID`/shared expert/DeltaNet state、
+  JSONL parser fuzz、canonical encode/decode property、**CU fragmentation invariant**
+  (「同一 semantic operation を複数 event に分割しても CU は増えない」)、公式 Transformers との
+  differential、M1/M4 cross-device。
+
+### B. 外部インフラ/ハードウェア依存で本 repo・本セッションでは完結不可(honest boundary)
+
+これらは既存の R13/R21/R23/R24/R26/R27/R32/R35 と同じく、この repository の完了範囲外である
+([`requirements.md`](requirements.md)、[[palw-honest-boundary]] と整合)。**捏造しない。**
+
+- **#4 challenge-in-context と global nullifier。** epoch beacon と network-wide global nullifier
+  set(consensus 側)が必要。設計としては
+  `job_nullifier = H("palw-job-nullifier/v2" || network_id || challenge_epoch || epoch_beacon ||
+  request_commitment || scheduler_job_id)` とし、CSPRNG/owner salt を nullifier へ入れない
+  (入れると同一仕事の nullifier を量産できる)。`current_epoch - challenge_epoch <= W` を mint 時
+  検査。**receipt_id を毎回変えることは replay 防止ではない**(むしろ量産を容易にする)。ローカル
+  SQLite は自 DB 内の重複しか防がない。
+- **#6 cross-device 決定論の実証。** M1 Max ×2 / M4 Pro ×2 / 複数 macOS build / 複数 prompt 長 /
+  16・256・1024 output / 4096 近傍 prefill / EOS 有無 / expert-routing 境界 / top1-top2 margin の
+  小さい prompt。初期は M1 class と M4 class を別 `runtime_class_id` にする。実測では M1/M4 の
+  logits 差(token は一致)があり、MoE router の微差が Expert 選択差へ拡大しうるため dense より
+  cross-generation の影響が大きい。複数実機が必要。
+- **#10 network verification。** `embedded_local_snapshot` は network authority の代替ではない。
+  UI/CLI 表示は `self_consistent_unanchored` / `local_snapshot_verified` /
+  `not_network_certified` を推奨。mint には scheduler key の chain inclusion proof、credential の
+  activation/revocation proof、set activation proof、global nullifier 未使用証明が別途必要。
+- **#11 persistent bonded credential と署名。** ephemeral receipt key を persistent worker
+  credential が authorize する `EphemeralWorkerDelegation` を導入し、slashing は必ず persistent
+  credential/bond に到達させる。PALW が耐量子署名を不変条件とするなら Ed25519 単独は不整合で、
+  ML-DSA(NIST FIPS 204)の dual-sign または PQ profile が必要。bond authority は repo 外。
+- **#13 Genesis 正本モデル。** 対象は公式 Qwen ではなく第三者の abliterated 変換(model card 自身
+  が crude PoC / safety 大幅削減 / production 非推奨と明記)。hash pin は改ざん耐性のみで内容の
+  安全性・正当変換は保証しない。Genesis canonical model は公式 `Qwen/Qwen3.6-35B-A3B` から
+  決定的生成した GGUF(official revision / converter commit / conversion+quant command /
+  `tensor_inventory_root` / output SHA-256 / two-party reproducibility attestation)にすべき。
+  abliterated 版は `experimental_unfiltered_model_profile_id` として production set と分離する。
+- **#14 consensus governance。** wire 不変でも `Generic` 追加・CU v2・validator 緩和は mint 可否と
+  報酬額を変える(`wire unchanged ≠ consensus unchanged`)。`cu_ruleset_id` を class-as-data として
+  chain registry に `set_id / activation_epoch / deactivation_epoch / ruleset code hash /
+  model profile hash / allowed evidence levels / mint weight` として登録し、activation 前の
+  receipt は mint 不可にする。`matching_ruleset_id([v1,v2])` はコード上の選択であって governance
+  ではない。
+
+### C. 可用性(#15)
+
+- **GGUF を receipt ごとに 4 回 hash しない。** install 時と process 起動時に full SHA-256、各
+  receipt では検証済み file descriptor/inode を再利用、周期的に full rehash。TOCTOU 回避のため
+  content-addressed read-only directory、`O_NOFOLLOW`、hash と load で同一 fd、inode/device/size/
+  mtime 再確認、実行中の置換禁止。現行の 1 発行約 5 分は利用者の忍耐を攻撃している。
+
+## 最優先 5 点(mint-grade 化の前提)
+
+1. graph-fallback を mint から除外し weight 0 にする → **mint gate として実施済み**
+   (EvidenceLevel enum の rename は v2)。**graph-fallback 自体の解消(kernel trace)は #5 で未達。**
+2. `Generic` pricing を廃止し profile 由来の semantic CU v3 へ移す → **M1 で canonical commitment 化
+   完了(実機検証済み)**。
+3. ExpertRoute / `MUL_MAT_ID` / shared expert / DeltaNet state を trace 対象へ入れる → **M3(Generic
+   廃止・忠実 canonical 写像)+ M4(実 routing 捕捉)で完了(実機検証済み)**。
+4. challenge-in-context と global nullifier を必須化する → B(#4、外部・未達)。
+5. Qwen3.6 の完全な architecture profile と cross-device conformance を凍結する → A(#5 arch profile)
+   + B(#6 cross-device、外部ハード必要)。**Metal kernel-level trace(#5)は on-device 実装が残る。**

docs/requirements.md

@@ -0,0 +1,125 @@
+# Specification Completion Matrix
+
+この表は設計書 v0.1 の要求を、実装 artifact と検証 gate に分解した正本である。
+`Complete` は列挙したacceptance criteriaがすべて実装・統合・検証済みで、既知の内部未実装と必須外部gateが
+残らない場合だけ付与する。`In progress` は少なくとも1つのcriterion、内部実装、統合、またはevidenceが未完了で、
+明示的なhard blockerだけで状態を表していない場合である。`Blocked` は必須criterionに利用不能な外部hardware/
+environment/serviceによるhard blockerがある状態を示し、内部実装が完了したという意味ではない。内部gapと外部
+blockerが共存する場合はverification列で分離し、production発行はfail-closedに停止する。
+
+本ファイル群は repository-scope の設計・実装・evidence baseline を固定した版である。ただし、これを
+Production Network readiness や全要件の `Complete` への昇格とは解釈しない。
+
+current Metal E2E（hybrid Qwen3.6-35B-A3B、41/41 offload、`trace_evidence=metal_kernel`）の正本は
+[`evidence/metal-hybrid-qwen36-2026-07-19.md`](evidence/metal-hybrid-qwen36-2026-07-19.md)、canonical Receipt は
+[`../receipts/final-v7/8e2dd34b7609d6d7aeec17bff485eb1ae4db31f66dd899a3c3a3e671656053f9.palw`](../receipts/final-v7/8e2dd34b7609d6d7aeec17bff485eb1ae4db31f66dd899a3c3a3e671656053f9.palw)
+である。移行前 dense Qwen3-8B の schema-v4 証跡（[`evidence/metal-smoke-schema-v4-2026-07-15.md`](evidence/metal-smoke-schema-v4-2026-07-15.md)、`final-v6/eb51b08c…4278131`）と historical schema-v3 証跡は
+[`evidence/metal-smoke-2026-07-15.md`](evidence/metal-smoke-2026-07-15.md) と
+[`../receipts/final-v5/ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68.palw`](../receipts/final-v5/ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68.palw)
+に保持する。current sourceは旧DBをsilent migrate/openしない。
+
+Windows/WSL2 上の RTX 4060 Ti (`sm_89`) で実行した CUDA 実験 gate の正本は
+[`evidence/cuda-wsl-sm89-2026-07-15.md`](evidence/cuda-wsl-sm89-2026-07-15.md) である。この証跡は
+Qwen の 37/37 layer offload、diagnostic observer の反復性、standalone producer-accumulator
+primitive の実device gateを示す。続くvendored Q4_K/Q6_K MMVQ hookのone-token実device gateは
+[`evidence/cuda-v3-mmvq-hook-sm89-2026-07-15.md`](evidence/cuda-v3-mmvq-hook-sm89-2026-07-15.md)
+に履歴として保持する。MMVQ、FA-off attention、release manifest、Receipt/Bundle/SQLite V2までを含む
+現行の正本は
+[`evidence/cuda-v3-full-hook-sm89-2026-07-16.md`](evidence/cuda-v3-full-hook-sm89-2026-07-16.md)
+である。いずれもproduction Receipt発行の証明ではない。
+
+| ID | Requirement | Implementation evidence | Verification gate / result | Status |
+|---|---|---|---|---|
+| R01 | Qwen3.6-35B-A3B 学習済み base を再学習しない | `../config/qwen3.6-35b-a3b-claude-4.7-profile.json`, `../scripts/install.sh` | Ollama blob revision、GGUF size/hash、base metadata 7件照合 | Complete |
+| R02 | mining logic を runtime 側へ分離 | `../runtime-palw/`, read-only CLI path | model を変更せず実行前後 manifest が一致した実モデル E2E | Complete |
+| R03 | prompt 受付と runtime tokenizer token 数 | wrapper `--prompt-stdin`、Qwen adapter | 1 MiB/single-source gate、stdin child path、known vectors、live prefill=5/decode=2 | Complete |
+| R04 | runtime manifest 取得・hash | `manifest.rs`, `qwen_profile.rs`, `artifact.rs` | canonical/mutation/rebuild test、実 hash `5920accc…2b84dd` | Complete |
+| R05 | model profile 全固定 field | `manifest.rs`, `qwen_profile.rs` | official config/GGUF metadata fixture と mutation test | Complete |
+| R06 | runtime class 全固定 field | `manifest.rs`, `qwen_profile.rs` | build/host/policy/artifact mutation が identity を変更 | Complete |
+| R07 | deterministic policy 強制 | `deterministic.rs`, native header validation | invalid matrix、live `n_ctx=4096`/batch/ubatch/thread=1 | Complete |
+| R08 | read-only observer | `observer.rs`, llama scheduler callback | 現行 binary で off/graph/sketch の token/output byte が短・長 prompt とも一致 | Complete |
+| R09 | prefill/decode/layer/GEMM/attention/route/KV 観測 | native observer + strict Qwen adapter | dense profile、phase coverage、全 native event の live validation | Complete |
+| R10 | complete/versioned canonical CU | `compute_units.rs`, adapter mapping v1 | unknown/overflow/全 op pricing test、live 5,868 ops = 14,562 CU | Complete |
+| R11 | ordered operation schedule commitment | `scheduler.rs`, `adversarial.rs` | reorder/insert/delete/shape/CU mutation を拒否 | Complete |
+| R12 | GEMM trace chain | `trace.rs`, graph fallback adapter | golden/mutation test、live 1,950 GEMM trace events/root | Complete |
+| R13 | tile/shape/kernel/accumulator sketch | Metal graph fallback + CUDA V1 device observer / standalone V2 producer primitive + V3 schema/Rust binder + vendored MMVQ/FA-off attention hook | SM89でone-token 253 MMVQと72 attention GEMM＋36 softmaxを合計361件取得し3回同一fingerprint。actual entry attributes/cubin release manifestとV2 bindingを検証済み。実機のlive 361×452B V3 transcriptを`--emit-records`で採取しRust `RawCudaTraceRecordV3::decode_strict`へ直接投入、authority-canonical recordsとfield単位で比較。**live callbackがauthority由来canonical identityを消費する接続を実装・実機検証済み:** smokeに`--authority-ids`を追加し、Rustが決定論的に導出した361×128B canonical identity table（operation/plan/physical-layout/attention-group）をcallbackがstampする。実機再実行で当該4 fieldのdivergenceが361/361/361/108→0/0/0/0となることを確認（env-gated test `live_rtx_transcript_is_authority_canonical_and_drives_the_receipt`、diagnostic/authority両モードで実データ固定）。残差はsketch（実GPU値、synthetic fixtureとの差）とkernel-identity 36件のみ。残: production authority serviceがこのidentity tableをlive供給する統合と、live-transcript attestation下でのReceipt発行 | In progress |
+| R14 | salted output commitment | `commitment.rs`, `builder.rs` | opening、nonce/token/stop/output mutation test | Complete |
+| R15 | owner commitment | `commitment.rs`, public schema | salt/key opening test、canonical/public Receipt secret scan | Complete |
+| R16 | job/execution nullifier | `commitment.rs`, `state_store.rs` | domain/uniqueness/replay/restart/concurrency test | Complete |
+| R17 | full `ComputeReceiptV1` fields | `receipt.rs`, `builder.rs` | strict round-trip、field mutation、713-byte live canonical envelope | Complete |
+| R18 | Receipt signer | signed Ed25519 envelope + signer registry | sign/verify/tamper/version/key/algorithm/registry test。CLI の一時 key は production network 登録 identity ではない | Complete |
+| R19 | Self Local validation | `verifier.rs`, `audit.rs`, `work_ticket.rs` | required evidence/opening/weight test + signed live Self Local Receipt | Complete |
+| R20 | Self Replicated k=2 exact match | `matcher.rs`, `adversarial.rs` | compared-field/owner/credential/instance/self-pair/reuse mutation test | Complete |
+| R21 | External Replicated request/escrow/settlement/bonus | `external_authority.rs` + schema-v4 escrow/command/terminal | signed exact funding/grant/terminal、scheduler request、k=2、state1..3 expiry refund、両prepared stateのslash cutoff、local atomic settlement+maturity+2 bond release+ticketを検証。prepared confirmation timeout/superseding terminal/recoveryは内部未実装。実rail/authority serviceとdistributed atomicityは外部 | In progress |
+| R22 | future beacon selection | `audit.rs`, `future_beacon.rs` | signed network-scoped beacon、post-issuance full 256-bit selection、replay/revocation/durable transition test。delivery/governance service は外部 | Complete |
+| R23 | re-execution match and maturity | `audit.rs`, durable replay、opaque `MatureEvidence` | pass/mismatch/timeout/restart/tamper gate は完了。production auditor、re-execution executor、beacon delivery orchestration なし | In progress |
+| R24 | mature Receipt から Work Ticket のみ | opaque basis/grant + `WorkTicketV2` + mature-source bond links | raw bypass、epoch前倒し、required 1/2 bond release、unbonded rollback、再消費、restart、External atomic issueを検証。production admission/orchestrationは外部 | In progress |
+| R25 | Self Local 0.25–0.5 weight policy | integer basis-point `WeightPolicyV1` | boundary、challenge/audited distinction、governance version test | Complete |
+| R26 | replicated 1.0 と demand bonus | `WorkTicketV2`, signed demand-weight grant, atomic External settlement | weight/bonus cap/terms/grant bindingとsettled ticketを整数演算で検証。production grant governanceと実bonus railは外部 | In progress |
+| R27 | canary、bond、slashing | `bond_authority.rs`, signed canary, schema-v4 bond/slash/appeal/health, `slash_proof.rs` typed-proof constructors | signed funding/lock、atomic canary pass/mismatch/timeout attribution、pass/OpeningMissing後のmaturity遅延・lock保持、order-independent slash allocation、accepted-epoch基準appeal/decision deadline・default-uphold、eligible unpaired expiry、conservation/restartを実装。`InvalidManifest`/`Equivocation`/`DuplicateExecution`のtyped-proof constructorとdurable orchestration (`StateStore::apply_fault_proof`) を`slash_proof.rs`に実装し、verifierと同一のsigner/assignment authority registryで署名済み受領を検証、worker-credentialをbondに束縛、offense idはorder-independentかつidempotent。unit 12 + integration 6でpositive/fail-closed/worker-mismatchを検証。残るは実authority serviceからの署名素材供給とgovernance/key distributionという外部境界のみ | In progress |
+| R28 | fake token/runtime/output rejection | `verifier.rs`, `adversarial.rs` | nonce/prompt/output/runtime/request/network mutation suite | Complete |
+| R29 | fork/dummy/schedule rewrite rejection | `matcher.rs`, `canary.rs`, `adversarial.rs` | dummy signer/assignment、fork identity、schedule mutation suite | Complete |
+| R30 | Receipt duplication rejection | `state_store.rs` | receipt/nullifier/slot uniqueness、restart、race、rollback tests | Complete |
+| R31 | Metal runtime class local E2E | pinned llama.cpp/Qwen3.6-35B-A3B、strict hybrid adapter、release issuer + separate verifier | 41/41 offload、schema-v4 encrypted/restored Receipt `8e2dd34b…6053f9`（`trace_evidence=metal_kernel`）、verifier exit 0 | Complete |
+| R32 | CUDA runtime class compile/E2E | Qwen CUDA 37/37 offload + deterministic observer、V1/V2/V3 device transport、vendored MMVQ/FA-off attention hook、release manifest、Receipt/Bundle/SQLite V2 | RTX 4060 Ti/SM89で361-launch positive 3/3、Q4/Q6/QK/softmax/PV各reject-index、exact runtime attrs/cubin/DSO manifest、V2 stateless/restart/replay/rollbackを検証。live 361-record transcriptをRust verifierへ直接投入する経路を実装（smoke `--emit-records` + `RawCudaTraceRecordV3` decode + `build_with_material`）し、live recordのReceipt buildがfail-closedであることを実データで確認。**未統合:** (A) callbackがauthority由来canonical operation/plan/physical-layout IDを消費する接続（R13、上記4 identity fieldがdiverge）、(B) 配備済みgovernance/trust root(KMS)と承認済みNVIDIA replica/reproducibility matrix。1台のRTXは(B)を満たさない。production CMake gateは(A)(B)の両方を理由に発行拒否 | **In progress** |
+| R33 | prompt/output/key/salt 非漏えい | stdin-only adapter、XChaCha20-Poly1305 `.palw.bundle`、strict key/file gate | canonical/bundle secret scan、strict public JSON v2 cross-check、separate-process restore、prompt text scan | Complete |
+| R34 | operational install/reproduce docs | install/verify scripts、lockfiles、exact MSRV dependency pins、本 runbook | pinned clean procedure、4 target、Rust 1.81 locked gate 実行済み | Complete |
+| R35 | tests、fmt、clippy、sanitizers | Rust 1.81 suite、CUDA host sanitizer + SM89 device CTests、vendored full-stream smoke、`../.github/workflows/palw-ci.yml` | 242 passed/2 ignored（244 discovered）、fmt/clippy/rustdoc/MSRV check、host 5/5、SM89 8/8、361-launch positive 3回 + 5 work-class negative、manifest Python 4/4を通過。remote CI、production authority E2E、replica/cross-driver reproducibility matrixは未達 | In progress |
+
+## 現行 gate summary
+
+- Rust MSRV: Rust/Cargo 1.81.0 を実 install。open transitive range による edition-2024 manifest
+  incompatibility を `zeroize=1.8.1` / `base64ct=1.7.3` exact pin で解消し、`--locked` で検証。
+  library 144 passed + real-model 2 ignored、`tests/adversarial.rs` 12、`tests/bonded_maturity.rs` 3、
+  `tests/canary_durable.rs` 2、`tests/core_flow.rs` 3、`tests/cuda_trace_contract.rs` 13、
+  `tests/cuda_attestation_v3.rs` 10、`tests/cuda_release_manifest.rs` 9、
+  `tests/cuda_trace_v3_contract.rs` 9、`tests/external_bonded_settlement.rs` 2、
+  `tests/protocol_v2.rs` 14、`tests/receipt_v2_flow.rs` 6、`tests/restart_bundle.rs` 9、
+  `tests/slash_proof.rs` 6 passed、
+  合計 **242 passed, 2 ignored**（244 discovered）。ignored 2件は
+  release/汚染親環境の手動 gate で
+  2/2 passed。fmt と
+  `clippy --locked --all-targets -D warnings`、`rustdoc -D warnings` を通過。
+- Metal: installer full device gateで全pin、Apple M1 Max、41/41 GPU offloadを再検証し、current final-v7
+  hybrid Qwen3.6-35B-A3B Self Local Receipt（`8e2dd34b…6053f9`、`trace_evidence=metal_kernel`）を署名、stateless verify、
+  strict round-trip、schema-v4 SQLite acceptまで完了。移行前 dense Qwen3-8B の final-v6、および
+  historical final-v5は当時の証跡としてのみ保持し、旧DBをsilent migrateしない。
+- Persistence: V1 current sourceはapplication `PALW`、schema v4、full DDL fingerprint、foreign keys、
+  `synchronous=FULL`、WAL checkpointを検査する。receipt/audit/pairに加え、signed bond authority、assignment
+  lock/release/slash/appeal/health、signed canary、external authority/command/terminal、maturity bond links、
+  WorkTicketV2をrestart/rollback/adversarial testで検証する。checked-in final-v6 DBはcurrent schema v4、
+  final-v5 DBはhistorical schema v3であり、後者はcurrent verifier sourceのcontinuity inputではない。
+  CUDA V2は別application `PAL2`、別schemaでjob/receipt/encrypted bundleを原子的に保存し、receipt/
+  execution/assignment/job-slot replay、epoch rollback、torn transaction、schema mutationを拒否する。
+- Bundle: private verification material は認証付き暗号化し、別 process verifier が exact filename、
+  owner/mode/link/inode、v2 marker、strict public JSON v2、current schema-v4 acceptance をfail-closedに照合する。
+  marker は非 keyed の crash-completion signal であり、単独の authenticity/authority evidence ではない。
+- CUDA host: 通常host buildとAppleClang ASan+UBSanでABI C++、C header、V2/V3 golden codec、
+  producer descriptor、llama bridge、production rejection gateが各5/5通過し、Rust
+  `cuda_trace_contract` 13/13、`cuda_trace_v3_contract` 9/9、release manifest 9/9、
+  Receipt V2 flow 6/6もstrict
+  stream/binding/authority/adversarial caseを通過。
+- CUDA device: Windows/WSL2のRTX 4060 Ti (`sm_89`)、CUDA toolkit 13.3.1/NVCC 13.3.73で
+  host 5 + device/collector 3 CTestsが8/8 non-skippedで通過。standalone producerはtrue segmented FP32
+  pre-epilogue accumulatorを取得し20回の独立実行が同一diagnostic fingerprintとなった。
+  Qwen observerも37/37 layer CUDA offload、`n_batch=n_ubatch=1`で同一event/result stream 6/6を確認。
+  さらにV3 hookをvendored Q4_K/Q6_K MMVQとFA-off QK/softmax/PVへ統合し、one-token
+  361件（Q4_K 216、Q6_K 37、QK/softmax/PV各36）のpositive 3/3が同一canonical-record
+  fingerprintとなること、5 work classの先頭rejectionが各位置でfail closedになることを確認した。
+  exact symbol/runtime attributes/cubin/DSO release manifestもcreate/verify一致した。ただしlive smokeは
+  `diagnostic_only=true` / `receipt_authority=false` で、production署名Receiptではない。
+- CI: workflow YAML は parse 済みで、push/PR の Rust 1.81 gate と Linux host ASan+UBSan、手動
+  self-hosted NVIDIA experimental job を定義する。remote Actions は未実行。V1 observer と
+  standalone producer の両device executableで return 77 を failure 扱いにするが、この job は
+  明示的に `not R32` であり、定義だけでは
+  R32/R35 completion evidence にならない。
+
+## Completion rule
+
+文書 baseline を固定しても、
+R13、R21、R23、R24、R26、R27、R32、R35 が `Complete` になり、true CUDA
+producer accumulator/kernel identity、production scheduler/beacon/auditor/bond/external authority/payment services、
+vendored Qwenのauthority-connected production E2E、認可済みreplica/reproducibility matrix
+の証跡が揃うまで、設計書全体を完了とは扱わない。host
+fixture、library-level state-machine test、skipped device test、Metal graph fallback は production
+service や CUDA production gate の代替にならない。

docs/runbook.md

@@ -0,0 +1,493 @@
+# Qwen3.6-35B-A3B / llama.cpp 導入・検証 Runbook
+
+この runbook は、固定済みの Qwen3.6-35B-A3B artifact と llama.cpp を clean checkout から
+Apple Silicon の Metal runtime class へ導入し、署名済み Self Local Receipt を発行する
+手順を定義する。実モデル Receipt 発行まで実機検証済みなのは **Metal arm64**
+である。CUDA は Windows/WSL2 の RTX 4060 Ti で Qwen offload、diagnostic observer、
+standalone producer-accumulator primitive、same-backend vendored MMVQ V3 1-token diagnostic E2Eまで
+実機検証したが、実験 transport として分離しproduction Receipt は発行しない。
+
+対象モデルは Ollama registry の `huihui_ai/Qwen3.6-abliterated:35b-Claude-4.7`
+（abliterated Qwen3.6-35B-A3B、GGUF `Q4_K_M`）である。これは linear-attention
+（state-space / gated-delta-net）層と mixture-of-experts 層を組み合わせた hybrid 構成で、
+pinned llama.cpp には qwen35moe loader/graph の互換修正
+（`src/models/qwen35moe.cpp`）を PALW patch として加えている。
+
+固定値の正本は次の3ファイルである。
+
+- `../config/runtime-pins.sh`: repository、revision、path、CMake 値、build target
+- `../config/qwen3.6-35b-a3b-claude-4.7-base-metadata.sha256`: base metadata 7ファイルの SHA-256
+- `../config/qwen3.6-35b-a3b-claude-4.7-profile.json`: 人間可読な model/runtime profile pin
+
+## 1. Metal arm64（現在サポート）
+
+### 1.1 前提条件
+
+- Apple Silicon Mac（`uname -m` が `arm64`）。GGUF を全 GPU offload するため十分な
+  unified memory を推奨（Qwen3.6-35B-A3B `Q4_K_M` は約 24 GB。M1 Max 32GB で 41/41 layer
+  offload を確認済み）
+- Xcode Command Line Tools または Xcode（C/C++/Metal toolchain を含む）
+- `git`、CMake、`uv`、`rustup`
+- 最低約 30 GB の空き領域（GGUF は 23,938,321,728 bytes = 約 24 GB）
+- Ollama registry（`registry.ollama.ai`）と Hugging Face、GitHub への HTTPS 接続
+
+macOS、SDK、AppleClang、GPU/Metal identity は runtime manifest に記録する。CMake 入力と
+上流 commit を固定しても、異なる toolchain が生成した binary の byte 列まで同一とは限らない。
+そのため検証 script は各 binary の SHA-256 を表示し、Receipt 用 manifest は実際にロードした
+observer と dylib 群を content-address する。
+
+### 1.2 clean checkout からの一括導入
+
+project root で次を実行する。
+
+```sh
+./scripts/install.sh
+```
+
+変更予定だけを確認する場合は次を使う。installer は `eval` を使わず、実行予定の引数を
+escape して表示する。
+
+```sh
+./scripts/install.sh --dry-run
+```
+
+build host に Metal device がない場合だけ、file gate に用途を限定して probe を省略できる。
+
+```sh
+./scripts/install.sh --skip-device
+```
+
+`--skip-device` は artifact の正しさを検査しても、Metal runtime class の実行可能性を証明
+しない。実運用 node の acceptance では省略してはならない。並列数は必要に応じて
+`--jobs N` で指定する。
+
+installer は次を順番に行う。
+
+1. `uv sync --frozen` で lock 済み Python 環境を用意する。
+2. `ggml-org/llama.cpp` を clone し、commit
+   `12127defda4f41b7679cb2477a4b0d65ee6a0c8f` へ detached checkout し、
+   `patches/llama.cpp-palw-observer.patch`（qwen35moe loader/graph 修正 + observer +
+   ggml-metal kernel-dispatch hook）を適用する。
+3. **Ollama registry blob** から Qwen3.6-35B-A3B GGUF を取得する。model は
+   `huihui_ai/Qwen3.6-abliterated`、tag `35b-Claude-4.7`、URL は
+   `https://registry.ollama.ai/v2/huihui_ai/Qwen3.6-abliterated/blobs/sha256:$PALW_GGUF_REVISION`。
+   blob digest は GGUF 本体の SHA-256 に等しく、size（23,938,321,728）と SHA-256 を照合してから
+   atomic に確定する（`Qwen3.6-abliterated-35b-Claude-4.7-Q4_K_M.gguf`）。
+4. base metadata（7 files: `README.md`/`chat_template.jinja`/`config.json`/
+   `model.safetensors.index.json`/`processor_config.json`/`tokenizer.json`/
+   `tokenizer_config.json`）を HF `huihui-ai/Huihui-Qwen3.6-35B-A3B-Claude-4.7-Opus-abliterated`
+   revision `ac18882735d037f6074a7630eb68d85db8234c25` から取得する。
+5. `vendor/llama.cpp/build-palw` を Metal profile で configure し、`llama-cli`、
+   `llama-server`、`llama-tokenize`、`llama-palw-observer` の4 target を build する。
+6. install gate をすべて検証する。
+
+> **モデルについて:** 対象は第三者の *abliterated* 変換（refusal 挙動を上流で削減）です。この
+> runtime はモデルの安全性を主張せず、「pin された計算が走ったこと」だけを attest します。
+> Genesis 正本モデルは公式 `Qwen/Qwen3.6-35B-A3B` からの決定的再変換にすべきで、この点は
+> [`receipt-review-remediation.md`](receipt-review-remediation.md) #13 の残件です。
+
+Hugging Face 取得は `uv` 環境の `huggingface_hub.snapshot_download` を使い、`revision` と
+`allow_patterns` を指定する。download subprocess では `HF_HUB_DISABLE_XET=1`、implicit token
+無効化を使い、`HF_TOKEN` と `HUGGING_FACE_HUB_TOKEN` を除外する。script に token を書かず、
+`set -x` で実行しない。
+
+### 1.3 固定 Metal build / execution profile
+
+主な CMake pin は次のとおりである。全項目は `../config/runtime-pins.sh` を正本とする。
+
+```text
+CMAKE_BUILD_TYPE=Release
+CMAKE_OSX_ARCHITECTURES=arm64
+GGML_NATIVE=OFF
+GGML_METAL=ON
+GGML_METAL_EMBED_LIBRARY=ON
+GGML_METAL_SHADER_DEBUG=ON
+GGML_CPU_KLEIDIAI=OFF
+GGML_LTO=OFF
+GGML_CUDA=OFF
+BUILD_SHARED_LIBS=ON
+GGML_CPU=ON
+GGML_ACCELERATE=ON
+GGML_BLAS=ON
+GGML_BLAS_VENDOR=Apple
+LLAMA_BUILD_TESTS=OFF
+LLAMA_BUILD_EXAMPLES=OFF
+LLAMA_BUILD_TOOLS=ON
+LLAMA_BUILD_SERVER=ON
+LLAMA_BUILD_APP=OFF
+LLAMA_BUILD_UI=OFF
+LLAMA_OPENSSL=OFF
+LLAMA_USE_PREBUILT_UI=OFF
+```
+
+`llama-palw-observer` は `n_ctx=4096`、`n_batch=1`、`n_ubatch=1`、request batch=1、
+parallel sequence=1、CPU thread と batch thread=1 を強制する。greedy sampling、固定 seed、
+context shift/speculation/tensor parallel 無効、tensor repack 無効、Flash Attention 無効である。
+prompt と prediction bound の合計が 4096 を超える実行は shift せず失敗する。Metal と CUDA で
+同じ build directory や CMake cache を共有してはならない。
+
+### 1.4 独立 install 検証
+
+```sh
+./scripts/verify-install.sh
+```
+
+検証 gate は次のとおりである。
+
+- llama.cpp origin と full commit が pin と一致する。
+- GGUF が 23,938,321,728 bytes かつ SHA-256
+  `1dc494614bee8a3bc00e79fe5a49da0fc1c36b3b118c4156e223e98e5a0a671b` である
+  （Ollama blob digest = GGUF 本体 SHA-256）。
+- GGUF の revision sidecar、base metadata 7ファイル（HF `huihui-ai/...abliterated` rev
+  `ac18882735…`）の SHA-256 と revision が一致する。
+- `config.json` の shape/dtype が profile pin
+  （`config/qwen3.6-35b-a3b-claude-4.7-profile.json`）と一致する。
+- `CMakeCache.txt` の全必須値と source directory が一致する。
+- 4 binary が `version: 10015 (12127def)` を報告し、それぞれの SHA-256 を取得できる。
+- Metal device `MTL0` が発見・選択され、Qwen3.6-35B-A3B の 41/41 layers が GPU へ offload される。
+- 固定 prompt による one-token probe が exit 0 になる。
+
+`llama-palw-observer` binary の size/SHA-256 は toolchain と適用 patch（qwen35moe 修正 + observer +
+ggml-metal kernel-dispatch hook）に依存して build ごとに変わり得るため固定 pin しない。正本は
+`patches/llama.cpp-palw-observer.patch`（SHA-256 は `config/runtime-pins.sh` の
+`PALW_LLAMA_PATCH_SHA256`）であり、Receipt 用 manifest は実際にロードした observer/dylib を
+content-address する。worktree の HEAD は固定 commit のままで、patch の canonical digest を manifest
+に含める。予期しない untracked/変更 file があれば Receipt CLI は fail-closed する。
+
+device を使えない CI で file gate だけ確認する場合は、用途を限定して次を使う。
+
+```sh
+./scripts/verify-install.sh --skip-device
+```
+
+現行 Qwen3.6-35B-A3B の full device gate は Apple M1 Max の Metal device、**41/41 layer offload**、
+固定した artifact hash と upstream revision の全照合を通過した。現行 Receipt の一次証跡（発行
+→ 別 process 検証、`trace_evidence=metal_kernel`）は
+[`evidence/metal-hybrid-qwen36-2026-07-19.md`](evidence/metal-hybrid-qwen36-2026-07-19.md)
+に、移行前 dense Qwen3-8B の記録は
+[`evidence/metal-smoke-schema-v4-2026-07-15.md`](evidence/metal-smoke-schema-v4-2026-07-15.md)
+に記録する。
+
+### 1.5 native observer と strict Qwen adapter の手動確認
+
+observer へ prompt を渡すときは argv ではなく stdin を使う。通常実行は
+`--emit-output-bytes` を付けないため、JSONL result の `output_bytes` は空である。JSONL には
+private な token IDs が含まれるため、その stdout を公開 artifact として保存してはならない。
+
+```sh
+printf '%s' 'PALW' | \
+  vendor/llama.cpp/build-palw/bin/llama-palw-observer \
+    --model models/Qwen3.6-abliterated-35b-Claude-4.7/Qwen3.6-abliterated-35b-Claude-4.7-Q4_K_M.gguf \
+    --prompt-stdin --n-predict 2 --n-gpu-layers 999 --observer sketch
+```
+
+Rust adapter は dedicated stdin pipe を作り、native stdout を versioned JSONL として厳格に読む。
+schema、header/event/result の順序と個数、連続 sequence、Qwen3.6-35B-A3B shape、上記 deterministic
+policy、full GPU offload marker、phase/token count、sketch width、trace claim の不一致を拒否する。
+既知の Qwen graph operation はすべて canonical CU operation へ変換し、layout-only metadata
+だけを明示的に除外する。未知 operation、未価格 operation、CUDA kernel を偽る graph event は
+fail-closed である。
+
+### 1.6 Rust 1.81 MSRV gate と release CLI
+
+crate は `rust-version = "1.81"` を宣言する。検証中、crypto stack の open transitive range が
+`zeroize 1.9` と `base64ct 1.8.3` を選び、両 crate の edition-2024 manifest を Cargo 1.81 が
+parse できない矛盾を検出した。`Cargo.toml` は互換版 `zeroize = "=1.8.1"` と
+`base64ct = "=1.7.3"` を exact pin し、`Cargo.lock` も同じ version に固定する。
+依存解決の再現性を検査するため clippy/test/build は `--locked` を必須にする。
+
+```sh
+rustup toolchain install 1.81.0 --profile minimal --component rustfmt,clippy
+cd runtime-palw
+cargo +1.81.0 fmt --all -- --check
+cargo +1.81.0 clippy --locked --all-targets -- -D warnings
+cargo +1.81.0 test --locked --all-targets
+cargo +1.81.0 build --release --locked \
+  --bin palw-metal-receipt --bin palw-verify-bundle
+cd ..
+```
+
+現行のRust all-target結果は合計 **224 passed, 2 ignored**（226 discovered）である。ignored 2件は
+pinned model/observer を必要とし、通常 CI が model download や Metal 実機を暗黙に要求しないため
+分離している。release build と汚染した親環境を使う手動 gate では 2/2 passed である。実モデル
+Receipt E2E は本 runbook の次節と evidence 文書で別に検証する。
+
+pedantic Clippy の `module_name_repetitions` だけは、protocol の versioned public API 名を module
+外でも自己記述的に保つ設計判断として crate level で allow する。他の warning は
+`-D warnings` で失敗させる。
+
+実モデルで新しい Self Local Receipt set を生成する。audit key は exact 32-byte raw key とし、
+output directory の外に一度だけ安全に作成・保管する。key file は current user 所有の single-link
+regular file、mode `0400` または `0600` でなければならない。既存 key をこの手順で上書きしない。
+
+```sh
+set -eu
+OUT="receipts/manual-$(date +%Y%m%d-%H%M%S)"
+PROMPT_FILE="/path/to/private-prompt.txt"
+AUDIT_KEY="$HOME/.config/misaka-palw/audit-keys/local-audit.key"
+
+install -d -m 700 "$(dirname "$AUDIT_KEY")"
+test ! -e "$AUDIT_KEY"
+(umask 077 && /usr/bin/openssl rand 32 > "$AUDIT_KEY")
+chmod 600 "$AUDIT_KEY"
+
+runtime-palw/target/release/palw-metal-receipt \
+  --prompt-stdin --audit-key-file "$AUDIT_KEY" \
+  --output-dir "$OUT" --n-predict 2 < "$PROMPT_FILE"
+```
+
+`--prompt-stdin`、`--audit-key-file`、`--output-dir` はすべて必須である。prompt は UTF-8、非空、
+最大 1 MiB を要求し、argv で prompt を受ける互換 option はない。source の省略、重複 option、
+上限超過、zero/all-zero または不正 permission の audit key は inference または publication 前に
+拒否する。wrapper は受け取った prompt を pinned tokenizer と native observer の専用 stdin pipe
+へ渡す。output directory は新規または空で、symlink ではなく current user 所有でなければならず、
+CLI が mode `0700` を強制する。
+
+job ID、nonce、salt、scheduler/worker signing key、network ID は OS CSPRNG からローカル実行ごとに
+生成されるため、Receipt ID は証跡例と同一にならない。これらの一時 identity は receipt set 内の
+binding を検証するためのものであり、production network の登録済み scheduler/worker authority や
+credential ではない。private signing key は publication 後に保持しない。
+
+CLI は実行前後で model/runtime manifest を再構築して artifact 変更を検出し、署名済み request と
+assignment、prompt/output opening、全 observer evidence、CU、schedule、graph trace を stateless
+verify する。canonical binary を strict decode で round-trip し、secret scan を通過した後だけ
+SQLite transaction で receipt/job/nullifier を受理する。private request/assignment、opening、owner
+salt、検証用 signer record は XChaCha20-Poly1305 の `.palw.bundle` に認証付き暗号化する。Self Local
+Receipt はこの時点では Work Ticket ではなく、future audit または challenge-window maturity が
+別途必要である。
+
+正常終了時の directory は同一 Receipt ID を basename とする次の set になる。
+
+- `<id>.palw` (`0644`): 署名済み canonical public envelope
+- `<id>.json` (`0644`): strict `misaka.palw.public-receipt.v2` metadata。unknown field を拒否し、
+  verifier が retained field を authenticated receipt/bundle と照合
+- `<id>.palw.bundle` (`0600`): audit key で認証付き暗号化した private verification material
+- `palw-state.sqlite3` (`0600`): application/schema identity と full DDL fingerprint を検査する schema v4 state
+- `<id>.complete` (`0644`): `misaka.palw.receipt-set.v2` completion marker
+
+CLI は WAL を main DB へ checkpoint/truncate し、DB と各 artifact を fsync して directory entry を
+永続化した後、marker を最後に作成・fsync する。したがって portable set は `-wal` / `-shm` file に
+依存しない。旧schemaや未知/legacy DBを暗黙にmigrateせずfail-closedに拒否する。
+
+marker は receipt ID、bundle ID、公開 JSON byte 列の SHA-256 を bind し、crash 後に「前提 file を
+永続化してから publication を完了した」ことを示す。ただし marker 自体は keyed MAC でも network
+authority の署名でもなく、directory を変更できる同一 user は再計算できる。marker 単独を artifact
+authenticity、network authorization、maturity の根拠にしてはならない。
+
+別 process で artifact set を復元・再検証する。次は CLI が表示した ID を `.palw` basename から
+取得する単発 set 用の例である。
+
+```sh
+RECEIPT="$(find "$OUT" -maxdepth 1 -type f -name '*.palw' -print)"
+ID="$(basename "$RECEIPT" .palw)"
+
+runtime-palw/target/release/palw-verify-bundle \
+  --receipt "$OUT/$ID.palw" \
+  --bundle "$OUT/$ID.palw.bundle" \
+  --public-json "$OUT/$ID.json" \
+  --audit-key-file "$AUDIT_KEY" \
+  --state-db "$OUT/palw-state.sqlite3"
+```
+
+verifier は artifact の exact filename、同一 private directory、owner、mode、link count、distinct inode、
+bounded read/path race、v2 marker、公開 JSON の全 field、暗号化 bundle の authentication、署名・
+assignment・manifest・evidence/opening、既存 DB acceptance を照合する。正常時は
+`status=local_restored` と `trust_scope=embedded_local_snapshot` を出力する。この local mode は
+発行時に暗号化した registry snapshot との continuity を示すだけで、後日の network revocation や
+外部 authority を独立に取得しない。production verifier は library の external-trust API へ current
+network ID、scheduler/signer registry、approved manifest hash を別経路から与える必要がある。
+
+後段のticketingではrawな「mature」登録APIを使用しない。field/constructorが非公開の
+`MatureEvidence`はSelf Local audit `Mature`またはSelf Replicated typed `MatchedReplicaPair`だけが
+generic pathへ渡せる。Externalはgeneric registrationを拒否し、authority-confirmed durable settlement
+transactionだけがmaturityを作る。`WorkTicketV2`はsourceに加えて`maturity_basis_id`と、Externalに必須の
+authority-signed `weight_grant_id`をbindする。
+
+production bonded pathではauthority-signed fundingをcreditし、scheduler-signed assignmentごとにlockして、
+Receiptを`accept_bonded`で受理する。maturity登録はSelf Localで1件、replicatedで2件のactive assignment
+bondを同じtransactionでrelease/linkする。`issue_ticket`はrequired link数、`issued_epoch >= mature_epoch`、
+source未消費を再検査する。External settlementはsigned terminal confirmation、terminal、2 bond releases/
+links、maturity、ticketを1 SQLite transactionでcommitする。External refundはstate 1..3からexpiry後にpairの
+有無を問わず進め、terminalとeligible bond releaseをatomicにcommitするがticketを作らない。pending claimの
+bondは解決までreleaseしない。
+
+expiry releaseは未使用assignmentに加え、acceptedでもまだpairを持たないSelf Replicatedだけをsigned expiry後に
+許す。pending canary/slash、paired receipt、Self Local、その他used assignmentはexpiry bypassを拒否する。
+slash claimはinitial bond基準のimmutable targetを持ち、overlapを加算せずfinalized max-envelopeとpending
+extensionへorder-independentにallocateする。appeal/decision windowはsigned claimed epochだけでなく、authority
+registryでのverification/acceptance epochも期限内であることを要求する。Externalの
+`SettlementPrepared` transitionは両assignmentがactiveでslash claimなしとpreflightする。
+`SettlementPrepared`または`RefundPrepared`以後のnon-replay slashを拒否する。両prepared state後のauthority confirmation timeoutや
+superseding terminalはないため、production運用はauthority availabilityとprepared-state recovery手順を
+crate外で用意する。
+
+これらはcore APIとdurable transitionの手順であり、production service一式を含まない。repository内には
+network scheduler/worker registry service、beacon delivery/governance、auditor/re-execution executor、
+bond/external authority governance service、payment railがない。signed funding/terminalは外部factの
+authenticated statementであり、実collateral/rail movementをcrateが独立証明しない。railとSQLiteは
+distributed atomic transactionではない。
+したがって library test の成功やローカル生成 identity を production maturity/payment evidence として
+扱わず、該当する要件は [`requirements.md`](requirements.md) の `In progress` のままである。
+
+永続 store を検査する。
+
+```sh
+sqlite3 "$OUT/palw-state.sqlite3" \
+  'PRAGMA user_version; PRAGMA integrity_check; PRAGMA foreign_key_check;
+   SELECT COUNT(*) FROM receipts; SELECT COUNT(*) FROM jobs;'
+```
+
+current sourceの正常な単発実行はschema version `4`、`ok`、foreign-key violationなし、receipt `1`、job
+`1`を返す。
+store は `SQLITE_OPEN_NOFOLLOW`、WAL、`synchronous=FULL`、foreign keys、full sqlite_master DDL
+fingerprint、transactional uniqueness を強制し、restart、競合 accept、rollback、pair/ticket/slash/
+external terminal state を Rust test で検証する。
+
+current schema-v4 証跡は `../receipts/final-v6/` にあり、Receipt ID は
+`eb51b08c3b86ef5df2cdebcfa9fcef812ec72197b3ad40ae2c5ba68cf4278131`、bundle ID は
+`359f1bedaeefc1e140bf8c0dbba11582cb5cc0be428dcd95bc6077721f8096e9` である。canonical
+envelope 713 bytes、bundle 403,066 bytes、公開 JSON 3,427 bytes、marker 262 bytes、SQLite
+282,624 bytes。SHA-256 は順に `85ecb4281a1cb4abf26d6e3e70c84bfb3cc2a6dad80e2022ea4a356165345a75`、
+`b475193fcfe1aea3189066790f925cc3682d2ff5a48cdfa061d62db85d0cff78`、
+`03bee886144a2c64dd5f4d2207f86c748f5a3e7891b43f82f077f051342c3d0b`、
+`f3dc4e142eb602977c1ac065d51297418c8dca3967b6cdb53eb0dfb447d5c77b`、
+`8a740c342a12c83ae211edfa8776b93a14ea9369e3d7bd19a1e780e0724c471e` である。separate verifier は
+exit 0、`status=local_restored`、`trust_scope=embedded_local_snapshot` を返した。DB は application
+`PALW` (`1346456663`)、schema v4、`integrity_check=ok`、foreign-key violationなし、receipt=1、job=1、
+pair/audit/ticket/slash/external state=0で、最終検証後に `-wal` / `-shm` は残っていない。詳細は
+[`evidence/metal-smoke-schema-v4-2026-07-15.md`](evidence/metal-smoke-schema-v4-2026-07-15.md)
+を参照する。
+
+historical schema-v3証跡は`../receipts/final-v5/`にあり、Receipt IDは
+`ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68`、bundle ID は
+`6fd4e57a6cbcd6fc1d9138989960b627c9ee4817bc3ac4ce889a1a1b41d7d63b` である。canonical
+envelope 713 bytes、bundle 337,257 bytes、公開 JSON 3,427 bytes、marker 262 bytes、SQLite
+126,976 bytes。separate verifier は exit 0、`status=local_restored`、
+`trust_scope=embedded_local_snapshot` を返した。生成当時のDBはapplication `PALW`、schema v3、
+`integrity_check=ok`、foreign-key violation なし、receipt=1、job=1、その他 state table=0 で、
+最終 verifier 後に `-wal` / `-shm` は残っていない。詳細は
+[`evidence/metal-smoke-2026-07-15.md`](evidence/metal-smoke-2026-07-15.md) を参照する。
+current schema-v4 sourceはこの旧DBをsilent migrate/openしないため、final-v5をcurrent verifierのcontinuity
+testへ流用しない。final-v6は新しいempty output directoryから生成したcurrent E2E証跡である。
+
+### 1.7 冪等性と異常 artifact の扱い
+
+installer は commit、content hash、size、Hub revision が一致する artifact を再利用する。既存の
+GGUF または metadata が期待 hash と異なる場合は、上書きや削除をせず停止する。対象を調査・
+保全し、必要なら別名へ移してから再実行する。
+
+```sh
+mv models/Qwen3.6-abliterated-35b-Claude-4.7/Qwen3.6-abliterated-35b-Claude-4.7-Q4_K_M.gguf \
+  models/Qwen3.6-abliterated-35b-Claude-4.7/Qwen3.6-abliterated-35b-Claude-4.7-Q4_K_M.gguf.rejected
+./scripts/install.sh
+```
+
+途中で停止した Hugging Face の `.incomplete` cache は download library が再開に利用するため、
+手動削除を前提にしない。Git worktree が固定 commit 以外で dirty な場合も自動 checkout しない。
+
+## 2. CUDA（実験的・production 非発行）
+
+`../runtime-palw/cuda/`の汎用device observerはGEMM/attention deterministic final-output tile sketch、
+checked C ABI/canonical V1 codec、capacity/sequence/stream/poison stateを実装する。additive V2 transportは
+origin、accumulator stage/dtype、sketch scheme、reduction segment、producer variant IDを含むexact
+184-byte canonical recordを定義し、Rustが全unfiltered streamをexpected dispatch/runtimeへstrict bindする。
+
+standalone V2 producer primitiveは、実のCUDA test kernel内でFP32 segmented accumulatorをepilogue/store前に
+捕捉する。exact function pointer/attributes、launch nonce、compiled identity、sample coverage、fault maskを
+fail-closedに検証する。Rustはさらにnetwork-scoped authority attestationをjob/execution、assignment、
+runtime manifest/class/instance、producer integration、operation schedule、full transcript、epochへ署名bindする。
+
+vendored llama.cppのQ4_K/Q6_K MMVQ producerはV3 full-K pre-epilogue hookへ接続済みである。
+same-backend Qwen 1-token diagnostic E2Eで253/253 record（Q4_K 216 / Q6_K 37）、3回同一
+fingerprintを確認した。FA-off attentionのcanonical 3-sublaunch grouping/strict binderと、実QK-score/
+softmax/value-aggregation直後collector/typed associationも接続し、QK 36、softmax 36、PV 36を加えた
+361/361 recordを3回同一fingerprintで取得した。Q4/Q6/QK/softmax/PV各先頭の選択launch拒否も
+fail closedである。exact entry symbols/runtime attributes/cubin/DSO release manifest、361 expected tableを
+検証するReceipt/RuntimeManifest/Request/Assignment V2、暗号化Bundle V2、SQLite V2も実装済みである。
+ただしlive callback���diagnostic IDであり、production authorityからのReceipt発行には使用しない。
+`ComputeReceiptV1` への変換はbuilder/verifierの両方が拒否する。
+
+CUDA のない host では ABI、codec、header、production rejection gate だけを検証する。
+
+```sh
+cmake -S runtime-palw/cuda -B build/palw-cuda-host \
+  -DPALW_CUDA_TRACE_ENABLE_CUDA=OFF -DBUILD_TESTING=ON
+cmake --build build/palw-cuda-host
+ctest --test-dir build/palw-cuda-host --output-on-failure -L host
+```
+
+AppleClang host ABI/codec を ASan+UBSan でも確認する場合は次を使う。この macOS ASan は leak
+detection 非対応のため `detect_leaks=0` とし、これは LeakSanitizer の代替証跡ではない。
+
+```sh
+cmake -S runtime-palw/cuda -B build/palw-cuda-sanitize \
+  -DPALW_CUDA_TRACE_ENABLE_CUDA=OFF -DBUILD_TESTING=ON \
+  -DCMAKE_BUILD_TYPE=Debug \
+  -DCMAKE_C_FLAGS='-Wall -Wextra -Wpedantic -Werror -fsanitize=address,undefined -fno-omit-frame-pointer' \
+  -DCMAKE_CXX_FLAGS='-Wall -Wextra -Wpedantic -Werror -fsanitize=address,undefined -fno-omit-frame-pointer'
+cmake --build build/palw-cuda-sanitize
+ASAN_OPTIONS=detect_leaks=0:abort_on_error=1 \
+UBSAN_OPTIONS=halt_on_error=1 \
+  ctest --test-dir build/palw-cuda-sanitize --output-on-failure -L host
+```
+
+production 発行を有効化する構成は意図どおり失敗しなければならない。
+
+```sh
+cmake -S runtime-palw/cuda -B build/palw-cuda-production \
+  -DPALW_CUDA_PRODUCTION_KERNEL_TRACE=ON
+```
+
+NVIDIA host での実験 transport の device test は次で行う。exact CUDA toolkit、driver、NVCC、
+cuBLAS、GPU model/compute capability、単一 `CMAKE_CUDA_ARCHITECTURES`、test 出力を保存する。
+
+```sh
+cmake -S runtime-palw/cuda -B build/palw-cuda -DBUILD_TESTING=ON \
+  -DCMAKE_CUDA_ARCHITECTURES=89-real
+cmake --build build/palw-cuda
+ctest --test-dir build/palw-cuda --output-on-failure
+```
+
+現行証跡はWindows/WSL2、RTX 4060 Ti (`sm_89`)、driver 610.62、CUDA toolkit 13.3.1 /
+NVCC 13.3.73で取得した。standalone CTestsは7/7 non-skipped、standalone producerは
+20回の独立実行で同一encoded-transcript diagnostic fingerprintとなった。同じhostのQwenは
+37/37 layerをGPU offloadし、dedicated observerは`n_batch=n_ubatch=1`で6/6同一event/result
+streamを返した。最終grouped suiteは8/8 non-skipped、vendored MMVQ/attention same-backend gateは
+361/361 V3 recordと3回同一fingerprintを返した。
+詳細は[`evidence/cuda-wsl-sm89-2026-07-15.md`](evidence/cuda-wsl-sm89-2026-07-15.md)と
+[`evidence/cuda-v3-mmvq-hook-sm89-2026-07-15.md`](evidence/cuda-v3-mmvq-hook-sm89-2026-07-15.md)と
+[`evidence/cuda-v3-full-hook-sm89-2026-07-16.md`](evidence/cuda-v3-full-hook-sm89-2026-07-16.md)に固定する。
+
+これによりNVIDIA実機不足というR32の外部blockerは解消したが、R32自体は未完了である。
+vendored MMVQ/FA-off attention diagnostic hook、361-launch実機E2E、release manifest、Receipt V2/
+bundle/persistenceは完了したが、R32のproduction完了にはauthority-derived canonical physical-layout IDを
+使うlive callback、deployed trust roots、署名Receiptの独立restore、認可済みreplica/reproducibility matrixが
+必要である。CUDA は Metal と異なる
+`runtime_class_id` とし、cross-runtime determinism が別途証明されるまで k=2 replica として
+直接照合しない。
+
+## 3. CI gate 定義
+
+[`../.github/workflows/palw-ci.yml`](../.github/workflows/palw-ci.yml) は checkout action を
+commit SHA で固定し、credential persistence を無効化し、read-only contents permission を設定する。
+push/PR は同じ event/ref の旧 run を cancel するが、manual NVIDIA run は event 名で分離して
+cancel しない。push / pull request では次の2 job を定義する。
+
+1. Ubuntu 24.04 に Rust 1.81.0、rustfmt、Clippy を install し、`fmt`、
+   `clippy --locked --all-targets -D warnings`、`test --locked --all-targets` を実行する。
+2. Linux host-only CUDA ABI/codec/production-rejection gate を ASan+UBSan、leak detection 有効、
+   warning-as-error で build/test する。
+
+手動 `workflow_dispatch` で `run_nvidia_experimental=true` を選んだ場合だけ、
+`self-hosted, linux, x64, nvidia` label の runner で exact real SM architecture を指定し、experimental
+CUDA transport を build/test する。`CUDA_VISIBLE_DEVICES=0` に固定し、`nvidia-smi` の実 compute
+capability が選択した single `*-real` architecture と一致しなければ configure 前に失敗する。
+V1 observer と standalone producer の両device executableを CTest 経由ではなく直接実行
+するため、device/driver 不在を表す return code 77 は skip ではなく job failure になる。
+
+この manual job は `PALW_CUDA_PRODUCTION_KERNEL_TRACE=OFF` であり、workflow 名にも `not R32` を
+明記する。成功すれば final-output observer と standalone true-accumulator primitive を検査
+できるが、repositoryの別実測で完了したMMVQ hookを���のmanual job自体は検査しない。
+repositoryの別実測で完了したvendored-Qwen MMVQ+attention full stream、release manifest、Receipt V2も
+このjob自体は検査しない。またproduction authority接続と必要なrepeatability matrixは満たさない。
+workflow 定義の存在自体も runner での成功証跡ではないため、R32/R35 の未達 gate を解除しない。

