ADR-0055: Candidate-Matched Gate B Measurement and Claim

Status: accepted; measurement boundary complete, candidate claim rejected

Date: 2026-08-02

Visibility: private NAUX architecture/governance record. This ADR is not public roadmap material.

Related: ADR-0039, ADR-0041, ADR-0051, ADR-0052, ADR-0053, ADR-0054

Extends: ADR-0054 by measuring its exact BranchMix candidate ELF against the already admitted structurally matched hand baseline

Preserves: ordinary ADR-0041 observation and claim domains; encoder policy 1.4 as the sole globally selected policy; Bounds fallback and all accepted correctness identities

Context

ADR-0054 proves direct-process correctness for the exact policy-1.5 BranchMix candidate and policy-1.4 Bounds fallback, but deliberately records no time. The next Roadmap gate must determine whether that exact candidate improves the fixed Gate B end-to-end workload enough to meet the existing 2.0x threshold.

ADR-0041 already freezes the fair measurement mechanics: a separately admitted hand-written target packaged behind the same startup/protocol/ELF shape, one fresh process per invocation, a deterministic 65,536-element by 64 repetition workload, five warmup pairs, 30 measured pairs, alternating order, no sample deletion, exact medians, p95, integer CV admission, and a 30-second timeout. Those mechanics must not change after seeing candidate performance.

The ordinary measurement API accepts only the globally selected policy-1.4 standalone artifact and produces an ordinary claim token. Widening it to the candidate would silently mix provenance and could make a local candidate measurement look like global encoder selection. ADR-0055 therefore needs its own authority, observation identity, verifier, rejection type, and claim token while reusing only the frozen mechanical/statistical primitives.

Decision drivers

Measurement requires the exact verified ADR-0054 direct-process witness and exact verified BranchMix candidate artifact; detached hashes are rejected.
The candidate artifact must equal the frozen ADR-0054 Branch artifact and remain bound to ADR-0051/0052/0053/0054 roots.
The hand denominator requires opaque verified finite baseline admission and exact independently rebuilt baseline bytes.
Workload, input, expected output, warmups, measured pairs, alternating schedule, timeout, statistic, CV limit, and 2.0x threshold remain exactly ADR-0041 v1.
Candidate and baseline use the same prepared-executable and fresh-process containment path. Construction and verification remain outside samples.
Failure of either pair member rejects the complete observation; there is no retry, fallback, sample deletion, outlier filtering, or order substitution.
Observation verification recomputes all deterministic identities, statistics, stability decisions, and threshold decisions from raw samples.
A claim token can be created only after host/repository/stability/threshold admission. It grants no global selection or executable authority.
A slow or noisy run remains useful verified local evidence but produces no claim.
The implementation is NAUX-owned and adds no dependency.

Considered options

1. Pass the candidate artifact to the ordinary ADR-0041 API

This requires widening ordinary artifact provenance and returns a claim type whose meaning predates the candidate chain. Rejected.

2. Change the workload, sample count, threshold, or denominator

Changing the benchmark after observing candidate performance destroys comparability with policy 1.3 and policy 1.4 evidence. Rejected.

3. Time native calls instead of direct processes

This excludes startup, protocol, mapping, I/O, loader, and reap costs that the North Star explicitly includes and no longer matches the hand baseline. Rejected.

4. Measure the full 46+5 correctness corpus

Gate B performance is frozen specifically for BranchMix. Bounds remains a correctness fallback and must not be blended into the performance ratio. Rejected.

5. Create a candidate-specific measurement/claim domain over ADR-0041 mechanics

This preserves benchmark comparability and type-level provenance separation. Accepted.

Decision

1. Measurement authority

Emission and verification require all of:

the live candidate BranchMix standalone authority;
its exact lifetime-bound verified ADR-0054 ELF view;
an opaque verified ADR-0054 51-case direct-process witness whose Branch artifact identity equals that view; and
an opaque verified hand-baseline finite admission witness.

The Bounds authority/artifact remain lifetime anchors of the ADR-0054 witness but are not executed in the performance workload. No raw code, artifact hash, target selector, workload, schedule, timeout, or threshold is accepted from a caller.

2. Frozen matched observation

The candidate policy reuses the exact ADR-0041 constants:

array elements                 65,536
repetitions                        64
element visits               4,194,304
warmup pairs                          5
measured pairs                       30
schedule             paired alternating
sample dropping                     none
timeout                          30,000 ms
primary statistic                 median
tail statistic                       p95
maximum admitted CV                   5%
threshold          candidate <= 2 * baseline

Each sample begins immediately before spawn and ends after exact output/error capture, process-group containment, and child reap. Decoding and aggregation follow the timestamp. Candidate and baseline executable preparation occurs before warmup and measurement.

3. Candidate observation identity

The separately domain-separated observation seals at least:

candidate measurement schema/policy
ADR-0051 capsule, ADR-0052 correctness, ADR-0053 worker-process root
ADR-0054 Branch artifact and direct-process roots
candidate ELF/startup/target identities
hand baseline target/artifact/admission identities
frozen workload values/input/output identities
warmup, sample, timeout, schedule, statistic, CV, and threshold policies
release/affinity/repository admission metadata
all ordered raw paired durations and output-frame identities
recomputed exact statistics and decisions
outer observation seal

PIDs, paths, ASLR, addresses, individual diagnostic text, and construction durations remain outside deterministic evidence.

4. Verification and claim admission

Verification rebuilds both exact images, rebinds the ADR-0054 and baseline witnesses, regenerates workload/input/expected output, checks canonical pair order and nonzero samples, recomputes output identities, exact statistics, CV decisions, threshold decision, and observation seal.

