Bounded Phase 1 conformance

The selected deterministic profile exercises the real standalone Linux node, operator CLI, durable catalogs and Wasmtime guests. It produces a versioned report and raw diagnostics. The completed Phase 1 gate combines this profile with separate scale, soak and comparison evidence. Passing this bounded profile alone is not a new completion decision.

Run and inspect

From a checkout with the pinned toolchain:

tools/validate_contracts.sh

The contracts gate builds the required echo, generic and capabilities fixtures, runs their existing owner suites, builds latent and latentd, then runs the bounded profile. With those fixtures and binaries already built:

python3 tools/run_phase1_conformance.py

Each run creates a fresh target/phase1-conformance/run-* directory. Use --output PATH for an explicitly new or empty directory and --target-root PATH for a different Cargo target directory. Missing fixtures, failed compilation, failed child assertions, absent reports and exceeded watchdogs are failures. No case is silently skipped because its required toolchain is unavailable.

conformance.json uses latent.phase1.conformance.v1. The validator checks the fixed case manifest, required case verdicts, work totals, process identities, cleanup, bounded artifact paths and hashes. The runner also checks reported input identities against the binaries, fixtures and Cargo lockfile actually used. Source commit/tree and dirty state are recorded. config_sha256 identifies canonical JSON of the sanitized public configuration; no credential-derived config hash is retained. A dirty local run is not evidence for an unmodified commit.

CI retains reports and diagnostics for 14 days in phase-1-bounded-conformance-<commit>, including failures. A failure before the profile starts may have only the contracts job log. No performance baseline is generated by this command.

Work limits and ownership

Resource	Profile bound
Attempted Invoke operations	64 aggregate; rejected and malformed attempts also count
CLI/direct-adapter/RPC commands	256 aggregate; process allocation 192, adapter allocation 64
Driver Invoke allocations	Process 36, adapter 28; no automatic invocation retries
Standalone compositions	One adapter composition, then one CLI-owned node; sequential
CLI payloads	Small fixtures, at most 4 KiB per input
Driver log / report	4 MiB each; product child pipes have separate smaller bounds
Execution watchdog	120 seconds after test compilation; adapter 50 seconds, process 65 seconds
Test compilation	Separate 600-second bound per target

The cap covers this selected profile. Existing workspace and component owner suites run separately; their aggregate execution count is not represented as 64.

latent-testkit::process::OwnedProcess retains each child and capped asynchronous pipe readers. Explicit wait/termination reaps the child and joins readers. Drop requests termination and aborts readers as a fallback; dropping an owner is not a successful cleanup receipt. The outer Linux runner also bounds the disposable driver process group so a failed test cannot leave its node running indefinitely.

Child resource observations bind the retained PID to its kernel start-time identity before and after capture. They read that child's /proc entries and intersect socket inodes owned by its descriptors with its network namespace's TCP tables. Namespace-wide sockets and the test runner's resources are not attributed to the node. All task child lists are bounded; missing data, unstable identity or exhausted probe bounds fail the selected profile.

Samples cover empty readiness, a small dormant catalog before guest preparation, warmup and idle state after mixed outcomes. OS and inventory reads occupy an observation window; they are not an atomic kernel/runtime snapshot. Raw RSS is recorded without interpreting a short run as a reclamation plateau. No OS timer registration counter is invented.

Final cleanup uses the actual product ShutdownReport, zero transient owner counters, telemetry flush, epoch-helper join, successful process exit and reader joins. Conservatively quarantined cells are recorded separately; a quarantine is not a live activation or leaked store.

The reusable BorrowedBackendHarness counts calls through a supplied real activation manager and exposes its supplied execution backend. InvocationConformanceSuite retains at most eight small typed outcome cases; ScopedNodeHarness delegates start/status/cancel to the actual lifecycle owner under one authenticated fixture principal. ObservedInvariantProbe reads the actual inventory reporter and bounded telemetry sink. Its legacy idle-scaling method requires a supplied measured latency source and otherwise returns an explicit error, rather than fabricating a p99 value.

Evidence coverage

The fixed cases cover small dormant catalogs, fresh guest stores, success/domain error/trap distinctions, deadline, explicit cancellation, malformed input, positive fuel exhaustion, memory/log limits, current activation capabilities, tenant-scoped observations, healthy recovery and owned shutdown. Repeated store and context calls identify the actual reused pool cell. Relative wall-time cases age the node and a persisted deployment ceiling beyond their duration, then check fresh effective deadlines and an earlier caller deadline.

A policy-update case holds an activation across a revision change. The queue case holds both cells, queues two activations from one tenant and one from another, then releases capacity in controlled steps. The second tenant must finish while the first tenant's remaining waiter and the other holder still run. FIFO would leave that second tenant blocked; natural expiry cannot satisfy the running-owner and accepted-cancellation checks. Full-queue rejection and final accounting/cleanup are checked separately in the same bounded case.

Eight outcome pairs compare a listener-independent invocation adapter with actual loopback RPC through the same production node manager/backend: echo success, declared error, malformed input, expired absolute deadline, zero memory, zero fuel, a missing route and a foreign tenant. Three additional pairs exercise capability snapshots, live budget changes and clocks. The single-cell adapter composition verifies physical cell reuse across these calls. Typed results, receipt pins, deterministic consumption fields and each call's retained terminal status are checked.

Context comparisons check principal, lineage, allowed metadata, filtered claims and baggage, fresh trace identity and effective grants. Clock values and per-call identities are validated against their own invariants instead of requiring equal timestamps or identities across distinct calls. Actual guest logs and completion spans are correlated to their activation, root, tenant, service, release and trace. Echo and capabilities use the same service name in different tenant namespaces, so matching that name alone cannot satisfy the telemetry assertions. This covers the selected Phase 1 inline-adapter/network boundary; later execution-host backends and stateful semantics remain outside this profile.

Existing owning suites remain necessary: the scheduler tests tenant fairness and bounded queues; activation lifecycle tests pinning, races and terminal retention; wire tests ingress identity, deadlines and management boundaries; Wasmtime tests canonical values, capabilities and interruption; standalone tests durable restart and running/queued shutdown. The CLI workflows include publication, pagination, source-file removal before restart, cancellation and interrupted response ambiguity. Their passing assertions do not substitute for unmeasured scale or calibrated resource evidence.

Selected-profile boundary and collective completion

Every report retains phase1_completion: incomplete, even when deterministic_status: passed. The following required heavy evidence is not_run within this report with reason outside-bounded-profile. Separate scale, soak and benchmark collectors collect it:

• dormant registrations at 100, 1,000, 10,000 and 100,000 releases/deployments;
• a mixed workload soak and matched RSS reclamation baseline;
• a calibrated initial Phase 1 benchmark baseline; and
• comparable Phase 0 performance deltas for the changed composition.

The Phase 1 completion report combines this selected profile with retained full measurements and controlled historical/current comparison evidence. The finite fairness cycle and selected capability comparisons do not establish arbitrary-duration fairness, leak freedom or performance guarantees. The checked-in manifest and report schema are test definitions, not measured benchmark results. The retained August 30 Phase 0 evidence and authorization keep their original scope and are not relabeled as Phase 1 measurements.