docs/security-model.md

@@ -0,0 +1,269 @@
+# Security Model
+
+## Protected assets
+
+- model artifact、tokenizer、runtime binary/dylib/source patch の同一性
+- prompt、prompt/generated token IDs、decoded output、owner key、commitment opening、audit key の秘匿性
+- token count、operation schedule、canonical CU、graph/kernel trace の完全性
+- scheduler request/assignment、job/execution nullifier、Receipt の一回性
+- replica、audit、escrow、bond/slashing、Work Ticket の状態遷移
+
+## Trust and issuance boundary
+
+単一の自己申告 Receipt は、悪意ある host に対する独立な暗号学的 proof ではない。本プロトコルは
+次を組み合わせて不正コストを上げる。
+
+- content-address された model/runtime manifest と Ed25519 scheduler/worker signature
+- 同一 runtime class 内の独立 credential/runtime instance による k=2 exact match
+- Receipt 発行後の future beacon による再実行 audit
+- authority-signed funding、scheduler-signed assignment lock、conserved durable bond accounting、appeal
+- scheduler-signed hidden precommitを期限後に開き、worker/scheduler timeoutを分離するdurable canary
+- transactional replay、pair、audit、bond/slash/health、maturity、WorkTicketV2、external settlement registry
+
+schema-v4 coreではこれらの多くがSQLite transactionで接続された。bonded Receipt acceptance、audit/canary
+slash、maturity時bond release/link、External settlementからticketまでのlocal atomicityを持つ。ただし
+production scheduler/auditor/authority/payment service全体をrepository内で実装したわけではない。
+
+現行 Metal Self Local path は signed Receipt を発行できるが、evidence は `graph_fallback` であり
+CUDA kernel proof ではない。mature weight には future audit または challenge window が必要である。
+現行CLIはscheduler/worker keyとregistry snapshotをlocalに生成するため、その出力だけからproduction
+scheduler authorizationやnetwork admissionを推論してはならない。
+
+future-audit state、signed beacon provenance、audit replay、passing maturityはSQLiteへdurableに保存する。
+ただしfinalized beaconの取得/governance、独立auditorへのassignment、model re-execution、private opening
+deliveryは外部serviceのtrust boundaryである。crate内のlocal authority registryはnetwork consensusや
+beacon finalityを実装しない。
+
+CUDA code はadditive 184-byte V2 codecとstrict full-stream/dispatch/runtime binderを持つが、raw recordの
+declared producer originはtransport metadataであってproofではない。authority署名をnetwork/job/execution/
+assignment、runtime class/manifest、producer integration、operation schedule commitment、全scheduled
+GEMM/attention coverage、full transcriptへbindし、producer
+accumulator GEMMだけをReceipt V2 evidenceへ射影するtypestateも実装した。ただしV1にはこの
+provenanceをcommitするfieldがないため、builderとverifierはCUDA `KernelSketch`をともに拒否する。
+この署名は登録authorityによるexact transcript/integrationの承認をauthenticateするが、authorityの正しさや
+GPU register由来を単独で暗号学的に証明しない。
+
+standaloneのproducer-internal FP32 accumulator採取primitiveはWSL2 Ubuntu 24.04上のRTX 4060 Ti（sm_89）、CUDA Toolkit
+13.3.1 / nvcc 13.3.73で最終grouped device suite 8/8とproducer 20/20同一diagnostic fingerprintを通過した。固定Qwenも
+37/37 layer CUDA offloadとgraph observer 6/6同一diagnostic streamを確認済みである。vendored llama.cppの
+Q4_K/Q6_K MMVQ producerはV3 full-K pre-epilogue hookへ接続済みで、same-backend 1-token diagnostic
+E2Eは253/253 recordを取得する。V3 schema/binderはFA-off eager attentionのcanonical groupingを表現し、
+3 stageのwork直後collectorとtyped associationも接続済みである。合計361 launchを3回同一fingerprintで
+取得し、5 work classの拒否を確認した。exact symbol/runtime attributes/cubin/DSO release manifest、
+Receipt/RuntimeManifest/Request/Assignment V2、暗号化Bundle V2、SQLite V2も実装・検証済みである。
+ただしlive callbackはauthority-derived canonical physical-layout IDではなくdiagnostic IDを使用するため、
+trace/producer production capability、vendor integration、Receipt mappingの各macroは0、production
+CMake optionはconfigure時に失敗する。したがって
+R32は`In progress`だがCUDA Receiptは発行不可である。
+
+host OS、driver、GPU firmware まで敵対的とみなす場合は、TEE attestation または ZK/VC を追加
+しなければならない。この v1 はその主張を行わない。
+
+## Threat controls
+
+| Threat | Primary controls | Fail condition |
+|---|---|---|
+| Fake token count | pinned runtime tokenizer IDs、prefill/decode graph step consistency、opening、audit | count/token vector/phase step が不一致 |
+| Fake runtime | model/binary/dylib/source/build/host digest、manifest ID、allowlist | digest、class、実行前後 manifest が不一致 |
+| Fake output | salted output commitment、signed shared nonce、replica/audit opening | nonce、token、stop reason、再実行 output が不一致 |
+| Replay | domain-separated job/execution nullifier、SQLite unique constraint | receipt/nullifier/job slot が既に受理済み |
+| Forked runtime | manifest digest、signed assignment、canary、independent runtime instance | 未許可 digest、credential/instance 重複、canary failure |
+| Dummy execution | strict non-empty event stream、full event/token coverage、trace、replica/audit | event 欠落、unknown op、required evidence 不足 |
+| Schedule rewrite | ordered hash chain、event count、CU、Receipt signature | reorder/insert/delete/shape mutation で chain または CU 不一致 |
+| Receipt duplication | receipt/execution/job-slot uniqueness、pair/ticket one-shot state | duplicate accept、pair reuse、二重 ticket 化 |
+| Trace forgery | manifest capability、strict graph claim、trace root/count、replica/audit | CUDA claim、scheme、root、count、tile metadata が不一致 |
+| Secret leakage | stdin child pipe、output-byte omission、private opening schema、pre-write scan | canonical Receipt に prompt/token/key/nonce/salt bytes が出現 |
+| Bundle substitution | receipt/public/AAD binding、XChaCha20-Poly1305 tag、strict decode | receipt/bundle/public digest、nonce、tagが不一致 |
+| Incomplete output set | checkpoint/fsync、marker-last、core JSON field cross-check | marker欠落・ID/hash不一致（marker自体はunkeyedでauthenticity controlではない） |
+| Local trust escalation | DB exact restoreとexternal anchored stateless pathの分離 | embedded key snapshotだけで第三者authorityを主張 |
+| CUDA async failure | permanent poison、committed-count barrier、production gate | poisoned/pending/overflow context または非発行 capability |
+| External funding/weight forgery | network-scoped authority capability、signed exact funding/grant、canonical replay ID | key/network/asset/amount/grant/epoch/signature不一致 |
+| External double settlement | stable payment command、signed terminal confirmation、single durable terminal | command/distribution/pair/amount/epoch不一致、逆terminal、conflicting replay |
+| Canary false slash | scheduler-signed precommit、atomic receipt acceptance、fault-party timeout attribution | precommit/request/assignment/window不一致、opening未到達、scheduler opening timeout |
+| Bond funding/slash replay | signed funding event、typed primary proof、conservation reconciliation、appeal state | event/offense/canonical payload conflict、account/assignment/evidence不一致 |
+| Dependency/MSRV drift | exact crypto pins、lockfile、Rust 1.81 all-target CI | lock変更、MSRV manifest parse失敗、lint/test failure |
+| Premature Work Ticket | opaque maturity basis、required bond release links、WorkTicketV2、atomic one-shot issue | raw claim、epoch前倒し、bond link不足、grant不一致、source再消費 |
+
+## Cryptographic rules
+
+- hash は SHA3-256 とし、用途ごとの domain separation と version を必須にする。
+- 可変長 field は canonical length-prefix し、曖昧な連結を禁止する。
+- Receipt、manifest、request、assignment、future beacon、canary precommit、bond/external authority
+  evidence、verification bundle はstrict versioned canonical formだけを署名・hash/AEAD binding対象にする。
+- output nonce、owner salt、private key seed は OS CSPRNG から 32 bytes 生成し、zero を拒否する。
+- replica 用 output nonce は scheduler-signed request で共通指定し、worker による差し替えを防ぐ。
+- prompt commitment も signed shared nonce、network、job、runtime tokenizer IDs に binding する。
+- key ID、algorithmと署名をenvelopeに明記し、public keyはregistryから解決する。Receipt、scheduler
+  message、future beacon、canary precommit、bond/external authorityのEd25519検証は`verify_strict`を使い、
+  small-order/weak public keyを各registryへの登録時と検証時に拒否する。bond authorityはfunding/appeal/
+  decision、external authorityはfunding/demand-weight/terminalのcapabilityを分離する。
+- verification bundle はXChaCha20-Poly1305（256-bit derived key、192-bit random nonce、128-bit tag）を
+  使い、receipt binding、public digest、nonce、canonical public sectionをAADへbindする。caller-owned
+  raw audit keyとprivate signing-key seedはbundleへserializeしない。
+- replay/cardinality/terminal transition は process-local set ではなく durable transaction で確定する。
+- MSRV gate、Clippy、test、release build は committed lockfile を使い、open transitive range が
+  toolchain 非互換 manifest を silent に選ばないようにする。
+
+## Privacy rules
+
+canonical Receipt と公開 JSON に prompt、raw output、prompt/generated token IDs、owner public key、
+output nonce、owner salt、private key、accumulator 全体を含めない。公開 JSON は commitment、digest、
+non-secret identifier/counter/protocol label、CU、artifact/observer summary、filename、privacy flagを記録する。
+後述のlocal verifierがsemanticに照合するのはその一部である。
+
+Receipt CLI は必須の `--prompt-stdin` を使い、UTF-8/非空/1 MiB 上限を inference 前に検査する。
+`--prompt TEXT` は廃止され、unknown optionとして拒否する。CLIはさらに `--audit-key-file` を必須とし、
+exact 32-byte nonzero key、owner、single link、regular-file、mode `0400`/`0600`、symlink/path race/inode
+alias/output directory内配置をfail-closedに検査する。
+Rust adapter は prompt を tokenizer/native child argv、stderr、error text に置かず専用 stdin pipe
+で渡す。通常の Receipt 実行は native observer の `--emit-output-bytes` を使わないため decoded
+output bytes は IPC result にも含まれない。ただし native JSONL は wrapper 内部で
+prompt/generated token IDs を opening として運ぶため、この local pipe と process memory は
+trusted privacy boundary である。debug QA で output bytes を明示的に有効化した stream を公開
+ログへ流してはならない。
+
+verification bundleのpublic sectionにはreceipt binding/ID、verification epoch、scheduler public-key
+snapshot、manifest、execution evidenceを置く。worker public keyを含むsigner record、signed
+request/assignment、output nonce、prompt/generated token IDs、stop reason、owner saltはencrypted private
+sectionだけに置く。private signing-key seedとaudit keyはoutput artifactへ保持/serializeしない。CLI はcanonical bytesの
+strict round-tripとprompt/token/key/nonce/salt scanを通過してからだけ`create_new`で書く。audit keyの
+rotation/backup、bundle/openingのretention/deletionはcallerの運用責任で、このcrateに自動retention policy
+はない。
+
+tokenizer、observer、host/source identity helperは inherited environment を消去し、`LANG=C` と
+`LC_ALL=C`だけを設定する。このallowlistはmanifestへbindされ、host identity helperはabsolute pathで
+起動する。ただしsame-user debugger、process memory reader、malicious host kernelからlocal openingや
+audit keyを保護するattestationは提供しない。
+
+## Durable-state rules
+
+SQLite store は WAL、`synchronous=FULL`、foreign key、application ID、schema version 4を検証する。
+table/column/foreign-key/index集合に加え、non-internal `sqlite_master` の完全な
+`(type,name,tbl_name,sql)`列をcanonical SHA3-256 fingerprintで照合する。旧schemaをsilent migrateせず、
+既存objectを持つunclaimed DBも拒否する。Receipt ID、execution nullifier、job/replica slot、pair
+membership、future audit/replay、bond funding/account/assignment/release/slash/appeal/health、signed canary、
+maturity source/assignment link、Work Ticket v2、external escrow/payment command/terminalをunique constraintと
+transactionで守る。
+
+raw maturity flag を受ける public store API は持たない。original receiptの`accepted_at_epoch`、pairの
+`matched_epoch`、signed beaconのclaimed epoch/key ID/canonical envelope、audit replayのissued/accepted
+epochを保存し、epoch rollbackを拒否する。beaconを検証したcaller current epochは保存せず、restore時に
+current `AcceptedReceipt.verified_at_epoch`とauthority registryから再確立する。selected auditは
+audit-specific replay identityの一回予約、typed
+projection verdict、terminal state、passing maturity sourceを同一transactionで確定し、non-selected
+auditもwindow maturityとsource登録を同一transactionで確定する。bond rowがあるaudit pathとSelf
+Replicated pathはmaturityと同じtransactionでrequired assignment bondをrelease/linkする。Work Ticketは
+その`mature_epoch`より前には発行できず、job classに必要なrelease link数を満たすsourceだけを一度消費する。
+
+bond fundingはauthority-verified typestateだけをcreditし、funding event ledgerとaccount buckets、active
+assignment remaining、pending/finalized slash、healthをread/transition時にreconcileする。lockはexact
+scheduler-signed assignmentにbindする。bonded assignmentのReceiptをgeneric `accept`で受けず、
+`accept_bonded`または`accept_canary`のatomic pathを要求する。audit mismatch/timeoutとcanary mismatch/
+receipt timeoutはtransition自身からtyped primary proofを作り、slash accountingを同じtransactionに含める。
+各claimはinitial bond基準のimmutable targetを持ち、finalized max-envelopeを優先してpending extensionだけを
+allocateする。overlapを加算せず、equal/weaker/strongerの到着順やreverse後にも全claimから再計算する。
+v1のEquivocation追加penaltyは0である。
+
+authority-verified appealはpending offense/worker/assignment/deadlineへexact bindする。signed submissionと
+appeal verification/acceptance epochをappeal window内に��求し、decision windowは後者から開始する。signed
+decision epochとdecision verification/acceptance epochもdeadline内でなければならない。期限経過後は
+default-uphold、appealがなければappeal deadline後のfinalizationだけを認める。exact canonical replayは
+idempotent、同じbusiness IDのconflicting payloadはfatalである。
+
+pendingまたはuphold/default-final claimを持つassignmentからmaturity/ticketを生成しない。全claim解決後、
+audit mismatch/timeout terminalはclaim reversal時も残額を`SlashResolved`
+releaseする。canary fault terminalはmatching claimがuphold/default-finalの場合だけreleaseでき、reversed
+canary claim単独では解放しない。External refundもrelease terminalであり、state 1..3からexpiry後にpairの
+有無を問わず確定できる。eligible bond残額はrefund terminalでreleaseするが、pending claimを持つbondは解決まで
+lockedに残す。expiry releaseは未使用またはaccepted-unpaired SelfReplicatedだけを許し、pending canary/slash、paired、Self Local、その他used
+assignmentを拒否する。`fault_event_epoch`とdurable `applied_epoch`を分離し、terminal epoch/proofは
+offense-sortedな完全claim/terminal fact setとmax effective epochからcanonicalに導出する。
+
+scheduler-signed canary precommitはactive lockとcanonical envelopeを保存する。normal Receipt insertと
+`ReceiptSubmitted`はatomicである。pass terminal、mismatch/slash、receipt-missing worker slash、opening-
+missing scheduler fault/no-worker-slashをそれぞれ一transactionで確定する。passとopening-missingはbondを
+releaseせず、pending canary中のmaturityを拒否する。terminal後のmature epochをcanary completion以後へ
+遅延し、maturity transactionだけが`Mature` release/linkを行う。
+
+External settlementはauthority-verified funding/grant、scheduler request、k=2 pair、stable command、signed
+terminal confirmationを順にbindする。settlement confirmationはterminal、maturity、両worker bond release/
+link、WorkTicketV2を一SQLite transactionでcommitする。refundはterminalとeligible bond releaseをatomicに
+commitするが、maturity/ticketを生成せず、pending claimのbondは解決までreleaseしない。
+`SettlementPrepared` transitionは両bondがactiveでpending/upheld/default-final slashなしと同じtransactionで
+preflightする。`SettlementPrepared`または`RefundPrepared`以後のnon-replay slashを拒否する。
+
+restartでは`restore_audit`がselected pass/mismatch terminalを`AuditReplayRequired`で拒否する。
+`restore_selected_audit_with_replay`だけがstored challenge/canonical replayと全identity/epochを再照合し、
+再計算したmatch bit、submission commitment、completed epochをdurable terminalへexact比較する。
+
+DB file の possession は signer authorization を代替しない。受理前の stateless verifier が署名、
+request/assignment、manifest/evidence/opening を検証し、その typestate と canonical bytes だけを
+store へ渡す。
+
+発行時はowned non-symlink output directoryを`0700`に固定し、Receipt/公開JSON/completion markerを
+`0644`、暗号化bundle/DBを`0600`にする。DBはWAL `TRUNCATE` checkpoint、connection drop、main-file
+`fsync`を完了してからpublic artifactsを書き、各fileを`fsync`した後にmarkerを最後に作ってdirectoryを
+`fsync`する。marker v2はreceipt ID、bundle ID、公開JSON SHA-256を記録する。これはcross-file atomic
+renameではないためlate failureでpartial setは残り得るが、local verifierは全protected artifactの
+same-directory/expected filename/mode/owner/type/link count、exact marker、typed公開JSON
+`misaka.palw.public-receipt.v2`全体がsigned Receiptと
+authenticated bundle manifest/evidenceへ一致しないsetを拒否する。unknown fieldも全階層で拒否する。
+
+markerはunkeyed plain textでsignature/AEAD protectionを持たず、same-owner writerは公開JSONとmarkerを
+一緒に置換できる。しかしverifierは保持する`artifacts`と`observer_summary`を含むtyped文書全体を
+authenticated dataから再構成してexact照合するため、markerを書き直しても改変JSONは受理されない。
+marker/JSONはcompletenessとhuman-readable projectionのboundaryであり、canonical Receiptとauthenticated
+bundleのauthorityを代替しない。
+
+`verify_bundle_and_restore`はembedded snapshotsで再検証した後、既存DB rowへのexact continuityだけを
+認め、missing rowをinsertしない。第三者用`verify_bundle_stateless_with_trust`は外部scheduler/signer
+registry、expected network、approved manifest hashを必須とし、embedded snapshotをauthorityにしない。
+後者はbundle-bound historical `verification_epoch`でのstateless verificationであり、present-time network
+acceptanceやdurable replay reservationではない。
+
+fresh APIはcaller-selected epochがbundleのhistorical verification epoch���上であることを要求する。
+`verify_bundle_and_restore_at_epoch`はlocal embedded snapshotsでfresh `AcceptedReceipt`を作りoriginal durable
+acceptance epochを保持するが、bundle作成後のrevocationは学習できない。
+`verify_bundle_stateless_at_epoch_with_trust`はexternal rootsでfresh stateless typestateを作るがDB continuityを
+検査しない。production restartではcurrent external rootsと既存DB rowを同時に検査する
+`verify_bundle_and_restore_at_epoch_with_trust`を使う。future audit restoreではepochをbeacon以上にし、
+present-time network admissionは別途判断する。現行CLIはhistorical default restoreだけを呼び、fresh epochは
+library/service APIで指定する。
+
+## Residual risks
+
+- greedy decode でも driver/kernel/toolchain 差により bitwise output が変わり得る。
+- Metal graph-level logical-prefix sketch は lossy で、CUDA kernel/accumulator trace より弱い。
+- observer callback の read-only access は timing と synchronization を変え得る。
+- k=2 replica が同一所有者・同一障害 domain なら共謀耐性がない。
+- external registry/finality serviceが供給するfuture beaconが予測・操作可能ならaudit samplingが弱くなる。
+- auditor scheduling、model re-execution、opening deliveryはcrate外であり、durable audit stateだけでは
+  independent replayの運用を保証しない。
+- bond/external authority registryのproduction governance、key distribution、revocation deliveryはcrate外で、
+  同梱in-memory registryはnetwork consensusではない。
+- signed funding/terminal evidenceはauthorityのstatementをauthenticateするが、実collateralやpayment railを
+  crateが独立観測したproofではない。rail movementとlocal SQLite commitはdistributed atomicではない。
+- External `SettlementPrepared`/`RefundPrepared`後にauthority confirmationが来ない場合のtimeoutや
+  superseding terminalはなく、prepared stateのoperational recoveryは外部serviceに依存する。
+- durable canaryはscheduler opening欠落をscheduler faultとしてworker slashから分離するが、production
+  schedulerのprecommit/opening deliveryとavailabilityはcrate外である。
+- durable slashへ自動接続済みなのはaudit mismatch/timeoutとcanary mismatch/receipt timeoutである。
+  invalid-manifest、equivocation、duplicate-executionのproduction typed proof/orchestrationは未統合である。
+- legacy in-memory `BondLedger`、`CanaryRecord`、`ExternalEscrow` helperはraw caller mutationを許すため、
+  schema-v4 signed/durable authority pathの代用にしてはならない。
+- `future_audits.state=4`はpublic transitionではdeadlineを保持するが、SQL constraint単独では
+  `deadline_epoch NOT NULL`を要求しない。constraint-validなDB corruptionはload/release時にfail closedとなるが、
+  schema-level hardening余地が残る。
+- CU table は実時間・電力を表さず、versioned governance の対象である。
+- encrypted bundleはaudit keyを取得したsame-user/malicious hostからopeningを守らず、key backup/rotation/
+  retentionも自動化しない。
+- CI workflowやRTX実機でのvendored MMVQ diagnostic hook/E2E成功も、FA-off attentionの361-launch実機coverage、
+  production-approved kernel manifest identity、authority-bound full-stream verification、Receipt V2を代替せず、
+  R32 production acceptance authorityを与えない。
+
+production scheduler/network transport、governance key distribution、beacon/authority service、payment rail、
+NVIDIA CUDAのfull production issuance pathも未統合である。
+
+これらは runtime class 分離、independent identity、future beacon finality、versioned CU policy、
+bond/slashing、source統合済みFA-off attention hookの実機full-stream検証、release manifest authorityと
+attestation/proof layerで緩和する。