A separately named candidate claim token is admitted only when:

the observation is release-built;
exactly one logical CPU is admitted by the frozen affinity check;
repository revision and dirty state are recorded, revision is nonzero, and the worktree is clean;
candidate and baseline CV are each at most 5%; and
candidate median is no greater than twice baseline median.

An emitted local observation deliberately records missing repository state and a dirty flag, so the normal library emission API alone cannot mint a claim. Claim-bearing host/repository attestation remains an explicit later operational input, not inferred from paths or Git subprocess text.

5. Explicitly excluded authority

Acceptance of this ADR does not authorize:

changing global or per-program encoder selection;
converting candidate authority/artifacts into ordinary policy-1.4 types;
arbitrary candidate code, workload, input, schedule, sample, or threshold;
retrying a failed candidate sample through policy 1.4;
dropping samples or accepting a noisy/slow/local observation as a claim;
Gate C, the mature 1.25x target, P1-within-10%, another workload/host, or C/C++ leadership claims; or
binary, kernel, scheduler, thermal, filesystem, or launch-environment attestation beyond the explicitly recorded admission fields.

Consequences

Candidate performance becomes directly comparable to historical Gate B observations without weakening ordinary claim provenance.
A rejected measurement gives an exact optimization signal while global policy safely remains 1.4.
A passing candidate claim is necessary but not sufficient for a later policy-selection ADR; selection requires a separate decision and complete rollback/fallback policy.

Validation required before acceptance

Measurement accepts only exact live ADR-0054 Branch authority/artifact, verified ADR-0054 direct-process witness, and verified baseline admission.
Candidate, baseline, workload, input, output, policy, and all upstream roots are regenerated and matched before executable preparation.
Exactly five warmup and 30 measured pairs run in alternating order through the shared fresh-process containment path.
Either pair-member failure, timeout, signal, abnormal status, malformed output, unexpected stderr, inherited pipe, or cleanup failure rejects the complete observation with no retry or partial evidence.
Raw samples are nonzero, ordered, retained without deletion, and bind exact canonical output-frame identities for both engines.
Median numerator, p95, sum, scaled squared deviations, exact CV comparison, and 2.0x threshold are recomputed with checked integer arithmetic.
Wrong artifact/upstream/baseline/workload/output/schedule/sample/statistic/ host/repository/decision/seal fields fail verification even when locally re-sealed.
Debug, unpinned, repository-missing, dirty, candidate-noisy, baseline-noisy, or threshold-failing observations cannot mint a claim.
Candidate claim token has no conversion or consumer in ordinary claim, measurement, executable, or global selection APIs.
Candidate failure never executes or records policy 1.4 BranchMix as a fallback candidate sample.
Static audits prove global encoder policy remains 1.4.0 and ordinary ADR-0041 behavior/identities remain unchanged.
Focused tests, complete debug/release workspace suites, strict refinement, governance, Clippy with warnings denied, format, and diff gates pass.
At least one explicit release local observation runs the complete frozen schedule and is independently verified; its pass/rejection result and exact raw/statistical identities are recorded without changing policy.

Implementation and acceptance evidence

The accepted implementation is isolated in x64_gate_b_candidate_measurement.rs. It introduces candidate-only observation, verified-observation, claim, error, and rejection types. It reuses ADR-0041 only for the exact frozen workload, prepared-executable containment, paired schedule, integer statistics, and threshold mechanics. There is no conversion to ordinary Gate B evidence, standalone authority, target authority, or encoder selection.

The observation seals the complete ADR-0051 through ADR-0054 root vector, BranchMix candidate ELF/startup/target identities, Bounds fallback artifact identities retained by the direct-process witness, independently admitted hand-baseline identities, explicit schedule/statistics/CV/threshold policies, all 30 raw paired samples, and the recomputed decisions. Self-resealed upstream-root, baseline, pair-order, duration, statistic, and threshold mutations all fail verification.

Two explicit release observations executed the exact 51-case ADR-0054 direct process gate, 46-case hand-baseline admission, five warmup pairs, and 30 alternating measured pairs:

host affinity       12 logical CPUs
observation         d52b7007e2226f1d0eec0dd50d289c49cf531b113b8f0238f3a6d8caf2ab851c
candidate median*2  54,140,180 ns
baseline median*2   12,752,892 ns
median ratio        4.245325688x
candidate p95       29,110,315 ns
baseline p95         6,501,047 ns
candidate CV gate   pass
baseline CV gate    fail
2.0x threshold      fail

host affinity       CPU 0 only
observation         15d421cef6d9d2888c3f17a7a1aa34542b137d96b5990b43fc46188cb31753a8
candidate median*2  49,765,849 ns
baseline median*2   13,013,980 ns
median ratio        3.824029928x
candidate p95       25,538,766 ns
baseline p95         7,492,535 ns
candidate CV gate   pass
baseline CV gate    fail
2.0x threshold      fail

Both observations are local-only and deliberately lack independently recorded clean-revision provenance. The pinned run additionally proves that the threshold failure is not explained by multi-CPU affinity alone. No claim token was admitted. Global encoder policy remains exactly 1.4.0; there is no policy-1.4 BranchMix retry hidden in any candidate sample.

Acceptance gates pass: the focused release measurement/mutation gate 1/1, candidate unit gates 2/2, candidate boundary integration 1/1, complete debug and release workspaces, strict refinement 8/8, governance 22/22, workspace Clippy with warnings denied, format, diff, and static capability audits. The pre-existing nom 1.2.4 future-incompatibility warning remains outside this decision.

Acceptance of the measurement boundary does not accept the measured candidate. The authoritative outcome is a rejected performance claim and an evidence-backed optimization signal.