7.4 KiB
Why
The existing fixed-profile harness treats each 1,179-byte datagram as an encoded frame, so its reported frame rate, frame boundaries, bitrate, queue pressure, and processing evidence do not model the named 60/120 FPS profiles.
The v6 complete-frame fixture subsequently exposed a source-fidelity defect on ordinary Linux runners: it emitted every UDP shard in one tight loop, unlike pinned Apollo's bounded intra-frame rate and batch schedule. The affected v6 qualification evidence remains retained but is superseded for candidate-readiness purposes.
Private Linux run 125 then demonstrated a separate production-ingress defect after source pacing was corrected: 33 successful fixture writes missing from MediaIngress matched 33 measured kernel UDP drops while decrypt/FEC, queue, pacer, QUIC, and client counters remained downstream of the shortfall.
The consumed v8 Section 7 attempt at 55afea72 subsequently failed after accumulated host scheduling delays exposed the production pacer's discarded schedule debt beyond its 5 ms instantaneous catch-up allowance. The retained partial evidence remains failed and supersedes 55afea72 as a final executable candidate.
Private Linux run 127/job 481 at exact source 122080ab342d20585d9a45db0017337b9ece570a then failed TestQualificationLossAndSteppedThroughputBounds: the 25% capacity step reported the 11-second convergence sentinel and 5,207,475 bytes in the measured five-second window. The run produced no artifact and was not retried. Its retained log is /private/tmp/versevdi-gitea-run-127-job-481.log, SHA-256 2b368413d4b0e954c64ba6f6dcefb1e165166d773b6d8f84ee372bc2c92ff5f1; 122080ab is superseded as a final source candidate.
Private Linux run 128/job 482 was the single push-triggered attempt at exact source 22433e5c45c179e9d487b59e5d80f1dcf3b285ce. Linux make verify, the sustained gate, strict OpenSpec, deterministic artifact generation, upload, and the clean-checkout step passed. Artifact 28's binaries and SPDX matched the frozen hashes and source metadata. The retained log /private/tmp/versevdi-gitea-run-128-job-482.log has SHA-256 6f5852dce815ba87a55d61aae34cb2fce17a1a62c5ee50e18c0034259ad0a029. The workflow requested 30 retention days, but Gitea 1.27 floored the positive request delay and its API scheduled exactly 29 elapsed days. The run was not retried: it is passing Linux execution and artifact-byte evidence but retention-nonconforming, so it does not satisfy the private Linux artifact gate or authorize normative Section 7. The local 31-day request preserves the at-least-30-elapsed-day requirement; a separately authorized future run must prove expires_at - created_at >= 2,592,000 seconds.
At exact source c0e362c0285d267f8af4087d07943822311f60e1, the first Section 7 attempt created gateway-rc10-c0e362c and stopped at the sandbox loopback-bind boundary, leaving that mode-0750 directory empty. The separately authorized escalated attempt gateway-rc10-c0e362c-a2 then passed the v9 runtime gates and retained 16 files; its manifest has SHA-256 61ea55140dfe6b37332de03879ac33206dd5d47763d09fb0fc2f65bb1f8e02b4. Independent review denied normative acceptance because v9 retained only logical impairment rows and aggregate capacity summaries: it did not retain the raw public datagram timestamps/lengths or fairness transition offsets needed to recompute those summaries. Both attempts remain preserved without relabeling; a2 is runtime-passing but normative-raw-evidence-incomplete.
Private Linux run 129/job 483 and artifact 29 at c0e362c0285d267f8af4087d07943822311f60e1 passed execution, artifact-byte, and at-least-30-elapsed-day retention checks. That Linux result remains valid, while the later v9 a2 qualification remains runtime-passing but normative-raw-evidence-incomplete. Neither classification is relabeled.
Immutable v10 source ce3b3079837c5745f95a51c98eb6204363962ae7 passed its single private Linux push attempt, run 130/job 484, including make verify, the sustained gate, strict OpenSpec, deterministic build/upload, and the clean-checkout gate. Artifact 30 retained the unchanged amd64 and arm64 binaries plus a source-correct, unscanned, unsigned SPDX for exactly 2,592,000 API-recorded seconds. Two later elevated-execution preflights were denied before CreateProcess; neither created the target nor consumed a qualification attempt. The subsequent owner-approved direct command ran exactly once, exited zero, and wrote the 17-file v10 gateway-rc10-ce3b307 bundle with passed manifest SHA-256 53f1e24a3182887d496b745826af20c7b220a3a0cc2e1682baf1eb746f4c240d.
Independent review recomputed all three processing profiles, 11.25 GB of payload, all eight logical impairment files, the 15,060-row constrained public-wire artifact, and the 70,916-row fairness artifact from the retained v10 evidence. It reproduced ordered 25%/50% transitions, full-tail impairment convergence and maxima, stage-bounded fairness convergence and maxima, Jain index 0.9999999546920958, maximum share error 0.0003749275708101844, and every bound manifest identity/hash/grammar value without a material mismatch. This closes only deterministic fixture evidence: live Apollo, the native macOS client, the physical firewall and route, a real encoder, multi-host operation, Phase 3C-C, scanning, signing, deployment, and promotion remain outside this result.
What Changes
- Generate deterministic variable-size encoded frame units at the named frame rates and target bitrates, including bounded keyframes.
- Traverse native Apollo recovery, production queues, the production pacer, QUIC framing, and independent reassembly.
- Assert frame count/rate, bitrate, exact bytes and boundaries, clean loss attribution, latency, and resource bounds.
- Decouple native video socket draining from the single decrypt/FEC processor with a fixed provider-scoped receive pool and request the source-backed video receive-buffer size.
- Retain bounded valid per-flow pacing debt after a host stall and repay it at no more than 5% above nominal fair share.
- Measure capacity convergence and rolling caps from each raw public QUIC datagram's observed length and receive time while retaining completed logical-payload observations for integrity and traversal results.
- Persist the constrained public datagram observations and capacity transitions under one monotonic epoch, bind their hash/counts into the v10 manifest, and retain fairness transition offsets for independent recomputation. Impairment summaries use the full delivery tail after each transition; trusted caller input selects normative validation, and bounded readers reject oversized compressed, decompressed, and field data.
- Keep short smoke tests separate and leave all prior normative artifacts unchanged.
Capabilities
New Capabilities
None.
Modified Capabilities
gateway-qualification: Fixed-profile evidence measures complete encoded frame units rather than one datagram per frame.
Impact
The qualification harness and its canonical specification, plus the already-reviewed native Apollo video ingress in gateway/apollo_native.go and production fair pacer in gateway/telemetry.go. This v10 correction changes test-only retained evidence, not production behavior. Downstream complete-frame queues, audio/control ingress, codec/FEC formats, QUIC, dependencies, and public interfaces remain unchanged. No codec operation or normative rerun is included. Requirements: P3C-002, P3C-008, P3C-029, P3C-030, P3C-033, VER-009, VER-010, OPS-015.