docs/state-machines.md

@@ -0,0 +1,551 @@
+# PALW State Machines and Policy V1
+
+本書は現行 `runtime-palw` が実際に持つtypestate、legacy in-memory helper、schema-v4 SQLite stateを
+区別して記述する。receipt/audit/canary/bond/external/maturityの主要transitionはdurable transactionで接続
+されたが、production scheduler/auditor/authority/payment service全体を実装した単一lifecycle daemonはない。
+
+## 1. Receipt verification and durable acceptance
+
+実装済みの型遷移:
+
+```text
+canonical bytes / SignedReceiptV1
+        |
+        v
+UnverifiedReceipt
+        | verify_stateless(...)
+        v
+StatelesslyVerifiedReceipt
+        | StateStore::accept (SQLite transaction)
+        v
+AcceptedReceipt
+```
+
+`verify_stateless` は body/signature、scheduler-derived assignment authorization、manifest、
+schedule/CU/trace、prompt/output openingを検証する。`StateStore::accept` はその後にのみ receipt ID、
+execution nullifier、job class、replica slotと`accepted_at_epoch`を永続予約し、成功した値だけを
+`AcceptedReceipt`へ昇格する。process restart後は同じcanonical signed receiptとruntime instanceで
+再度stateless verifyし、`restore_accepted`でoriginal acceptance epochを保持したtypestateを復元する。
+この値はrestart時の`verified_at_epoch`と区別される。
+
+exact assignmentのbond rowが存在するReceiptをgeneric `accept`へ渡すと
+`BondedReceiptRequiresAtomicAcceptance`になる。production bonded pathはactive lockとのworker/request/
+assignment/class/slot/runtime/epoch bindingを同じtransactionで検査する`accept_bonded`を使う。canaryは
+後述の`accept_canary`を使い、Receipt insertとcanary state更新の間のcrash gapを作らない。
+
+現行DBには `Received`、`Rejected`、`AwaitingBeacon` 等のreceipt lifecycle列はない。したがって
+genericな `Received -> ... -> Ticketed` CAS machineやtransition logは未実装である。拒否は各APIの
+errorであり、Rejected rowを保存しない。
+
+### Self Local path
+
+```text
+AcceptedReceipt
+  -> AuditRecord::new
+  -> authority-signed future beacon verify/apply
+  -> StateStore::store_audit_selection
+  -> StateStore::complete_selected_audit
+       または StateStore::mature_unselected_audit
+  -> assignment bond release/link（bonded path）
+  -> StateStore::issue_ticket -> WorkTicketV2
+```
+
+`AuditRecord::new` はexact `AcceptedReceipt`からnetwork、receipt ID、issued/accepted epoch、job/requestを
+bindする。beacon適用後のselectionとsigned beacon provenanceは`future_audits`へ保存する。selected path
+では`complete_selected_audit`がaudit-specific replay identity、typed projection verdict、terminal state、
+passing maturity sourceを1 transactionで確定する。non-selected pathでは
+`mature_unselected_audit`がchallenge-window maturityとsource登録を1 transactionで確定する。
+rawなprojection match boolやlocal maturity markerをstoreへ渡すpublic APIはない。bonded sourceならpassing
+maturityと同じtransactionでassignmentを`Mature` releaseしてsourceへlinkし、mismatch/timeoutならtyped
+slashを同じtransactionで適用する。historical unbonded Self Local rowはmatureになり得るが、required bond
+release linkがないためWork Ticket発行gateを通らない。
+
+ただしfinalized future beaconの取得/governance、independent auditor assignment、model再実行、encrypted
+opening配送は外部serviceのtrust boundaryである。durable state machineがそれらのproduction serviceを
+実装したことにはならない。
+
+### Restart verification bundle
+
+Receipt CLI は `--prompt-stdin` とoutput directory外の `--audit-key-file` を必須にする。argv promptの
+`--prompt TEXT`は存在しない。bundle public sectionはreceipt binding/ID、verification epoch、scheduler
+key snapshot、manifest、execution evidenceを含み、worker public keyを含むsigner record、signed
+request/assignment、prompt/output opening、owner saltはXChaCha20-Poly1305 private sectionへ暗号化する。
+
+発行setはoutput directory `0700`、Receipt/公開JSON/marker `0644`、bundle/DB `0600`。DBをWAL
+`TRUNCATE` checkpointし、DBと各fileを`fsync`した後、receipt ID、bundle ID、公開JSON SHA-256を記録する
+marker v2を最後に書く。cross-file atomic commitではないため途中artifactは残り得るが、markerのない
+setはcompleteではない。markerはunkeyed plain textで、crash-completeness signal以上のauthorityを持たない。
+
+local `verify_bundle_and_restore` はembedded key snapshotsでstateless verificationをやり直し、既存DBの
+exact accepted rowだけをrestoreする。local CLIは`--public-json`も必須とし、全artifactのsame private
+directory/expected filename/mode、marker v2、typed公開JSON `misaka.palw.public-receipt.v2`全体を検査する。保持する`artifacts`と
+`observer_summary`はauthenticated bundle manifest/evidenceから再構成してexact照合し、extra fieldは
+��階層で拒否する。same-owner writerはJSONとmarkerを一緒に置換できるが、改変JSONはこの照合を通らない。
+canonical Receipt/authenticated bundleをauthorityとする。missing rowを
+insertしない。external
+`verify_bundle_stateless_with_trust`はexpected network、external scheduler/signer registry、approved
+manifest hashを必須にするDBなしのpathで、embedded snapshotsをauthorityにせず、bundle-bound historical
+`verification_epoch`を検証する。present-time admissionとdurable acceptは行わない。
+
+future beacon後のrestoreには`verify_bundle_and_restore_at_epoch`がcaller-selected epochをhistorical値
+以上へ進め、original durable acceptance epochを保持したfresh `AcceptedReceipt`を返す。ただしembedded
+snapshotはlater revocationを学習しない。productionはcurrent external rootsとDB continuityを同時に検査する
+`verify_bundle_and_restore_at_epoch_with_trust`を使う。statelessだけなら
+`verify_bundle_stateless_at_epoch_with_trust`を使う。全fresh APIはepoch rollbackを拒否する。現行verifier
+CLIはhistorical default pathだけを呼ぶため、fresh epochはlibrary/service APIで指定する。
+
+### Replicated path
+
+```text
+AcceptedReceipt(slot 0) + AcceptedReceipt(slot 1)
+  -> K2Matcher::match_pair
+  -> MatchedReplicaPair
+  -> StateStore::store_pair
+  -> MatureEvidence::from_self_replicated_pair
+  -> StateStore::register_mature_evidence
+  -> assignment bonds 2件をatomic release/link
+  -> StateStore::issue_ticket -> WorkTicketV2
+```
+
+matcher は2 Receiptのprojectionとreceipt/execution/signer/credential/owner/assignment/runtime-instanceの
+独立性を検査する。`current_epoch`は両receiptのissued、original accepted、current verified epoch以上、
+expiry以下でなければならない。DBはpair本体と2 memberを同一transactionで保存する。
+`MatchedReplicaPair` はmatchに使った`current_epoch`をprivate `matched_epoch`として保持し、durable
+canonical pairにもcommitする。public constructorがその値をmaturity epochとしてopaque evidenceへ
+封入する。rawなpair maturity登録APIは存在せず、`register_mature_evidence`はstored pairの
+network/class/CU/matched epochとtyped evidenceを照合する。さらにpair member 2件からassignment IDを再取得し、
+両方がauthority-funded active lockでなければsource登録transaction全体をrollbackする。成功時は2件を
+`Mature` releaseしてsourceへlinkする。replay/restart時は同じlinksを再利用し、ticketは一回だけ発行できる。
+
+External Replicatedではpublic maturity registrationを拒否し、authority-confirmed durable settlement
+transactionだけがmaturity、2件のbond release/link、WorkTicketV2を作る。詳細は第6節を参照する。
+
+## 2. Scheduler messages
+
+現行実装は job/assignment の operational lifecycle table を持たない。実装されているのは immutable
+signed-message validation である。
+
+```text
+JobRequestV1 --scheduler Ed25519--> SignedJobRequestV1
+      |
+      +-- exact network/model/runtime/shape/evidence/epoch/escrow policy
+      v
+AssignmentV1 --scheduler Ed25519--> SignedAssignmentV1
+      |
+      +-- request binding, slot, credential, runtime instance, epoch containment
+      v
+AssignmentAuthorizationRecord
+```
+
+- scheduler key は network-scoped registry、valid-from/through、revocationで検証する。Ed25519は
+  `verify_strict`を使い、weak/small-order key recordを拒否する。
+- Self Localはslot 0、replicatedはslot 0/1だけ。
+- replicated requestは`GemmTraced`を要求する。
+- assignment validity intervalはrequest interval内でなければならない。
+- receipt verifierはassignmentのepochをexact一致でbindし、current epochが範囲外なら拒否する。
+
+`Requested/Scheduled/Running/Cancelled` 状態、scheduler queue、assignment cancellation、renewalは
+このcrateの状態機械にはない。cancelled stop reasonもwire protocolにはない。現行Receipt CLIはlocal
+scheduler keyを自己生成するため、production scheduler/network transportとの統合は別途必要である。
+
+## 3. Future audit
+
+`AuditRecord` の実装済み遷移:
+
+```text
+AwaitingBeacon
+  | apply_beacon(VerifiedFutureBeacon)
+  +--> NotSelected { mature_epoch }
+  |      | StateStore::mature_unselected_audit(current >= mature_epoch)
+  |      +--> Mature { ChallengeWindowElapsed } + mature source (atomic)
+  |
+  +--> Selected { challenge/beacon authority/deadline }
+         | complete_selected_audit(distinct StatelesslyVerifiedReceipt)
+         | before/equal deadline; typed projection match
+         +--> Mature { SelectedAuditPassed } + replay + source (atomic)
+         |
+         | typed projection mismatch before/equal deadline
+         +--> FailedMismatch + replay (atomic)
+         |
+         | expire_selected_audit(current_epoch > deadline)
+         +--> FailedTimeout
+```
+
+`SignedFutureBeaconV1`はversion/network/epoch/value body��authority key ID、Ed25519 signatureをstrict
+canonical decodeする。network-scoped authority registryはkey validity/revocation/weak keyを検査し、
+`verify_strict`成功後だけraw constructorを持たない`VerifiedFutureBeacon`を返す。beacon epochはverification
+時点以下かつoriginal receiptのissued epochとdurable accepted epochの両方より後でなければならない。
+beacon finalityとauthority registry governanceはcaller側serviceの責任である。
+
+selection は `(network, receipt, beacon_epoch, beacon_value)` の256-bit digestと固定256-bit thresholdの
+strict `<` 比較。v1 thresholdは一様digestの1/16、selected response windowは2 epoch、non-selected
+challenge windowは5 epochで、完全なfixed policyをpolicy IDへhashする。`store_audit_selection`はoriginal
+receiptのissued/accepted epoch、job/request binding、policy ID、beacon ID/value/authority key、canonical
+signed beacon、challenge/deadlineまたはmature epochを保存する。
+
+selected replayはnormal receipt slotへacceptせず、audit-specific `audit_replays` table/typestateへ一度だけ
+予約する。replayはbeacon後にissuedされ、submit epochがreplay issued/current stateless verified epoch以上、
+deadline以下でなければならない。originalとreplayはsame network/job/requestかつdistinct receipt、execution
+nullifier、assignment、runtime instance、signer key、worker credential、owner commitmentである。
+`VerifiedReplayVerdict`自身が両`MatchProjectionV1`を比較するため、external callerはraw match boolを作れない。
+
+restart時の`restore_audit`はstored rowとoriginal `AcceptedReceipt`をexact照合し、canonical signed beaconを
+current authority registryで再検証し、selection/challenge/deadlineを再計算する。selected pass/mismatch
+terminalは`restore_audit`単独では`AuditReplayRequired`になり、
+`restore_selected_audit_with_replay`がaudit rowとcanonical replay、全identity、issued/accepted epochを
+restoreし、match bit、submission commitment、completed epochをstored terminalへexact比較する。
+なお、prompt/opening配送、auditor assignment、model実行そのもの、auditor service identityはこのcrate外
+である。
+
+## 4. Canary
+
+canary は通常の signed request/assignment/Receipt を使い、Receipt bodyに markerを追加しない。
+期待projectionはsalt付きcommitmentだけを先に公開する。v1ではSelf Local/Self Replicatedだけを許し、
+paid External Replicated requestをhidden scheduler probeに転用しない。
+
+```text
+SignedCanaryPrecommitV1
+  | scheduler registry + request + assignment + active bond verify
+  v
+AwaitingReceipt (durable)
+  | accept_canary(StatelesslyVerifiedReceipt), now <= receipt_deadline
+  +--> ReceiptSubmitted + normal Receipt row (atomic)
+  |      | valid opening, opening_epoch <= now <= opening_deadline
+  |      +--> Passed, no slash (bond remains locked)
+  |      +--> FailedMismatch + typed CanaryFailure slash (atomic)
+  |      |
+  |      +-- now > opening_deadline
+  |           --> TimedOut { OpeningMissing, scheduler fault }, no slash
+  |               (bond remains locked)
+  |
+  +-- now > receipt_deadline
+       --> TimedOut { ReceiptMissing, worker fault } + typed CanaryFailure slash
+```
+
+precommit bodyはnetwork、canary/job/request/assignment/worker、expected commitment、created/receipt/opening
+windowをbindし、`canary-precommit/v1` IDをschedulerがstrict Ed25519署名する。registry keyはbody creation
+からopening deadlineまで有効で、verification epoch時点にrevokedであってはならない。完全なorderingは
+次である。
+
+```text
+assignment.issued <= created <= receipt_deadline <= assignment.expires
+    < opening_epoch <= opening_deadline
+```
+
+`register_verified_canary`はcanonical signed precommitをactive healthy assignment bondへbindし、同じ
+assignmentの既存Receipt、別canary、External classを拒否する。`accept_canary`はnetwork、worker、job、
+request、assignmentとdeadlineを検査し、normal replay/cardinality reservationと`ReceiptSubmitted`を
+`BEGIN IMMEDIATE` transactionで確定する。
+
+不正なsalt/projection openingはstateを変えずerrorとし、schedulerの壊れたopeningをworker slashへ
+変換しない。valid commitment opening後のprojection mismatchだけがworker faultである。receipt欠落は
+worker action欠落、opening欠落はscheduler action欠落とdurableに記録し、後者はworkerを不健康化/
+slashしない。passとOpeningMissingはassignment bondをreleaseせず、pending canaryがある間はmaturityを
+拒否する。terminal後のsource maturityはcanary completion epoch以上へ遅延し、そのmaturity transactionが
+bondを`Mature` release/linkする。明示expiryは未使用またはaccepted-unpaired SelfReplicatedだけに許し、
+pending canary/slash、paired、Self Local、その他used assignmentを拒否する。terminal proof、fault party、
+deadline、projection digestをschema constraintとload時のsemantic validationで再検査する。
+legacy in-memory `CanaryRecord` helperは残るが、production authority pathはこのsigned/durable APIである。
+
+## 5. Bond and slashing
+
+authoritative pathはschema-v4 SQLite accountである。network-scoped bond authority registryはEd25519 keyの
+validity/revocationとfunding/appeal/decision capabilityを分離する。`VerifiedBondFunding`はnetwork、worker、
+funding event、asset、exact amount/finality epochをbindし、canonical signed envelopeだけをcreditできる。
+same event/envelope replayはidempotent、same IDのconflicting payloadはfatalである。
+
+```text
+authority-signed finalized funding
+  -> available
+  -> lock_verified_assignment(scheduler-signed request + assignment)
+  -> locked assignment
+       +-- verified maturity --> Released + mature-source link
+       +-- eligible signed expiry --> Released
+       +-- typed fault --> immutable claim + derived pending allocation + unhealthy
+                              +-- no appeal after deadline --> finalized_slashed
+                              +-- verified appeal
+                                   +-- signed Uphold --> finalized_slashed
+                                   +-- signed Reverse --> allocation recompute
+                                   +-- decision deadline elapsed --> default Uphold
+```
+
+assignment lockはexact scheduler-signed request/assignmentをcurrent registryで検証し、uniqueかつjob class
+minimum以上、account healthy、epoch内でなければならない。bonded assignmentのReceiptはgeneric acceptを
+拒否し、active lockを同一transactionで検査する。release reasonは`Mature`、`Expired`、
+`CancelledBeforeExecution`、`SlashResolved`である。public durable pathで自動生成するのはmaturity、未使用または
+accepted-unpaired SelfReplicatedのexpiry、全slash claim解決後のtyped fault/refund terminal releaseである。
+pending canary/slash、paired receipt、Self Local、その他used assignmentはexpiry releaseを拒否する。
+
+account snapshot/transitionは次に加え、funding event合計、active assignment remaining、slash status別合計、
+healthをDB ledgerから再計算する。
+
+```text
+available + locked + pending_slashed + finalized_slashed == total_funded
+sum(assignment.remaining_amount) == locked
+sum(verified funding event.amount) == total_funded
+sum(pending/final slash.allocated_amount) == pending_slashed/finalized_slashed
+```
+
+default policy:
+
+| SlashReason tag | Reason | Assignment bond slash | Additional penalty |
+|---:|---|---:|---:|
+| 1 | `InvalidManifest` | 100% | 0 |
+| 2 | `AuditMismatch` | 100% | 0 |
+| 3 | `Equivocation` | 100% | 0 |
+| 4 | `DuplicateExecution` | 50% | 0 |
+| 5 | `CanaryFailure` | 100% | 0 |
+| 6 | `AuditTimeout` | policy値、default 25% | 0 |
+
+割合はinitial assignment amountにceil適用したimmutable claim targetである。allocationは全claimから
+order-independentに再計算する。finalized（uphold/default uphold）のmax-envelopeを優先し、pendingはその
+extensionだけを受けるため、overlapを加算しない。late equal/weaker claimは既存envelopeに覆われれば0、
+stronger claimはdeltaだけをallocateする。reverseも同じ再計算を行う。partial target後のremainderはactive
+lockとして残り、pendingまたはuphold/default-final claimを持つassignmentはmaturity/Work Ticketを生成しない。
+reverseはそのclaim allocationを0へ再配分するが、既存finalized envelopeをpendingへ戻さない。全claim解決後、
+audit mismatch/timeout terminalはreverse時も`SlashResolved` releaseし、canary fault terminalはmatching claimが
+uphold/default-finalの場合だけreleaseする。reversed canary claim単独ではreleaseしない。External refundも
+release terminal、eligible unpaired SelfReplicatedはexpiry、別のstronger claimは追加deltaへ進める。
+durable offense IDはreason、assignment、worker、policy、typed primary
+proofへbindし、attachment追加は同じoffenseへidempotent mergeする。audit mismatch/timeoutとcanary
+mismatch/receipt timeoutはstate transition自身がproofを作るため、callerはreason/raw hashからこれらの
+slashを捏造できない。invalid manifest、equivocation、duplicate executionのproduction proof wiringは未完了。
+
+`fault_event_epoch`はtyped proofが示す発生時刻、`applied_epoch`はdurable claim受理時刻として別に保存する。
+late equal/weaker/stronger claimはpending-full state 2にも保存できるが、fully finalized/exhausted state 3は
+新claimを拒否する。terminal epoch/proofはoffense ID順の全claim、各effective epochのmax、typed terminal fact
+setからcanonicalに導出する。audit/canary terminalとExternal prepared/terminalは新evidence cutoffで、
+Externalは`SettlementPrepared`または`RefundPrepared`以後のnon-replay slashを拒否する。
+
+standard policyのappeal deadlineはdurable slash `applied_epoch`から100 epochである。signed
+`submitted_epoch`とappeal verification epochの両方をinclusive window内に要求し、後者をdurable
+`accepted_epoch`として保存する。decision deadlineはそのaccepted epochから100である。
+`VerifiedSlashAppeal`はnetwork/worker/offense/assignment/appeal ID/submitted epochをbindする。
+`VerifiedSlashDecision`はappeal/offense、`Uphold|Reverse`、decided epochをbindし、signed decided epochと
+decision verification/acceptance epochの両方をdeadline以下でだけ受理する。`current_epoch > decision_deadline`なら
+`finalize_stale_slash_appeal`がdeterministic default-upholdをcommitする。appealなしは
+`current_epoch > appeal_deadline`でだけfinalizeできる。balance、slash/appeal/assignment terminal、health
+eventは各transactionで全claim allocationから再導出する。offenseごとにappealは1件でfirst stored
+signed/default decisionが勝ち、exact canonical replayだけは期限後もno-opである。
+
+legacy `BondLedger`はlocal arithmetic/test helperとして残り、raw initial balance/deposit/reasonを受ける。
+productionではこれをauthority-signed durable pathの代わりに使わない。authority署名も実collateralを
+crateが独立観測した証明ではなく、production registry/funding serviceは外部trust boundaryである。
+
+## 6. External escrow
+
+durable External Replicated pathは3種類のnetwork-scoped authority evidenceを要求する。
+
+- exact finalized `VerifiedFundingAttestation`
+- funding attestationとfunded bonusへbindした`VerifiedDemandWeightGrant`
+- stable payment commandとexact distributionへbindした`VerifiedTerminalConfirmation`
+
+authority keyはfunding/demand-weight/terminal capability、validity/revocation、strict Ed25519を検査する。
+durable transitionは次である。
+
+```text
+Verified exact funding + Verified demand grant
+  -> Funded
+  -> Assigned(scheduler-signed External request)
+  -> EvidenceReady(typed k=2 pair)
+  -> SettlementPrepared(stable payment command)
+  -> Settled + maturity + 2 bond releases/links + WorkTicketV2 (atomic)
+
+Funded | Assigned | EvidenceReady (state 1..3), now > terms expiry
+  -> RefundPrepared(stable payment command)
+  -> Refunded + eligible assignment bond releases (atomic; no maturity/ticket)
+```
+
+funding attestation amountとterminal distribution totalは次にexact一致する。
+
+```text
+required_reward + demand_bonus_amount + protocol_fee + failure_reserve
+```
+
+bonus amountはbase rewardに対するpayout cap、bonus bpsはweight cap（default +5,000）以内で、grantの
+asset/funding/amount/bps/intervalをtermsへexact bindする。assignmentはnetwork-scoped scheduler signature、
+ExternalReplicated class、escrow reference、prompt commitment、constraints、epoch containmentを検査する。
+
+EvidenceReadyにはtyped `MatchedReplicaPair`が必要で、network、request commitment、class、CU、expiryを
+照合する。settlement commandはworkerへbase+bonus、protocol fee、failure reserveのrequester refundを
+exact配分する。`SettlementPrepared`をcommitする`BEGIN IMMEDIATE` transactionは両assignmentがactive state 0で
+pending/upheld/default-final slashなしとpreflightする。`SettlementPrepared`と`RefundPrepared`はいずれも
+以後のnon-replay slashをcut offする。authority
+confirmation後、terminal、maturity basis/weight grant、両worker assignmentの
+Mature release/link、WorkTicketV2 insert、source consumptionを1transactionでcommitする。どちらかのbondが
+missing/nonactiveならsettlement transactionはrollbackし、escrowだけをworker bondの代用にしない。exact
+confirmation replayはstored ticketを返す。refund commandはstate 1..3のいずれからもterms expiry後に作れ、
+required total全額をrequesterへ返す。pair/EvidenceReadyの存在はrefundを妨げない。confirmed refundはterminalと
+関連するeligible active assignment bondの残額releaseを同じtransactionでcommitし、maturity/ticketは生じない。
+pending slash claimがあるassignmentはreleaseせず、claimがuphold/reverse/defaultのいずれかへ解決した後にだけ
+残額をresolved-terminal releaseできる。finalized slash allocationはrelease対象に戻さない。
+
+legacy in-memory `ExternalEscrow` helperは残るが、production authority pathはこのdurable APIである。crateは
+実payment railを操作せず、terminal authorityがrail finalityを正しく署名することを信頼する。rail movement
+とSQLite commitはdistributed atomicではなく、dispute/rail recovery/governance serviceもcrate外である。
+`SettlementPrepared`/`RefundPrepared`後にauthority confirmationが永久に来ない場合のtimeout/superseding
+terminalも未実装であり、prepared stateのoperational recoveryは外部service boundaryである。
+
+## 7. Work Ticket and weight
+
+typed maturity source:
+
+- Self Local: primary durable pathは`mature_unselected_audit`または`complete_selected_audit`がaudit
+  terminalと同じtransactionでsourceを���録する。bondedならassignmentをrelease/linkする。typed
+  constructorを使う場合もstored durable auditのexact state/basis/epochと再照合する
+- Self Replicated: `MatureEvidence::from_self_replicated_pair(MatchedReplicaPair)`。
+  maturity epochはmatcherが記録した`matched_epoch`。2 assignment bondを同じtransactionでrelease/linkする
+- External Replicated: authority-confirmed settlement transactionだけ。confirmation ID/epochとauthority-
+  signed weight grantをbindし、2 assignment bondをrelease/linkして即時ticketをcommitする
+
+`MatureEvidence`のfieldと低水準constructorはpublicではないため、外部callerはsource/class/CU/
+maturity reason/demand bonus/basis/grant/epochを自己申告できない。`StateStore::register_mature_evidence`は
+opaque proofをdurable receipt/pair/audit stateと再照合し、Externalはこのgeneric APIから拒否する。
+
+`WeightPolicy::v1()`:
+
+| Evidence basis | `weight_bps` | `weighted_CU` |
+|---|---:|---|
+| Self Local, challenge window elapsed | 2,500 | `ceil(CU*2500/10000)` |
+| Self Local, selected audit passed | 5,000 | `ceil(CU*5000/10000)` |
+| Self Replicated pair | 10,000 | `CU` |
+| External Replicated pair | 10,000 + funded demand bps（最大5,000） | 同じceil式 |
+
+`WorkTicketV2`はversion、network、source、`maturity_basis_id`、optional `weight_grant_id`、job class、
+policy version、CU、weight、issued epochを`work-ticket/v2` IDへhashする。Self classのgrantは必ずNone、
+Externalはzero bonusでもauthority grant IDが必須である。
+
+`StateStore::issue_ticket`は`issued_epoch >= stored mature_epoch`、required replica数と
+`mature_source_assignments` release link数を検査し、ticket insertと`consumed_ticket_id`更新を同じ
+transactionで行う。通常pathの二回目は`SourceAlreadyConsumed`になる。Externalだけはterminal confirmation
+transaction内で同じissuerを呼び、exact terminal replay時はstored ticketを返す。
+
+このweight変換はproduction network admissionやCUDA approvalそのものではない。bond gateはworker
+collateral lifecycleを閉じるが、runtime classがproduction approvedか、authority registryがnetwork
+governanceに採用されたかは別のadmission/service decisionである。
+
+## 8. Durable SQLite invariants
+
+`StateStore` は application ID `PALW`、schema version 4、`foreign_keys=ON`、`WAL`、
+`synchronous=FULL`、30秒busy timeoutを要求し、mutationは`BEGIN IMMEDIATE` transactionで行う。
+SQLite integerがsignedであるため、consensus `u64` は8-byte big-endian BLOBとして保存する。旧schema
+の暗黙migrationはなく、既存objectを持つapplication/user version 0 DBもclaimしない。
+
+open時はexact table set、column order、foreign-key count、required indexに加え、全non-internal
+`sqlite_master (type,name,tbl_name,sql)`をcanonical encodeしたSHA3-256をcompiled v4 goldenと照合する。
+同じtable/column名を保ったconstraint/index/DDL mutationも拒否する。portable snapshot/markerの前には
+`wal_checkpoint(TRUNCATE)`がbusy 0かつ全frame checkpoint済みであることを要求する。
+
+### Receipt and job
+
+- `receipt_id` はDB全体でunique
+- `execution_nullifier` はDB全体でunique
+- `(network_id, job_nullifier, replica_slot)` はunique
+- `(network_id, job_nullifier)` ごとのjob classは不変
+- Self Localはslot 0のみ、replicatedはslot 0/1のみ
+- canonical signed envelopeとauthorized runtime instanceを保存し、restart restore時にexact一致
+- `accepted_at_epoch`はfirst stateful acceptanceのstateless verification epochを保存し、restart時の
+  `verified_at_epoch`で上書きしない
+- restoreは`issued_epoch <= accepted_at_epoch <= expires_epoch`かつ
+  `accepted_at_epoch <= current verified_at_epoch`を要求し、epoch rollbackを拒否
+- assignment bond rowが存在するReceiptはgeneric acceptを拒否し、active exact lockとのatomic acceptanceを要求
+
+### Pair
+
+- pair candidateはprojection digest/pair IDを再計算
+- member 2件が両方accepted、同network/job/class、未失効でcandidate metadataと一致し、相互の
+  execution nullifierは異なる
+- `(network_id, job_nullifier)` は最大1 pair
+- receiptは最大1 pairのmember
+- pair rowと2 member rowは1transaction。partial pairはcommitされない
+- exact canonical replayはidempotent、同ID異内容はconflict
+- `matched_epoch`はmemberのissued/accepted epoch以上かつexpiry以下で、durable canonical pairにcommit
+
+### Future audit and replay
+
+- original accepted receiptはSelf Localで、stored network/job/request/issued/accepted epochとexact一致
+- applied beaconはoriginal issued/accepted epochより後、verification時点以下で、canonical signed envelope、
+  beacon ID/value/authority key IDを保存
+- restore時はcurrent authority registryのvalidity/revocation/strict Ed25519 verificationを再適用し、
+  selection、challenge ID、deadlineを再計算
+- selected challenge/original receiptごとにaudit replayは最大1件。replay receipt/execution/assignmentは
+  `audit_replays` table内でunique（normal `receipts` tableとのglobal uniquenessではない）
+- replay issued epochはbeaconより後、accepted epochはissued/current verification以上かつdeadline以下
+- selected passはreplay insert、audit terminal/maturity、Self Local mature sourceを1transaction
+- bonded selected passは同じtransactionでassignment release/link。selected mismatchはreplay insert、failed
+  terminal、typed slashを1transaction。timeoutと競合して片方だけcommitし、bonded timeoutもtyped slash
+- non-selected maturityはaudit terminal、Self Local mature source、bondedならrelease/linkを1transaction
+
+### Mature source and ticket
+
+- `source_id` はDB全体でunique
+- public registrationは`MatureEvidence`のみ。raw source/class/reason/epoch登録APIはない
+- receipt sourceはaccepted Self Localとexact network/class/CUが一致し、typed maturity reasonを持つ
+- pair sourceはstored replicated pairとexact network/class/CUが一致する
+- `maturity_basis_id`は全classに必須、`weight_grant_id`はExternalだけに必須
+- demand bonusはExternal Replicatedだけ、maturity epochはtyped evidence/terminal confirmationから保存
+- sourceとrequired assignment release IDを`mature_source_assignments`でlink。countはrequired replica数と一致
+- `source_id` はwork ticketでもunique
+- ticket issued epochはstored maturity epoch以上
+- ticket insertとsource consumed更新は1transaction
+
+### Bond, canary, slash, and external terminal
+
+- funding event、assignment、release、offense、appeal、canary、external authority evidence/terminalのbusiness
+  IDはunique。canonical exact replayだけidempotent
+- bond accountはavailable/locked/pending/finalized合計、funding ledger、active assignment、slash status、healthをreconcile
+- slash claimはfault/applied epoch、immutable target、derived allocationを分離し、offense-sorted complete setから
+  assignment terminal epoch/proofを再導出
+- assignment terminal rowはremaining 0、terminal epoch/proofを必須とし、network/worker foreign keyでbind
+- canary precommitはsigned envelopeのbody/key ID、assignment/worker/request/windowとstored rowを再照合
+- canary terminalはpass/mismatch/receipt timeout/opening timeoutごとのrequired/forbidden fieldとfault partyをconstraint
+- appealは`submitted <= accepted <= appeal_deadline`、decisionは`decided <= accepted <= decision_deadline`。
+  pendingだけdecisionを受け、期限後default upholdは別terminal state
+- external keyは`(network_id, escrow_reference)`。funding/grant/command/confirmation IDの再利用を拒否
+- terminalは`Settled`または`Refunded`のどちらか一方で、command/confirmation distribution totalはfunded totalとexact一致
+- settlementはterminal/maturity/bond links/ticketを1transaction、refundはterminalとeligible bond releaseを
+  1transactionでcommitする。pending claim分のbondは解決までlocked、conflicting replayはfatal
+
+future audit/replayのrow、signed beacon、selection/challenge、replay terminal outcomeを再検証するrestore
+APIと、bundleからrollbackなしでfresh later-epoch `AcceptedReceipt`を作るAPIは実装されている。bond/canary/
+external rowはverified typestateのcanonical signed bytesを保存し、load時にbody-to-row binding/ledger invariantsを
+再検査するが、production registry governanceやexternal rail finalityをDB自身が再取得するわけではない。
+
+## 9. Metal GraphFallback and CUDA R32 in-progress non-issuance
+
+現行 Qwen3.6-35B-A3B Metal runtime classは `TraceCapability::GraphFallback`。sketch modeでも各scheduled GEMM
+に1 synthetic graph tileを作るだけで、CUDA kernel/tile evidenceを名乗らない。
+
+`TraceCapability::KernelSketch` とwire tagは将来互換のため存在する。CUDAはadditive exact 184-byte V2
+recordとRust strict full-stream/dispatch/runtime binderを持つが、raw declared accumulator originはproofではない。
+authority署名、registry/runtime/job、operation schedule commitment、scheduled GEMM/attention coverage、
+full transcriptを検証した場合だけ
+`BoundCudaTranscriptV1 -> AuthorityBoundCudaTranscriptV2 -> AuthorityBoundCudaReceiptEvidenceV2`
+と進む、public raw constructorのないtypestateを実装した。V3 authority typestateは別versionの
+Receipt V2 builder/verifier、暗号化Bundle V2、SQLite V2 state machineへ接続されている。V1 builder/verifierは
+引き続きCUDA `KernelSketch`をfail closedで拒否する。
+
+Windows WSL2 Ubuntu 24.04のRTX 4060 Ti（sm_89）、CUDA Toolkit 13.3.1 / nvcc 13.3.73では、固定Qwenの37/37
+layer offloadとbatch 1 graph observer 6/6同一diagnostic streamを確認した。standaloneのtrue FP32
+producer-accumulator採取primitiveも最終grouped device suite 8/8とproducer 20/20同一diagnostic
+fingerprintを通過した。vendored llama.cpp Q4_K/Q6_K MMVQ producerはV3 full-K pre-epilogue hookへ
+接続済みで、same-backend Qwen 1-token diagnostic E2Eは253 MMVQ recordを取得する。
+
+FlashAttention-onlyのV2で表せなかったFA-off attentionに対し、V3 schema/binderはcanonical
+3-sublaunch groupingと実entry point直後collector/typed associationを実装する。253 MMVQにQK/softmax/PV
+各36を加えた361-launch実機E2E、5 work-class negative、exact release manifest、V2 stateless verification、
+encrypted bundle、atomic persistence/restart/replay/rollback gateは完了した。live callbackへの
+authority-derived canonical physical-layout ID接続はproduction境界として未統合である。
+`PALW_CUDA_TRACE_PRODUCTION_CAPABLE=0`、`PALW_CUDA_PRODUCER_VENDOR_RUNTIME_INTEGRATED=0`、
+`PALW_CUDA_PRODUCER_RECEIPT_MAPPING_AVAILABLE=0`、`PALW_CUDA_PRODUCER_PRODUCTION_CAPABLE=0`で、
+production CMake gateは意図的にfatalのままである。
+
+したがってR32は`In progress`であり、完了するまでproduction CUDA Receiptを発行せず、CUDA
+`KernelSketch`を根拠に
+production Work Ticketを発行しない。Metal GraphFallbackのlocal/development receiptと、production
+CUDA approvalは別gateである。
+
+さらにproduction scheduler/network、governance-backed signer/beacon/bond/external registryとauthority
+service、finalized beacon delivery、independent auditor re-execution、payment railは未統合である。invalid-
+manifest/equivocation/duplicate-executionのdurable typed slash proof wiringも残る。個別typestateやSQLite
+transitionの実装をproduction lifecycle service全体の完成と読み替えない。

models/.gitkeep

@@ -0,0 +1 @@
+

patches/llama.cpp-palw-observer.patch

@@ -0,0 +1,1792 @@
+diff --git a/ggml/include/ggml-metal.h b/ggml/include/ggml-metal.h
+index 433838f0..213e148d 100644
+--- a/ggml/include/ggml-metal.h
++++ b/ggml/include/ggml-metal.h
+@@ -56,6 +56,21 @@ GGML_BACKEND_API void ggml_backend_metal_capture_next_compute(ggml_backend_t bac
+ 
+ GGML_BACKEND_API ggml_backend_reg_t ggml_backend_metal_reg(void);
+ 
++// PALW kernel-level dispatch hook.
++//
++// When set (process-global), the callback is invoked for every Metal compute
++// dispatch with the bound pipeline (kernel) name and the launch geometry
++// (threadgroup grid tg0..2 and threads-per-threadgroup tptg0..2). This lets the
++// PALW observer produce a kernel-level execution trace bound to the actual GPU
++// kernel dispatches rather than to graph-node outputs. Pass NULL to disable.
++typedef void (*ggml_metal_palw_dispatch_cb)(
++        void * user_data,
++        const char * pipeline,
++        int tg0, int tg1, int tg2,
++        int tptg0, int tptg1, int tptg2);
++
++GGML_BACKEND_API void ggml_metal_palw_set_dispatch_hook(ggml_metal_palw_dispatch_cb cb, void * user_data);
++
+ #ifdef __cplusplus
+ }
+ #endif
+diff --git a/ggml/src/ggml-metal/ggml-metal-device.m b/ggml/src/ggml-metal/ggml-metal-device.m
+index 80e47f2c..3e36c08d 100644
+--- a/ggml/src/ggml-metal/ggml-metal-device.m
++++ b/ggml/src/ggml-metal/ggml-metal-device.m
+@@ -1,5 +1,6 @@
+ #import "ggml-metal-device.h"
+ 
++#import "ggml-metal.h"
+ #import "ggml-impl.h"
+ #import "ggml-backend-impl.h"
+ 
+@@ -72,6 +73,9 @@ void ggml_metal_cv_set_bool(ggml_metal_cv_t cv, bool value, int32_t idx) {
+ 
+ struct ggml_metal_pipeline {
+     id<MTLComputePipelineState> obj;
++
++    // PALW: stable kernel (pipeline) name, captured for kernel-level tracing.
++    char name[128];
+ };
+ 
+ ggml_metal_pipeline_t ggml_metal_pipeline_init(void) {
+@@ -79,6 +83,7 @@ ggml_metal_pipeline_t ggml_metal_pipeline_init(void) {
+ 
+     *res = (struct ggml_metal_pipeline) {
+         /*.obj  =*/ nil,
++        /*.name =*/ {0},
+     };
+ 
+     return res;
+@@ -443,6 +448,8 @@ struct ggml_metal_pipeline_with_params ggml_metal_library_compile_pipeline(ggml_
+ 
+         res.pipeline = ggml_metal_pipeline_init();
+         res.pipeline->obj = obj;
++        // PALW: record the stable kernel name for kernel-level dispatch tracing.
++        snprintf(res.pipeline->name, sizeof(res.pipeline->name), "%s", name);
+ 
+         ggml_metal_pipelines_add(lib->pipelines, name, res.pipeline);
+     }
+@@ -458,8 +465,23 @@ struct ggml_metal_pipeline_with_params ggml_metal_library_compile_pipeline(ggml_
+ 
+ struct ggml_metal_encoder {
+     id<MTLComputeCommandEncoder> obj;
++
++    // PALW: name of the pipeline currently bound, for kernel-level dispatch tracing.
++    const char * cur_pipeline;
+ };
+ 
++// PALW: process-global kernel-dispatch hook. When set, it is invoked for every
++// Metal compute dispatch with the bound pipeline (kernel) name and the launch
++// geometry (threadgroup grid + threads-per-threadgroup). Used by the PALW
++// observer to produce a kernel-level (not graph-fallback) execution trace.
++static ggml_metal_palw_dispatch_cb g_palw_dispatch_cb = NULL;
++static void *                      g_palw_dispatch_ud = NULL;
++
++void ggml_metal_palw_set_dispatch_hook(ggml_metal_palw_dispatch_cb cb, void * user_data) {
++    g_palw_dispatch_cb = cb;
++    g_palw_dispatch_ud = user_data;
++}
++
+ ggml_metal_encoder_t ggml_metal_encoder_init(ggml_metal_cmd_buf_t cmd_buf_raw, bool concurrent) {
+     ggml_metal_encoder_t res = calloc(1, sizeof(struct ggml_metal_encoder));
+ 
+@@ -491,6 +513,8 @@ void ggml_metal_encoder_debug_group_pop (ggml_metal_encoder_t encoder) {
+ 
+ void ggml_metal_encoder_set_pipeline(ggml_metal_encoder_t encoder, struct ggml_metal_pipeline_with_params pipeline) {
+     [encoder->obj setComputePipelineState:pipeline.pipeline->obj];
++    // PALW: remember the bound kernel name so dispatches can be attributed to it.
++    encoder->cur_pipeline = pipeline.pipeline->name;
+ }
+ 
+ void ggml_metal_encoder_set_bytes(ggml_metal_encoder_t encoder, void * data, size_t size, int idx) {
+@@ -506,6 +530,11 @@ void ggml_metal_encoder_set_threadgroup_memory_size(ggml_metal_encoder_t encoder
+ }
+ 
+ void ggml_metal_encoder_dispatch_threadgroups(ggml_metal_encoder_t encoder, int tg0, int tg1, int tg2, int tptg0, int tptg1, int tptg2) {
++    // PALW: report the kernel-level dispatch (bound pipeline + launch geometry).
++    if (g_palw_dispatch_cb) {
++        g_palw_dispatch_cb(g_palw_dispatch_ud, encoder->cur_pipeline ? encoder->cur_pipeline : "",
++                tg0, tg1, tg2, tptg0, tptg1, tptg2);
++    }
+     [encoder->obj dispatchThreadgroups:MTLSizeMake(tg0, tg1, tg2) threadsPerThreadgroup:MTLSizeMake(tptg0, tptg1, tptg2)];
+ }
+ 
+diff --git a/src/models/qwen35moe.cpp b/src/models/qwen35moe.cpp
+index 7b0876cb..4d955261 100644
+--- a/src/models/qwen35moe.cpp
++++ b/src/models/qwen35moe.cpp
+@@ -6,7 +6,18 @@ void llama_model_qwen35moe::load_arch_hparams(llama_model_loader & ml) {
+     ml.get_key(LLM_KV_EXPERT_SHARED_FEED_FORWARD_LENGTH, hparams.n_ff_shexp, false);
+     ml.get_key(LLM_KV_ATTENTION_LAYERNORM_RMS_EPS,       hparams.f_norm_rms_eps);
+ 
+-    ml.get_key_or_arr(LLM_KV_ROPE_DIMENSION_SECTIONS,    hparams.rope_sections, 4, true);
++    // PALW: newer HF->GGUF conversions write 3 mrope sections ([t, h, w]) and
++    // omit the trailing zero; older conversions write 4. Accept both forms and
++    // zero-pad so the pinned runtime loads current upstream GGUF artifacts.
++    {
++        std::vector<int32_t> sections;
++        ml.get_arr(LLM_KV_ROPE_DIMENSION_SECTIONS, sections, true);
++        if (sections.size() != 3 && sections.size() != 4) {
++            throw std::runtime_error("rope.dimension_sections must have 3 or 4 entries");
++        }
++        std::fill(hparams.rope_sections.begin(), hparams.rope_sections.end(), 0);
++        std::copy(sections.begin(), sections.end(), hparams.rope_sections.begin());
++    }
+ 
+     // Load linear attention (gated delta net) parameters
+     ml.get_key(LLM_KV_SSM_CONV_KERNEL,    hparams.ssm_d_conv);
+@@ -73,8 +84,13 @@ void llama_model_qwen35moe::load_arch_tensors(llama_model_loader & ml) {
+         layer.attn_post_norm = create_tensor(tn(LLM_TENSOR_ATTN_POST_NORM, "weight", il), { n_embd }, flags);
+ 
+         if (!hparams.is_recr(il)) {
+-            // Attention layers
+-            create_tensor_qkv(layer, il, n_embd, n_embd_head_k * n_head * 2, n_embd_k_gqa, n_embd_v_gqa, flags);
++            // Attention layers. The LLAMA_LOAD_LOCALS macro derives the global
++            // n_embd_k_gqa/n_embd_v_gqa from layer 0, which in this MoE is a
++            // linear-attention (recurrent) layer with n_head_kv == 0. Use the
++            // uniform full-attention KV projection width instead.
++            const int64_t n_embd_k_gqa_attn = hparams.n_embd_k_gqa_max();
++            const int64_t n_embd_v_gqa_attn = hparams.n_embd_v_gqa_max();
++            create_tensor_qkv(layer, il, n_embd, n_embd_head_k * n_head * 2, n_embd_k_gqa_attn, n_embd_v_gqa_attn, flags);
+             layer.wo = create_tensor(tn(LLM_TENSOR_ATTN_OUT, "weight", il), { n_embd_head_k * n_head, n_embd }, flags);
+ 
+             // Q/K normalization for attention layers
+@@ -86,7 +102,12 @@ void llama_model_qwen35moe::load_arch_tensors(llama_model_loader & ml) {
+             layer.wqkv           = create_tensor(tn(LLM_TENSOR_ATTN_QKV,       "weight", il), { n_embd, key_dim * 2 + value_dim }, TENSOR_NOT_REQUIRED);
+             layer.wqkv_gate      = create_tensor(tn(LLM_TENSOR_ATTN_GATE,      "weight", il), { n_embd, value_dim }, TENSOR_NOT_REQUIRED);
+             layer.ssm_conv1d     = create_tensor(tn(LLM_TENSOR_SSM_CONV1D,     "weight", il), { hparams.ssm_d_conv, conv_dim }, flags);
+-            layer.ssm_dt         = create_tensor(tn(LLM_TENSOR_SSM_DT,         "bias",   il), { hparams.ssm_dt_rank }, flags);
++            // PALW: some conversions store the delta-time bias without the
++            // ".bias" suffix ("blk.N.ssm_dt"). Accept both spellings.
++            layer.ssm_dt         = create_tensor(tn(LLM_TENSOR_SSM_DT,         "bias",   il), { hparams.ssm_dt_rank }, flags | TENSOR_NOT_REQUIRED);
++            if (!layer.ssm_dt) {
++                layer.ssm_dt     = create_tensor(tn(LLM_TENSOR_SSM_DT,                   il), { hparams.ssm_dt_rank }, flags);
++            }
+             layer.ssm_a          = create_tensor(tn(LLM_TENSOR_SSM_A_NOSCAN,             il), { hparams.ssm_dt_rank }, flags);
+             layer.ssm_beta       = create_tensor(tn(LLM_TENSOR_SSM_BETA,       "weight", il), { n_embd, n_v_heads }, flags);
+             layer.ssm_alpha      = create_tensor(tn(LLM_TENSOR_SSM_ALPHA,      "weight", il), { n_embd, n_v_heads }, flags);
+@@ -116,7 +137,11 @@ void llama_model_qwen35moe::load_arch_tensors(llama_model_loader & ml) {
+         layer.attn_norm      = create_tensor(tn(LLM_TENSOR_ATTN_NORM,      "weight", il), { n_embd }, 0);
+         layer.attn_post_norm = create_tensor(tn(LLM_TENSOR_ATTN_POST_NORM, "weight", il), { n_embd }, 0);
+ 
+-        create_tensor_qkv(layer, il, n_embd, n_embd_head_k * n_head * 2, n_embd_k_gqa, n_embd_v_gqa, 0);
++        // The MTP layer index has no entry in the per-layer n_head_kv array, so
++        // derive the KV projection width from the full-attention trunk layers.
++        const int64_t n_embd_k_gqa_mtp = hparams.n_embd_k_gqa_max();
++        const int64_t n_embd_v_gqa_mtp = hparams.n_embd_v_gqa_max();
++        create_tensor_qkv(layer, il, n_embd, n_embd_head_k * n_head * 2, n_embd_k_gqa_mtp, n_embd_v_gqa_mtp, 0);
+         layer.wo          = create_tensor(tn(LLM_TENSOR_ATTN_OUT,    "weight", il), { n_embd_head_k * n_head, n_embd }, 0);
+         layer.attn_q_norm = create_tensor(tn(LLM_TENSOR_ATTN_Q_NORM, "weight", il), { n_embd_head_k }, 0);
+         layer.attn_k_norm = create_tensor(tn(LLM_TENSOR_ATTN_K_NORM, "weight", il), { n_embd_head_k }, 0);
+@@ -147,6 +172,24 @@ void llama_model_qwen35moe::load_arch_tensors(llama_model_loader & ml) {
+     for (int i = n_layer; i < n_layer_all; ++i) {
+         load_block_mtp(i);
+     }
++
++    // PALW: the Ollama-packaged Qwen3.6-35B-A3B GGUF bundles the multimodal
++    // vision tower ("v.*") and, when the next-token/MTP head is not enabled by
++    // hyperparameters, the MTP sub-model ("mtp.*") in the same file. The pinned
++    // text runtime never builds those sibling sub-models, so account for their
++    // tensors here; otherwise done_getting_tensors() rejects the load for
++    // having created fewer tensors than the file contains. This does not weaken
++    // the check for a genuinely missing text tensor: only tensors that exist in
++    // the file under these sibling prefixes are counted, exactly once each.
++    for (const auto & entry : ml.weights_map) {
++        const std::string & name = entry.first;
++        const bool is_vision = name.rfind("v.", 0) == 0;
++        const bool is_mtp    = name.rfind("mtp.", 0) == 0;
++        if (is_vision || is_mtp) {
++            ml.size_data -= ggml_nbytes(entry.second.tensor);
++            ml.n_created++;
++        }
++    }
+ }
+ 
+ std::unique_ptr<llm_graph_context> llama_model_qwen35moe::build_arch_graph(const llm_graph_params & params) const {
+@@ -287,6 +330,12 @@ ggml_tensor * llama_model_qwen35moe::graph::build_layer_attn(
+     const int64_t n_embd_head = hparams.n_embd_head_v();
+     GGML_ASSERT(n_embd_head == hparams.n_embd_head_k());
+ 
++    // PALW: the llm_graph_context base initializes n_head/n_head_kv from layer
++    // 0, which in this hybrid MoE is a linear-attention layer with n_head_kv 0.
++    // Use the per-layer counts for the full-attention reshapes below.
++    const int64_t n_head    = hparams.n_head(il);
++    const int64_t n_head_kv = hparams.n_head_kv(il);
++
+     // Order: joint QG projection, QG split, Q norm, KV projection, K norm, RoPE, attention
+ 
+     // Qwen3Next uses a single Q projection that outputs query + gate
+diff --git a/tools/CMakeLists.txt b/tools/CMakeLists.txt
+index 780df326..a1f04870 100644
+--- a/tools/CMakeLists.txt
++++ b/tools/CMakeLists.txt
+@@ -28,6 +28,7 @@ else()
+     endif()
+     add_subdirectory(tokenize)
+     add_subdirectory(parser)
++    add_subdirectory(palw-observer)
+     add_subdirectory(tts)
+     add_subdirectory(mtmd)
+     if (GGML_RPC)
+diff --git a/tools/palw-observer/CMakeLists.txt b/tools/palw-observer/CMakeLists.txt
+new file mode 100644
+index 00000000..40e3ffd8
+--- /dev/null
++++ b/tools/palw-observer/CMakeLists.txt
+@@ -0,0 +1,9 @@
++set(TARGET llama-palw-observer)
++
++add_executable(${TARGET} palw-observer.cpp)
++target_link_libraries(${TARGET} PRIVATE llama llama-common-base ${CMAKE_THREAD_LIBS_INIT})
++target_compile_features(${TARGET} PRIVATE cxx_std_17)
++
++if(LLAMA_TOOLS_INSTALL)
++    install(TARGETS ${TARGET} RUNTIME)
++endif()
+diff --git a/tools/palw-observer/README.md b/tools/palw-observer/README.md
+new file mode 100644
+index 00000000..efd1823b
+--- /dev/null
++++ b/tools/palw-observer/README.md
+@@ -0,0 +1,66 @@
++# PALW native graph observer
++
++`llama-palw-observer` is a non-interactive, single-request Qwen3.6-35B-A3B runner.
++It uses only the public llama and ggml APIs and writes versioned JSONL records to
++stdout. Runtime and model logs are written to stderr.
++
++## Build and run
++
++```sh
++cmake --build build-palw --target llama-palw-observer -j
++build-palw/bin/llama-palw-observer \
++  --model /path/to/Qwen3.6-abliterated-35b-Claude-4.7-Q4_K_M.gguf \
++  --prompt "Hello" \
++  --n-predict 8 \
++  --observer graph
++```
++
++The runner fixes greedy sampling, request batch, logical/physical token batch,
++parallel sequences, tensor parallelism, and CPU thread counts to one. It also
++disables context shifting, speculation, Flash Attention, and split-model tensor
++parallelism. The prompt is therefore evaluated one token at a time. The context
++is sized before execution and the run fails instead of shifting when the prompt
++and prediction bound exceed the model training context.
++
++The accepted model profile is hybrid Qwen3.6-35B-A3B (mixture-of-experts):
++architecture `qwen35moe`, 40 layers, 2048 hidden elements, and a 248320-token
++vocabulary, decoder-only. Per-layer head counts vary (the model alternates
++linear-attention/state-space layers with full-attention layers), so head counts
++are not part of the accepted profile. Other profiles fail before a header or
++inference result is emitted. Legitimate zero-element recurrent-state-cache graph
++nodes are skipped rather than treated as errors.
++
++## Observer modes
++
++- `off` installs no scheduler callback.
++- `graph` emits metadata for every graph node from the callback's `ask` stage.
++  It never requests tensor data.
++- `sketch` emits the same metadata and requests post-compute data only for plain
++  `MUL_MAT` nodes (indirect expert GEMM, `MUL_MAT_ID`, is emitted as an ordinary
++  metadata node, not sketched). It copies at most the first 64 contiguous output
++  elements through `ggml_backend_tensor_get`. Each element becomes one
++  hexadecimal nibble: one sign bit and a fixed three-bit magnitude bucket. The
++  resulting 64 hex digits are a 256-bit sketch. Raw activation values are never
++  serialized.
++
++Nibble bit 3 is the sign bit. Bits 0-2 use these absolute-value buckets: zero,
++`(0, 2^-8)`, `[2^-8, 2^-4)`, `[2^-4, 2^-2)`, `[2^-2, 1)`, `[1, 4)`,
++`[4, 16)`, and `[16, infinity)`. Fewer than 64 available elements are padded
++with zero nibbles.
++
++Every stdout line has `schema`, `schema_version`, and `record`. A successful run
++contains one `header`, zero or more `event` records, and one `result`. The result
++contains prompt token IDs, sampled token IDs (including an EOG token when one is
++sampled), the non-special generated output bytes, and the stop reason.
++
++## Limits
++
++This target is a runtime-observation prototype, not a PALW receipt generator.
++It does not calculate canonical compute units, sign receipts, form commitments,
++or trace CUDA kernels. The sketch tile is explicitly identified as
++`graph_fallback_logical_prefix_v1`, and `kernel_trace.claim` is
++`not_a_cuda_kernel_trace`. Scheduler callbacks add synchronization and can
++change timing, but they must not change token IDs or output bytes. The sketch is
++lossy observation data, not a cryptographic proof. Graph topology and floating
++point results can vary across backends or hardware, so byte identity is only
++claimed for repeated runs of the same pinned model, runtime, and backend class.
+diff --git a/tools/palw-observer/palw-observer.cpp b/tools/palw-observer/palw-observer.cpp
+new file mode 100644
+index 00000000..83fc243b
+--- /dev/null
++++ b/tools/palw-observer/palw-observer.cpp
+@@ -0,0 +1,1473 @@
++#include "ggml-backend.h"
++#include "ggml.h"
++#include "ggml-metal.h"
++#include "llama.h"
++#include "build-info.h"
++
++#include <algorithm>
++#include <array>
++#include <charconv>
++#include <clocale>
++#include <cmath>
++#include <cstdint>
++#include <cstdio>
++#include <cstring>
++#include <exception>
++#include <limits>
++#include <memory>
++#include <string>
++#include <string_view>
++#include <utility>
++#include <vector>
++
++namespace {
++
++constexpr const char * SCHEMA_NAME = "misaka.palw.runtime_observer";
++// Schema v2 adds "route" records: the real mixture-of-experts Top-K expert
++// selection (the `ffn_moe_topk` tensor) read back post-compute. Consumers that
++// only understand v1 must reject v2.
++constexpr int SCHEMA_VERSION = 2;
++constexpr size_t SKETCH_SAMPLES = 64;
++// Upper bound on selected-expert indices read back from one routing tensor:
++// n_expert_used (Top-K) * n_tokens for a single mixture-of-experts layer.
++constexpr size_t MAX_ROUTE_INDICES = 262144;
++
++// PALW #5 diagnostic: empirically map Metal kernel dispatches to graph nodes so
++// the node<->dispatch correlation can be validated before it is committed as a
++// kernel-level trace. Enabled only when PALW_TRACE_DIAG is set in the env.
++static bool g_diag_enabled = false;
++constexpr uint32_t PALW_CONTEXT_TOKENS = 4096;
++
++enum class observer_mode {
++    off,
++    graph,
++    sketch,
++};
++
++struct options {
++    std::string model_path;
++    std::string prompt;
++    int32_t n_predict = -1;
++    int32_t n_gpu_layers = 999;
++    observer_mode mode = observer_mode::off;
++    bool prompt_set = false;
++    bool prompt_stdin = false;
++    bool emit_output_bytes = false;
++};
++
++struct model_metadata {
++    std::vector<std::pair<std::string, std::string>> entries;
++};
++
++static const char * mode_name(observer_mode mode) {
++    switch (mode) {
++        case observer_mode::off:    return "off";
++        case observer_mode::graph:  return "graph";
++        case observer_mode::sketch: return "sketch";
++    }
++    return "invalid";
++}
++
++static void log_callback(ggml_log_level level, const char * text, void *) {
++    const char * label = "unknown";
++    switch (level) {
++        case GGML_LOG_LEVEL_NONE:  label = "none";  break;
++        case GGML_LOG_LEVEL_DEBUG: label = "debug"; break;
++        case GGML_LOG_LEVEL_INFO:  label = "info";  break;
++        case GGML_LOG_LEVEL_WARN:  label = "warn";  break;
++        case GGML_LOG_LEVEL_ERROR: label = "error"; break;
++        case GGML_LOG_LEVEL_CONT:  label = "cont";  break;
++    }
++    std::fprintf(stderr, "[llama:%s] %s", label, text ? text : "");
++}
++
++static void print_usage(const char * argv0) {
++    std::fprintf(stderr,
++            "usage: %s --model MODEL (--prompt TEXT|--prompt-stdin) --n-predict N "
++            "[--observer off|graph|sketch] [--n-gpu-layers N] [--emit-output-bytes]\n",
++            argv0);
++}
++
++static bool parse_i32(const char * value, int32_t min_value, int32_t max_value, int32_t & result) {
++    if (!value || value[0] == '\0') {
++        return false;
++    }
++    int32_t parsed = 0;
++    const char * end = value + std::strlen(value);
++    const auto converted = std::from_chars(value, end, parsed);
++    if (converted.ec != std::errc() || converted.ptr != end || parsed < min_value || parsed > max_value) {
++        return false;
++    }
++    result = parsed;
++    return true;
++}
++
++static bool take_value(int argc, char ** argv, int & i, const char * option, const char *& value) {
++    if (i + 1 >= argc) {
++        std::fprintf(stderr, "error: %s requires a value\n", option);
++        return false;
++    }
++    value = argv[++i];
++    return true;
++}
++
++static bool parse_options(int argc, char ** argv, options & opts, bool & help, bool & version) {
++    help = false;
++    version = false;
++    for (int i = 1; i < argc; ++i) {
++        const std::string_view arg(argv[i]);
++        const char * value = nullptr;
++        if (arg == "--help" || arg == "-h") {
++            help = true;
++            return true;
++        } else if (arg == "--version") {
++            version = true;
++            return true;
++        } else if (arg == "--model" || arg == "-m") {
++            if (!take_value(argc, argv, i, argv[i], value)) {
++                return false;
++            }
++            opts.model_path = value;
++        } else if (arg == "--prompt" || arg == "-p") {
++            if (opts.prompt_stdin) {
++                std::fprintf(stderr, "error: --prompt and --prompt-stdin are mutually exclusive\n");
++                return false;
++            }
++            if (!take_value(argc, argv, i, argv[i], value)) {
++                return false;
++            }
++            opts.prompt = value;
++            opts.prompt_set = true;
++        } else if (arg == "--prompt-stdin") {
++            if (opts.prompt_set || opts.prompt_stdin) {
++                std::fprintf(stderr, "error: prompt input may be selected only once\n");
++                return false;
++            }
++            opts.prompt_stdin = true;
++        } else if (arg == "--emit-output-bytes") {
++            opts.emit_output_bytes = true;
++        } else if (arg == "--n-predict" || arg == "-n") {
++            if (!take_value(argc, argv, i, argv[i], value) ||
++                    !parse_i32(value, 0, 65536, opts.n_predict)) {
++                std::fprintf(stderr, "error: --n-predict must be an integer in [0, 65536]\n");
++                return false;
++            }
++        } else if (arg == "--n-gpu-layers" || arg == "-ngl") {
++            if (!take_value(argc, argv, i, argv[i], value) ||
++                    !parse_i32(value, -1, 100000, opts.n_gpu_layers)) {
++                std::fprintf(stderr, "error: --n-gpu-layers must be an integer in [-1, 100000]\n");
++                return false;
++            }
++        } else if (arg == "--observer") {
++            if (!take_value(argc, argv, i, argv[i], value)) {
++                return false;
++            }
++            const std::string_view mode(value);
++            if (mode == "off") {
++                opts.mode = observer_mode::off;
++            } else if (mode == "graph") {
++                opts.mode = observer_mode::graph;
++            } else if (mode == "sketch") {
++                opts.mode = observer_mode::sketch;
++            } else {
++                std::fprintf(stderr, "error: --observer must be off, graph, or sketch\n");
++                return false;
++            }
++        } else {
++            std::fprintf(stderr, "error: unknown argument: %s\n", argv[i]);
++            return false;
++        }
++    }
++
++    if (opts.model_path.empty()) {
++        std::fprintf(stderr, "error: --model is required\n");
++        return false;
++    }
++    if (opts.prompt_stdin) {
++        std::array<char, 8192> buffer = {};
++        while (true) {
++            const size_t count = std::fread(buffer.data(), 1, buffer.size(), stdin);
++            if (count != 0) {
++                if (opts.prompt.size() > static_cast<size_t>(std::numeric_limits<int32_t>::max()) - count) {
++                    std::fprintf(stderr, "error: stdin prompt exceeds the tokenizer API bound\n");
++                    return false;
++                }
++                opts.prompt.append(buffer.data(), count);
++            }
++            if (count != buffer.size()) {
++                if (std::ferror(stdin)) {
++                    std::fprintf(stderr, "error: failed to read prompt from stdin\n");
++                    return false;
++                }
++                break;
++            }
++        }
++        opts.prompt_set = true;
++    }
++    if (!opts.prompt_set) {
++        std::fprintf(stderr, "error: --prompt is required (an explicitly empty prompt is allowed)\n");
++        return false;
++    }
++    if (opts.n_predict < 0) {
++        std::fprintf(stderr, "error: --n-predict is required\n");
++        return false;
++    }
++    if (opts.prompt.size() > static_cast<size_t>(std::numeric_limits<int32_t>::max())) {
++        std::fprintf(stderr, "error: prompt exceeds the tokenizer API bound\n");
++        return false;
++    }
++    return true;
++}
++
++static void append_json_string(std::string & out, std::string_view value) {
++    static constexpr char hex[] = "0123456789abcdef";
++    out.push_back('"');
++    for (const unsigned char c : value) {
++        switch (c) {
++            case '"': out += "\\\""; break;
++            case '\\': out += "\\\\"; break;
++            case '\b': out += "\\b";  break;
++            case '\f': out += "\\f";  break;
++            case '\n': out += "\\n";  break;
++            case '\r': out += "\\r";  break;
++            case '\t': out += "\\t";  break;
++            default:
++                if (c < 0x20) {
++                    out += "\\u00";
++                    out.push_back(hex[c >> 4]);
++                    out.push_back(hex[c & 0x0f]);
++                } else {
++                    out.push_back(static_cast<char>(c));
++                }
++                break;
++        }
++    }
++    out.push_back('"');
++}
++
++static void append_bool(std::string & out, bool value) {
++    out += value ? "true" : "false";
++}
++
++template<typename T>
++static void append_integer(std::string & out, T value) {
++    out += std::to_string(value);
++}
++
++static void append_float(std::string & out, double value) {
++    if (!std::isfinite(value)) {
++        out += "null";
++        return;
++    }
++    char buffer[64];
++    const int n = std::snprintf(buffer, sizeof(buffer), "%.9g", value);
++    if (n <= 0 || static_cast<size_t>(n) >= sizeof(buffer)) {
++        out += "null";
++        return;
++    }
++    out.append(buffer, static_cast<size_t>(n));
++}
++
++static bool write_json_line(const std::string & line) {
++    if (std::fwrite(line.data(), 1, line.size(), stdout) != line.size() ||
++            std::fputc('\n', stdout) == EOF || std::fflush(stdout) != 0) {
++        std::fprintf(stderr, "error: failed to write JSONL to stdout\n");
++        return false;
++    }
++    return true;
++}
++
++static void append_record_prefix(std::string & out, const char * record) {
++    out += "{\"schema\":\"";
++    out += SCHEMA_NAME;
++    out += "\",\"schema_version\":";
++    append_integer(out, SCHEMA_VERSION);
++    out += ",\"record\":";
++    append_json_string(out, record);
++}
++
++static size_t bounded_name_length(const char * name) {
++    size_t length = 0;
++    while (length < GGML_MAX_NAME && name[length] != '\0') {
++        ++length;
++    }
++    return length;
++}
++
++static std::string_view tensor_name(const ggml_tensor * tensor) {
++    if (!tensor) {
++        return {};
++    }
++    return std::string_view(tensor->name, bounded_name_length(tensor->name));
++}
++
++static std::string lowercase(std::string_view value) {
++    std::string result;
++    result.reserve(value.size());
++    for (const unsigned char c : value) {
++        if (c >= 'A' && c <= 'Z') {
++            result.push_back(static_cast<char>(c - 'A' + 'a'));
++        } else {
++            result.push_back(static_cast<char>(c));
++        }
++    }
++    return result;
++}
++
++static bool has_text(std::string_view value, std::string_view needle) {
++    return value.find(needle) != std::string_view::npos;
++}
++
++static void collect_related_names(const ggml_tensor * tensor, std::vector<std::string_view> & names) {
++    if (!tensor) {
++        return;
++    }
++    if (!tensor_name(tensor).empty()) {
++        names.push_back(tensor_name(tensor));
++    }
++    if (tensor->view_src && !tensor_name(tensor->view_src).empty()) {
++        names.push_back(tensor_name(tensor->view_src));
++    }
++    for (int i = 0; i < GGML_MAX_SRC; ++i) {
++        const ggml_tensor * src = tensor->src[i];
++        if (!src) {
++            continue;
++        }
++        if (!tensor_name(src).empty()) {
++            names.push_back(tensor_name(src));
++        }
++        if (src->view_src && !tensor_name(src->view_src).empty()) {
++            names.push_back(tensor_name(src->view_src));
++        }
++    }
++}
++
++static bool related_names_contain(const ggml_tensor * tensor, std::string_view needle) {
++    std::vector<std::string_view> names;
++    collect_related_names(tensor, names);
++    for (const auto name : names) {
++        if (has_text(lowercase(name), needle)) {
++            return true;
++        }
++    }
++    return false;
++}
++
++static bool parse_decimal_at(std::string_view name, size_t offset, int & value) {
++    if (offset >= name.size() || name[offset] < '0' || name[offset] > '9') {
++        return false;
++    }
++    uint64_t parsed = 0;
++    size_t i = offset;
++    while (i < name.size() && name[i] >= '0' && name[i] <= '9') {
++        parsed = parsed * 10 + static_cast<unsigned>(name[i] - '0');
++        if (parsed > static_cast<uint64_t>(std::numeric_limits<int>::max())) {
++            return false;
++        }
++        ++i;
++    }
++    value = static_cast<int>(parsed);
++    return true;
++}
++
++static bool parse_layer_from_name(std::string_view name, int & layer) {
++    const size_t dash = name.rfind('-');
++    if (dash != std::string_view::npos && dash + 1 < name.size()) {
++        int parsed = -1;
++        if (parse_decimal_at(name, dash + 1, parsed)) {
++            size_t end = dash + 1;
++            while (end < name.size() && name[end] >= '0' && name[end] <= '9') {
++                ++end;
++            }
++            if (end == name.size()) {
++                layer = parsed;
++                return true;
++            }
++        }
++    }
++
++    const size_t block = name.find("blk.");
++    if (block != std::string_view::npos && parse_decimal_at(name, block + 4, layer)) {
++        return true;
++    }
++
++    if (has_text(lowercase(name), "cache_")) {
++        const size_t marker = name.rfind("_l");
++        if (marker != std::string_view::npos && parse_decimal_at(name, marker + 2, layer)) {
++            return true;
++        }
++    }
++    return false;
++}
++
++static int tensor_layer(const ggml_tensor * tensor) {
++    int layer = -1;
++    if (parse_layer_from_name(tensor_name(tensor), layer)) {
++        return layer;
++    }
++    std::vector<std::string_view> names;
++    collect_related_names(tensor, names);
++    for (const auto name : names) {
++        if (parse_layer_from_name(name, layer)) {
++            return layer;
++        }
++    }
++    return -1;
++}
++
++static void append_shape(std::string & out, const ggml_tensor * tensor) {
++    out.push_back('[');
++    for (int i = 0; i < GGML_MAX_DIMS; ++i) {
++        if (i != 0) {
++            out.push_back(',');
++        }
++        append_integer(out, tensor->ne[i]);
++    }
++    out.push_back(']');
++}
++
++static void append_token_ids(std::string & out, const std::vector<llama_token> & tokens) {
++    out.push_back('[');
++    for (size_t i = 0; i < tokens.size(); ++i) {
++        if (i != 0) {
++            out.push_back(',');
++        }
++        append_integer(out, tokens[i]);
++    }
++    out.push_back(']');
++}
++
++class graph_observer {
++public:
++    graph_observer(observer_mode mode, int32_t n_layers) : mode_(mode), n_layers_(n_layers) {}
++
++    void set_phase(const char * phase, int64_t step) {
++        phase_ = phase;
++        phase_step_ = step;
++    }
++
++    bool failed() const {
++        return failed_;
++    }
++
++    const std::string & error() const {
++        return error_;
++    }
++
++    uint64_t event_count() const {
++        return event_sequence_;
++    }
++
++    static bool callback(ggml_tensor * tensor, bool ask, void * user_data) noexcept {
++        auto * observer = static_cast<graph_observer *>(user_data);
++        try {
++            return observer->on_tensor(tensor, ask);
++        } catch (const std::exception & exception) {
++            observer->fail(std::string("observer exception: ") + exception.what());
++        } catch (...) {
++            observer->fail("observer exception: unknown");
++        }
++        return false;
++    }
++
++private:
++    observer_mode mode_;
++    int32_t n_layers_;
++    std::string phase_ = "uninitialized";
++    int64_t phase_step_ = -1;
++    uint64_t event_sequence_ = 0;
++    bool failed_ = false;
++    std::string error_;
++
++    // Kernel-level dispatch capture (Metal). Every compute dispatch is appended
++    // here by the backend hook; each GEMM node is then attributed to the actual
++    // matmul kernel dispatch that produced it (validated 1:1 on-device).
++    struct kdispatch {
++        std::string kernel;
++        int tg[3];
++        int tptg[3];
++    };
++    std::vector<kdispatch> dispatches_;
++    size_t processed_dispatches_ = 0;
++    bool have_kernel_ = false;
++    kdispatch current_kernel_{};
++
++public:
++    // Called by the ggml-metal dispatch hook for every compute dispatch.
++    void on_dispatch(const char * kernel, int tg0, int tg1, int tg2, int tptg0, int tptg1, int tptg2) {
++        kdispatch d;
++        d.kernel = kernel ? kernel : "";
++        d.tg[0] = tg0; d.tg[1] = tg1; d.tg[2] = tg2;
++        d.tptg[0] = tptg0; d.tptg[1] = tptg1; d.tptg[2] = tptg2;
++        dispatches_.push_back(std::move(d));
++        if (g_diag_enabled) {
++            std::fprintf(stderr, "PALW_DIAG dispatch #%zu pipeline=%s tg=%d,%d,%d tptg=%d,%d,%d\n",
++                    dispatches_.size(), kernel ? kernel : "", tg0, tg1, tg2, tptg0, tptg1, tptg2);
++        }
++    }
++
++    static void dispatch_hook(void * user_data, const char * pipeline,
++            int tg0, int tg1, int tg2, int tptg0, int tptg1, int tptg2) {
++        static_cast<graph_observer *>(user_data)->on_dispatch(
++                pipeline, tg0, tg1, tg2, tptg0, tptg1, tptg2);
++    }
++
++private:
++    // Attributes the just-computed GEMM node to the last matmul (non-expert-id)
++    // dispatch in its ASK->POST window. Expert GEMMs use distinct `*_id_*`
++    // kernels and are excluded. Returns false (fail-closed) if none is found.
++    bool resolve_gemm_kernel() {
++        have_kernel_ = false;
++        for (size_t i = dispatches_.size(); i > processed_dispatches_; --i) {
++            const std::string & k = dispatches_[i - 1].kernel;
++            const bool is_matmul =
++                    (k.find("mul_mv") != std::string::npos || k.find("mul_mm") != std::string::npos) &&
++                    k.find("_id") == std::string::npos;
++            if (is_matmul) {
++                current_kernel_ = dispatches_[i - 1];
++                have_kernel_ = true;
++                break;
++            }
++        }
++        processed_dispatches_ = dispatches_.size();
++        if (!have_kernel_) {
++            fail("no matmul kernel dispatch found for GEMM node");
++            return false;
++        }
++        return true;
++    }
++
++    void fail(std::string message) {
++        if (!failed_) {
++            failed_ = true;
++            error_ = std::move(message);
++            std::fprintf(stderr, "observer error: %s\n", error_.c_str());
++        }
++    }
++
++    bool validate_tensor(const ggml_tensor * tensor, bool validate_op) {
++        if (!tensor) {
++            fail("null graph tensor");
++            return false;
++        }
++        if (bounded_name_length(tensor->name) == GGML_MAX_NAME) {
++            fail("graph tensor name is not terminated");
++            return false;
++        }
++        const int type = static_cast<int>(tensor->type);
++        if (type < 0 || type >= static_cast<int>(GGML_TYPE_COUNT)) {
++            fail("graph tensor type is outside public ggml bounds");
++            return false;
++        }
++        if (validate_op) {
++            const int op = static_cast<int>(tensor->op);
++            if (op < 0 || op >= static_cast<int>(GGML_OP_COUNT)) {
++                fail("graph op is outside public ggml bounds");
++                return false;
++            }
++        }
++
++        // An empty (zero-element) tensor is valid graph metadata for recurrent
++        // state gathers and carries no storage to validate.
++        if (is_empty(tensor)) {
++            return true;
++        }
++
++        uint64_t elements = 1;
++        for (int i = 0; i < GGML_MAX_DIMS; ++i) {
++            const uint64_t dimension = static_cast<uint64_t>(tensor->ne[i]);
++            if (elements > static_cast<uint64_t>(std::numeric_limits<int64_t>::max()) / dimension) {
++                fail("graph tensor element count overflows int64");
++                return false;
++            }
++            elements *= dimension;
++        }
++        if (elements != static_cast<uint64_t>(ggml_nelements(tensor)) || ggml_nbytes(tensor) == 0) {
++            fail("graph tensor storage bounds are inconsistent");
++            return false;
++        }
++        return true;
++    }
++
++    bool validate_node(const ggml_tensor * tensor) {
++        if (!validate_tensor(tensor, true)) {
++            return false;
++        }
++        for (int i = 0; i < GGML_MAX_SRC; ++i) {
++            if (tensor->src[i] && !validate_tensor(tensor->src[i], false)) {
++                return false;
++            }
++        }
++        const int layer = tensor_layer(tensor);
++        if (layer >= n_layers_) {
++            fail("graph layer id exceeds model layer count");
++            return false;
++        }
++        if (is_gemm(tensor)) {
++            if (!tensor->src[0] || !tensor->src[1]) {
++                fail("GEMM node is missing an input");
++                return false;
++            }
++            if (tensor->src[0]->ne[0] != tensor->src[1]->ne[0] ||
++                    tensor->ne[0] != tensor->src[0]->ne[1] ||
++                    tensor->ne[1] != tensor->src[1]->ne[1]) {
++                fail("GEMM dimensions are inconsistent");
++                return false;
++            }
++        }
++        return true;
++    }
++
++    // Only the plain dense GEMM is sketched. Indirect expert GEMM
++    // (GGML_OP_MUL_MAT_ID) is emitted as an ordinary metadata node; its
++    // batched, id-indexed output layout is committed by the adapter as a
++    // generic compute operation rather than an accumulator sketch.
++    static bool is_gemm(const ggml_tensor * tensor) {
++        return tensor->op == GGML_OP_MUL_MAT;
++    }
++
++    static bool is_empty(const ggml_tensor * tensor) {
++        for (int i = 0; i < GGML_MAX_DIMS; ++i) {
++            if (tensor->ne[i] <= 0) {
++                return true;
++            }
++        }
++        return false;
++    }
++
++    // The mixture-of-experts Top-K selection tensor: the concrete list of expert
++    // indices chosen per token. Captured post-compute so the receipt commits the
++    // real routing, not merely that routing of some shape occurred. Matched by
++    // the llama.cpp `cb` label and the I32 index type.
++    static bool is_route_tensor(const ggml_tensor * tensor) {
++        return tensor->type == GGML_TYPE_I32 &&
++                has_text(lowercase(tensor_name(tensor)), "ffn_moe_topk");
++    }
++
++    std::vector<std::string> categories(const ggml_tensor * tensor) const {
++        std::vector<std::string> result;
++        if (is_gemm(tensor)) {
++            result.emplace_back("gemm");
++        }
++        if (tensor->op == GGML_OP_NORM || tensor->op == GGML_OP_RMS_NORM ||
++                tensor->op == GGML_OP_GROUP_NORM || tensor->op == GGML_OP_L2_NORM) {
++            result.emplace_back("norm");
++        }
++        if (tensor->op == GGML_OP_ROPE || tensor->op == GGML_OP_ROPE_BACK) {
++            result.emplace_back("rope");
++        }
++        if (tensor->op == GGML_OP_FLASH_ATTN_EXT || tensor->op == GGML_OP_FLASH_ATTN_BACK ||
++                related_names_contain(tensor, "attn") || related_names_contain(tensor, "qcur") ||
++                related_names_contain(tensor, "kcur") || related_names_contain(tensor, "vcur") ||
++                related_names_contain(tensor, "kq")) {
++            result.emplace_back("attention");
++        }
++        if (related_names_contain(tensor, "cache_") || related_names_contain(tensor, "_cache")) {
++            result.emplace_back("kv_cache");
++        }
++        if (result.empty()) {
++            result.emplace_back("other");
++        }
++        return result;
++    }
++
++    static int magnitude_bucket(float value) {
++        const float magnitude = std::fabs(value);
++        if (magnitude == 0.0f) return 0;
++        if (magnitude < 0.00390625f) return 1;
++        if (magnitude < 0.0625f) return 2;
++        if (magnitude < 0.25f) return 3;
++        if (magnitude < 1.0f) return 4;
++        if (magnitude < 4.0f) return 5;
++        if (magnitude < 16.0f) return 6;
++        return 7;
++    }
++
++    bool make_sketch(const ggml_tensor * tensor, std::string & sketch, size_t & copied_bytes, size_t & sampled) {
++        if (!tensor->buffer || !ggml_is_contiguous(tensor)) {
++            fail("GEMM output is not backed by a contiguous public backend tensor");
++            return false;
++        }
++
++        size_t element_size = 0;
++        switch (tensor->type) {
++            case GGML_TYPE_F32:  element_size = sizeof(float); break;
++            case GGML_TYPE_F16:  element_size = sizeof(ggml_fp16_t); break;
++            case GGML_TYPE_BF16: element_size = sizeof(ggml_bf16_t); break;
++            default:
++                fail("GEMM output type is unsupported by sign/bucket sketch v1");
++                return false;
++        }
++
++        const uint64_t n_elements = static_cast<uint64_t>(ggml_nelements(tensor));
++        sampled = static_cast<size_t>(std::min<uint64_t>(SKETCH_SAMPLES, n_elements));
++        if (sampled > std::numeric_limits<size_t>::max() / element_size) {
++            fail("GEMM sketch copy bound overflows size_t");
++            return false;
++        }
++        copied_bytes = sampled * element_size;
++        if (copied_bytes > ggml_nbytes(tensor)) {
++            fail("GEMM sketch copy exceeds tensor storage");
++            return false;
++        }
++
++        std::vector<uint8_t> host(copied_bytes);
++        ggml_backend_tensor_get(tensor, host.data(), 0, copied_bytes);
++
++        static constexpr char hex[] = "0123456789abcdef";
++        sketch.assign(SKETCH_SAMPLES, '0');
++        for (size_t i = 0; i < sampled; ++i) {
++            float value = 0.0f;
++            if (tensor->type == GGML_TYPE_F32) {
++                std::memcpy(&value, host.data() + i * element_size, sizeof(value));
++            } else if (tensor->type == GGML_TYPE_F16) {
++                ggml_fp16_t packed;
++                std::memcpy(&packed, host.data() + i * element_size, sizeof(packed));
++                value = ggml_fp16_to_fp32(packed);
++            } else {
++                ggml_bf16_t packed;
++                std::memcpy(&packed, host.data() + i * element_size, sizeof(packed));
++                value = ggml_bf16_to_fp32(packed);
++            }
++            if (!std::isfinite(value)) {
++                fail("GEMM sketch encountered a non-finite output");
++                return false;
++            }
++            const unsigned nibble = (std::signbit(value) ? 8u : 0u) |
++                    static_cast<unsigned>(magnitude_bucket(value));
++            sketch[i] = hex[nibble];
++        }
++        return true;
++    }
++
++    void append_tensor_metadata(std::string & out, const ggml_tensor * tensor) const {
++        out += "\"name\":";
++        append_json_string(out, tensor_name(tensor));
++        out += ",\"op\":";
++        append_json_string(out, ggml_op_name(tensor->op));
++        out += ",\"type\":";
++        append_json_string(out, ggml_type_name(tensor->type));
++        out += ",\"shape\":";
++        append_shape(out, tensor);
++        out += ",\"n_bytes\":";
++        append_integer(out, ggml_nbytes(tensor));
++    }
++
++    bool emit_event(const ggml_tensor * tensor, const char * stage,
++            const std::string * sketch, size_t copied_bytes, size_t sampled) {
++        std::string line;
++        line.reserve(2048);
++        append_record_prefix(line, "event");
++        line += ",\"event_seq\":";
++        append_integer(line, event_sequence_++);
++        line += ",\"observer\":";
++        append_json_string(line, mode_name(mode_));
++        line += ",\"phase\":";
++        append_json_string(line, phase_);
++        line += ",\"phase_step\":";
++        append_integer(line, phase_step_);
++        line += ",\"stage\":";
++        append_json_string(line, stage);
++
++        const int layer = tensor_layer(tensor);
++        line += ",\"layer\":";
++        if (layer < 0) {
++            line += "null";
++        } else {
++            append_integer(line, layer);
++        }
++
++        line += ",\"categories\":[";
++        const auto node_categories = categories(tensor);
++        for (size_t i = 0; i < node_categories.size(); ++i) {
++            if (i != 0) {
++                line.push_back(',');
++            }
++            append_json_string(line, node_categories[i]);
++        }
++        line += "],\"tensor\":{";
++        append_tensor_metadata(line, tensor);
++        line += "},\"sources\":[";
++        bool first_source = true;
++        for (int i = 0; i < GGML_MAX_SRC; ++i) {
++            if (!tensor->src[i]) {
++                continue;
++            }
++            if (!first_source) {
++                line.push_back(',');
++            }
++            first_source = false;
++            line.push_back('{');
++            append_tensor_metadata(line, tensor->src[i]);
++            line.push_back('}');
++        }
++        line.push_back(']');
++
++        if (is_gemm(tensor)) {
++            line += ",\"gemm\":{\"variant\":\"ggml_graph_op_v1\",\"m\":";
++            append_integer(line, tensor->src[0]->ne[1]);
++            line += ",\"n\":";
++            append_integer(line, tensor->src[1]->ne[1]);
++            line += ",\"k\":";
++            append_integer(line, tensor->src[0]->ne[0]);
++            line += ",\"batch_shape\":[";
++            append_integer(line, tensor->ne[2]);
++            line.push_back(',');
++            append_integer(line, tensor->ne[3]);
++            line += "]}";
++        }
++
++        if (sketch) {
++            line += ",\"sketch\":{\"version\":\"sign_bucket_256_v1\",\"bits\":256,";
++            line += "\"encoding\":\"hex\",\"probe\":\"contiguous_prefix_64_v1\",";
++            line += "\"sample_count\":";
++            append_integer(line, sampled);
++            line += ",\"copied_bytes\":";
++            append_integer(line, copied_bytes);
++            line += ",\"value\":";
++            append_json_string(line, *sketch);
++            line += "},\"tile\":{\"variant\":\"graph_fallback_logical_prefix_v1\",";
++            line += "\"linear_offset\":0,\"linear_elements\":";
++            append_integer(line, sampled);
++            if (have_kernel_) {
++                // Kernel-level binding: the actual Metal compute pipeline (kernel)
++                // and its launch geometry that produced this GEMM output. This is
++                // launch-geometry + output-sketch bound to a real GPU dispatch,
++                // not a CUDA-style intra-kernel accumulator sketch.
++                line += "},\"kernel_trace\":{\"available\":true,\"backend\":\"metal\",";
++                line += "\"claim\":\"metal_kernel_launch_bound_v1\",\"kernel\":";
++                append_json_string(line, current_kernel_.kernel);
++                line += ",\"threadgroups\":[";
++                append_integer(line, current_kernel_.tg[0]);
++                line.push_back(',');
++                append_integer(line, current_kernel_.tg[1]);
++                line.push_back(',');
++                append_integer(line, current_kernel_.tg[2]);
++                line += "],\"threads_per_threadgroup\":[";
++                append_integer(line, current_kernel_.tptg[0]);
++                line.push_back(',');
++                append_integer(line, current_kernel_.tptg[1]);
++                line.push_back(',');
++                append_integer(line, current_kernel_.tptg[2]);
++                line += "]}";
++            } else {
++                line += "},\"kernel_trace\":{\"available\":false,\"backend\":\"none\",";
++                line += "\"claim\":\"not_a_cuda_kernel_trace\"}";
++            }
++        }
++
++        line.push_back('}');
++        if (!write_json_line(line)) {
++            fail("stdout JSONL write failed");
++            return false;
++        }
++        return true;
++    }
++
++    // Reads the mixture-of-experts Top-K selection tensor back from the compute
++    // backend and emits a "route" record carrying the real per-token selected
++    // expert indices. ne[0] is the number of experts selected per token (Top-K);
++    // the remaining dimensions are the token count.
++    bool emit_route(const ggml_tensor * tensor) {
++        if (!tensor->buffer) {
++            fail("route tensor has no backend buffer");
++            return false;
++        }
++        const uint64_t experts_used = static_cast<uint64_t>(tensor->ne[0]);
++        const uint64_t tokens = static_cast<uint64_t>(tensor->ne[1]) *
++                static_cast<uint64_t>(tensor->ne[2]) * static_cast<uint64_t>(tensor->ne[3]);
++        const uint64_t total = experts_used * tokens;
++        if (experts_used == 0 || tokens == 0 || total > MAX_ROUTE_INDICES) {
++            fail("route tensor shape is out of bounds");
++            return false;
++        }
++
++        // Read each selected index using the tensor's byte strides, so a strided
++        // Top-K view of the argsort output is captured correctly.
++        std::vector<int32_t> indices;
++        indices.reserve(static_cast<size_t>(total));
++        for (uint64_t t = 0; t < tokens; ++t) {
++            for (uint64_t e = 0; e < experts_used; ++e) {
++                const size_t offset = static_cast<size_t>(e) * tensor->nb[0] +
++                        static_cast<size_t>(t) * tensor->nb[1];
++                if (offset + sizeof(int32_t) > ggml_nbytes(tensor)) {
++                    fail("route tensor read exceeds tensor storage");
++                    return false;
++                }
++                int32_t value = 0;
++                ggml_backend_tensor_get(tensor, &value, offset, sizeof(int32_t));
++                indices.push_back(value);
++            }
++        }
++
++        std::string line;
++        line.reserve(1024);
++        append_record_prefix(line, "route");
++        line += ",\"event_seq\":";
++        append_integer(line, event_sequence_++);
++        line += ",\"observer\":";
++        append_json_string(line, mode_name(mode_));
++        line += ",\"phase\":";
++        append_json_string(line, phase_);
++        line += ",\"phase_step\":";
++        append_integer(line, phase_step_);
++        const int layer = tensor_layer(tensor);
++        line += ",\"layer\":";
++        if (layer < 0) {
++            line += "null";
++        } else {
++            append_integer(line, layer);
++        }
++        line += ",\"experts_used\":";
++        append_integer(line, experts_used);
++        line += ",\"tokens\":";
++        append_integer(line, tokens);
++        line += ",\"selected_experts\":[";
++        for (size_t i = 0; i < indices.size(); ++i) {
++            if (i != 0) {
++                line.push_back(',');
++            }
++            append_integer(line, indices[i]);
++        }
++        line += "]}";
++        if (!write_json_line(line)) {
++            fail("stdout JSONL write failed");
++            return false;
++        }
++        return true;
++    }
++
++    bool on_tensor(ggml_tensor * tensor, bool ask) {
++        if (failed_ || mode_ == observer_mode::off) {
++            return false;
++        }
++        // Recurrent (state-space / gated-delta-net) layers gather an initially
++        // empty state cache, producing legitimate zero-element graph nodes. They
++        // perform no compute, so they are skipped rather than treated as errors.
++        if (tensor && is_empty(tensor)) {
++            return false;
++        }
++        if (!validate_node(tensor)) {
++            return false;
++        }
++
++        if (g_diag_enabled && is_gemm(tensor)) {
++            std::fprintf(stderr, "PALW_DIAG %s MUL_MAT node=%.*s layer=%d dispatch#=%zu\n",
++                    ask ? "ASK " : "POST", (int) tensor_name(tensor).size(), tensor_name(tensor).data(),
++                    tensor_layer(tensor), dispatches_.size());
++        }
++
++        if (ask) {
++            if (mode_ == observer_mode::graph) {
++                emit_event(tensor, "ask_metadata", nullptr, 0, 0);
++                return false;
++            }
++            if (is_gemm(tensor)) {
++                return true;
++            }
++            // Sketch mode also reads back the mixture-of-experts Top-K selection
++            // so the receipt commits the real routing content.
++            if (is_route_tensor(tensor)) {
++                return true;
++            }
++            emit_event(tensor, "ask_metadata", nullptr, 0, 0);
++            return false;
++        }
++
++        if (mode_ != observer_mode::sketch) {
++            fail("unexpected post-compute callback");
++            return false;
++        }
++        if (is_route_tensor(tensor)) {
++            return emit_route(tensor);
++        }
++        if (!is_gemm(tensor)) {
++            fail("unexpected post-compute callback");
++            return false;
++        }
++
++        // Bind this GEMM to the actual Metal matmul kernel dispatch that produced
++        // it before sketching its output.
++        if (!resolve_gemm_kernel()) {
++            return false;
++        }
++        std::string sketch;
++        size_t copied_bytes = 0;
++        size_t sampled = 0;
++        if (!make_sketch(tensor, sketch, copied_bytes, sampled)) {
++            return false;
++        }
++        return emit_event(tensor, "post_compute_sketch", &sketch, copied_bytes, sampled);
++    }
++};
++
++static bool get_model_string(const llama_model * model, int32_t index, bool key, std::string & value) {
++    std::vector<char> buffer(256);
++    for (int attempt = 0; attempt < 3; ++attempt) {
++        const int32_t length = key
++                ? llama_model_meta_key_by_index(model, index, buffer.data(), buffer.size())
++                : llama_model_meta_val_str_by_index(model, index, buffer.data(), buffer.size());
++        if (length < 0) {
++            return false;
++        }
++        if (static_cast<size_t>(length) < buffer.size()) {
++            value.assign(buffer.data(), static_cast<size_t>(length));
++            return true;
++        }
++        buffer.resize(static_cast<size_t>(length) + 1);
++    }
++    return false;
++}
++
++static bool read_model_metadata(const llama_model * model, model_metadata & metadata) {
++    const int32_t count = llama_model_meta_count(model);
++    if (count < 0 || count > 100000) {
++        std::fprintf(stderr, "error: model metadata count is outside bounds\n");
++        return false;
++    }
++    metadata.entries.reserve(static_cast<size_t>(count));
++    for (int32_t i = 0; i < count; ++i) {
++        std::string key;
++        std::string value;
++        if (!get_model_string(model, i, true, key) || !get_model_string(model, i, false, value)) {
++            std::fprintf(stderr, "error: failed to read model metadata index %d\n", i);
++            return false;
++        }
++        metadata.entries.emplace_back(std::move(key), std::move(value));
++    }
++    return true;
++}
++
++static const std::string * find_metadata(const model_metadata & metadata, const char * key) {
++    for (const auto & entry : metadata.entries) {
++        if (entry.first == key) {
++            return &entry.second;
++        }
++    }
++    return nullptr;
++}
++
++static bool validate_qwen36_35b_a3b_profile(const llama_model * model, const model_metadata & metadata) {
++    const std::string * architecture = find_metadata(metadata, "general.architecture");
++    const llama_vocab * vocab = llama_model_get_vocab(model);
++    if (!architecture || *architecture != "qwen35moe" ||
++            llama_model_n_layer(model) != 40 ||
++            llama_model_n_embd(model) != 2048 ||
++            llama_vocab_n_tokens(vocab) != 248320 ||
++            llama_model_has_encoder(model) || !llama_model_has_decoder(model)) {
++        std::fprintf(stderr,
++                "error: model is not the supported Qwen3.6-35B-A3B MoE profile "
++                "(qwen35moe, 40 layers, 2048 hidden, 248320 vocab); observed "
++                "arch=%s layers=%d embd=%d head=%d head_kv=%d vocab=%d\n",
++                architecture ? architecture->c_str() : "(none)",
++                llama_model_n_layer(model),
++                llama_model_n_embd(model),
++                llama_model_n_head(model),
++                llama_model_n_head_kv(model),
++                llama_vocab_n_tokens(vocab));
++        return false;
++    }
++    return true;
++}
++
++static const char * device_type_name(enum ggml_backend_dev_type type) {
++    switch (type) {
++        case GGML_BACKEND_DEVICE_TYPE_CPU:   return "cpu";
++        case GGML_BACKEND_DEVICE_TYPE_GPU:   return "gpu";
++        case GGML_BACKEND_DEVICE_TYPE_IGPU:  return "igpu";
++        case GGML_BACKEND_DEVICE_TYPE_ACCEL: return "accelerator";
++        case GGML_BACKEND_DEVICE_TYPE_META:  return "meta";
++    }
++    return "unknown";
++}
++
++static bool emit_header(const options & opts, const llama_model * model, const llama_context * context,
++        const model_metadata & metadata, size_t prompt_tokens) {
++    char description[1024] = {};
++    const int32_t description_length = llama_model_desc(model, description, sizeof(description));
++    if (description_length < 0 || static_cast<size_t>(description_length) >= sizeof(description)) {
++        std::fprintf(stderr, "error: model description exceeds header bound\n");
++        return false;
++    }
++
++    std::string line;
++    line.reserve(32768);
++    append_record_prefix(line, "header");
++    line += ",\"observer\":";
++    append_json_string(line, mode_name(opts.mode));
++    line += ",\"trace_variant\":";
++    if (opts.mode == observer_mode::off) {
++        append_json_string(line, "none");
++    } else if (opts.mode == observer_mode::graph) {
++        append_json_string(line, "ggml_sched_ask_metadata_v1");
++    } else {
++        append_json_string(line, "ggml_sched_fixed_prefix_sketch_v1");
++    }
++    line += ",\"cuda_kernel_trace\":false";
++
++    line += ",\"model\":{\"path\":";
++    append_json_string(line, opts.model_path);
++    line += ",\"description\":";
++    append_json_string(line, description);
++    line += ",\"tensor_size_bytes\":";
++    append_integer(line, llama_model_size(model));
++    line += ",\"parameter_count\":";
++    append_integer(line, llama_model_n_params(model));
++    line += ",\"file_type\":";
++    append_integer(line, static_cast<int>(llama_model_ftype(model)));
++    line += ",\"n_ctx_train\":";
++    append_integer(line, llama_model_n_ctx_train(model));
++    line += ",\"n_embd\":";
++    append_integer(line, llama_model_n_embd(model));
++    line += ",\"n_layer\":";
++    append_integer(line, llama_model_n_layer(model));
++    line += ",\"n_head\":";
++    append_integer(line, llama_model_n_head(model));
++    line += ",\"n_head_kv\":";
++    append_integer(line, llama_model_n_head_kv(model));
++    line += ",\"n_vocab\":";
++    append_integer(line, llama_vocab_n_tokens(llama_model_get_vocab(model)));
++    line += ",\"rope_type\":";
++    append_integer(line, static_cast<int>(llama_model_rope_type(model)));
++    line += ",\"rope_freq_scale_train\":";
++    append_float(line, llama_model_rope_freq_scale_train(model));
++    line += ",\"metadata\":[";
++    for (size_t i = 0; i < metadata.entries.size(); ++i) {
++        if (i != 0) {
++            line.push_back(',');
++        }
++        line += "{\"key\":";
++        append_json_string(line, metadata.entries[i].first);
++        line += ",\"value\":";
++        append_json_string(line, metadata.entries[i].second);
++        line.push_back('}');
++    }
++    line += "]}";
++
++    line += ",\"runtime\":{\"ggml_version\":";
++    append_json_string(line, ggml_version());
++    line += ",\"ggml_commit\":";
++    append_json_string(line, ggml_commit());
++    line += ",\"system_info\":";
++    append_json_string(line, llama_print_system_info());
++    line += ",\"supports_gpu_offload\":";
++    append_bool(line, llama_supports_gpu_offload());
++    line += ",\"requested_gpu_layers\":";
++    append_integer(line, opts.n_gpu_layers);
++    line += ",\"devices\":[";
++    const size_t device_count = ggml_backend_dev_count();
++    for (size_t i = 0; i < device_count; ++i) {
++        if (i != 0) {
++            line.push_back(',');
++        }
++        const ggml_backend_dev_t device = ggml_backend_dev_get(i);
++        ggml_backend_dev_props properties = {};
++        ggml_backend_dev_get_props(device, &properties);
++        line += "{\"name\":";
++        append_json_string(line, properties.name ? properties.name : "");
++        line += ",\"description\":";
++        append_json_string(line, properties.description ? properties.description : "");
++        line += ",\"type\":";
++        append_json_string(line, device_type_name(properties.type));
++        line += ",\"memory_free_observed\":";
++        append_integer(line, properties.memory_free);
++        line += ",\"memory_total\":";
++        append_integer(line, properties.memory_total);
++        line.push_back('}');
++    }
++    line += "]}";
++
++    line += ",\"execution_policy\":{\"sampling\":\"greedy\",\"temperature\":0,";
++    line += "\"top_p\":1,\"top_k\":0,\"batch\":1,\"request_batch\":1,\"n_batch\":";
++    append_integer(line, llama_n_batch(context));
++    line += ",\"n_ubatch\":";
++    append_integer(line, llama_n_ubatch(context));
++    line += ",\"parallel\":1,\"parallel_sequences\":";
++    append_integer(line, llama_n_seq_max(context));
++    line += ",\"tensor_parallel\":1,\"split_mode\":\"none\",\"scheduler_parallel\":false,";
++    line += "\"tensor_repack\":false,";
++    line += "\"context_shift\":false,\"speculation\":false,\"flash_attention\":false,";
++    line += "\"threads\":1,\"threads_batch\":1,\"n_predict\":";
++    append_integer(line, opts.n_predict);
++    line += ",\"n_ctx\":";
++    append_integer(line, llama_n_ctx(context));
++    line += ",\"prompt_tokens\":";
++    append_integer(line, prompt_tokens);
++    line += ",\"tokenization\":{\"add_special\":true,\"parse_special\":true}}";
++
++    line += ",\"observation_policy\":{\"read_only\":true,";
++    line += "\"graph_metadata_stage\":\"ask\",\"sketch_bits\":256,";
++    line += "\"sketch_probe\":\"gemm_output_contiguous_prefix_64\",";
++    line += "\"raw_activation_values_published\":false,";
++    line += "\"tile_variant\":\"graph_fallback_logical_prefix_v1\",";
++    line += "\"kernel_trace_claim\":\"none\"}";
++    line.push_back('}');
++    return write_json_line(line);
++}
++
++static bool tokenize_prompt(const llama_vocab * vocab, const std::string & prompt,
++        std::vector<llama_token> & tokens) {
++    const int32_t length = static_cast<int32_t>(prompt.size());
++    const int32_t required = llama_tokenize(vocab, prompt.data(), length, nullptr, 0, true, true);
++    if (required == std::numeric_limits<int32_t>::min()) {
++        std::fprintf(stderr, "error: tokenizer result overflow\n");
++        return false;
++    }
++    const int32_t count = required < 0 ? -required : required;
++    if (count <= 0) {
++        std::fprintf(stderr, "error: prompt tokenization produced no tokens\n");
++        return false;
++    }
++    tokens.resize(static_cast<size_t>(count));
++    const int32_t actual = llama_tokenize(vocab, prompt.data(), length,
++            tokens.data(), count, true, true);
++    if (actual != count) {
++        std::fprintf(stderr, "error: prompt tokenization was not stable across sizing calls\n");
++        return false;
++    }
++    return true;
++}
++
++static bool append_token_piece(const llama_vocab * vocab, llama_token token,
++        std::vector<uint8_t> & output) {
++    std::array<char, 64> small = {};
++    int32_t length = llama_token_to_piece(vocab, token, small.data(), small.size(), 0, false);
++    if (length >= 0) {
++        output.insert(output.end(), small.begin(), small.begin() + length);
++        return true;
++    }
++    if (length == std::numeric_limits<int32_t>::min()) {
++        return false;
++    }
++    const int32_t required = -length;
++    std::vector<char> buffer(static_cast<size_t>(required));
++    length = llama_token_to_piece(vocab, token, buffer.data(), required, 0, false);
++    if (length != required) {
++        return false;
++    }
++    output.insert(output.end(), buffer.begin(), buffer.end());
++    return true;
++}
++
++static bool emit_result(const options & opts, const char * status, const char * stop_reason,
++        const std::vector<llama_token> & prompt_tokens,
++        const std::vector<llama_token> & generated_tokens,
++        const std::vector<uint8_t> & output_bytes,
++        const graph_observer & observer, const std::string & error) {
++    std::string line;
++    line.reserve(1024 + prompt_tokens.size() * 12 + generated_tokens.size() * 12 + output_bytes.size() * 4);
++    append_record_prefix(line, "result");
++    line += ",\"status\":";
++    append_json_string(line, status);
++    line += ",\"observer\":";
++    append_json_string(line, mode_name(opts.mode));
++    line += ",\"stop_reason\":";
++    append_json_string(line, stop_reason);
++    line += ",\"prompt_token_ids\":";
++    append_token_ids(line, prompt_tokens);
++    line += ",\"generated_token_ids\":";
++    append_token_ids(line, generated_tokens);
++    line += ",\"output_bytes\":[";
++    const size_t published_output_bytes = opts.emit_output_bytes ? output_bytes.size() : 0;
++    for (size_t i = 0; i < published_output_bytes; ++i) {
++        if (i != 0) {
++            line.push_back(',');
++        }
++        append_integer(line, static_cast<unsigned>(output_bytes[i]));
++    }
++    line += "],\"output_n_bytes\":";
++    append_integer(line, published_output_bytes);
++    line += ",\"event_count\":";
++    append_integer(line, observer.event_count());
++    if (!error.empty()) {
++        line += ",\"error\":";
++        append_json_string(line, error);
++    }
++    line.push_back('}');
++    return write_json_line(line);
++}
++
++struct backend_guard {
++    ~backend_guard() {
++        llama_backend_free();
++    }
++};
++
++} // namespace
++
++int main(int argc, char ** argv) {
++    std::setlocale(LC_NUMERIC, "C");
++    llama_log_set(log_callback, nullptr);
++
++    options opts;
++    bool help = false;
++    bool version = false;
++    if (!parse_options(argc, argv, opts, help, version)) {
++        print_usage(argv[0]);
++        return 2;
++    }
++    if (version) {
++        std::fprintf(stderr, "version: %d (%s)\n", llama_build_number(), llama_commit());
++        return 0;
++    }
++    if (help) {
++        print_usage(argv[0]);
++        return 0;
++    }
++
++    llama_backend_init();
++    backend_guard backend_cleanup;
++    ggml_backend_load_all();
++
++    llama_model_params model_params = llama_model_default_params();
++    model_params.n_gpu_layers = opts.n_gpu_layers;
++    model_params.split_mode = LLAMA_SPLIT_MODE_NONE;
++    model_params.main_gpu = 0;
++    model_params.use_mmap = true;
++    model_params.use_mlock = false;
++    model_params.check_tensors = true;
++    model_params.use_extra_bufts = false;
++
++    using model_ptr = std::unique_ptr<llama_model, decltype(&llama_model_free)>;
++    model_ptr model(llama_model_load_from_file(opts.model_path.c_str(), model_params), llama_model_free);
++    if (!model) {
++        std::fprintf(stderr, "error: failed to load model\n");
++        return 3;
++    }
++
++    model_metadata metadata;
++    if (!read_model_metadata(model.get(), metadata) || !validate_qwen36_35b_a3b_profile(model.get(), metadata)) {
++        return 3;
++    }
++
++    const llama_vocab * vocab = llama_model_get_vocab(model.get());
++    std::vector<llama_token> prompt_tokens;
++    if (!tokenize_prompt(vocab, opts.prompt, prompt_tokens)) {
++        return 3;
++    }
++
++    const uint64_t required_context = prompt_tokens.size() + static_cast<uint64_t>(opts.n_predict);
++    if (required_context > PALW_CONTEXT_TOKENS ||
++            PALW_CONTEXT_TOKENS > static_cast<uint64_t>(llama_model_n_ctx_train(model.get()))) {
++        std::fprintf(stderr, "error: prompt plus n-predict exceeds the fixed PALW context bound\n");
++        return 3;
++    }
++
++    graph_observer observer(opts.mode, llama_model_n_layer(model.get()));
++    llama_context_params context_params = llama_context_default_params();
++    context_params.n_ctx = PALW_CONTEXT_TOKENS;
++    context_params.n_batch = 1;
++    context_params.n_ubatch = 1;
++    context_params.n_seq_max = 1;
++    context_params.n_outputs_max = 1;
++    context_params.n_threads = 1;
++    context_params.n_threads_batch = 1;
++    context_params.flash_attn_type = LLAMA_FLASH_ATTN_TYPE_DISABLED;
++    context_params.type_k = GGML_TYPE_F16;
++    context_params.type_v = GGML_TYPE_F16;
++    context_params.embeddings = false;
++    context_params.offload_kqv = true;
++    context_params.no_perf = true;
++    context_params.op_offload = true;
++    context_params.kv_unified = false;
++    if (opts.mode != observer_mode::off) {
++        context_params.cb_eval = graph_observer::callback;
++        context_params.cb_eval_user_data = &observer;
++        g_diag_enabled = std::getenv("PALW_TRACE_DIAG") != nullptr;
++        // Capture every Metal kernel dispatch so GEMMs can be bound to the actual
++        // kernel + launch geometry that produced them (kernel-level trace).
++        if (opts.mode == observer_mode::sketch) {
++            ggml_metal_palw_set_dispatch_hook(graph_observer::dispatch_hook, &observer);
++        }
++    }
++
++    using context_ptr = std::unique_ptr<llama_context, decltype(&llama_free)>;
++    context_ptr context(llama_init_from_model(model.get(), context_params), llama_free);
++    if (!context) {
++        std::fprintf(stderr, "error: failed to initialize context\n");
++        return 3;
++    }
++    if (llama_n_batch(context.get()) != 1 || llama_n_ubatch(context.get()) != 1 ||
++            llama_n_seq_max(context.get()) != 1 || llama_n_ctx(context.get()) != PALW_CONTEXT_TOKENS ||
++            llama_n_threads(context.get()) != 1 || llama_n_threads_batch(context.get()) != 1) {
++        std::fprintf(stderr, "error: runtime did not honor the deterministic execution policy\n");
++        return 3;
++    }
++
++    if (!emit_header(opts, model.get(), context.get(), metadata, prompt_tokens.size())) {
++        return 4;
++    }
++
++    std::vector<llama_token> generated_tokens;
++    std::vector<uint8_t> output_bytes;
++    generated_tokens.reserve(static_cast<size_t>(opts.n_predict));
++
++    for (size_t i = 0; i < prompt_tokens.size(); ++i) {
++        observer.set_phase("prefill", static_cast<int64_t>(i));
++        llama_token token = prompt_tokens[i];
++        const int32_t decode_status = llama_decode(context.get(), llama_batch_get_one(&token, 1));
++        if (decode_status != 0) {
++            const std::string error = "llama_decode prefill status " + std::to_string(decode_status);
++            emit_result(opts, "error", "decode_error", prompt_tokens, generated_tokens,
++                    output_bytes, observer, error);
++            return 5;
++        }
++        if (observer.failed()) {
++            emit_result(opts, "error", "observer_error", prompt_tokens, generated_tokens,
++                    output_bytes, observer, observer.error());
++            return 5;
++        }
++    }
++
++    using sampler_ptr = std::unique_ptr<llama_sampler, decltype(&llama_sampler_free)>;
++    sampler_ptr sampler(llama_sampler_init_greedy(), llama_sampler_free);
++    if (!sampler) {
++        emit_result(opts, "error", "sampler_error", prompt_tokens, generated_tokens,
++                output_bytes, observer, "failed to initialize greedy sampler");
++        return 5;
++    }
++
++    const char * stop_reason = "n_predict";
++    for (int32_t i = 0; i < opts.n_predict; ++i) {
++        const llama_token token = llama_sampler_sample(sampler.get(), context.get(), -1);
++        if (token < 0 || token >= llama_vocab_n_tokens(vocab)) {
++            emit_result(opts, "error", "sampler_error", prompt_tokens, generated_tokens,
++                    output_bytes, observer, "greedy sampler returned an out-of-range token");
++            return 5;
++        }
++        generated_tokens.push_back(token);
++        if (llama_vocab_is_eog(vocab, token)) {
++            stop_reason = "eog";
++            break;
++        }
++        if (!append_token_piece(vocab, token, output_bytes)) {
++            emit_result(opts, "error", "detokenize_error", prompt_tokens, generated_tokens,
++                    output_bytes, observer, "failed to convert generated token to bytes");
++            return 5;
++        }
++        if (i + 1 == opts.n_predict) {
++            break;
++        }
++
++        observer.set_phase("decode", i);
++        llama_token mutable_token = token;
++        const int32_t decode_status = llama_decode(context.get(), llama_batch_get_one(&mutable_token, 1));
++        if (decode_status != 0) {
++            const std::string error = "llama_decode generation status " + std::to_string(decode_status);
++            emit_result(opts, "error", "decode_error", prompt_tokens, generated_tokens,
++                    output_bytes, observer, error);
++            return 5;
++        }
++        if (observer.failed()) {
++            emit_result(opts, "error", "observer_error", prompt_tokens, generated_tokens,
++                    output_bytes, observer, observer.error());
++            return 5;
++        }
++    }
++
++    if (!emit_result(opts, "ok", stop_reason, prompt_tokens, generated_tokens,
++            output_bytes, observer, {})) {
++        return 4;
++    }
++    return 0;
++}

pyproject.toml

@@ -0,0 +1,12 @@
+[project]
+name = "misaka-palw-runtime"
+version = "0.1.0"
+description = "Model acquisition tooling for the MISAKA PALW Qwen3.6-35B-A3B runtime"
+readme = "README.md"
+requires-python = ">=3.12,<3.13"
+dependencies = [
+    "huggingface-hub[hf-xet]>=0.30,<2",
+]
+
+[tool.uv]
+package = false

receipts/final-v5/ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68.complete

@@ -0,0 +1,4 @@
+misaka.palw.receipt-set.v2
+receipt_id=ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68
+bundle_id=6fd4e57a6cbcd6fc1d9138989960b627c9ee4817bc3ac4ce889a1a1b41d7d63b
+public_json_sha256=3aa158cacd9c790a85f550e232e1b5b3a5c3f1d81aaa0c5b56b57bb08f1dca22

receipts/final-v5/ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68.json

@@ -0,0 +1,63 @@
+{
+  "artifacts": {
+    "llama_commit": "12127defda4f41b7679cb2477a4b0d65ee6a0c8f",
+    "model_bytes": 5027783488,
+    "model_palw_root": "ad7d0e950531195bc2cf84f112fee6487777f78120c9a809cf9306c7a7a8684f",
+    "tokenizer_palw_root": "63839f0ab58084bbaa108a877e52bebd685b2c0616fcfab684a08354dee713dd"
+  },
+  "canonical_compute_units": 12135,
+  "canonical_receipt_file": "ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68.palw",
+  "completion_marker": "ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68.complete",
+  "cu_ruleset_id": "d8ef60255b3ba7ab12062942771b3e0ac9a674f151c3c321fe82c7d1fe52d299",
+  "decode_tokens": 2,
+  "durable_state_database": "palw-state.sqlite3",
+  "encrypted_verification_bundle": "ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68.palw.bundle",
+  "evidence_level": "gemm_traced",
+  "execution_nullifier": "da2977c18f045718d8027301d8045e979db7d17b38d288daf6b897a4ebd0bad2",
+  "expires_epoch": 100,
+  "gemm_trace_root": "ebfd5d143ee57b1db20751ae4d241479fa9447cd5fcc7052fccce129604b78bc",
+  "issued_epoch": 1,
+  "job_class": "self_local",
+  "job_nullifier": "bb669cc73bb376766555e99592399a93b713ab190f3f9447a1f79046c19a0cbb",
+  "model_profile_id": "0c58c66b03bb471a248cb36be954b42945c6694c148370e6852f674ff98e64d4",
+  "network_id": "5314ef28b17106c232db89c7ada20d4e72f7d20bb95a7025c5c9abcec19055d9",
+  "observer_summary": {
+    "canonical_operations": 4890,
+    "decode_graph_steps": 1,
+    "gemm_events": 1625,
+    "prefill_graph_steps": 4
+  },
+  "operation_schedule_commitment": "6ee6163863df1a9a715bb42dc89d7431c13e0cb2538d022d074ca07c11aabab7",
+  "output_commitment": "ab778d40a2e00f8d047a5e5c79924e3667aad43c12af9aceea95044843353de8",
+  "owner_commitment": "eb8102e4a86b9636e528caa80926b17b5b2044a9d2c7ccf8bbcd650cefe0c406",
+  "prefill_tokens": 4,
+  "privacy": {
+    "decoded_output_bytes_retained": false,
+    "generated_tokens_public": false,
+    "output_nonce_public": false,
+    "owner_salt_encrypted": true,
+    "owner_salt_public": false,
+    "private_signing_keys_retained": false,
+    "prompt_output_opening_encrypted": true,
+    "prompt_tokens_public": false,
+    "signed_assignment_encrypted": true,
+    "signed_request_encrypted": true
+  },
+  "receipt_id": "ab2b3196a6c0935aafd4d563a9d2e1d71d828cc87a378ae77b8e49c102033b68",
+  "replica_slot": 0,
+  "request_commitment": "fbed17891d3e8e326e18ba00dbdec05de729b33c2f271581a03988b214c615e1",
+  "runtime_class_id": "5b2fd7a56d73aa9757e516f92cbc7b4d43995ebe9ed27e445b9b7ab4cd8c7bc9",
+  "runtime_manifest_hash": "2b9c3cd05942f16b36ab348bc71033c33e8f7aa6872ce4c0c0fcac3ba0212bc1",
+  "schedule_event_count": 4890,
+  "scheduler_job_id": "407bacfe3d8ad3dcfa7ba0ab15f7d16b95473d6c43f26755fa08dd2617fdf447",
+  "schema": "misaka.palw.public-receipt.v2",
+  "shape_profile_id": "c4f8ae70ab6fda2707d841a64d79d36cff58509ea7f228eb4c93b693e630d674",
+  "signed_assignment_id": "2aa43b4369cbd2f584898764aefc99005afb81bc633882dddf6525022f0e9c68",
+  "signer_key_id": "af0ff7daae66f1fc903775994351e8c099b1fa2e9495f1d84f4a0d8ba08d5d91",
+  "timestamp_millis": 1784101608591,
+  "trace_event_count": 1625,
+  "trace_evidence": "graph_fallback",
+  "trace_scheme_id": "809191d894ecc9d0ec53b1b2da9eafa5856eb26c6bfc641ea6405c041130d8a0",
+  "verification_bundle_id": "6fd4e57a6cbcd6fc1d9138989960b627c9ee4817bc3ac4ce889a1a1b41d7d63b",
+  "worker_credential_id": "ff0bc29f4f856fb7dec1c39e8f4dcd7e20990917b04242a6bfa87d05e9ca341e"
+}

receipts/final-v6/eb51b08c3b86ef5df2cdebcfa9fcef812ec72197b3ad40ae2c5ba68cf4278131.complete

@@ -0,0 +1,4 @@
+misaka.palw.receipt-set.v2
+receipt_id=eb51b08c3b86ef5df2cdebcfa9fcef812ec72197b3ad40ae2c5ba68cf4278131
+bundle_id=359f1bedaeefc1e140bf8c0dbba11582cb5cc0be428dcd95bc6077721f8096e9
+public_json_sha256=03bee886144a2c64dd5f4d2207f86c748f5a3e7891b43f82f077f051342c3d0b

receipts/final-v6/eb51b08c3b86ef5df2cdebcfa9fcef812ec72197b3ad40ae2c5ba68cf4278131.json

@@ -0,0 +1,63 @@
+{
+  "artifacts": {
+    "llama_commit": "12127defda4f41b7679cb2477a4b0d65ee6a0c8f",
+    "model_bytes": 5027783488,
+    "model_palw_root": "ad7d0e950531195bc2cf84f112fee6487777f78120c9a809cf9306c7a7a8684f",
+    "tokenizer_palw_root": "63839f0ab58084bbaa108a877e52bebd685b2c0616fcfab684a08354dee713dd"
+  },
+  "canonical_compute_units": 14562,
+  "canonical_receipt_file": "eb51b08c3b86ef5df2cdebcfa9fcef812ec72197b3ad40ae2c5ba68cf4278131.palw",
+  "completion_marker": "eb51b08c3b86ef5df2cdebcfa9fcef812ec72197b3ad40ae2c5ba68cf4278131.complete",
+  "cu_ruleset_id": "d8ef60255b3ba7ab12062942771b3e0ac9a674f151c3c321fe82c7d1fe52d299",
+  "decode_tokens": 2,
+  "durable_state_database": "palw-state.sqlite3",
+  "encrypted_verification_bundle": "eb51b08c3b86ef5df2cdebcfa9fcef812ec72197b3ad40ae2c5ba68cf4278131.palw.bundle",
+  "evidence_level": "gemm_traced",
+  "execution_nullifier": "1ff2d8035bee73c268c9ab39ea493f6f6112c28c1508a9e4ed972a09124ed5a8",
+  "expires_epoch": 100,
+  "gemm_trace_root": "53c906957957aa34cd5c66fc9ad8c863e541732ead6728e3125d78dff6c133f1",
+  "issued_epoch": 1,
+  "job_class": "self_local",
+  "job_nullifier": "848144497db27d8e39d38d1e41bf05cd7cc54fbd7e4267dc16db6c5cb0c81e73",
+  "model_profile_id": "0c58c66b03bb471a248cb36be954b42945c6694c148370e6852f674ff98e64d4",
+  "network_id": "5314ef28b17106c232db89c7ada20d4e72f7d20bb95a7025c5c9abcec19055d9",
+  "observer_summary": {
+    "canonical_operations": 5868,
+    "decode_graph_steps": 1,
+    "gemm_events": 1950,
+    "prefill_graph_steps": 5
+  },
+  "operation_schedule_commitment": "ad5b7b98c81354be64a9021cb7a20838ccf9d555576fc0743c79286ea29681f6",
+  "output_commitment": "6dab6a439df562c1da3dc54c4d0390b951631d0b54cfce023fa7429541c63acf",
+  "owner_commitment": "784f01145a243ff47af1e5a8f10900e70d8923208f754ad44818ba062ca4c4b3",
+  "prefill_tokens": 5,
+  "privacy": {
+    "decoded_output_bytes_retained": false,
+    "generated_tokens_public": false,
+    "output_nonce_public": false,
+    "owner_salt_encrypted": true,
+    "owner_salt_public": false,
+    "private_signing_keys_retained": false,
+    "prompt_output_opening_encrypted": true,
+    "prompt_tokens_public": false,
+    "signed_assignment_encrypted": true,
+    "signed_request_encrypted": true
+  },
+  "receipt_id": "eb51b08c3b86ef5df2cdebcfa9fcef812ec72197b3ad40ae2c5ba68cf4278131",
+  "replica_slot": 0,
+  "request_commitment": "baa38c80930d4af9186c4b708d2cbfef2f1ee789caef11dcd3c5a66dfbe11921",
+  "runtime_class_id": "c38307d57c847f3c276247411c563daf50fc7576cf1f6488ab29fe9a56970c5c",
+  "runtime_manifest_hash": "5920accc3a0a0529c5f0c0a4050d6bf00d4d8fdf2b9772b64af2b4fdac2b84dd",
+  "schedule_event_count": 5868,
+  "scheduler_job_id": "5425d9aa3d39fa5d80275d60a498274979bff103cc7a8214bf2418f4c3b6d81b",
+  "schema": "misaka.palw.public-receipt.v2",
+  "shape_profile_id": "c4f8ae70ab6fda2707d841a64d79d36cff58509ea7f228eb4c93b693e630d674",
+  "signed_assignment_id": "022501b13963fa70d45d86dae37386f0ed41bb9ae79646beb1fc41fca159e4f6",
+  "signer_key_id": "d1c014d205033b8b7e01a712bce01d57afd1fa8a0d96f4bf1809c551827b31ef",
+  "timestamp_millis": 1784111006188,
+  "trace_event_count": 1950,
+  "trace_evidence": "graph_fallback",
+  "trace_scheme_id": "809191d894ecc9d0ec53b1b2da9eafa5856eb26c6bfc641ea6405c041130d8a0",
+  "verification_bundle_id": "359f1bedaeefc1e140bf8c0dbba11582cb5cc0be428dcd95bc6077721f8096e9",
+  "worker_credential_id": "99663e6ddd5e0e38684beebf9d9c46872e960745bf9ab66bfbaa92e60af822d5"
+}

receipts/final-v7/8e2dd34b7609d6d7aeec17bff485eb1ae4db31f66dd899a3c3a3e671656053f9.complete

@@ -0,0 +1,4 @@
+misaka.palw.receipt-set.v2
+receipt_id=8e2dd34b7609d6d7aeec17bff485eb1ae4db31f66dd899a3c3a3e671656053f9
+bundle_id=f5b8a2968c4ea266b2cbbabf351a171e0fa2581984eff63362de2640fcdcf9db
+public_json_sha256=2bc670c2de4147fa150126cc36a5f35b5c0600f0835b334e3d36de58ccbf5154

receipts/final-v7/8e2dd34b7609d6d7aeec17bff485eb1ae4db31f66dd899a3c3a3e671656053f9.json

@@ -0,0 +1,87 @@
+{
+  "artifacts": {
+    "llama_commit": "12127defda4f41b7679cb2477a4b0d65ee6a0c8f",
+    "model_bytes": 23938321728,
+    "model_palw_root": "f94585e843a993db3ff8f34232b72128784cb074942d3263a05d5da6dc25ef06",
+    "tokenizer_palw_root": "a5b09fef67156eaeb5b98e0c406a304c7b0fca75861bd2d7c02b4185a64ce762"
+  },
+  "canonical_compute_units": 41692,
+  "canonical_receipt_file": "8e2dd34b7609d6d7aeec17bff485eb1ae4db31f66dd899a3c3a3e671656053f9.palw",
+  "completion_marker": "8e2dd34b7609d6d7aeec17bff485eb1ae4db31f66dd899a3c3a3e671656053f9.complete",
+  "cu_ruleset_id": "43a5feef177b389f976361b22ac9d57da65815261282005bc78d1666a37870ce",
+  "decode_tokens": 2,
+  "durable_state_database": "palw-state.sqlite3",
+  "encrypted_verification_bundle": "8e2dd34b7609d6d7aeec17bff485eb1ae4db31f66dd899a3c3a3e671656053f9.palw.bundle",
+  "evidence_level": "gemm_traced",
+  "execution_nullifier": "1ea89b576f78cbbbc1f878b8f786e2aa6158b9d3a9762b43146207ddba85e16e",
+  "expert_route": {
+    "root": "5e4ea70ba91658e6a24cf3da00ac747eae4985ea5f0dc8f46009cc827bbc1c9e",
+    "route_event_count": 240
+  },
+  "expires_epoch": 100,
+  "gemm_trace_root": "78f6f15a768bcfa90597c2ee1cb25c4e08beb32f869e5dfb45f43fc9bb6d84f7",
+  "issued_epoch": 1,
+  "job_class": "self_local",
+  "job_nullifier": "2d8b5b9d5ea6699c47b06c1defb044f9a6582b216cd438a172ee6af92fd8bfb9",
+  "mint": {
+    "class": "local_self_consistent_v0_1",
+    "eligible": false,
+    "ineligible_reasons": [
+      "trace is a Metal kernel-launch-bound sketch, not an intra-kernel accumulator proof",
+      "assignment is an embedded local snapshot, not a network-anchored challenge-bound assignment",
+      "signing identity is ephemeral and not bonded to a persistent worker credential"
+    ],
+    "mainnet_ready": false,
+    "weight": 0
+  },
+  "model_profile_id": "b6b83a274a889fc5dfa2044b9158111b3849f880a05eb7ebcf560d036515d472",
+  "network_id": "5314ef28b17106c232db89c7ada20d4e72f7d20bb95a7025c5c9abcec19055d9",
+  "observer_summary": {
+    "canonical_operations": 13770,
+    "decode_graph_steps": 1,
+    "gemm_events": 2466,
+    "prefill_graph_steps": 5
+  },
+  "operation_schedule_commitment": "eb29962a094774e4de78c426cd653249540aab371a0a69372f0a4b4371696322",
+  "output_commitment": "16d16907a410297aec0f01527c89304461fc1390f8afa49c091b63b1d422b9e0",
+  "owner_commitment": "64c702b1d90842b85e4e554cc18413a04c1309db0f47c300e4102d9e042c5284",
+  "prefill_tokens": 5,
+  "privacy": {
+    "decoded_output_bytes_retained": false,
+    "generated_tokens_public": false,
+    "output_nonce_public": false,
+    "owner_salt_encrypted": true,
+    "owner_salt_public": false,
+    "private_signing_keys_retained": false,
+    "prompt_output_opening_encrypted": true,
+    "prompt_tokens_public": false,
+    "signed_assignment_encrypted": true,
+    "signed_request_encrypted": true
+  },
+  "receipt_id": "8e2dd34b7609d6d7aeec17bff485eb1ae4db31f66dd899a3c3a3e671656053f9",
+  "replica_slot": 0,
+  "request_commitment": "d9a4994816b1bf29f561cbe181e57c086a89a17a0407cc0e9c8960cf223f16b8",
+  "runtime_class_id": "8f6f536118a72be70dab2028535c3bb95e3de9a3bac0e9b81cf78677ae902a9c",
+  "runtime_manifest_hash": "8a07a1767a7e503259f9b157d932454ce790f428f7b8d271d4b472f1f5103963",
+  "schedule_event_count": 13770,
+  "scheduler_job_id": "ea681cd4d99163aec502aba3d23513197f861ce4e6495243c85a404f910f823e",
+  "schema": "misaka.palw.public-receipt.v2",
+  "semantic_compute_units_v3": 41692,
+  "semantic_schedule": {
+    "attention_ops": 20,
+    "commitment": "e6fc731e80e9b1135beced7f178dd8c9eda542507cb4c143451b523c361ead34",
+    "expert_route_ops": 80,
+    "forward_passes": 2,
+    "gemm_ops": 82,
+    "total_ops": 764
+  },
+  "shape_profile_id": "c4f8ae70ab6fda2707d841a64d79d36cff58509ea7f228eb4c93b693e630d674",
+  "signed_assignment_id": "94dec962b00f395a8ef349f4227f2bdebc716f261b7ce8a88e17efe31c5778b8",
+  "signer_key_id": "b2d968277c5e5464a273c92c5d501565367117b68c7d949823bd2403f77601ed",
+  "timestamp_millis": 1784446365200,
+  "trace_event_count": 2466,
+  "trace_evidence": "metal_kernel",
+  "trace_scheme_id": "809191d894ecc9d0ec53b1b2da9eafa5856eb26c6bfc641ea6405c041130d8a0",
+  "verification_bundle_id": "f5b8a2968c4ea266b2cbbabf351a171e0fa2581984eff63362de2640fcdcf9db",
+  "worker_credential_id": "94351cf05b8fa9c4a6b2a31a492ba08f0931cb659a44ae06d7d39ebd2cf0bff0"
+}

runtime-palw/Cargo.lock

@@ -0,0 +1,852 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common 0.1.7",
+ "generic-array",
+]
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "arrayref"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76a2e8124351fda1ef8aaaa3bbd7ebbcb486bbcd4225aca0aa0d84bb2db8fecb"
+
+[[package]]
+name = "arrayvec"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "base64ct"
+version = "1.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89e25b6adfb930f02d1981565a6e5d9c547ac15a96606256d3b59040e5cd4ca3"
+
+[[package]]
+name = "bitflags"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+
+[[package]]
+name = "blake2b_simd"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b79834656f71332577234b50bfc009996f7449e0c056884e6a02492ded0ca2f3"
+dependencies = [
+ "arrayref",
+ "arrayvec",
+ "constant_time_eq",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "cc"
+version = "1.2.67"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17dd265a7d0f31ef544e1b20e03add05d3b45b491b633b10d67145d2acc1a38"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chacha20"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "chacha20poly1305"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
+dependencies = [
+ "aead",
+ "chacha20",
+ "cipher",
+ "poly1305",
+ "zeroize",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common 0.1.7",
+ "inout",
+ "zeroize",
+]
+
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
+[[package]]
+name = "constant_time_eq"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "typenum",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "getrandom 0.4.3",
+ "hybrid-array",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "curve25519-dalek-derive",
+ "digest 0.10.7",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid 0.9.6",
+ "zeroize",
+]
+
+[[package]]
+name = "der"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a69dedd701da44b0536442edf09c81a64b0ab97a7a4a5e3d1971f00027cbc63d"
+dependencies = [
+ "const-oid 0.10.2",
+ "zeroize",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common 0.1.7",
+]
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "crypto-common 0.2.2",
+]
+
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "pkcs8 0.10.2",
+ "signature 2.2.0",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "rand_core 0.6.4",
+ "serde",
+ "sha2",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "fallible-iterator"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
+
+[[package]]
+name = "fallible-streaming-iterator"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+]
+
+[[package]]
+name = "hashlink"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
+dependencies = [
+ "hashbrown",
+]
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hybrid-array"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
+dependencies = [
+ "ctutils",
+ "typenum",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "keccak"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
+dependencies = [
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "keccak"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e24a010dd405bd7ed803e5253182815b41bf2e6a80cc3bfc066658e03a198aa"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "ml-dsa"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "add6b9d92e496f16f4526d68ff29da1483aba4b119baeab8bed3b9e3544a6f3d"
+dependencies = [
+ "const-oid 0.10.2",
+ "crypto-common 0.2.2",
+ "ctutils",
+ "hybrid-array",
+ "module-lattice",
+ "pkcs8 0.11.0",
+ "shake",
+ "signature 3.0.0",
+]
+
+[[package]]
+name = "module-lattice"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c61b87c9683ab7cb1c6871d261ad5479b6b10ceb52c4352aaca3b5d35a8febe"
+dependencies = [
+ "ctutils",
+ "hybrid-array",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der 0.7.10",
+ "spki 0.7.3",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
+dependencies = [
+ "der 0.8.1",
+ "spki 0.8.0",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "poly1305"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+dependencies = [
+ "cpufeatures 0.2.17",
+ "opaque-debug",
+ "universal-hash",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "runtime-palw"
+version = "0.1.0"
+dependencies = [
+ "base64ct",
+ "blake2b_simd",
+ "chacha20poly1305",
+ "ed25519-dalek",
+ "getrandom 0.2.17",
+ "hex",
+ "ml-dsa",
+ "rusqlite",
+ "serde",
+ "serde_json",
+ "sha2",
+ "sha3",
+ "thiserror",
+ "zeroize",
+]
+
+[[package]]
+name = "rusqlite"
+version = "0.32.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
+dependencies = [
+ "bitflags",
+ "fallible-iterator",
+ "fallible-streaming-iterator",
+ "hashlink",
+ "libsqlite3-sys",
+ "smallvec",
+]
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.150"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha3"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
+dependencies = [
+ "digest 0.10.7",
+ "keccak 0.1.6",
+]
+
+[[package]]
+name = "shake"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09057cb2149ad4cbd2da1e26b351f9a4c354219421229c69c3063e6f61947c4a"
+dependencies = [
+ "digest 0.11.3",
+ "keccak 0.2.0",
+ "sponge-cursor",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "signature"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
+dependencies = [
+ "digest 0.11.3",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der 0.7.10",
+]
+
+[[package]]
+name = "spki"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d9efca8738c78ee9484207732f728b1ef517bbb1833d6fc0879ca898a522f6f"
+dependencies = [
+ "base64ct",
+ "der 0.8.1",
+]
+
+[[package]]
+name = "sponge-cursor"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common 0.1.7",
+ "subtle",
+]
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "zerocopy"
+version = "0.8.54"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7cbbc0a705a0fd05cc3676525980d2bf5a9bc4adac6d6475209a7887cf59d19"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.54"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"

runtime-palw/Cargo.toml

@@ -0,0 +1,62 @@
+[package]
+name = "runtime-palw"
+version = "0.1.0"
+edition = "2021"
+rust-version = "1.81"
+description = "Deterministic PALW receipt core for Qwen runtimes"
+license = "Apache-2.0"
+
+[workspace]
+
+[[bin]]
+name = "palw-worker"
+path = "src/bin/palw-worker.rs"
+required-features = ["ml-dsa"]
+[[bin]]
+name = "palw-integer-receipt"
+path = "src/bin/palw-integer-receipt.rs"
+required-features = ["ml-dsa"]
+
+[[bin]]
+name = "palw-verify-integer"
+path = "src/bin/palw-verify-integer.rs"
+required-features = ["ml-dsa"]
+
+
+[dependencies]
+chacha20poly1305 = { version = "=0.10.1", features = ["std"] }
+ed25519-dalek = { version = "2.1", features = ["rand_core"] }
+getrandom = "0.2"
+rusqlite = { version = "0.32", features = ["bundled"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"
+sha3 = "0.10"
+thiserror = "2"
+# The crypto stack leaves these transitive ranges open. Newer releases use an
+# edition-2024 Cargo manifest, so pin compatible versions to preserve MSRV 1.81.
+base64ct = "=1.7.3"
+# `curve25519-dalek` accepts any zeroize 1.x release, but zeroize 1.9's
+# manifest requires Cargo's edition-2024 support. Keep the declared 1.81 MSRV
+# honest by constraining the transitive resolver to the last compatible line.
+zeroize = "=1.8.1"
+blake2b_simd = "1"
+ml-dsa = { version = "0.1.0-pre.2", optional = true }
+
+[dev-dependencies]
+hex = "0.4"
+
+[lints.rust]
+unsafe_code = "forbid"
+missing_docs = "warn"
+
+[lints.clippy]
+all = { level = "warn", priority = -1 }
+pedantic = { level = "warn", priority = -1 }
+missing_errors_doc = "allow"
+missing_panics_doc = "allow"
+module_name_repetitions = "allow"
+similar_names = "allow"
+
+[features]
+ml-dsa = ["dep:ml-dsa"]

runtime-palw/cuda/CMakeLists.txt

@@ -0,0 +1,168 @@
+cmake_minimum_required(VERSION 3.24)
+project(misaka_palw_cuda_trace LANGUAGES C CXX)
+
+include(CTest)
+
+option(PALW_CUDA_TRACE_ENABLE_CUDA "Build the CUDA trace implementation" ON)
+option(
+    PALW_CUDA_PRODUCTION_KERNEL_TRACE
+    "Enable production receipt issuance from native CUDA kernel evidence"
+    OFF
+)
+
+if(PALW_CUDA_PRODUCTION_KERNEL_TRACE)
+    message(FATAL_ERROR
+        "PALW CUDA production kernel trace is unavailable. "
+        "The live diagnostic callback does not consume authority-derived canonical operation, plan, "
+        "and physical-layout identities, and deployed governance/trust plus an approved NVIDIA "
+        "replica/reproducibility matrix are unavailable; "
+        "R32 remains closed.")
+endif()
+
+add_executable(palw_cuda_trace_abi_contract
+    abi_contract_test.cpp
+    record_codec.cpp
+)
+target_include_directories(palw_cuda_trace_abi_contract PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}")
+target_compile_features(palw_cuda_trace_abi_contract PRIVATE cxx_std_17)
+target_compile_definitions(palw_cuda_trace_abi_contract PRIVATE
+    PALW_CUDA_TRACE_NO_CUDA_HEADERS=1
+    PALW_CUDA_TRACE_GOLDEN_FIXTURE_PATH="${CMAKE_CURRENT_SOURCE_DIR}/fixtures/trace_record_v2.hex"
+    PALW_CUDA_TRACE_GOLDEN_FIXTURE_V3_PATH="${CMAKE_CURRENT_SOURCE_DIR}/fixtures/trace_record_v3.hex"
+)
+
+add_executable(palw_cuda_trace_c_header_contract header_c_contract_test.c)
+target_include_directories(palw_cuda_trace_c_header_contract PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}")
+target_compile_features(palw_cuda_trace_c_header_contract PRIVATE c_std_11)
+target_compile_definitions(palw_cuda_trace_c_header_contract PRIVATE PALW_CUDA_TRACE_NO_CUDA_HEADERS=1)
+if(MSVC)
+    target_compile_options(palw_cuda_trace_c_header_contract PRIVATE /W4 /WX)
+else()
+    target_compile_options(palw_cuda_trace_c_header_contract PRIVATE
+        -Wall -Wextra -Wpedantic -Werror)
+endif()
+
+add_executable(palw_cuda_producer_contract
+    producer_contract_test.cpp
+    producer_contract.cpp
+    record_codec.cpp
+)
+target_include_directories(palw_cuda_producer_contract PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}")
+target_compile_features(palw_cuda_producer_contract PRIVATE cxx_std_17)
+target_compile_definitions(palw_cuda_producer_contract PRIVATE PALW_CUDA_TRACE_NO_CUDA_HEADERS=1)
+
+add_executable(palw_cuda_llama_mmvq_bridge_contract
+    llama_mmvq_bridge_contract_test.cpp
+)
+target_include_directories(palw_cuda_llama_mmvq_bridge_contract PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}")
+target_compile_features(palw_cuda_llama_mmvq_bridge_contract PRIVATE cxx_std_17)
+target_compile_definitions(palw_cuda_llama_mmvq_bridge_contract PRIVATE PALW_CUDA_TRACE_NO_CUDA_HEADERS=1)
+if(MSVC)
+    target_compile_options(palw_cuda_llama_mmvq_bridge_contract PRIVATE /W4 /WX)
+else()
+    target_compile_options(palw_cuda_llama_mmvq_bridge_contract PRIVATE
+        -Wall -Wextra -Wpedantic -Werror)
+endif()
+
+if(BUILD_TESTING)
+    add_test(NAME palw_cuda_trace_abi_contract COMMAND palw_cuda_trace_abi_contract)
+    add_test(NAME palw_cuda_trace_c_header_contract COMMAND palw_cuda_trace_c_header_contract)
+    add_test(NAME palw_cuda_producer_contract COMMAND palw_cuda_producer_contract)
+    add_test(NAME palw_cuda_llama_mmvq_bridge_contract COMMAND palw_cuda_llama_mmvq_bridge_contract)
+    add_test(
+        NAME palw_cuda_trace_production_gate
+        COMMAND "${CMAKE_COMMAND}"
+            "-DSOURCE_DIR=${CMAKE_CURRENT_SOURCE_DIR}"
+            "-DBINARY_DIR=${CMAKE_CURRENT_BINARY_DIR}/production-gate-check"
+            -P "${CMAKE_CURRENT_SOURCE_DIR}/production_gate_test.cmake"
+    )
+    set_tests_properties(palw_cuda_trace_abi_contract PROPERTIES LABELS "host;abi;palw")
+    set_tests_properties(palw_cuda_trace_c_header_contract PROPERTIES LABELS "host;abi;palw")
+    set_tests_properties(palw_cuda_producer_contract PROPERTIES LABELS "host;producer;palw")
+    set_tests_properties(palw_cuda_llama_mmvq_bridge_contract PROPERTIES LABELS "host;abi;producer;palw")
+    set_tests_properties(palw_cuda_trace_production_gate PROPERTIES LABELS "host;gate;palw")
+endif()
+
+if(NOT PALW_CUDA_TRACE_ENABLE_CUDA)
+    message(STATUS "PALW CUDA implementation disabled; only the host ABI contract target is available")
+    return()
+endif()
+
+include(CheckLanguage)
+check_language(CUDA)
+if(NOT CMAKE_CUDA_COMPILER)
+    message(FATAL_ERROR
+        "PALW CUDA trace requires nvcc/CUDA. "
+        "Use -DPALW_CUDA_TRACE_ENABLE_CUDA=OFF only for the host ABI contract gate.")
+endif()
+enable_language(CUDA)
+find_package(CUDAToolkit REQUIRED)
+
+add_library(palw_cuda_trace STATIC
+    accumulator.cu
+    attention_trace.cu
+    gemm_trace.cu
+    producer_accumulator.cu
+    producer_contract.cpp
+    record_codec.cpp
+)
+
+target_include_directories(palw_cuda_trace PUBLIC "${CMAKE_CURRENT_SOURCE_DIR}")
+target_link_libraries(palw_cuda_trace PUBLIC CUDA::cudart)
+target_compile_features(palw_cuda_trace PUBLIC cxx_std_17)
+set_target_properties(palw_cuda_trace PROPERTIES
+    CUDA_STANDARD 17
+    CUDA_STANDARD_REQUIRED ON
+    CUDA_SEPARABLE_COMPILATION ON
+    POSITION_INDEPENDENT_CODE ON
+)
+
+target_compile_options(palw_cuda_trace PRIVATE
+    $<$<COMPILE_LANGUAGE:CUDA>:--fmad=false;--prec-div=true;--prec-sqrt=true>
+)
+
+if(BUILD_TESTING)
+    target_compile_definitions(palw_cuda_trace PRIVATE PALW_CUDA_TRACE_TESTING=1)
+    add_executable(palw_cuda_trace_device_test cuda_trace_test.cu)
+    target_include_directories(palw_cuda_trace_device_test PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}")
+    target_link_libraries(palw_cuda_trace_device_test PRIVATE palw_cuda_trace CUDA::cudart)
+    target_compile_features(palw_cuda_trace_device_test PRIVATE cxx_std_17)
+    target_compile_definitions(palw_cuda_trace_device_test PRIVATE PALW_CUDA_TRACE_TESTING=1)
+    set_target_properties(palw_cuda_trace_device_test PROPERTIES
+        CUDA_STANDARD 17
+        CUDA_STANDARD_REQUIRED ON
+    )
+    add_test(NAME palw_cuda_trace_device COMMAND palw_cuda_trace_device_test)
+    set_tests_properties(palw_cuda_trace_device PROPERTIES
+        LABELS "cuda;gpu;palw"
+        SKIP_RETURN_CODE 77
+    )
+
+    add_executable(palw_cuda_producer_device_test producer_accumulator_test.cu)
+    target_include_directories(palw_cuda_producer_device_test PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}")
+    target_link_libraries(palw_cuda_producer_device_test PRIVATE palw_cuda_trace CUDA::cudart)
+    target_compile_features(palw_cuda_producer_device_test PRIVATE cxx_std_17)
+    set_target_properties(palw_cuda_producer_device_test PROPERTIES
+        CUDA_STANDARD 17
+        CUDA_STANDARD_REQUIRED ON
+    )
+    add_test(NAME palw_cuda_producer_device COMMAND palw_cuda_producer_device_test)
+    set_tests_properties(palw_cuda_producer_device PROPERTIES
+        LABELS "cuda;gpu;producer;palw"
+        SKIP_RETURN_CODE 77
+    )
+
+    add_executable(palw_cuda_grouped_capture_info grouped_capture_info.cu)
+    target_include_directories(palw_cuda_grouped_capture_info PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}")
+    target_link_libraries(palw_cuda_grouped_capture_info PRIVATE palw_cuda_trace CUDA::cudart)
+    target_compile_features(palw_cuda_grouped_capture_info PRIVATE cxx_std_17)
+    set_target_properties(palw_cuda_grouped_capture_info PROPERTIES
+        CUDA_STANDARD 17
+        CUDA_STANDARD_REQUIRED ON
+    )
+    add_test(NAME palw_cuda_grouped_capture_info COMMAND palw_cuda_grouped_capture_info)
+    set_tests_properties(palw_cuda_grouped_capture_info PROPERTIES
+        LABELS "cuda;gpu;producer;manifest;palw"
+        SKIP_RETURN_CODE 77
+    )
+endif()

runtime-palw/cuda/README.md

@@ -0,0 +1,683 @@
+# PALW CUDA trace backend
+
+This directory contains five related but deliberately separate experimental
+contracts:
+
+- the CUDA device observer writes V1 records for deterministic, fixed-width
+  GEMM and attention tile sketches over the final contiguous `float` output;
+- the standalone producer API writes V2 records from FP32 accumulator values
+  passed directly by an instrumented producer kernel before epilogue/output
+  storage, and launches only one registered exact CUDA function pointer; and
+- an additive V2 C ABI/codec can carry declared accumulator provenance,
+  reduction-segment metadata, and a producer-variant digest, and the Rust
+  runtime can strictly decode and bind a complete V2 stream to expected
+  dispatch and runtime metadata;
+- an additive 452-byte V3 codec and Rust binder carry exact schedule/group,
+  launch-geometry, work-entry, and capture identities and represent the three
+  FA-off eager-attention sublaunch roles; and
+- an opt-in, request-local llama.cpp bridge instruments the exact unfused,
+  single-column Q4_K/Q6_K MMVQ specializations at their full-K pre-epilogue
+  FP32 accumulator point plus the FA-off QK/softmax/PV paths, and fails closed
+  on association/identity mismatch.
+
+The standalone hook is a real device-side accumulator capture primitive: its
+device test computes segmented dot-product accumulators in registers, captures
+them before an independently variable epilogue, and emits V2 without reading the
+final output. It requires exactly 32 canonical samples per tile and K segment,
+rejects duplicate/missing samples, and detects a stale launch nonce or a compiled
+producer identity mismatch. The existing generic GEMM/attention observer remains
+V1 final-output-only.
+
+The vendored MMVQ bridge is available for diagnostic collection, but this does
+**not** make the Qwen path production- or Receipt-capable. The exact launch
+wrapper checks one CUDA function pointer, current SM, and exact
+`cudaFuncGetAttributes` values, then uses that same pointer in `cudaLaunchKernel`.
+The producer supplies compiled dispatch/work/capture IDs to the device hook,
+while the host descriptor supplies a committed binary digest. Binding those
+identifiers to the actual release cubin is implemented by the strict release
+manifest; governance approval remains an authority responsibility. CUDA does not expose a trustworthy
+current-entry-point identity to an arbitrary device helper.
+
+The CUDA implementation is fail-closed. Compiling with `nvcc`, passing both
+non-skipped real-device CTests, and passing a reproducibility matrix on the exact
+supported NVIDIA hardware/software manifest are necessary but not sufficient
+for production approval; R32 also requires the FA-off eager-attention producer
+hooks, release binding, Receipt V2 mapping, and complete MMVQ-plus-attention
+device E2E. Those fixed-profile experimental gates are complete; R32 production
+approval still requires the live canonical authority callback, deployed trust
+roots, and replica/reproducibility evidence.
+The no-CUDA CTests prove the C/C++ ABI and canonical codecs. Rust host tests add
+strict V2/V3 decoding and expected-stream binding, but neither host test suite
+proves where a device sketch originated or which kernel actually ran.
+The public headers fix their production-capable macros to zero. Configuring
+with `-DPALW_CUDA_PRODUCTION_KERNEL_TRACE=ON` always fails: this transport cannot
+be enabled for production receipt issuance.
+
+The historical MMVQ-only SM89 results are in
+[`../../docs/evidence/cuda-v3-mmvq-hook-sm89-2026-07-15.md`](../../docs/evidence/cuda-v3-mmvq-hook-sm89-2026-07-15.md):
+three positive one-token runs each finalized 253 records (216 Q4_K, 37 Q6_K)
+with fingerprint `6618cafb2d66fc5c`, and a zero-based index-17 rejection stopped
+at 17 accepted records. The current full-stream evidence is
+[`../../docs/evidence/cuda-v3-full-hook-sm89-2026-07-16.md`](../../docs/evidence/cuda-v3-full-hook-sm89-2026-07-16.md):
+three 361/361 runs, 253 MMVQ plus 108 attention records, five work-class
+rejections, and the exact release manifest. The tool reports
+`diagnostic_only=true` and `receipt_authority=false` in both modes.
+
+## Standalone V2 producer-accumulator contract
+
+`palw_cuda_producer_trace.h` exposes the host session/launch ABI and
+`palw_cuda_producer_trace.cuh` exposes
+`palw_cuda_producer_capture_accumulator_f32`. The capture call belongs inside
+the producer, at the declared K-segment boundary, while the FP32 accumulator is
+still a register/local value and before epilogue or final store. A producer
+thread calls it exactly once for every logical output and segment. Unsampled
+outputs are ignored; the fixed sample-position function selects 32 ordinals per
+tile, including repeated positions for small tiles.
+
+Segment boundaries are canonical, contiguous, and nonempty. Integrations use
+`palw_cuda_producer_segment_begin/end(k, segment, count)`, which partitions the
+full `[0, k)` range by integer quotient/remainder without overlap or gaps.
+`reduction_segment_count > k` is rejected. The audited dispatch variant must
+commit this partition contract; the standalone helper cannot detect a producer
+that computes a different semantic range and then lies about the segment index.
+
+Records are initialized and stored in canonical order:
+
+```text
+tile_index  = tile_row * tile_grid_columns + tile_column
+record_index = base_record
+             + tile_index * reduction_segment_count
+             + reduction_segment_index
+```
+
+For each record, a 32-bit atomic sample mask proves every selected ordinal was
+seen. A second mask makes duplicate observation fatal. Sketch lanes use a
+commutative integer XOR of canonicalized FP32 contributions tagged with sample,
+logical row/column, and segment; scheduling cannot change the result. The hook
+never loads the final-output buffer. `-0.0` and NaN payloads use the same
+canonicalization as V1.
+
+`palw_cuda_producer_trace_prepare` validates GEMM shape, canonical record count,
+strict logical sequence, strictly increasing nonzero request-local nonce, exact
+SM, launch geometry, nonzero identity digests, and exact CUDA-reported binary/
+PTX/register/max-thread attributes. It initializes records on the bound stream
+and returns a library-owned device view. `palw_cuda_producer_trace_launch`
+rejects a function pointer different from the prepared pointer and launches the
+prepared pointer itself. It also injects the immutable prepared device view at
+the kernel-argument index registered with the audited ABI during `prepare`;
+`launch` has no free index/count input. A caller-provided substitute view is
+therefore never marshalled to the kernel. Finalization synchronizes and accepts records only if
+every sample was observed exactly once and no view, nonce, index, identity, or
+metadata fault occurred. Every copied V2 semantic metadata field is re-encoded
+and compared with the host-retained immutable launch expectation; only the four
+data-dependent sketch lanes may differ. Any integrity failure permanently poisons the context;
+copied bytes are diagnostic only.
+
+The three identity domains are intentionally separate:
+
+- `producer_variant_id` commits the canonical dispatch descriptor and is in V2;
+- `entry_point_id` commits the fully specialized producer entry-point contract;
+- `kernel_binary_digest` commits the release cubin/fatbin artifact.
+
+The wrapper proves which registered CUDA function pointer it launched in the
+current trusted process. It cannot derive either digest from a function pointer,
+prove that a caller-provided digest matches loaded machine code, or prove that
+an unreviewed producer passed a semantically genuine accumulator. Production
+therefore additionally needs audited vendored integration, release-binary
+attestation, actual-dispatch coverage, and the closed Receipt mapping gate.
+
+## V1 device observer and deterministic record order
+
+The observer launch is enqueued immediately after the operation being observed,
+on the same CUDA stream. One CUDA block and one active thread handle each logical
+output tile. For a tile grid with columns `grid_x`, the canonical tile index is:
+
+```text
+tile_index = tile_row * grid_x + tile_column
+record_index = base_record + tile_index
+```
+
+Each thread writes directly to that record index. CUDA block scheduling therefore
+cannot reorder records. A tile reads 32 fixed logical positions, canonicalizes
+`-0.0` to `+0.0` and every NaN payload to one quiet-NaN bit pattern, and produces
+four integer mixing lanes. It uses no floating-point reduction and no atomics.
+
+This makes the observer deterministic for identical output bits and metadata on
+the same supported stack. It does not make an upstream GEMM or attention kernel
+numerically deterministic. A legitimate upstream bit change is expected to
+change a sketch, and cross-GPU repeatability has not yet been established.
+
+The current launch path writes `palw_cuda_trace_record` with schema V1. V2 has a
+separate ordering contract: the Rust binder requires logical launches in
+consecutive zero-based order, and within each launch requires tile-major then
+reduction-segment-major order. The C codec validates each record's tile and
+segment consistency; the Rust binder validates the cross-record ordering. The
+current CUDA observer does not produce those V2 records.
+
+## Validated V1 device contracts
+
+All dimensions must be nonzero and fit in `uint32_t`. Common validation also
+rejects null or misaligned pointers, address and multiplication overflow, a row
+stride smaller than the logical width, out-of-range layer/phase/dtype/quantization
+tags, invalid tile geometry, more than `UINT32_MAX` tiles, CUDA grid limits, a
+nonconsecutive sequence, a second CUDA stream, pending copies, and insufficient
+record capacity.
+
+The `float` pointer is the sketch transport. `dtype` records the logical operation
+dtype and may therefore differ from the transport type.
+
+GEMM uses ggml's contiguous storage for a logical `[m, n]` result:
+
+```text
+storage              [batch][n][m], m is contiguous
+output_rows          n * batch
+output_columns       m
+row_stride           >= m
+m, n, k, batch       nonzero and <= UINT32_MAX
+```
+
+Attention uses:
+
+```text
+storage              [batch][query_tokens][heads * head_dim]
+output_rows          query_tokens * batch
+output_columns       heads * head_dim
+row_stride           >= output_columns
+causal               exactly 0 or 1
+causal KV length     key_value_tokens >= query_tokens
+decode query length  exactly 1
+```
+
+Prefill requires `decode_step == 0`; decode requires a step that fits in
+`uint32_t`. Attention always records quantization `NONE`.
+
+## State, rollback, and poison semantics
+
+One context is permanently bound to the first CUDA stream used with it and is
+not thread-safe. The required sequence starts at zero.
+
+| Event | Count/sequence effect | Resulting state |
+| --- | --- | --- |
+| Validation failure | No change | Reusable |
+| Sequence mismatch | No change | Reusable |
+| Capacity failure | No reservation and no sequence consumption | Sticky overflow |
+| Immediate observed/trace launch error | No reservation for that launch | Permanently poisoned |
+| Successful immediate trace launch | Reserves every tile and consumes one sequence | Queued, not committed |
+| Successful synchronize | Commits all accepted launches and completes a pending copy | Reusable |
+| Asynchronous stream failure at synchronize | Existing reservations remain diagnostic only | Permanently poisoned |
+| D2H enqueue failure | No new copy becomes usable | Permanently poisoned |
+
+`palw_cuda_trace_count` reports accepted/reserved records, including queued work.
+`palw_cuda_trace_committed_count` advances only after a successful
+`palw_cuda_trace_synchronize`. An immediate failure rolls back implicitly because
+the host counters advance only after `cudaGetLastError` reports success. An
+asynchronous failure cannot safely roll back already queued device writes, so the
+context is poisoned and every later launch, copy, synchronize, or reset fails
+closed with `PALW_CUDA_TRACE_POISONED`. Destroy it, fail the enclosing inference
+request, and rebuild the affected CUDA backend/stream before a later request;
+allocating only a fresh trace context is not proof that an asynchronous device
+failure was recovered. If synchronization fails after a D2H enqueue, do not
+consume or release the host buffer until that backend/stream teardown completes.
+
+Overflow is also a receipt failure. It can be cleared only by synchronizing any
+work accepted before the overflow and then resetting. Reset clears counts,
+sequence, and overflow, but does not change the permanent stream binding and can
+never clear CUDA poison. Destroying a context or releasing a host copy buffer
+while work is pending is a caller error.
+
+## Canonical V1/V2/V3 encoding: never hash native memory
+
+`palw_cuda_trace_record` has a checked native ABI size of 144 bytes, including a
+reserved byte and native tail padding. `palw_cuda_trace_record_v2` has a checked
+native ABI size of 192 bytes and more padding between fields. None of that
+padding is transport or consensus data. Hashing or serializing either raw struct
+is forbidden.
+
+`palw_cuda_trace_encode_record_v1` validates a schema-V1 record and writes
+exactly 139 big-endian bytes, field by field, in this order:
+
+```text
+9 * u64   kernel_sequence .. key_value_tokens
+4 * u64   sketch lanes
+7 * u32   layer_id .. output_columns
+1 * u16   schema_version
+5 * u8    kind, phase, dtype, quantization, causal
+```
+
+The additive `palw_cuda_trace_encode_record_v2` requires schema V2 and writes the
+same 139-byte semantic prefix followed by:
+
+```text
+3 * u8    declared_origin, accumulator_stage, accumulator_dtype
+1 * u16   sketch_scheme
+2 * u32   reduction_segment_index, reduction_segment_count
+32 bytes  producer_variant_id
+```
+
+The result is exactly 184 bytes. The V1 reserved byte and all native padding are
+excluded from both encodings. V2 does not replace V1: the generic observer and
+its copy API still use the V1 native record. The standalone producer session has
+a separate V2 device buffer/finalizer and never relabels a V1 observation.
+
+Both the C++ codec and Rust decoder reject unknown tags, zero producer-variant
+IDs, and inconsistent provenance tuples. Final-output records must use no
+accumulator stage or dtype, the final-output sketch scheme, and zero reduction
+segment fields. A producer-accumulator declaration is accepted only for GEMM,
+FP32 scalar-accumulator sketches, an approved pre-reduction or full-K stage, and
+a valid nonempty segment range; full-K evidence must be a single segment.
+
+These checks establish canonical syntax and internal consistency only. In
+particular, the C codec cannot prove that `producer_variant_id` is canonical or
+that `declared_origin` is true.
+
+V3 is a separate additive schema with a checked 464-byte native record and an
+exact 452-byte canonical encoding. It extends the V2 semantic prefix with exact
+schedule and attention-group ownership, sublaunch role/count, physical layout
+and launch geometry, and operation/group/plan/layout/work/capture identities.
+The V3 codec never serializes native padding. Neither V1 nor V2 Receipt code may
+reinterpret a V3 record.
+
+## Rust V2/V3 stream binding
+
+`runtime-palw/src/cuda_trace.rs` provides `RawCudaTraceRecordV2::decode_strict`
+for exactly one 184-byte record and `decode_cuda_trace_v2_stream` for a
+concatenated exact-size stream. `bind_cuda_trace_v2` then validates the complete,
+unfiltered stream before any possible GEMM-only projection. It requires:
+
+- an immutable, nonempty expected-launch table with consecutive zero-based
+  logical launch sequences and strictly increasing schedule indices;
+- exact record count and contiguous tile/segment order for every GEMM and
+  attention launch;
+- equality of operation shape, phase/decode step, layer, tile geometry,
+  provenance tuple, segment count, and canonical dispatch-variant digest;
+- the initial profile of one CUDA accelerator, tensor parallelism one, no tensor
+  repack, batch one for bound operations, and flash attention enabled whenever
+  an attention launch is expected; and
+- an exact supported dispatch descriptor: currently unfused single-column
+  llama.cpp MMVQ metadata or a pinned flash-attention specialization digest.
+
+For a validated expected dispatch, `derive_cuda_kernel_id` binds the runtime
+manifest's kernel binary digest, kernel algorithm digest, source commit, CUDA SM
+architecture, and canonical dispatch descriptor. This is a host-side identity
+derivation from trusted expected metadata. Until the vendored producer reports
+and is checked against the actual selected specialization, it is not proof of
+the kernel entry point that executed.
+
+The result, `BoundCudaTranscriptV1`, intentionally exposes only the immutable
+raw records, bound launch ranges, expected descriptors, and derived producer
+kernel IDs. Raw or merely bound records have no conversion to receipt evidence
+and cannot authorize receipt issuance or upgrade `TraceCapability`.
+
+`runtime-palw/src/cuda_attestation.rs` adds a separate, no-public-constructor
+authority typestate. A network-scoped Ed25519 authority envelope commits the
+exact job/execution, signed assignment, runtime instance/class/manifest,
+reviewed producer integration, operation schedule, full unfiltered transcript,
+and epochs. Registry verification checks validity, revocation, and exact
+runtime/integration approval, then requires every scheduled GEMM and attention
+index exactly once. Only the resulting `AuthorityBoundCudaTranscriptV2` may be
+projected to `AuthorityBoundCudaReceiptEvidenceV2`, and that projection includes
+only true producer-accumulator GEMMs while retaining the full transcript
+commitment. The newer V3 authority and `receipt_v2_flow` bind the complete fixed
+361-launch profile into the implemented Receipt V2. The V1 builder
+and verifier both reject CUDA `KernelSketch`, including a hand-built/resigned V1
+body, because V1 has no field for the authority provenance commitment.
+
+The deterministic Qwen profile currently has flash attention disabled. In the
+measured three-token graph stream, 975 GEMMs split into 759 quantized MMVQ
+events (253/token: Q4_K 648 and Q6_K 111 total) and 216 eager-attention F16
+`MUL_MAT` events (72/token). The V3 schema and Rust binder now represent each
+FA-off eager group as QK-score GEMM, masked/scaled softmax, and PV GEMM
+sublaunches with separate covered schedule indices. The vendored QK-score,
+masked/scaled softmax, and PV work paths now enqueue the grouped collector on
+the same stream and are associated from typed graph metadata. The resulting
+361-launch MMVQ-plus-attention stream passed three real-model device runs with
+identical fingerprints and five work-class rejection gates. The implemented V2
+verifier binds a strict authority-provided expected table; the live diagnostic
+callback does not yet receive that canonical authority table.
+
+## Build and test gates
+
+The normal configuration requires CUDA and fails instead of silently compiling a
+stub. It builds the experimental transport and its tests, not a production
+receipt path:
+
+```sh
+cmake -S runtime-palw/cuda -B build/palw-cuda -DBUILD_TESTING=ON
+cmake --build build/palw-cuda
+ctest --test-dir build/palw-cuda --output-on-failure
+```
+
+The explicit production gate is intentionally closed:
+
+```sh
+cmake -S runtime-palw/cuda -B build/palw-cuda-production \
+  -DPALW_CUDA_PRODUCTION_KERNEL_TRACE=ON
+# FATAL_ERROR: vendored integration/Receipt mapping/reproducibility remain incomplete
+```
+
+Production builds must additionally set one exact `CMAKE_CUDA_ARCHITECTURES`
+value that matches the committed runtime class (for example `90-real` for an
+approved `sm_90` class); compiler-default or fat-binary ambiguity is not an
+acceptable reproducibility gate.
+
+On a machine without CUDA, the V1/V2 header, layout, enum-tag, canonical codec,
+golden-fixture, and closed production-gate contracts can be tested:
+
+```sh
+cmake -S runtime-palw/cuda -B build/palw-cuda-host \
+  -DPALW_CUDA_TRACE_ENABLE_CUDA=OFF -DBUILD_TESTING=ON
+cmake --build build/palw-cuda-host
+ctest --test-dir build/palw-cuda-host --output-on-failure -L host
+```
+
+The Rust cross-language contract is independent of CUDA hardware:
+
+```sh
+cargo +1.81 test --locked --test cuda_trace_contract
+```
+
+It decodes the shared V2 golden bytes also produced and checked by the C++ codec
+test, and exercises strict
+length/tag/provenance validation, complete GEMM-plus-attention stream binding,
+missing/duplicate/reordered/mutated failures, launch/schedule constraints,
+dispatch compatibility, runtime-class restrictions, and manifest/SM/dispatch
+kernel-ID derivation. These are transport and metadata-binding tests, not device
+producer tests.
+
+One device CTest exercises the final-output V1 observer. It covers GEMM and
+attention record count/order, same-stream
+repeatability, sampled mutation sensitivity and tile isolation, dtype/phase/
+quantization/shape/stride/tile validation, causal and decode constraints,
+capacity/reset behavior, exact sequence enforcement, stream binding, copy and
+commit states, permanent launch-failure poison, and recovery only through a new
+trace context for the injected non-sticky invalid-configuration error. It
+returns CTest skip code 77 if no CUDA device/driver is available. A
+future R32 production review must treat a skipped device test as **not
+verified**, not as a pass.
+
+The second device CTest exercises the standalone V2 producer primitive with a
+real segmented GEMM test kernel. It proves that an epilogue-only mutation changes
+final output but not pre-epilogue evidence, while an input/accumulator mutation
+does change evidence. It also rejects the wrong launch pointer, a compiled
+identity mismatch, and an uninstrumented producer with incomplete coverage.
+It proves that a producer-side V2 metadata overwrite is rejected by the
+host-retained expectation and that a substituted caller view is replaced by the
+prepared view. This is a primitive-level test kernel, not the vendored Qwen
+producer E2E.
+
+### Verification in this checkout (2026-07-15)
+
+- The host-only configuration built with AppleClang 21 using
+  `-Wall -Wextra -Wpedantic -Werror`; all five host CTests passed (5/5), including
+  pure producer-descriptor validation and
+  the nested configuration test that proves the production gate rejects this
+  transport.
+- The same five host CTests passed under AppleClang AddressSanitizer and
+  UndefinedBehaviorSanitizer (5/5) with no sanitizer report.
+- The default CUDA-required configuration failed at configure time as intended:
+  no CUDA compiler was found.
+- `nvcc` and an NVIDIA device are unavailable on this Apple arm64 host. On the
+  separate Windows/WSL2 NVIDIA gate, an RTX 4060 Ti (`sm_89`), driver 610.62,
+  CUDA toolkit 13.3.1/NVCC 13.3.73, and `CMAKE_CUDA_ARCHITECTURES=89-real` built
+  the final grouped build passed all eight CTests, including three non-skipped
+  device/collector tests.
+  The standalone producer test then passed 20 separate executions with the same
+  encoded-transcript diagnostic fingerprint `c1a38ed138200874` each time. This
+  is primitive-level SM89 evidence, not vendored Qwen E2E or a cross-stack
+  reproducibility matrix.
+- `cargo +1.81 test --locked --test cuda_trace_contract` passed all thirteen Rust
+  V2 codec/binding/authority-typestate tests on this host. Those host tests do
+  not replace producer device evidence.
+- `cargo +1.81 test --locked --test cuda_trace_v3_contract` passed all nine V3
+  codec, identity, dispatch, FA-off grouping, and binding contract tests. The
+  complete locked Rust 1.81.0 gate passed 224 tests, with 2 real-model tests
+  ignored (226 discovered); fmt, Clippy `-D warnings`, and rustdoc `-D warnings`
+  also passed.
+- The final opt-in vendored V3 build on the same RTX 4060 Ti/NVCC 13.3.73 stack
+  passed three one-token positive runs with 361/361 committed records and the
+  same `22f3a57e3640a8c6` canonical-record diagnostic fingerprint: Q4_K 216,
+  Q6_K 37, and QK/softmax/PV 36 each. Rejecting the first Q4_K, Q6_K, QK,
+  softmax, or PV launch stopped at the exact selected position. A strict release
+  manifest bound six exact symbols, runtime attributes, cubins, fatbin, and the
+  loaded DSO. This is complete vendored hook diagnostic E2E, not production
+  Receipt-authority E2E.
+
+## Historical V2 integration design and current V3 delta
+
+The original design below was pinned to vendored llama.cpp commit
+`12127defda4f41b7679cb2477a4b0d65ee6a0c8f`. Its default-off build boundary,
+request-local state, exact association, graph/fusion/concurrency rejection, and
+fail-closed principles now inform the active V3 MMVQ diagnostic bridge. Code
+snippets and V2 type names in this section are retained as the historical
+baseline, not as a literal description of the current V3 call sites. Attention
+producer integration and Receipt/Bundle/SQLite V2 are now implemented; the
+production authority callback and issuance gate remain future work.
+
+### Opt-in build boundary
+
+Add a default-off `GGML_CUDA_PALW_TRACE` CMake option. Only when it is enabled,
+require a `PALW_CUDA_TRACE_SOURCE_DIR`, add this directory with
+`EXCLUDE_FROM_ALL`, link `palw_cuda_trace` into `ggml-cuda`, and define the hook:
+
+```cmake
+option(GGML_CUDA_PALW_TRACE "Enable fail-closed PALW CUDA observation" OFF)
+set(PALW_CUDA_TRACE_SOURCE_DIR "" CACHE PATH "PALW CUDA trace source")
+
+if (GGML_CUDA_PALW_TRACE)
+    if (NOT IS_DIRECTORY "${PALW_CUDA_TRACE_SOURCE_DIR}")
+        message(FATAL_ERROR "GGML_CUDA_PALW_TRACE requires PALW_CUDA_TRACE_SOURCE_DIR")
+    endif()
+    set(PALW_CUDA_TRACE_ENABLE_CUDA ON CACHE BOOL "" FORCE)
+    add_subdirectory("${PALW_CUDA_TRACE_SOURCE_DIR}"
+                     "${CMAKE_CURRENT_BINARY_DIR}/palw-trace" EXCLUDE_FROM_ALL)
+    target_link_libraries(ggml-cuda PRIVATE palw_cuda_trace)
+    target_compile_definitions(ggml-cuda PRIVATE GGML_CUDA_PALW_TRACE=1)
+endif()
+```
+
+`GGML_CUDA_PALW_TRACE` in this design is an experimental data-collection hook
+only. Any receipt-issuing build must additionally require
+`PALW_CUDA_TRACE_PRODUCTION_CAPABLE == 1` and enable
+`PALW_CUDA_PRODUCTION_KERNEL_TRACE`; both checks intentionally fail today.
+
+The final patch must also verify compatible dynamic/static CUDA-runtime linkage
+for both llama.cpp link modes. With the option off, the existing target, ABI, and
+runtime behavior must remain unchanged.
+
+### Per-request registration API
+
+Do not use global mutable metadata and do not infer layer or phase from tensor
+names. Add an optional PALW state object to `ggml_backend_cuda_context` in
+`ggml/src/ggml-cuda/common.cuh`. Before graph compute, the runtime observer
+registers an immutable table keyed by `const ggml_tensor *` with one entry per
+expected CUDA node. It must contain the same information represented by Rust
+`ExpectedCudaLaunchV1`:
+
+```text
+node pointer, expected op and exact dispatch descriptor, logical launch sequence,
+schedule index, layer, phase/decode step, logical dtype, quantization, causal,
+tile geometry, declared provenance tuple, expected reduction segment count
+```
+
+The table is sorted by logical launch sequence, starts at zero, has strictly
+increasing schedule indices, contains no duplicate node, and has a precomputed
+expected record total. A request also owns the trace context, pinned host record
+buffer, observed-node bitmap, and sticky PALW status. Beginning a request rejects
+a reused/poisoned state or an unsupported execution mode. Finalization requires
+every registered node exactly once and no unexpected eligible node.
+
+### Central call sites
+
+In `ggml/src/ggml-cuda/ggml-cuda.cu`, place hooks in the central dispatcher after
+the final producer returns:
+
+```cpp
+case GGML_OP_MUL_MAT: {
+    const auto variant = ggml_cuda_mul_mat(ctx, dst->src[0], dst->src[1], dst);
+    ggml_cuda_palw_after_node(ctx, dst, variant); // same stream, after producer
+    break;
+}
+
+case GGML_OP_FLASH_ATTN_EXT: {
+    const auto variant = ggml_cuda_flash_attn_ext(ctx, dst);
+    ggml_cuda_palw_after_node(ctx, dst, variant); // same ctx.stream()
+    break;
+}
+```
+
+Those dispatcher hooks establish complete operation coverage and report the
+selected dispatch; they cannot by themselves observe a producer accumulator.
+True accumulator sampling must be instrumented inside the selected producer
+kernel at the declared stage, with the dispatcher hook checking that the
+expected node and specialization emitted exactly the required V2 records.
+
+This location is important. `ggml_cuda_mul_mat` near line 1731 has early returns
+for FWHT, cuBLAS, MMVF, MMF, MMVQ, and MMQ variants; hooking inside only one
+variant would silently omit records. The dispatcher cases are near lines 2119
+and 2224 in the pinned commit.
+
+The shown return value is part of the required patch: every producer path must
+report the actually selected stable dispatch token. The implemented Rust V1
+dispatch contract is deliberately narrower than llama.cpp's full selector: it
+accepts only an unfused, single-column MMVQ specialization with exact weight
+type, small-K flag, architecture parameter table, warp count, and rows per
+block, or a flash-attention descriptor with a nonzero exact specialization
+digest. FWHT, cuBLAS, MMVF, MMF, MMQ, fused MMVQ, and any unclassified attention
+specialization must fail closed until a versioned descriptor supports them.
+
+The hook must compare the actual token with the registered expected dispatch and
+place the canonical dispatch digest into every V2 record. Rust already derives a
+host-side `producer_kernel_id` from the committed kernel binary and algorithm
+digests, runtime source commit, SM architecture, and validated dispatch. A
+coarse "GEMM" or "attention" label is insufficient, and that derivation does not
+prove actual execution until the device integration supplies and authenticates
+the selected specialization.
+
+Some logical dispatches run an ordered bundle of conversion, GEMM/attention,
+and fixup kernels rather than one entry point. The current singular Rust
+`kernel_id` contract cannot silently represent such a bundle. Either restrict
+the approved runtime to a proven single-producer path, hook and record each
+actual kernel under a revised grouping contract, or version the receipt schema
+with an explicit ordered-bundle identity.
+
+The bridge accepts only contiguous `GGML_TYPE_F32` destination tensors and uses
+overflow-checked dimensions:
+
+| Operation | PALW mapping from ggml |
+| --- | --- |
+| GEMM | `m = dst->ne[0]`, `n = dst->ne[1]`, `k = src0->ne[0]`, `batch = dst->ne[2] * dst->ne[3]`, rows `n * batch`, columns/stride `m` |
+| Flash attention | `query_tokens = Q->ne[1]`, `key_value_tokens = K->ne[1]`, `heads = Q->ne[2] = dst->ne[1]`, `head_dim = V->ne[0] = dst->ne[0]`, `batch = Q->ne[3] = dst->ne[3]`, rows `query_tokens * batch`, columns/stride `heads * head_dim` |
+
+The registered descriptor supplies causal policy, logical dtype, quantization,
+phase, layer, and decode step. A non-null attention mask is not sufficient proof
+of causality. Any tensor/layout/descriptor disagreement fails the request before
+the trace launch.
+
+The hook stores a PALW error in the backend context. Change
+`ggml_cuda_graph_evaluate_and_capture` to return failure immediately after the
+current `ggml_cuda_compute_forward` call if that sticky status is non-OK, and
+have `ggml_backend_cuda_graph_compute` return `GGML_STATUS_FAILED`. Do not reuse
+the existing `false` return from `ggml_cuda_compute_forward`, because that path
+currently means "unsupported op" and is followed by `GGML_ASSERT(ok)`.
+
+The current `palw_cuda_trace_copy_async` path copies only native V1 final-output
+records. A producer integration must add a separately reviewed V2 device-buffer
+and copy path; relabeling or wrapping a copied V1 record as producer-accumulator
+evidence is forbidden. After graph submission, finalization must synchronize the
+same stream, check committed count and exact node/record coverage, encode every
+V2 record, strictly decode it in Rust, and call `bind_cuda_trace_v2`. Any hook,
+CUDA, overflow, coverage, codec, decoder, or binding error fails the request.
+Even success produces diagnostic bound transport only. It must next pass the
+authority verification described above; a successful authority-bound projection
+still suppresses V1 receipt issuance. Current V3 authority evidence is accepted
+only by the separately versioned Receipt V2 flow.
+
+The CUDA `kernel_sequence` is a zero-based **logical launch** sequence. Every
+tile belonging to one registered GEMM or attention launch carries the same raw
+sequence, and attention launches consume sequence values. This deliberately does
+not match the current Rust `GemmTraceSample.kernel_sequence`, which is a
+zero-based sequence over GEMM tile events only. `bind_cuda_trace_v2` now performs
+the complete unfiltered validation: launch sequences are consecutive, each
+registered launch owns one contiguous tile/segment range, every record in that
+range has matching metadata and dispatch digest, and all expected GEMM and
+attention launches are present exactly once. Filtering or resequencing first
+could hide a missing or reordered attention launch and remains forbidden.
+
+Raw or merely bound CUDA records must never be passed to `GemmTrace::push_group`
+or represented as `TraceEvidenceKind::KernelSketch`. Only the authority-verified
+typestate can create the implemented future-V2 projection, which commits its
+signed attestation, full transcript, integration, mapping version, and projected
+trace. It does not make that trace valid V1 evidence. Production issuance still
+requires governance approval of the exact binary/manifest, a live callback fed
+by canonical authority IDs, deployed trust roots, and reproducibility evidence.
+
+### Execution modes that must be disabled or rejected initially
+
+The first production integration must be deliberately narrow:
+
+- Disable CUDA graph capture/replay while PALW is active. A captured sketch
+  launch bakes `base_record` and sequence arguments, while a replay skips the
+  host dispatcher, so replay would overwrite records. The pinned tree recognizes
+  `GGML_CUDA_DISABLE_GRAPHS`, but the patch should make graph enablement return
+  false directly when PALW state is active.
+- Disable graph fusion while PALW is active by returning zero from
+  `ggml_cuda_try_fuse`. The pinned tree also has `GGML_CUDA_DISABLE_FUSION=1` for
+  prototype runs. Fused MUL_MAT paths around lines 3224-3715 bypass the central
+  dispatcher hooks.
+- Require `curr_stream_no == 0` and a single CUDA device. The graph optimization
+  path can use multiple streams when `GGML_CUDA_GRAPH_OPT=1`; an initial PALW
+  request must reject it. Supporting concurrency later requires one context per
+  stream plus a separately specified deterministic merge order.
+- Require the initial Rust V2 binding profile's fixed `batch == 1`. The strict
+  record decoder and standalone C transport can represent larger batches, but
+  `ExpectedCudaLaunchV1` rejects them.
+- Support the exact unfused, single-column MMVQ dense path only. Reject other
+  `GGML_OP_MUL_MAT` variants, `GGML_OP_MUL_MAT_ID`, and unexpected CPU/offload
+  paths until each has an explicit versioned dispatch descriptor. This is
+  suitable for the dense Qwen target, not MoE.
+- For the FA-off runtime, require exact hooks for QK-score GEMM, masked/scaled
+  softmax, and PV GEMM under the V3 grouping contract. Never
+  claim full attention coverage while any stage is uninstrumented. A separately
+  approved FA-on class would require its own exact fused specialization binding.
+
+These restrictions are receipt integrity requirements, not performance hints.
+Removing one requires a new tested ordering and coverage contract.
+
+## Known limits before production approval
+
+- The vendored Q4_K/Q6_K MMVQ hook captures a diagnostic full-K pre-epilogue
+  FP32 accumulator. The FA-off QK MMVF, F32 masked/scaled softmax, and PV MMVF
+  work paths enqueue the grouped collector on the same stream. The 361-launch
+  device E2E and exact release manifest are evidence, but the live callback still
+  uses diagnostic rather than authority-provided canonical physical-layout IDs.
+- The launch wrapper checks an exact function pointer and attributes, but CUDA
+  cannot derive/attest the release binary digest or semantic accumulator stage
+  from that pointer; reviewed source, binary attestation, and manifest binding
+  are still required.
+- The 32 public sample positions and integer mixer are deterministic evidence,
+  not a cryptographic proof that every output element was computed. Hashing the
+  resulting record with SHA3 does not recover unsampled coverage; replication,
+  future audit, and an approved sampling/security analysis remain mandatory.
+- Raw or merely bound transcripts cannot establish `KernelSketch` provenance.
+  Only the V3 authority typestate may enter Receipt V2; CUDA `KernelSketch`
+  remains forbidden in `ComputeReceiptV1`.
+- Cross-architecture and cross-driver reproducibility is unproven.
+- CUDA graph replay, fusion, concurrent streams, multi-GPU merge, MoE
+  `MUL_MAT_ID`, and attention variants outside the pinned FA-off QK-score /
+  masked-scaled-softmax / PV specializations are intentionally unsupported by
+  the proposed first integration.
+- Existing llama.cpp `CUDA_CHECK`/`GGML_ABORT` process-fatal behavior is outside
+  this library; a service-grade integration must audit whether those paths need
+  conversion to request-scoped errors.
+
+R32 remains in progress until the integration proves every accepted event came
+from the exact authority-approved release kernel entry point (or an explicitly
+versioned ordered-kernel-bundle identity) through the live canonical authority
+callback and passes replica/reproducibility gates under deployed trust roots.
+FA-off attention coverage, device E2E, the release manifest, and Receipt V2 are
+complete for the fixed diagnostic profile. The external NVIDIA
+hardware blocker is resolved by the SM89 gate above; the remaining blockers are
+authority/governance integration and production evidence.
+Host-side V2/V3 transport and expected-metadata binding do not satisfy those
+conditions. The production CMake gate and capability macro must not be opened
+before they do.

runtime-palw/cuda/abi_contract_test.cpp

@@ -0,0 +1,723 @@
+#include "palw_cuda_trace.h"
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <fstream>
+#include <string>
+#include <type_traits>
+#include <vector>
+
+#if !defined(PALW_CUDA_TRACE_GOLDEN_FIXTURE_PATH)
+#error "PALW_CUDA_TRACE_GOLDEN_FIXTURE_PATH is required"
+#endif
+#if !defined(PALW_CUDA_TRACE_GOLDEN_FIXTURE_V3_PATH)
+#error "PALW_CUDA_TRACE_GOLDEN_FIXTURE_V3_PATH is required"
+#endif
+
+static_assert(PALW_CUDA_TRACE_ABI_VERSION == 1U);
+static_assert(PALW_CUDA_TRACE_SCHEMA_VERSION == 1U);
+static_assert(PALW_CUDA_TRACE_SCHEMA_VERSION_V1 == 1U);
+static_assert(PALW_CUDA_TRACE_SCHEMA_VERSION_V2 == 2U);
+static_assert(PALW_CUDA_TRACE_SCHEMA_VERSION_V3 == 3U);
+static_assert(PALW_CUDA_TRACE_RECORD_ENCODED_SIZE_V1 == 139U);
+static_assert(PALW_CUDA_TRACE_RECORD_ENCODED_SIZE_V2 == 184U);
+static_assert(PALW_CUDA_TRACE_RECORD_ENCODED_SIZE_V3 == 452U);
+static_assert(PALW_CUDA_TRACE_PRODUCTION_CAPABLE == 0U);
+static_assert(sizeof(palw_cuda_trace_record) == 144U);
+static_assert(alignof(palw_cuda_trace_record) == 8U);
+static_assert(std::is_standard_layout_v<palw_cuda_trace_record>);
+static_assert(std::is_trivial_v<palw_cuda_trace_record>);
+static_assert(offsetof(palw_cuda_trace_record, kernel_sequence) == 0U);
+static_assert(offsetof(palw_cuda_trace_record, sketch) == 72U);
+static_assert(offsetof(palw_cuda_trace_record, layer_id) == 104U);
+static_assert(offsetof(palw_cuda_trace_record, schema_version) == 132U);
+static_assert(offsetof(palw_cuda_trace_record, kind) == 134U);
+static_assert(offsetof(palw_cuda_trace_record, reserved) == 139U);
+static_assert(sizeof(palw_cuda_trace_record_v2) == 192U);
+static_assert(alignof(palw_cuda_trace_record_v2) == 8U);
+static_assert(std::is_standard_layout_v<palw_cuda_trace_record_v2>);
+static_assert(std::is_trivial_v<palw_cuda_trace_record_v2>);
+static_assert(offsetof(palw_cuda_trace_record_v2, base) == 0U);
+static_assert(offsetof(palw_cuda_trace_record_v2, declared_origin) == 144U);
+static_assert(offsetof(palw_cuda_trace_record_v2, accumulator_stage) == 145U);
+static_assert(offsetof(palw_cuda_trace_record_v2, accumulator_dtype) == 146U);
+static_assert(offsetof(palw_cuda_trace_record_v2, sketch_scheme) == 148U);
+static_assert(offsetof(palw_cuda_trace_record_v2, reduction_segment_index) == 152U);
+static_assert(offsetof(palw_cuda_trace_record_v2, reduction_segment_count) == 156U);
+static_assert(offsetof(palw_cuda_trace_record_v2, producer_variant_id) == 160U);
+static_assert(sizeof(palw_cuda_trace_record_v3) == 464U);
+static_assert(alignof(palw_cuda_trace_record_v3) == 8U);
+static_assert(std::is_standard_layout_v<palw_cuda_trace_record_v3>);
+static_assert(std::is_trivial_v<palw_cuda_trace_record_v3>);
+static_assert(offsetof(palw_cuda_trace_record_v3, covered_schedule_index) == 192U);
+static_assert(offsetof(palw_cuda_trace_record_v3, layer_present) == 216U);
+static_assert(offsetof(palw_cuda_trace_record_v3, query_heads) == 220U);
+static_assert(offsetof(palw_cuda_trace_record_v3, grid_x) == 240U);
+static_assert(offsetof(palw_cuda_trace_record_v3, operation_instance_id) == 268U);
+static_assert(offsetof(palw_cuda_trace_record_v3, capture_implementation_id) == 428U);
+static_assert(PALW_CUDA_TRACE_OK == 0);
+static_assert(PALW_CUDA_TRACE_PENDING == 6);
+static_assert(PALW_CUDA_TRACE_INCOMPLETE == 7);
+static_assert(PALW_CUDA_TRACE_IDENTITY_MISMATCH == 8);
+static_assert(PALW_CUDA_TRACE_PRODUCER_FAULT == 9);
+static_assert(PALW_CUDA_TRACE_GEMM == 1);
+static_assert(PALW_CUDA_TRACE_ATTENTION == 2);
+static_assert(PALW_CUDA_TRACE_PREFILL == 0);
+static_assert(PALW_CUDA_TRACE_DECODE == 1);
+static_assert(PALW_CUDA_TRACE_DTYPE_FP32 == 0);
+static_assert(PALW_CUDA_TRACE_DTYPE_INT4 == 4);
+static_assert(PALW_CUDA_TRACE_QUANTIZATION_Q4_K_M == 2);
+static_assert(PALW_CUDA_TRACE_QUANTIZATION_IQ4_XS == 5);
+static_assert(PALW_CUDA_TRACE_QUANTIZATION_Q6_K == 6);
+static_assert(PALW_CUDA_TRACE_ORIGIN_FINAL_OUTPUT == 0);
+static_assert(PALW_CUDA_TRACE_ORIGIN_PRODUCER_ACCUMULATOR == 1);
+static_assert(PALW_CUDA_TRACE_ACCUMULATOR_STAGE_NONE == 0);
+static_assert(PALW_CUDA_TRACE_ACCUMULATOR_STAGE_FULL_K_PRE_EPILOGUE == 2);
+static_assert(PALW_CUDA_TRACE_ACCUMULATOR_DTYPE_FP32 == 0);
+static_assert(PALW_CUDA_TRACE_ACCUMULATOR_DTYPE_NONE == 255);
+static_assert(PALW_CUDA_TRACE_SKETCH_FINAL_OUTPUT_TILE_F32_V1 == 1);
+static_assert(PALW_CUDA_TRACE_SKETCH_SCALAR_ACCUMULATOR_F32_V1 == 2);
+static_assert(PALW_CUDA_TRACE_ATTENTION_STAGE_NONE == 0);
+static_assert(PALW_CUDA_TRACE_ATTENTION_STAGE_EAGER_QK_SCORE_MMVF == 1);
+static_assert(PALW_CUDA_TRACE_ATTENTION_STAGE_EAGER_MASKED_SCALED_SOFTMAX == 2);
+static_assert(PALW_CUDA_TRACE_ATTENTION_STAGE_EAGER_VALUE_AGGREGATION_MMVF == 3);
+
+namespace {
+
+int fail(const char * message) {
+    std::fprintf(stderr, "ABI contract failure: %s\n", message);
+    return 1;
+}
+
+palw_cuda_trace_record make_record() {
+    palw_cuda_trace_record record{};
+    record.kernel_sequence = 0x0102030405060708ULL;
+    record.m = 2;
+    record.n = 3;
+    record.k = 4;
+    record.batch = 1;
+    record.sketch[0] = 0x1112131415161718ULL;
+    record.sketch[1] = 0x2122232425262728ULL;
+    record.sketch[2] = 0x3132333435363738ULL;
+    record.sketch[3] = 0x4142434445464748ULL;
+    record.layer_id = 7;
+    record.tile_rows = 3;
+    record.tile_columns = 2;
+    record.output_rows = 3;
+    record.output_columns = 2;
+    record.schema_version = PALW_CUDA_TRACE_SCHEMA_VERSION;
+    record.kind = PALW_CUDA_TRACE_GEMM;
+    record.phase = PALW_CUDA_TRACE_PREFILL;
+    record.dtype = PALW_CUDA_TRACE_DTYPE_FP32;
+    record.quantization = PALW_CUDA_TRACE_QUANTIZATION_Q4_K_M;
+    return record;
+}
+
+palw_cuda_trace_record_v2 make_record_v2() {
+    palw_cuda_trace_record_v2 record{};
+    record.base = make_record();
+    record.base.kernel_sequence = 0;
+    record.base.schema_version = PALW_CUDA_TRACE_SCHEMA_VERSION_V2;
+    record.declared_origin = PALW_CUDA_TRACE_ORIGIN_PRODUCER_ACCUMULATOR;
+    record.accumulator_stage = PALW_CUDA_TRACE_ACCUMULATOR_STAGE_FULL_K_PRE_EPILOGUE;
+    record.accumulator_dtype = PALW_CUDA_TRACE_ACCUMULATOR_DTYPE_FP32;
+    record.sketch_scheme = PALW_CUDA_TRACE_SKETCH_SCALAR_ACCUMULATOR_F32_V1;
+    record.reduction_segment_count = 1;
+    for (size_t index = 0; index < sizeof(record.producer_variant_id); ++index) {
+        record.producer_variant_id[index] = static_cast<uint8_t>(0x80U + index);
+    }
+    return record;
+}
+
+void fill_id(uint8_t (&identity)[32], uint8_t seed) {
+    for (size_t index = 0; index < 32U; ++index) {
+        identity[index] = static_cast<uint8_t>(seed + index);
+    }
+}
+
+palw_cuda_trace_record_v3 make_record_v3() {
+    palw_cuda_trace_record_v3 record{};
+    record.base = make_record_v2();
+    record.base.base.schema_version = PALW_CUDA_TRACE_SCHEMA_VERSION_V3;
+    record.base.base.m = 256U;
+    record.base.base.n = 1U;
+    record.base.base.k = 128U;
+    record.base.base.batch = 32U;
+    record.base.base.query_tokens = 1U;
+    record.base.base.key_value_tokens = 3U;
+    record.base.base.tile_rows = 32U;
+    record.base.base.tile_columns = 256U;
+    record.base.base.output_rows = 32U;
+    record.base.base.output_columns = 256U;
+    record.base.base.dtype = PALW_CUDA_TRACE_DTYPE_FP32;
+    record.base.base.quantization = PALW_CUDA_TRACE_QUANTIZATION_NONE;
+    record.base.base.causal = 1U;
+    record.base.declared_origin = PALW_CUDA_TRACE_ORIGIN_FINAL_OUTPUT;
+    record.base.accumulator_stage = PALW_CUDA_TRACE_ACCUMULATOR_STAGE_NONE;
+    record.base.accumulator_dtype = PALW_CUDA_TRACE_ACCUMULATOR_DTYPE_NONE;
+    record.base.sketch_scheme = PALW_CUDA_TRACE_SKETCH_FINAL_OUTPUT_TILE_F32_V1;
+    record.base.reduction_segment_count = 0U;
+    record.covered_schedule_index = 14U;
+    record.attention_owner_schedule_index = 15U;
+    record.sublaunch_count = 3U;
+    record.layer_present = 1U;
+    record.attention_group_present = 1U;
+    record.attention_stage = PALW_CUDA_TRACE_ATTENTION_STAGE_EAGER_QK_SCORE_MMVF;
+    record.grouping_version = PALW_CUDA_TRACE_GROUPING_VERSION_V1;
+    record.query_heads = 32U;
+    record.key_value_heads = 8U;
+    record.head_dim = 128U;
+    record.logical_batch = 1U;
+    record.physical_key_value_tokens = 256U;
+    record.grid_x = 256U;
+    record.grid_y = 32U;
+    record.grid_z = 1U;
+    record.block_x = 64U;
+    record.block_y = 1U;
+    record.block_z = 1U;
+    record.dynamic_shared_memory_bytes = 128U;
+    fill_id(record.operation_instance_id, 0x10U);
+    fill_id(record.attention_group_instance_id, 0x30U);
+    fill_id(record.decomposition_plan_id, 0x50U);
+    fill_id(record.physical_layout_id, 0x70U);
+    fill_id(record.work_entry_point_id, 0x90U);
+    fill_id(record.capture_implementation_id, 0xb0U);
+    return record;
+}
+
+palw_cuda_trace_record_v3 make_direct_q6_record_v3() {
+    palw_cuda_trace_record_v3 record{};
+    record.base = make_record_v2();
+    record.base.base.schema_version = PALW_CUDA_TRACE_SCHEMA_VERSION_V3;
+    record.base.base.layer_id = 0U;
+    record.base.base.quantization = PALW_CUDA_TRACE_QUANTIZATION_Q6_K;
+    record.covered_schedule_index = 253U;
+    record.sublaunch_count = 1U;
+    record.grid_x = 2U;
+    record.grid_y = 1U;
+    record.grid_z = 1U;
+    record.block_x = 32U;
+    record.block_y = 4U;
+    record.block_z = 1U;
+    fill_id(record.operation_instance_id, 0x11U);
+    fill_id(record.decomposition_plan_id, 0x51U);
+    fill_id(record.physical_layout_id, 0x71U);
+    fill_id(record.work_entry_point_id, 0x91U);
+    fill_id(record.capture_implementation_id, 0xb1U);
+    return record;
+}
+
+uint8_t hex_nibble(char value) {
+    if (value >= '0' && value <= '9') {
+        return static_cast<uint8_t>(value - '0');
+    }
+    if (value >= 'a' && value <= 'f') {
+        return static_cast<uint8_t>(value - 'a' + 10);
+    }
+    return 0xffU;
+}
+
+std::vector<uint8_t> load_golden_fixture(const char * path) {
+    std::ifstream input(path);
+    std::string hex;
+    input >> hex;
+    if (!input || hex.size() % 2U != 0U) {
+        return {};
+    }
+    std::vector<uint8_t> bytes;
+    bytes.reserve(hex.size() / 2U);
+    for (size_t index = 0; index < hex.size(); index += 2U) {
+        const uint8_t high = hex_nibble(hex[index]);
+        const uint8_t low = hex_nibble(hex[index + 1U]);
+        if (high > 0x0fU || low > 0x0fU) {
+            return {};
+        }
+        bytes.push_back(static_cast<uint8_t>((high << 4U) | low));
+    }
+    return bytes;
+}
+
+} // namespace
+
+int main() {
+    palw_cuda_trace_record first = make_record();
+    palw_cuda_trace_record second = first;
+
+    auto * native_bytes = reinterpret_cast<uint8_t *>(&second);
+    for (size_t i = 140; i < sizeof(second); ++i) {
+        native_bytes[i] = static_cast<uint8_t>(0xa0U + i);
+    }
+
+    std::array<uint8_t, PALW_CUDA_TRACE_RECORD_ENCODED_SIZE_V1> encoded_first{};
+    std::array<uint8_t, PALW_CUDA_TRACE_RECORD_ENCODED_SIZE_V1> encoded_second{};
+    if (palw_cuda_trace_encode_record_v1(
+            &first, encoded_first.data(), encoded_first.size()) != PALW_CUDA_TRACE_OK ||
+        palw_cuda_trace_encode_record_v1(
+            &second, encoded_second.data(), encoded_second.size()) != PALW_CUDA_TRACE_OK) {
+        return fail("valid record did not encode");
+    }
+    if (encoded_first != encoded_second) {
+        return fail("native tail padding affected canonical encoding");
+    }
+
+    const std::array<uint8_t, 8> expected_sequence = {1, 2, 3, 4, 5, 6, 7, 8};
+    if (std::memcmp(encoded_first.data(), expected_sequence.data(), expected_sequence.size()) != 0) {
+        return fail("u64 encoding is not big-endian");
+    }
+
+    second.reserved = 1;
+    if (palw_cuda_trace_encode_record_v1(
+            &second, encoded_second.data(), encoded_second.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("nonzero reserved byte was accepted");
+    }
+    second = first;
+    second.dtype = 255;
+    if (palw_cuda_trace_encode_record_v1(
+            &second, encoded_second.data(), encoded_second.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("unknown dtype was accepted");
+    }
+    second = first;
+    second.quantization = 255;
+    if (palw_cuda_trace_encode_record_v1(
+            &second, encoded_second.data(), encoded_second.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("unknown quantization was accepted");
+    }
+    second = first;
+    second.schema_version = PALW_CUDA_TRACE_SCHEMA_VERSION_V2;
+    if (palw_cuda_trace_encode_record_v1(
+            &second, encoded_second.data(), encoded_second.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("V2 schema tag was accepted by the V1 codec");
+    }
+    second = first;
+    second.schema_version = PALW_CUDA_TRACE_SCHEMA_VERSION_V3;
+    if (palw_cuda_trace_encode_record_v1(
+            &second, encoded_second.data(), encoded_second.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("V3 schema tag was accepted by the V1 codec");
+    }
+    second = first;
+    second.quantization = PALW_CUDA_TRACE_QUANTIZATION_Q6_K;
+    if (palw_cuda_trace_encode_record_v1(
+            &second, encoded_second.data(), encoded_second.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("V3-only Q6_K tag was accepted by the V1 codec");
+    }
+    second = first;
+    second.decode_step = 1;
+    if (palw_cuda_trace_encode_record_v1(
+            &second, encoded_second.data(), encoded_second.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("invalid prefill step was accepted");
+    }
+    second = first;
+    second.tile_index = 1;
+    if (palw_cuda_trace_encode_record_v1(
+            &second, encoded_second.data(), encoded_second.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("invalid tile index was accepted");
+    }
+    second = first;
+    second.output_columns = 3;
+    if (palw_cuda_trace_encode_record_v1(
+            &second, encoded_second.data(), encoded_second.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("invalid GEMM output shape was accepted");
+    }
+    second = first;
+    second.batch = 2;
+    second.output_rows = 6;
+    if (palw_cuda_trace_encode_record_v1(
+            &second, encoded_second.data(), encoded_second.size()) != PALW_CUDA_TRACE_OK) {
+        return fail("valid batched GEMM output shape was rejected");
+    }
+    second = first;
+    second.m = static_cast<uint64_t>(UINT32_MAX) + 1U;
+    if (palw_cuda_trace_encode_record_v1(
+            &second, encoded_second.data(), encoded_second.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("oversized GEMM dimension was accepted");
+    }
+
+    palw_cuda_trace_record attention = first;
+    attention.kernel_sequence = 1;
+    attention.m = 2;
+    attention.n = 8;
+    attention.k = 3;
+    attention.query_tokens = 2;
+    attention.key_value_tokens = 3;
+    attention.tile_rows = 1;
+    attention.tile_columns = 4;
+    attention.output_rows = 2;
+    attention.output_columns = 8;
+    attention.kind = PALW_CUDA_TRACE_ATTENTION;
+    attention.dtype = PALW_CUDA_TRACE_DTYPE_FP16;
+    attention.quantization = PALW_CUDA_TRACE_QUANTIZATION_NONE;
+    attention.causal = 1;
+    if (palw_cuda_trace_encode_record_v1(
+            &attention, encoded_second.data(), encoded_second.size()) != PALW_CUDA_TRACE_OK) {
+        return fail("valid attention record did not encode");
+    }
+    attention.key_value_tokens = 1;
+    attention.k = 1;
+    if (palw_cuda_trace_encode_record_v1(
+            &attention, encoded_second.data(), encoded_second.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("invalid causal attention shape was accepted");
+    }
+    attention = first;
+    attention.kernel_sequence = 1;
+    attention.m = 2;
+    attention.n = 8;
+    attention.k = 3;
+    attention.query_tokens = 2;
+    attention.key_value_tokens = 3;
+    attention.tile_rows = 1;
+    attention.tile_columns = 4;
+    attention.output_rows = 2;
+    attention.output_columns = 8;
+    attention.kind = PALW_CUDA_TRACE_ATTENTION;
+    attention.phase = PALW_CUDA_TRACE_DECODE;
+    attention.dtype = PALW_CUDA_TRACE_DTYPE_FP16;
+    attention.quantization = PALW_CUDA_TRACE_QUANTIZATION_NONE;
+    attention.causal = 1;
+    if (palw_cuda_trace_encode_record_v1(
+            &attention, encoded_second.data(), encoded_second.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("multi-query-token decode attention was accepted");
+    }
+    if (palw_cuda_trace_encode_record_v1(
+            &first, encoded_first.data(), encoded_first.size() - 1U) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("short destination was accepted");
+    }
+
+    palw_cuda_trace_record_v2 first_v2 = make_record_v2();
+    palw_cuda_trace_record_v2 second_v2 = first_v2;
+    auto * native_v2_bytes = reinterpret_cast<uint8_t *>(&second_v2);
+    for (size_t index = 140U; index < 144U; ++index) {
+        native_v2_bytes[index] = static_cast<uint8_t>(0x50U + index);
+    }
+    native_v2_bytes[147] = 0xaaU;
+    native_v2_bytes[150] = 0xbbU;
+    native_v2_bytes[151] = 0xccU;
+
+    std::array<uint8_t, PALW_CUDA_TRACE_RECORD_ENCODED_SIZE_V2> encoded_first_v2{};
+    std::array<uint8_t, PALW_CUDA_TRACE_RECORD_ENCODED_SIZE_V2> encoded_second_v2{};
+    if (palw_cuda_trace_encode_record_v2(
+            &first_v2, encoded_first_v2.data(), encoded_first_v2.size()) !=
+            PALW_CUDA_TRACE_OK ||
+        palw_cuda_trace_encode_record_v2(
+            &second_v2, encoded_second_v2.data(), encoded_second_v2.size()) !=
+            PALW_CUDA_TRACE_OK) {
+        return fail("valid V2 producer-accumulator record did not encode");
+    }
+    if (encoded_first_v2 != encoded_second_v2) {
+        return fail("native V2 padding affected canonical encoding");
+    }
+
+    const std::vector<uint8_t> golden_v2 = load_golden_fixture(PALW_CUDA_TRACE_GOLDEN_FIXTURE_PATH);
+    if (golden_v2.size() != encoded_first_v2.size() ||
+        std::memcmp(golden_v2.data(), encoded_first_v2.data(), encoded_first_v2.size()) != 0) {
+        return fail("V2 canonical encoding did not match the shared golden fixture");
+    }
+
+    second_v2 = first_v2;
+    std::memset(second_v2.producer_variant_id, 0, sizeof(second_v2.producer_variant_id));
+    if (palw_cuda_trace_encode_record_v2(
+            &second_v2, encoded_second_v2.data(), encoded_second_v2.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("zero V2 producer variant ID was accepted");
+    }
+    second_v2 = first_v2;
+    second_v2.declared_origin = 255U;
+    if (palw_cuda_trace_encode_record_v2(
+            &second_v2, encoded_second_v2.data(), encoded_second_v2.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("unknown V2 declared origin was accepted");
+    }
+    second_v2 = first_v2;
+    second_v2.accumulator_stage = PALW_CUDA_TRACE_ACCUMULATOR_STAGE_NONE;
+    if (palw_cuda_trace_encode_record_v2(
+            &second_v2, encoded_second_v2.data(), encoded_second_v2.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("producer origin without an accumulator stage was accepted");
+    }
+    second_v2 = first_v2;
+    second_v2.accumulator_dtype = PALW_CUDA_TRACE_ACCUMULATOR_DTYPE_FP16;
+    if (palw_cuda_trace_encode_record_v2(
+            &second_v2, encoded_second_v2.data(), encoded_second_v2.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("non-FP32 scalar accumulator scheme was accepted");
+    }
+    second_v2 = first_v2;
+    second_v2.reduction_segment_count = 0U;
+    if (palw_cuda_trace_encode_record_v2(
+            &second_v2, encoded_second_v2.data(), encoded_second_v2.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("producer origin without reduction segments was accepted");
+    }
+    second_v2 = first_v2;
+    second_v2.reduction_segment_index = 1U;
+    if (palw_cuda_trace_encode_record_v2(
+            &second_v2, encoded_second_v2.data(), encoded_second_v2.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("out-of-range reduction segment was accepted");
+    }
+    second_v2 = first_v2;
+    second_v2.reduction_segment_count = 2U;
+    if (palw_cuda_trace_encode_record_v2(
+            &second_v2, encoded_second_v2.data(), encoded_second_v2.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("full-K accumulator was split into multiple reduction segments");
+    }
+    second_v2 = first_v2;
+    second_v2.base.schema_version = PALW_CUDA_TRACE_SCHEMA_VERSION_V1;
+    if (palw_cuda_trace_encode_record_v2(
+            &second_v2, encoded_second_v2.data(), encoded_second_v2.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("V1 schema tag was accepted by the V2 codec");
+    }
+    second_v2 = first_v2;
+    second_v2.base.schema_version = PALW_CUDA_TRACE_SCHEMA_VERSION_V3;
+    if (palw_cuda_trace_encode_record_v2(
+            &second_v2, encoded_second_v2.data(), encoded_second_v2.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("V3 schema tag was accepted by the V2 codec");
+    }
+
+    second_v2 = first_v2;
+    second_v2.declared_origin = PALW_CUDA_TRACE_ORIGIN_FINAL_OUTPUT;
+    second_v2.accumulator_stage = PALW_CUDA_TRACE_ACCUMULATOR_STAGE_NONE;
+    second_v2.accumulator_dtype = PALW_CUDA_TRACE_ACCUMULATOR_DTYPE_NONE;
+    second_v2.sketch_scheme = PALW_CUDA_TRACE_SKETCH_FINAL_OUTPUT_TILE_F32_V1;
+    second_v2.reduction_segment_index = 0U;
+    second_v2.reduction_segment_count = 0U;
+    if (palw_cuda_trace_encode_record_v2(
+            &second_v2, encoded_second_v2.data(), encoded_second_v2.size()) !=
+        PALW_CUDA_TRACE_OK) {
+        return fail("valid V2 final-output declaration did not encode");
+    }
+    second_v2.reduction_segment_count = 1U;
+    if (palw_cuda_trace_encode_record_v2(
+            &second_v2, encoded_second_v2.data(), encoded_second_v2.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("final-output declaration with a reduction segment was accepted");
+    }
+    if (palw_cuda_trace_encode_record_v2(
+            &first_v2, encoded_first_v2.data(), encoded_first_v2.size() - 1U) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("short V2 destination was accepted");
+    }
+
+    second_v2 = first_v2;
+    second_v2.base.quantization = PALW_CUDA_TRACE_QUANTIZATION_Q6_K;
+    if (palw_cuda_trace_encode_record_v2(
+            &second_v2, encoded_second_v2.data(), encoded_second_v2.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("V3-only Q6_K tag was accepted by the V2 codec");
+    }
+
+    palw_cuda_trace_record_v3 first_v3 = make_record_v3();
+    palw_cuda_trace_record_v3 second_v3 = first_v3;
+    std::array<uint8_t, PALW_CUDA_TRACE_RECORD_ENCODED_SIZE_V3> encoded_first_v3{};
+    std::array<uint8_t, PALW_CUDA_TRACE_RECORD_ENCODED_SIZE_V3> encoded_second_v3{};
+    if (palw_cuda_trace_encode_record_v3(
+            &first_v3, encoded_first_v3.data(), encoded_first_v3.size()) !=
+        PALW_CUDA_TRACE_OK) {
+        return fail("valid V3 eager-QK record did not encode");
+    }
+    auto * native_v3_bytes = reinterpret_cast<uint8_t *>(&second_v3);
+    for (size_t index = 460U; index < sizeof(second_v3); ++index) {
+        native_v3_bytes[index] = static_cast<uint8_t>(0xc0U + index);
+    }
+    if (palw_cuda_trace_encode_record_v3(
+            &second_v3, encoded_second_v3.data(), encoded_second_v3.size()) !=
+        PALW_CUDA_TRACE_OK) {
+        return fail("valid V3 record with nonzero native tail padding did not encode");
+    }
+    if (encoded_first_v3 != encoded_second_v3) {
+        return fail("native V3 tail padding affected canonical encoding");
+    }
+    const std::vector<uint8_t> golden_v3 =
+        load_golden_fixture(PALW_CUDA_TRACE_GOLDEN_FIXTURE_V3_PATH);
+    if (golden_v3.size() != encoded_first_v3.size() ||
+        std::memcmp(golden_v3.data(), encoded_first_v3.data(), encoded_first_v3.size()) != 0) {
+        return fail("V3 canonical encoding did not match the shared golden fixture");
+    }
+    if (palw_cuda_trace_encode_record_v3(
+            &first_v3, encoded_first_v3.data(), encoded_first_v3.size() - 1U) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("short V3 destination was accepted");
+    }
+
+    palw_cuda_trace_record_v3 softmax_v3 = first_v3;
+    softmax_v3.base.base.kind = PALW_CUDA_TRACE_ATTENTION;
+    softmax_v3.base.base.k = 1U;
+    softmax_v3.covered_schedule_index = 15U;
+    softmax_v3.sublaunch_index = 1U;
+    softmax_v3.attention_stage =
+        PALW_CUDA_TRACE_ATTENTION_STAGE_EAGER_MASKED_SCALED_SOFTMAX;
+    softmax_v3.grid_x = 1U;
+    softmax_v3.block_x = 256U;
+    softmax_v3.dynamic_shared_memory_bytes = 1152U;
+    if (palw_cuda_trace_encode_record_v3(
+            &softmax_v3, encoded_second_v3.data(), encoded_second_v3.size()) !=
+        PALW_CUDA_TRACE_OK) {
+        return fail("valid V3 eager-softmax record did not encode");
+    }
+
+    palw_cuda_trace_record_v3 kqv_v3 = first_v3;
+    kqv_v3.base.base.m = 128U;
+    kqv_v3.base.base.k = 256U;
+    kqv_v3.base.base.tile_columns = 128U;
+    kqv_v3.base.base.output_columns = 128U;
+    kqv_v3.covered_schedule_index = 16U;
+    kqv_v3.sublaunch_index = 2U;
+    kqv_v3.attention_stage =
+        PALW_CUDA_TRACE_ATTENTION_STAGE_EAGER_VALUE_AGGREGATION_MMVF;
+    kqv_v3.grid_x = 128U;
+    kqv_v3.block_x = 128U;
+    if (palw_cuda_trace_encode_record_v3(
+            &kqv_v3, encoded_second_v3.data(), encoded_second_v3.size()) !=
+        PALW_CUDA_TRACE_OK) {
+        return fail("valid V3 eager-KQV record did not encode");
+    }
+
+    palw_cuda_trace_record_v3 direct_q6 = make_direct_q6_record_v3();
+    if (palw_cuda_trace_encode_record_v3(
+            &direct_q6, encoded_second_v3.data(), encoded_second_v3.size()) !=
+        PALW_CUDA_TRACE_OK) {
+        return fail("valid direct Q6_K V3 record did not encode");
+    }
+
+    struct V3IdentityZeroMutation {
+        size_t offset;
+        const char * failure_message;
+    };
+    constexpr size_t producer_variant_id_offset =
+        offsetof(palw_cuda_trace_record_v3, base) +
+        offsetof(palw_cuda_trace_record_v2, producer_variant_id);
+    constexpr std::array<V3IdentityZeroMutation, 7> grouped_required_identities{{
+        {producer_variant_id_offset, "zero grouped V3 producer variant ID was accepted"},
+        {offsetof(palw_cuda_trace_record_v3, operation_instance_id),
+         "zero grouped V3 operation instance ID was accepted"},
+        {offsetof(palw_cuda_trace_record_v3, attention_group_instance_id),
+         "zero grouped V3 attention group instance ID was accepted"},
+        {offsetof(palw_cuda_trace_record_v3, decomposition_plan_id),
+         "zero grouped V3 decomposition plan ID was accepted"},
+        {offsetof(palw_cuda_trace_record_v3, physical_layout_id),
+         "zero grouped V3 physical layout ID was accepted"},
+        {offsetof(palw_cuda_trace_record_v3, work_entry_point_id),
+         "zero grouped V3 work entry-point ID was accepted"},
+        {offsetof(palw_cuda_trace_record_v3, capture_implementation_id),
+         "zero grouped V3 capture implementation ID was accepted"},
+    }};
+    for (const V3IdentityZeroMutation & mutation : grouped_required_identities) {
+        second_v3 = first_v3;
+        std::memset(reinterpret_cast<uint8_t *>(&second_v3) + mutation.offset, 0, 32U);
+        if (palw_cuda_trace_encode_record_v3(
+                &second_v3, encoded_second_v3.data(), encoded_second_v3.size()) !=
+            PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+            return fail(mutation.failure_message);
+        }
+    }
+
+    constexpr std::array<V3IdentityZeroMutation, 6> direct_required_identities{{
+        {producer_variant_id_offset, "zero direct V3 producer variant ID was accepted"},
+        {offsetof(palw_cuda_trace_record_v3, operation_instance_id),
+         "zero direct V3 operation instance ID was accepted"},
+        {offsetof(palw_cuda_trace_record_v3, decomposition_plan_id),
+         "zero direct V3 decomposition plan ID was accepted"},
+        {offsetof(palw_cuda_trace_record_v3, physical_layout_id),
+         "zero direct V3 physical layout ID was accepted"},
+        {offsetof(palw_cuda_trace_record_v3, work_entry_point_id),
+         "zero direct V3 work entry-point ID was accepted"},
+        {offsetof(palw_cuda_trace_record_v3, capture_implementation_id),
+         "zero direct V3 capture implementation ID was accepted"},
+    }};
+    for (const V3IdentityZeroMutation & mutation : direct_required_identities) {
+        second_v3 = direct_q6;
+        std::memset(reinterpret_cast<uint8_t *>(&second_v3) + mutation.offset, 0, 32U);
+        if (palw_cuda_trace_encode_record_v3(
+                &second_v3, encoded_second_v3.data(), encoded_second_v3.size()) !=
+            PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+            return fail(mutation.failure_message);
+        }
+    }
+    second_v3 = direct_q6;
+    fill_id(second_v3.attention_group_instance_id, 0xd0U);
+    if (palw_cuda_trace_encode_record_v3(
+            &second_v3, encoded_second_v3.data(), encoded_second_v3.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("nonzero direct V3 attention group instance ID was accepted");
+    }
+
+    second_v3 = first_v3;
+    second_v3.sublaunch_count = 2U;
+    if (palw_cuda_trace_encode_record_v3(
+            &second_v3, encoded_second_v3.data(), encoded_second_v3.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("self-declared V3 attention count shrink was accepted");
+    }
+    second_v3 = first_v3;
+    second_v3.attention_stage = PALW_CUDA_TRACE_ATTENTION_STAGE_EAGER_VALUE_AGGREGATION_MMVF;
+    if (palw_cuda_trace_encode_record_v3(
+            &second_v3, encoded_second_v3.data(), encoded_second_v3.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("V3 attention role swap was accepted");
+    }
+    second_v3 = first_v3;
+    second_v3.attention_owner_schedule_index = UINT64_MAX;
+    second_v3.covered_schedule_index = UINT64_MAX - 1U;
+    if (palw_cuda_trace_encode_record_v3(
+            &second_v3, encoded_second_v3.data(), encoded_second_v3.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("uncompletable V3 UINT64_MAX attention owner was accepted");
+    }
+    second_v3 = first_v3;
+    second_v3.key_value_heads = 3U;
+    if (palw_cuda_trace_encode_record_v3(
+            &second_v3, encoded_second_v3.data(), encoded_second_v3.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("V3 attention head factorization mutation was accepted");
+    }
+    second_v3 = first_v3;
+    second_v3.physical_key_value_tokens = 512U;
+    if (palw_cuda_trace_encode_record_v3(
+            &second_v3, encoded_second_v3.data(), encoded_second_v3.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("V3 logical/physical KV mismatch was accepted");
+    }
+    second_v3 = first_v3;
+    second_v3.block_x = 1U;
+    second_v3.block_z = 128U;
+    if (palw_cuda_trace_encode_record_v3(
+            &second_v3, encoded_second_v3.data(), encoded_second_v3.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("impossible V3 CUDA block-z dimension was accepted");
+    }
+    second_v3 = first_v3;
+    second_v3.base.base.schema_version = PALW_CUDA_TRACE_SCHEMA_VERSION_V2;
+    if (palw_cuda_trace_encode_record_v3(
+            &second_v3, encoded_second_v3.data(), encoded_second_v3.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("V2 schema tag was accepted by the V3 codec");
+    }
+    second_v3 = first_v3;
+    second_v3.base.base.schema_version = PALW_CUDA_TRACE_SCHEMA_VERSION_V1;
+    if (palw_cuda_trace_encode_record_v3(
+            &second_v3, encoded_second_v3.data(), encoded_second_v3.size()) !=
+        PALW_CUDA_TRACE_INVALID_ARGUMENT) {
+        return fail("V1 schema tag was accepted by the V3 codec");
+    }
+
+    std::puts("PALW CUDA trace V1/V2/V3 ABI and canonical codec contract: ok");
+    return 0;
+}

runtime-palw/cuda/accumulator.cu

@@ -0,0 +1,411 @@
+#include "palw_cuda_trace_internal.cuh"
+
+#include <cuda_runtime.h>
+
+#include <cstdint>
+#include <limits>
+#include <new>
+
+namespace {
+
+constexpr uint32_t kMaxGridX = 2147483647U;
+constexpr uint32_t kMaxGridY = 65535U;
+
+constexpr uint64_t kSketchSeed[4] = {
+    0x243f6a8885a308d3ULL,
+    0x13198a2e03707344ULL,
+    0xa4093822299f31d0ULL,
+    0x082efa98ec4e6c89ULL,
+};
+
+__device__ __forceinline__ uint64_t mix64(uint64_t value) {
+    value ^= value >> 30;
+    value *= 0xbf58476d1ce4e5b9ULL;
+    value ^= value >> 27;
+    value *= 0x94d049bb133111ebULL;
+    return value ^ (value >> 31);
+}
+
+__device__ __forceinline__ uint32_t canonical_float_bits(float value) {
+    uint32_t bits = __float_as_uint(value);
+    const uint32_t magnitude = bits & 0x7fffffffU;
+    if (magnitude == 0U) {
+        return 0U;
+    }
+    if ((bits & 0x7f800000U) == 0x7f800000U && (bits & 0x007fffffU) != 0U) {
+        return 0x7fc00000U;
+    }
+    return bits;
+}
+
+__global__ void accumulator_sketch_f32(
+    const float * output,
+    uint64_t row_stride,
+    palw_cuda_trace_record * records,
+    palw_cuda_trace_launch launch) {
+    const uint32_t tile_column = blockIdx.x;
+    const uint32_t tile_row = blockIdx.y;
+    const uint64_t tiles_per_row =
+        (static_cast<uint64_t>(launch.output_columns) + launch.tile_columns - 1U) /
+        launch.tile_columns;
+    const uint64_t tile_index = static_cast<uint64_t>(tile_row) * tiles_per_row + tile_column;
+    if (threadIdx.x != 0U || tile_index >= launch.tile_count) {
+        return;
+    }
+
+    const uint64_t row_begin_64 = static_cast<uint64_t>(tile_row) * launch.tile_rows;
+    const uint64_t column_begin_64 = static_cast<uint64_t>(tile_column) * launch.tile_columns;
+    const uint64_t row_end_64 = row_begin_64 + launch.tile_rows < launch.output_rows
+        ? row_begin_64 + launch.tile_rows
+        : launch.output_rows;
+    const uint64_t column_end_64 = column_begin_64 + launch.tile_columns < launch.output_columns
+        ? column_begin_64 + launch.tile_columns
+        : launch.output_columns;
+    const uint32_t row_begin = static_cast<uint32_t>(row_begin_64);
+    const uint32_t column_begin = static_cast<uint32_t>(column_begin_64);
+    const uint32_t height = static_cast<uint32_t>(row_end_64 - row_begin_64);
+    const uint32_t width = static_cast<uint32_t>(column_end_64 - column_begin_64);
+
+    uint64_t sketch[4] = {kSketchSeed[0], kSketchSeed[1], kSketchSeed[2], kSketchSeed[3]};
+#pragma unroll
+    for (uint32_t sample = 0; sample < 32U; ++sample) {
+        const uint32_t row = row_begin + ((sample * 13U + 3U) % height);
+        const uint32_t column = column_begin + ((sample * 7U + 1U) % width);
+        const uint32_t bits = canonical_float_bits(
+            output[static_cast<uint64_t>(row) * row_stride + column]);
+        const uint64_t tagged =
+            mix64(static_cast<uint64_t>(bits) | (static_cast<uint64_t>(sample) << 32)) ^
+            mix64(static_cast<uint64_t>(row)) ^
+            mix64(static_cast<uint64_t>(column) << 1);
+        const uint32_t lane = sample & 3U;
+        sketch[lane] = mix64(sketch[lane] ^ tagged);
+    }
+
+    palw_cuda_trace_record record{};
+    record.kernel_sequence = launch.kernel_sequence;
+    record.tile_index = tile_index;
+    record.decode_step = launch.decode_step;
+    record.m = launch.m;
+    record.n = launch.n;
+    record.k = launch.k;
+    record.batch = launch.batch;
+    record.query_tokens = launch.query_tokens;
+    record.key_value_tokens = launch.key_value_tokens;
+#pragma unroll
+    for (uint32_t lane = 0; lane < 4U; ++lane) {
+        record.sketch[lane] = sketch[lane];
+    }
+    record.layer_id = launch.layer_id;
+    record.tile_row = tile_row;
+    record.tile_column = tile_column;
+    record.tile_rows = launch.tile_rows;
+    record.tile_columns = launch.tile_columns;
+    record.output_rows = launch.output_rows;
+    record.output_columns = launch.output_columns;
+    record.schema_version = PALW_CUDA_TRACE_SCHEMA_VERSION;
+    record.kind = launch.kind;
+    record.phase = launch.phase;
+    record.dtype = launch.dtype;
+    record.quantization = launch.quantization;
+    record.causal = launch.causal;
+    records[launch.base_record + tile_index] = record;
+}
+
+void poison_context(palw_cuda_trace_context * context, cudaError_t error) {
+    context->poisoned = 1;
+    context->last_cuda_error = static_cast<int32_t>(error);
+}
+
+palw_cuda_trace_status reject_failed_context(const palw_cuda_trace_context * context) {
+    if (context->poisoned != 0) {
+        return PALW_CUDA_TRACE_POISONED;
+    }
+    if (context->overflowed != 0) {
+        return PALW_CUDA_TRACE_CAPACITY_EXCEEDED;
+    }
+    return PALW_CUDA_TRACE_OK;
+}
+
+bool bind_or_match_stream(palw_cuda_trace_context * context, cudaStream_t stream) {
+    if (context->stream_bound != 0) {
+        return context->stream == stream;
+    }
+    context->stream = stream;
+    context->stream_bound = 1;
+    return true;
+}
+
+palw_cuda_trace_status consume_pending_cuda_error(palw_cuda_trace_context * context) {
+    const cudaError_t error = cudaPeekAtLastError();
+    if (error == cudaSuccess) {
+        return PALW_CUDA_TRACE_OK;
+    }
+    (void) cudaGetLastError();
+    poison_context(context, error);
+    return PALW_CUDA_TRACE_CUDA_ERROR;
+}
+
+bool valid_address_range(
+    const float * output,
+    uint32_t output_rows,
+    uint32_t output_columns,
+    uint64_t row_stride) {
+    const uintptr_t base = reinterpret_cast<uintptr_t>(output);
+    if ((base % alignof(float)) != 0U) {
+        return false;
+    }
+    const uint64_t row_offset = static_cast<uint64_t>(output_rows - 1U);
+    const uint64_t column_offset = static_cast<uint64_t>(output_columns - 1U);
+    if (row_offset != 0U && row_stride > (UINT64_MAX - column_offset) / row_offset) {
+        return false;
+    }
+    const uint64_t last_element = row_offset * row_stride + column_offset;
+    if (last_element > std::numeric_limits<size_t>::max() / sizeof(float)) {
+        return false;
+    }
+    const uint64_t last_byte_offset = last_element * sizeof(float);
+    const uintptr_t pointer_max = std::numeric_limits<uintptr_t>::max();
+    return base <= pointer_max - (sizeof(float) - 1U) &&
+        last_byte_offset <= pointer_max - base - (sizeof(float) - 1U);
+}
+
+} // namespace
+
+bool palw_cuda_trace_valid_dtype(uint8_t dtype) {
+    return dtype <= PALW_CUDA_TRACE_DTYPE_INT4;
+}
+
+bool palw_cuda_trace_valid_quantization(uint8_t quantization) {
+    return quantization <= PALW_CUDA_TRACE_QUANTIZATION_IQ4_XS;
+}
+
+bool palw_cuda_trace_valid_phase(uint8_t phase, uint64_t decode_step) {
+    if (phase == PALW_CUDA_TRACE_PREFILL) {
+        return decode_step == 0U;
+    }
+    return phase == PALW_CUDA_TRACE_DECODE && decode_step <= UINT32_MAX;
+}
+
+extern "C" palw_cuda_trace_status palw_cuda_trace_create(
+    uint64_t capacity,
+    palw_cuda_trace_context ** out_context) {
+    if (capacity == 0U || out_context == nullptr ||
+        capacity > std::numeric_limits<size_t>::max() / sizeof(palw_cuda_trace_record)) {
+        return PALW_CUDA_TRACE_INVALID_ARGUMENT;
+    }
+    *out_context = nullptr;
+    auto * context = new (std::nothrow) palw_cuda_trace_context{};
+    if (context == nullptr) {
+        return PALW_CUDA_TRACE_CUDA_ERROR;
+    }
+    const cudaError_t error = cudaMalloc(
+        reinterpret_cast<void **>(&context->device_records),
+        static_cast<size_t>(capacity) * sizeof(palw_cuda_trace_record));
+    if (error != cudaSuccess) {
+        delete context;
+        return PALW_CUDA_TRACE_CUDA_ERROR;
+    }
+    context->capacity = capacity;
+    context->last_cuda_error = static_cast<int32_t>(cudaSuccess);
+    *out_context = context;
+    return PALW_CUDA_TRACE_OK;
+}
+
+extern "C" void palw_cuda_trace_destroy(palw_cuda_trace_context * context) {
+    if (context != nullptr) {
+        (void) cudaFree(context->device_records);
+        delete context;
+    }
+}
+
+extern "C" palw_cuda_trace_status palw_cuda_trace_reset(palw_cuda_trace_context * context) {
+    if (context == nullptr) {
+        return PALW_CUDA_TRACE_INVALID_ARGUMENT;
+    }
+    if (context->poisoned != 0) {
+        return PALW_CUDA_TRACE_POISONED;
+    }
+    if (context->copy_pending != 0 || context->committed_record != context->next_record ||
+        context->committed_kernel_sequence != context->next_kernel_sequence) {
+        return PALW_CUDA_TRACE_PENDING;
+    }
+    context->next_record = 0;
+    context->committed_record = 0;
+    context->next_kernel_sequence = 0;
+    context->committed_kernel_sequence = 0;
+    context->overflowed = 0;
+    context->last_cuda_error = static_cast<int32_t>(cudaSuccess);
+    return PALW_CUDA_TRACE_OK;
+}
+
+extern "C" uint64_t palw_cuda_trace_count(const palw_cuda_trace_context * context) {
+    return context == nullptr ? 0U : context->next_record;
+}
+
+extern "C" uint64_t palw_cuda_trace_committed_count(const palw_cuda_trace_context * context) {
+    return context == nullptr ? 0U : context->committed_record;
+}
+
+extern "C" int palw_cuda_trace_overflowed(const palw_cuda_trace_context * context) {
+    return context == nullptr ? 1 : context->overflowed;
+}
+
+extern "C" int palw_cuda_trace_poisoned(const palw_cuda_trace_context * context) {
+    return context == nullptr ? 1 : context->poisoned;
+}
+
+extern "C" int32_t palw_cuda_trace_last_cuda_error(const palw_cuda_trace_context * context) {
+    return context == nullptr ? -1 : context->last_cuda_error;
+}
+
+extern "C" palw_cuda_trace_status palw_cuda_trace_synchronize(
+    palw_cuda_trace_context * context,
+    cudaStream_t stream) {
+    if (context == nullptr) {
+        return PALW_CUDA_TRACE_INVALID_ARGUMENT;
+    }
+    if (context->poisoned != 0) {
+        return PALW_CUDA_TRACE_POISONED;
+    }
+    if (!bind_or_match_stream(context, stream)) {
+        return PALW_CUDA_TRACE_INVALID_ARGUMENT;
+    }
+    const palw_cuda_trace_status pending_error = consume_pending_cuda_error(context);
+    if (pending_error != PALW_CUDA_TRACE_OK) {
+        return pending_error;
+    }
+    const cudaError_t error = cudaStreamSynchronize(stream);
+    if (error != cudaSuccess) {
+        poison_context(context, error);
+        return PALW_CUDA_TRACE_CUDA_ERROR;
+    }
+    context->committed_record = context->next_record;
+    context->committed_kernel_sequence = context->next_kernel_sequence;
+    context->copy_pending = 0;
+    return PALW_CUDA_TRACE_OK;
+}
+
+extern "C" palw_cuda_trace_status palw_cuda_trace_copy_async(
+    palw_cuda_trace_context * context,
+    palw_cuda_trace_record * host_records,
+    uint64_t host_capacity,
+    cudaStream_t stream) {
+    if (context == nullptr || host_records == nullptr) {
+        return PALW_CUDA_TRACE_INVALID_ARGUMENT;
+    }
+    const palw_cuda_trace_status context_status = reject_failed_context(context);
+    if (context_status != PALW_CUDA_TRACE_OK) {
+        return context_status;
+    }
+    if (context->copy_pending != 0) {
+        return PALW_CUDA_TRACE_PENDING;
+    }
+    if (host_capacity < context->next_record || !bind_or_match_stream(context, stream)) {
+        return PALW_CUDA_TRACE_INVALID_ARGUMENT;
+    }
+    const palw_cuda_trace_status pending_error = consume_pending_cuda_error(context);
+    if (pending_error != PALW_CUDA_TRACE_OK) {
+        return pending_error;
+    }
+    const size_t bytes = static_cast<size_t>(context->next_record) * sizeof(palw_cuda_trace_record);
+    const cudaError_t error = cudaMemcpyAsync(
+        host_records,
+        context->device_records,
+        bytes,
+        cudaMemcpyDeviceToHost,
+        stream);
+    if (error != cudaSuccess) {
+        poison_context(context, error);
+        return PALW_CUDA_TRACE_CUDA_ERROR;
+    }
+    context->copy_pending = 1;
+    return PALW_CUDA_TRACE_OK;
+}
+
+palw_cuda_trace_status palw_cuda_trace_launch_f32(
+    palw_cuda_trace_context * context,
+    cudaStream_t stream,
+    const float * output,
+    uint64_t row_stride,
+    const palw_cuda_trace_launch * requested) {
+    if (context == nullptr || output == nullptr || requested == nullptr) {
+        return PALW_CUDA_TRACE_INVALID_ARGUMENT;
+    }
+    const palw_cuda_trace_status context_status = reject_failed_context(context);
+    if (context_status != PALW_CUDA_TRACE_OK) {
+        return context_status;
+    }
+    if (context->copy_pending != 0) {
+        return PALW_CUDA_TRACE_PENDING;
+    }
+    if (requested->output_rows == 0U || requested->output_columns == 0U ||
+        requested->tile_rows == 0U || requested->tile_columns == 0U ||
+        row_stride < requested->output_columns || requested->layer_id > PALW_CUDA_TRACE_MAX_LAYER_ID ||
+        !palw_cuda_trace_valid_phase(requested->phase, requested->decode_step) ||
+        !palw_cuda_trace_valid_dtype(requested->dtype) ||
+        !palw_cuda_trace_valid_quantization(requested->quantization) ||
+        requested->kind < PALW_CUDA_TRACE_GEMM || requested->kind > PALW_CUDA_TRACE_ATTENTION ||
+        !valid_address_range(output, requested->output_rows, requested->output_columns, row_stride)) {
+        return PALW_CUDA_TRACE_INVALID_ARGUMENT;
+    }
+    if (requested->kernel_sequence != context->next_kernel_sequence ||
+        requested->kernel_sequence == UINT64_MAX) {
+        return PALW_CUDA_TRACE_SEQUENCE_MISMATCH;
+    }
+    /* A wrong stream is invalid and must not make an otherwise-full context overflow-sticky. */
+    if (context->stream_bound != 0 && context->stream != stream) {
+        return PALW_CUDA_TRACE_INVALID_ARGUMENT;
+    }
+
+    const uint64_t grid_x =
+        (static_cast<uint64_t>(requested->output_columns) + requested->tile_columns - 1U) /
+        requested->tile_columns;
+    const uint64_t grid_y =
+        (static_cast<uint64_t>(requested->output_rows) + requested->tile_rows - 1U) /
+        requested->tile_rows;
+    if (grid_x == 0U || grid_y == 0U || grid_x > kMaxGridX || grid_y > kMaxGridY ||
+        grid_y > UINT64_MAX / grid_x) {
+        return PALW_CUDA_TRACE_INVALID_ARGUMENT;
+    }
+    const uint64_t tile_count = grid_x * grid_y;
+    if (tile_count > UINT32_MAX) {
+        return PALW_CUDA_TRACE_INVALID_ARGUMENT;
+    }
+    if (context->next_record > context->capacity ||
+        tile_count > context->capacity - context->next_record) {
+        context->overflowed = 1;
+        return PALW_CUDA_TRACE_CAPACITY_EXCEEDED;
+    }
+    if (!bind_or_match_stream(context, stream)) {
+        return PALW_CUDA_TRACE_INVALID_ARGUMENT;
+    }
+    const palw_cuda_trace_status pending_error = consume_pending_cuda_error(context);
+    if (pending_error != PALW_CUDA_TRACE_OK) {
+        return pending_error;
+    }
+
+    palw_cuda_trace_launch launch = *requested;
+    launch.base_record = context->next_record;
+    launch.tile_count = tile_count;
+    dim3 launch_grid(static_cast<uint32_t>(grid_x), static_cast<uint32_t>(grid_y), 1U);
+#if defined(PALW_CUDA_TRACE_TESTING)
+    if (context->test_force_launch_failure != 0) {
+        context->test_force_launch_failure = 0;
+        /* A zero-width grid forces a real, immediate CUDA launch-configuration error. */
+        launch_grid.x = 0U;
+    }
+#endif
+    accumulator_sketch_f32<<<
+        launch_grid,
+        dim3(1U, 1U, 1U),
+        0,
+        stream>>>(output, row_stride, context->device_records, launch);
+    const cudaError_t error = cudaGetLastError();
+    if (error != cudaSuccess) {
+        poison_context(context, error);
+        return PALW_CUDA_TRACE_CUDA_ERROR;
+    }
+    context->next_record += tile_count;
+    context->next_kernel_sequence += 1U;
+    return PALW_CUDA_TRACE_OK;
+}

runtime-palw/cuda/attention_trace.cu

@@ -0,0 +1,58 @@
+#include "palw_cuda_trace_internal.cuh"
+
+extern "C" palw_cuda_trace_status palw_cuda_trace_attention_f32(
+    palw_cuda_trace_context * context,
+    cudaStream_t stream,
+    const float * output,
+    uint32_t output_rows,
+    uint32_t output_columns,
+    uint64_t row_stride,
+    uint64_t kernel_sequence,
+    uint32_t layer_id,
+    uint8_t phase,
+    uint64_t decode_step,
+    uint64_t query_tokens,
+    uint64_t key_value_tokens,
+    uint64_t heads,
+    uint64_t head_dim,
+    uint64_t batch,
+    uint8_t dtype,
+    uint8_t causal,
+    uint32_t tile_rows,
+    uint32_t tile_columns) {
+    if (context != nullptr && context->poisoned != 0) {
+        return PALW_CUDA_TRACE_POISONED;
+    }
+    if (context != nullptr && context->overflowed != 0) {
+        return PALW_CUDA_TRACE_CAPACITY_EXCEEDED;
+    }
+    if (query_tokens == 0U || key_value_tokens == 0U || heads == 0U || head_dim == 0U ||
+        batch == 0U || causal > 1U || query_tokens > UINT32_MAX ||
+        key_value_tokens > UINT32_MAX || heads > UINT32_MAX || head_dim > UINT32_MAX ||
+        batch > UINT32_MAX || head_dim > UINT64_MAX / heads ||
+        query_tokens > UINT64_MAX / batch || query_tokens * batch != output_rows ||
+        heads * head_dim != output_columns ||
+        (causal != 0U && key_value_tokens < query_tokens) ||
+        (phase == PALW_CUDA_TRACE_DECODE && query_tokens != 1U)) {
+        return PALW_CUDA_TRACE_INVALID_ARGUMENT;
+    }
+    palw_cuda_trace_launch launch{};
+    launch.kernel_sequence = kernel_sequence;
+    launch.decode_step = decode_step;
+    launch.m = query_tokens;
+    launch.n = heads * head_dim;
+    launch.k = key_value_tokens;
+    launch.batch = batch;
+    launch.query_tokens = query_tokens;
+    launch.key_value_tokens = key_value_tokens;
+    launch.layer_id = layer_id;
+    launch.output_rows = output_rows;
+    launch.output_columns = output_columns;
+    launch.tile_rows = tile_rows;
+    launch.tile_columns = tile_columns;
+    launch.kind = PALW_CUDA_TRACE_ATTENTION;
+    launch.phase = phase;
+    launch.dtype = dtype;
+    launch.causal = causal;
+    return palw_cuda_trace_launch_f32(context, stream, output, row_stride, &launch);
+}

runtime-palw/cuda/cuda_trace_test.cu

@@ -0,0 +1,522 @@
+#include "palw_cuda_trace_internal.cuh"
+
+#include <cuda_runtime.h>
+
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <vector>
+
+static_assert(PALW_CUDA_TRACE_PRODUCTION_CAPABLE == 0U);
+
+namespace {
+
+#define REQUIRE(condition, message) \
+    do { \
+        if (!(condition)) { \
+            std::fprintf(stderr, "CUDA trace test failure at line %d: %s\n", __LINE__, message); \
+            return false; \
+        } \
+    } while (false)
+
+#define REQUIRE_STATUS(expression, expected) \
+    do { \
+        const palw_cuda_trace_status actual_status = (expression); \
+        if (actual_status != (expected)) { \
+            std::fprintf( \
+                stderr, \
+                "CUDA trace test failure at line %d: status %d, expected %d\n", \
+                __LINE__, \
+                static_cast<int>(actual_status), \
+                static_cast<int>(expected)); \
+            return false; \
+        } \
+    } while (false)
+
+class stream_guard {
+public:
+    bool create() {
+        return cudaStreamCreateWithFlags(&stream_, cudaStreamNonBlocking) == cudaSuccess;
+    }
+
+    ~stream_guard() {
+        if (stream_ != nullptr) {
+            (void) cudaStreamDestroy(stream_);
+        }
+    }
+
+    cudaStream_t get() const {
+        return stream_;
+    }
+
+private:
+    cudaStream_t stream_ = nullptr;
+};
+
+class device_float_buffer {
+public:
+    bool allocate(size_t elements) {
+        elements_ = elements;
+        return cudaMalloc(reinterpret_cast<void **>(&data_), elements * sizeof(float)) == cudaSuccess;
+    }
+
+    ~device_float_buffer() {
+        if (data_ != nullptr) {
+            (void) cudaFree(data_);
+        }
+    }
+
+    bool copy_from(const std::vector<float> & values, cudaStream_t stream) {
+        return values.size() <= elements_ &&
+            cudaMemcpyAsync(
+                data_,
+                values.data(),
+                values.size() * sizeof(float),
+                cudaMemcpyHostToDevice,
+                stream) == cudaSuccess;
+    }
+
+    float * get() const {
+        return data_;
+    }
+
+private:
+    float * data_ = nullptr;
+    size_t elements_ = 0;
+};
+
+class pinned_records {
+public:
+    bool allocate(size_t count) {
+        count_ = count;
+        return cudaMallocHost(
+            reinterpret_cast<void **>(&records_),
+            count * sizeof(palw_cuda_trace_record)) == cudaSuccess;
+    }
+
+    ~pinned_records() {
+        if (records_ != nullptr) {
+            (void) cudaFreeHost(records_);
+        }
+    }
+
+    palw_cuda_trace_record * get() const {
+        return records_;
+    }
+
+    uint64_t capacity() const {
+        return static_cast<uint64_t>(count_);
+    }
+
+private:
+    palw_cuda_trace_record * records_ = nullptr;
+    size_t count_ = 0;
+};
+
+class context_guard {
+public:
+    bool create(uint64_t capacity) {
+        return palw_cuda_trace_create(capacity, &context_) == PALW_CUDA_TRACE_OK;
+    }
+
+    ~context_guard() {
+        palw_cuda_trace_destroy(context_);
+    }
+
+    palw_cuda_trace_context * get() const {
+        return context_;
+    }
+
+private:
+    palw_cuda_trace_context * context_ = nullptr;
+};
+
+using encoded_record = std::array<uint8_t, PALW_CUDA_TRACE_RECORD_ENCODED_SIZE_V1>;
+using sketch = std::array<uint64_t, 4>;
+
+palw_cuda_trace_status launch_gemm(
+    palw_cuda_trace_context * context,
+    cudaStream_t stream,
+    const float * output,
+    uint64_t sequence,
+    uint8_t phase = PALW_CUDA_TRACE_PREFILL,
+    uint64_t decode_step = 0,
+    uint8_t dtype = PALW_CUDA_TRACE_DTYPE_FP32,
+    uint8_t quantization = PALW_CUDA_TRACE_QUANTIZATION_Q4_K_M,
+    uint32_t output_rows = 4,
+    uint32_t output_columns = 6,
+    uint64_t row_stride = 6,
+    uint64_t m = 6,
+    uint64_t n = 2,
+    uint64_t k = 3,
+    uint64_t batch = 2,
+    uint32_t tile_rows = 2,
+    uint32_t tile_columns = 4) {
+    return palw_cuda_trace_gemm_f32(
+        context,
+        stream,
+        output,
+        output_rows,
+        output_columns,
+        row_stride,
+        sequence,
+        5,
+        phase,
+        decode_step,
+        m,
+        n,
+        k,
+        batch,
+        dtype,
+        quantization,
+        tile_rows,
+        tile_columns);
+}
+
+palw_cuda_trace_status launch_attention(
+    palw_cuda_trace_context * context,
+    cudaStream_t stream,
+    const float * output,
+    uint64_t sequence,
+    uint8_t phase = PALW_CUDA_TRACE_PREFILL,
+    uint64_t decode_step = 0,
+    uint64_t query_tokens = 2,
+    uint64_t key_value_tokens = 2,
+    uint64_t heads = 2,
+    uint64_t head_dim = 4,
+    uint64_t batch = 1,
+    uint8_t dtype = PALW_CUDA_TRACE_DTYPE_FP16,
+    uint8_t causal = 1,
+    uint32_t output_rows = 2,
+    uint32_t output_columns = 8,
+    uint64_t row_stride = 8,
+    uint32_t tile_rows = 1,
+    uint32_t tile_columns = 4) {
+    return palw_cuda_trace_attention_f32(
+        context,
+        stream,
+        output,
+        output_rows,
+        output_columns,
+        row_stride,
+        sequence,
+        5,
+        phase,
+        decode_step,
+        query_tokens,
+        key_value_tokens,
+        heads,
+        head_dim,
+        batch,
+        dtype,
+        causal,
+        tile_rows,
+        tile_columns);
+}
+
+bool encode_records(
+    const palw_cuda_trace_record * records,
+    size_t count,
+    std::vector<encoded_record> & encoded) {
+    encoded.resize(count);
+    for (size_t i = 0; i < count; ++i) {
+        if (palw_cuda_trace_encode_record_v1(
+                &records[i], encoded[i].data(), encoded[i].size()) != PALW_CUDA_TRACE_OK) {
+            return false;
+        }
+    }
+    return true;
+}
+
+sketch record_sketch(const palw_cuda_trace_record & record) {
+    return {record.sketch[0], record.sketch[1], record.sketch[2], record.sketch[3]};
+}
+
+float float_from_bits(uint32_t bits) {
+    float value = 0.0f;
+    std::memcpy(&value, &bits, sizeof(value));
+    return value;
+}
+
+bool run_device_tests() {
+    stream_guard stream;
+    stream_guard other_stream;
+    device_float_buffer output;
+    pinned_records records;
+    context_guard context;
+    context_guard small_context;
+    context_guard recovered_context;
+
+    REQUIRE(stream.create(), "failed to create primary stream");
+    REQUIRE(other_stream.create(), "failed to create secondary stream");
+    REQUIRE(output.allocate(24), "failed to allocate output");
+    REQUIRE(records.allocate(32), "failed to allocate pinned records");
+    REQUIRE(context.create(32), "failed to create trace context");
+
+    std::vector<float> values(24);
+    for (size_t i = 0; i < values.size(); ++i) {
+        values[i] = static_cast<float>(i + 1U) * 0.25f;
+    }
+
+    REQUIRE(output.copy_from(values, stream.get()), "failed to upload baseline output");
+    REQUIRE_STATUS(launch_gemm(context.get(), stream.get(), output.get(), 0), PALW_CUDA_TRACE_OK);
+    REQUIRE_STATUS(
+        launch_attention(context.get(), stream.get(), output.get(), 1),
+        PALW_CUDA_TRACE_OK);
+    REQUIRE(palw_cuda_trace_count(context.get()) == 8U, "unexpected reserved record count");
+    REQUIRE(
+        palw_cuda_trace_committed_count(context.get()) == 0U,
+        "records committed before synchronization");
+    REQUIRE_STATUS(
+        palw_cuda_trace_copy_async(context.get(), records.get(), 7, stream.get()),
+        PALW_CUDA_TRACE_INVALID_ARGUMENT);
+    REQUIRE_STATUS(
+        palw_cuda_trace_synchronize(context.get(), other_stream.get()),
+        PALW_CUDA_TRACE_INVALID_ARGUMENT);
+    REQUIRE(palw_cuda_trace_count(context.get()) == 8U, "copy/stream rejection changed count");
+    REQUIRE_STATUS(palw_cuda_trace_reset(context.get()), PALW_CUDA_TRACE_PENDING);
+    REQUIRE_STATUS(
+        palw_cuda_trace_copy_async(
+            context.get(), records.get(), records.capacity(), stream.get()),
+        PALW_CUDA_TRACE_OK);
+    REQUIRE_STATUS(
+        palw_cuda_trace_copy_async(
+            context.get(), records.get(), records.capacity(), stream.get()),
+        PALW_CUDA_TRACE_PENDING);
+    REQUIRE_STATUS(launch_gemm(context.get(), stream.get(), output.get(), 2), PALW_CUDA_TRACE_PENDING);
+    REQUIRE_STATUS(palw_cuda_trace_synchronize(context.get(), stream.get()), PALW_CUDA_TRACE_OK);
+    REQUIRE(
+        palw_cuda_trace_committed_count(context.get()) == 8U,
+        "successful synchronize did not commit records");
+
+    for (uint64_t i = 0; i < 4U; ++i) {
+        const auto & record = records.get()[i];
+        REQUIRE(record.kernel_sequence == 0U, "GEMM sequence mismatch");
+        REQUIRE(record.tile_index == i, "GEMM tile index mismatch");
+        REQUIRE(record.tile_row == i / 2U && record.tile_column == i % 2U, "GEMM tile order mismatch");
+        REQUIRE(record.kind == PALW_CUDA_TRACE_GEMM, "GEMM kind mismatch");
+    }
+    for (uint64_t i = 0; i < 4U; ++i) {
+        const auto & record = records.get()[4U + i];
+        REQUIRE(record.kernel_sequence == 1U, "attention sequence mismatch");
+        REQUIRE(record.tile_index == i, "attention tile index mismatch");
+        REQUIRE(
+            record.tile_row == i / 2U && record.tile_column == i % 2U,
+            "attention tile order mismatch");
+        REQUIRE(record.kind == PALW_CUDA_TRACE_ATTENTION, "attention kind mismatch");
+    }
+
+    std::vector<encoded_record> baseline;
+    REQUIRE(encode_records(records.get(), 8, baseline), "failed to encode baseline records");
+    std::array<sketch, 4> baseline_gemm_sketches{};
+    for (size_t i = 0; i < baseline_gemm_sketches.size(); ++i) {
+        baseline_gemm_sketches[i] = record_sketch(records.get()[i]);
+    }
+
+    REQUIRE_STATUS(palw_cuda_trace_reset(context.get()), PALW_CUDA_TRACE_OK);
+    REQUIRE(output.copy_from(values, stream.get()), "failed to restore baseline output");
+    REQUIRE_STATUS(launch_gemm(context.get(), stream.get(), output.get(), 0), PALW_CUDA_TRACE_OK);
+    REQUIRE_STATUS(
+        launch_attention(context.get(), stream.get(), output.get(), 1),
+        PALW_CUDA_TRACE_OK);
+    REQUIRE_STATUS(
+        palw_cuda_trace_copy_async(
+            context.get(), records.get(), records.capacity(), stream.get()),
+        PALW_CUDA_TRACE_OK);
+    REQUIRE_STATUS(palw_cuda_trace_synchronize(context.get(), stream.get()), PALW_CUDA_TRACE_OK);
+    std::vector<encoded_record> repeated;
+    REQUIRE(encode_records(records.get(), 8, repeated), "failed to encode repeated records");
+    REQUIRE(repeated == baseline, "same-stream trace was not repeatable");
+
+    std::vector<float> canonical_values_a(24);
+    std::vector<float> canonical_values_b(24);
+    for (size_t i = 0; i < canonical_values_a.size(); ++i) {
+        if ((i & 1U) == 0U) {
+            canonical_values_a[i] = float_from_bits(0x00000000U);
+            canonical_values_b[i] = float_from_bits(0x80000000U);
+        } else {
+            canonical_values_a[i] = float_from_bits(0x7fc00001U + static_cast<uint32_t>(i));
+            canonical_values_b[i] = float_from_bits(0xff800001U + static_cast<uint32_t>(i));
+        }
+    }
+    REQUIRE_STATUS(palw_cuda_trace_reset(context.get()), PALW_CUDA_TRACE_OK);
+    REQUIRE(output.copy_from(canonical_values_a, stream.get()), "failed to upload canonical set A");
+    REQUIRE_STATUS(launch_gemm(context.get(), stream.get(), output.get(), 0), PALW_CUDA_TRACE_OK);
+    REQUIRE_STATUS(
+        palw_cuda_trace_copy_async(
+            context.get(), records.get(), records.capacity(), stream.get()),
+        PALW_CUDA_TRACE_OK);
+    REQUIRE_STATUS(palw_cuda_trace_synchronize(context.get(), stream.get()), PALW_CUDA_TRACE_OK);
+    std::vector<encoded_record> canonical_a;
+    REQUIRE(encode_records(records.get(), 4, canonical_a), "failed to encode canonical set A");
+
+    REQUIRE_STATUS(palw_cuda_trace_reset(context.get()), PALW_CUDA_TRACE_OK);
+    REQUIRE(output.copy_from(canonical_values_b, stream.get()), "failed to upload canonical set B");
+    REQUIRE_STATUS(launch_gemm(context.get(), stream.get(), output.get(), 0), PALW_CUDA_TRACE_OK);
+    REQUIRE_STATUS(
+        palw_cuda_trace_copy_async(
+            context.get(), records.get(), records.capacity(), stream.get()),
+        PALW_CUDA_TRACE_OK);
+    REQUIRE_STATUS(palw_cuda_trace_synchronize(context.get(), stream.get()), PALW_CUDA_TRACE_OK);
+    std::vector<encoded_record> canonical_b;
+    REQUIRE(encode_records(records.get(), 4, canonical_b), "failed to encode canonical set B");
+    REQUIRE(canonical_a == canonical_b, "signed-zero or NaN payload changed a sketch");
+
+    REQUIRE_STATUS(palw_cuda_trace_reset(context.get()), PALW_CUDA_TRACE_OK);
+    values[7] += 17.0f;
+    REQUIRE(output.copy_from(values, stream.get()), "failed to upload mutated output");
+    REQUIRE_STATUS(launch_gemm(context.get(), stream.get(), output.get(), 0), PALW_CUDA_TRACE_OK);
+    REQUIRE_STATUS(
+        palw_cuda_trace_copy_async(
+            context.get(), records.get(), records.capacity(), stream.get()),
+        PALW_CUDA_TRACE_OK);
+    REQUIRE_STATUS(palw_cuda_trace_synchronize(context.get(), stream.get()), PALW_CUDA_TRACE_OK);
+    REQUIRE(
+        record_sketch(records.get()[0]) != baseline_gemm_sketches[0],
+        "sampled mutation did not change its tile sketch");
+    for (size_t i = 1; i < baseline_gemm_sketches.size(); ++i) {
+        REQUIRE(
+            record_sketch(records.get()[i]) == baseline_gemm_sketches[i],
+            "mutation changed an unrelated tile sketch");
+    }
+
+    REQUIRE_STATUS(palw_cuda_trace_reset(context.get()), PALW_CUDA_TRACE_OK);
+    REQUIRE_STATUS(
+        launch_gemm(
+            context.get(), stream.get(), output.get(), 0, PALW_CUDA_TRACE_PREFILL, 0, 255),
+        PALW_CUDA_TRACE_INVALID_ARGUMENT);
+    REQUIRE_STATUS(
+        launch_gemm(
+            context.get(), stream.get(), output.get(), 0, PALW_CUDA_TRACE_PREFILL, 0,
+            PALW_CUDA_TRACE_DTYPE_FP32, 255),
+        PALW_CUDA_TRACE_INVALID_ARGUMENT);
+    REQUIRE_STATUS(
+        launch_gemm(
+            context.get(), stream.get(), output.get(), 0, PALW_CUDA_TRACE_PREFILL, 1),
+        PALW_CUDA_TRACE_INVALID_ARGUMENT);
+    REQUIRE_STATUS(
+        launch_gemm(
+            context.get(), stream.get(), output.get(), 0, PALW_CUDA_TRACE_PREFILL, 0,
+            PALW_CUDA_TRACE_DTYPE_FP32, PALW_CUDA_TRACE_QUANTIZATION_Q4_K_M, 3),
+        PALW_CUDA_TRACE_INVALID_ARGUMENT);
+    REQUIRE_STATUS(
+        launch_gemm(
+            context.get(), stream.get(), output.get(), 0, PALW_CUDA_TRACE_PREFILL, 0,
+            PALW_CUDA_TRACE_DTYPE_FP32, PALW_CUDA_TRACE_QUANTIZATION_Q4_K_M,
+            4, 6, 5),
+        PALW_CUDA_TRACE_INVALID_ARGUMENT);
+    REQUIRE_STATUS(
+        launch_gemm(
+            context.get(), stream.get(), output.get(), 0, PALW_CUDA_TRACE_PREFILL, 0,
+            PALW_CUDA_TRACE_DTYPE_FP32, PALW_CUDA_TRACE_QUANTIZATION_Q4_K_M,
+            4, 6, 6, 6, 2, 3, 2, 0, 4),
+        PALW_CUDA_TRACE_INVALID_ARGUMENT);
+    REQUIRE_STATUS(
+        launch_attention(
+            context.get(), stream.get(), output.get(), 0, PALW_CUDA_TRACE_DECODE, 0),
+        PALW_CUDA_TRACE_INVALID_ARGUMENT);
+    REQUIRE_STATUS(
+        launch_attention(
+            context.get(), stream.get(), output.get(), 0, PALW_CUDA_TRACE_PREFILL, 0,
+            2, 1),
+        PALW_CUDA_TRACE_INVALID_ARGUMENT);
+    REQUIRE_STATUS(
+        launch_attention(
+            context.get(), stream.get(), output.get(), 0, PALW_CUDA_TRACE_PREFILL, 0,
+            2, 2, 2, 4, 1, PALW_CUDA_TRACE_DTYPE_FP16, 1, 3),
+        PALW_CUDA_TRACE_INVALID_ARGUMENT);
+    REQUIRE_STATUS(
+        launch_attention(
+            context.get(), stream.get(), output.get(), 0, PALW_CUDA_TRACE_PREFILL, 0,
+            2, 2, 2, 4, 1, PALW_CUDA_TRACE_DTYPE_FP16, 2),
+        PALW_CUDA_TRACE_INVALID_ARGUMENT);
+    REQUIRE(palw_cuda_trace_count(context.get()) == 0U, "invalid arguments mutated count");
+    REQUIRE(palw_cuda_trace_poisoned(context.get()) == 0, "invalid arguments poisoned context");
+
+    REQUIRE_STATUS(launch_gemm(context.get(), stream.get(), output.get(), 1), PALW_CUDA_TRACE_SEQUENCE_MISMATCH);
+    REQUIRE(palw_cuda_trace_count(context.get()) == 0U, "sequence mismatch mutated count");
+    REQUIRE_STATUS(launch_gemm(context.get(), stream.get(), output.get(), 0), PALW_CUDA_TRACE_OK);
+    REQUIRE_STATUS(launch_gemm(context.get(), stream.get(), output.get(), 0), PALW_CUDA_TRACE_SEQUENCE_MISMATCH);
+    REQUIRE(palw_cuda_trace_count(context.get()) == 4U, "sequence mismatch changed reserved count");
+    REQUIRE_STATUS(palw_cuda_trace_synchronize(context.get(), stream.get()), PALW_CUDA_TRACE_OK);
+    REQUIRE_STATUS(palw_cuda_trace_reset(context.get()), PALW_CUDA_TRACE_OK);
+
+    REQUIRE_STATUS(
+        launch_gemm(context.get(), other_stream.get(), output.get(), 0),
+        PALW_CUDA_TRACE_INVALID_ARGUMENT);
+    REQUIRE(palw_cuda_trace_count(context.get()) == 0U, "wrong stream mutated count");
+
+    REQUIRE(small_context.create(3), "failed to create small trace context");
+    REQUIRE_STATUS(
+        launch_gemm(small_context.get(), stream.get(), output.get(), 0),
+        PALW_CUDA_TRACE_CAPACITY_EXCEEDED);
+    REQUIRE(palw_cuda_trace_overflowed(small_context.get()) == 1, "overflow flag was not sticky");
+    REQUIRE(palw_cuda_trace_count(small_context.get()) == 0U, "capacity failure reserved records");
+    REQUIRE_STATUS(
+        launch_gemm(small_context.get(), stream.get(), output.get(), 0),
+        PALW_CUDA_TRACE_CAPACITY_EXCEEDED);
+    REQUIRE_STATUS(palw_cuda_trace_reset(small_context.get()), PALW_CUDA_TRACE_OK);
+    REQUIRE(palw_cuda_trace_overflowed(small_context.get()) == 0, "reset did not clear overflow");
+    REQUIRE_STATUS(
+        launch_gemm(
+            small_context.get(), stream.get(), output.get(), 0, PALW_CUDA_TRACE_PREFILL, 0,
+            PALW_CUDA_TRACE_DTYPE_FP32, PALW_CUDA_TRACE_QUANTIZATION_Q4_K_M,
+            4, 6, 6, 6, 2, 3, 2, 4, 2),
+        PALW_CUDA_TRACE_OK);
+    REQUIRE(palw_cuda_trace_count(small_context.get()) == 3U, "exact capacity count mismatch");
+    REQUIRE_STATUS(
+        palw_cuda_trace_synchronize(small_context.get(), stream.get()),
+        PALW_CUDA_TRACE_OK);
+
+    context.get()->test_force_launch_failure = 1;
+    REQUIRE_STATUS(launch_gemm(context.get(), stream.get(), output.get(), 0), PALW_CUDA_TRACE_CUDA_ERROR);
+    REQUIRE(palw_cuda_trace_poisoned(context.get()) == 1, "launch failure did not poison context");
+    REQUIRE(palw_cuda_trace_count(context.get()) == 0U, "failed launch reserved records");
+    REQUIRE(palw_cuda_trace_last_cuda_error(context.get()) != 0, "poison lost CUDA error");
+    REQUIRE_STATUS(launch_gemm(context.get(), stream.get(), output.get(), 0), PALW_CUDA_TRACE_POISONED);
+    REQUIRE_STATUS(
+        launch_attention(context.get(), stream.get(), output.get(), 0),
+        PALW_CUDA_TRACE_POISONED);
+    REQUIRE_STATUS(palw_cuda_trace_reset(context.get()), PALW_CUDA_TRACE_POISONED);
+    REQUIRE_STATUS(
+        palw_cuda_trace_copy_async(
+            context.get(), records.get(), records.capacity(), stream.get()),
+        PALW_CUDA_TRACE_POISONED);
+    REQUIRE_STATUS(palw_cuda_trace_synchronize(context.get(), stream.get()), PALW_CUDA_TRACE_POISONED);
+
+    REQUIRE(recovered_context.create(4), "failed to recreate after poison");
+    REQUIRE_STATUS(
+        launch_gemm(
+            recovered_context.get(), stream.get(), output.get(), 0, PALW_CUDA_TRACE_PREFILL, 0,
+            PALW_CUDA_TRACE_DTYPE_FP32, PALW_CUDA_TRACE_QUANTIZATION_Q4_K_M,
+            4, 6, 6, 6, 2, 3, 2, 2, 4),
+        PALW_CUDA_TRACE_OK);
+    REQUIRE_STATUS(
+        palw_cuda_trace_synchronize(recovered_context.get(), stream.get()),
+        PALW_CUDA_TRACE_OK);
+
+    std::puts("PALW experimental CUDA GEMM/attention transport device gate: ok");
+    return true;
+}
+
+} // namespace
+
+int main() {
+    int device_count = 0;
+    const cudaError_t count_status = cudaGetDeviceCount(&device_count);
+    if (count_status == cudaErrorNoDevice || count_status == cudaErrorInsufficientDriver ||
+        (count_status == cudaSuccess && device_count == 0)) {
+        std::fprintf(stderr, "SKIP: CUDA trace device gate requires an NVIDIA CUDA device\n");
+        return 77;
+    }
+    if (count_status != cudaSuccess) {
+        std::fprintf(stderr, "cudaGetDeviceCount failed: %s\n", cudaGetErrorString(count_status));
+        return 1;
+    }
+    if (cudaSetDevice(0) != cudaSuccess) {
+        std::fprintf(stderr, "cudaSetDevice(0) failed\n");
+        return 1;
+    }
+    return run_device_tests() ? 0 : 1;
+}