ADR-0056: Sovereign Candidate Cost Attribution

Status: accepted; attribution boundary complete, proof-only successor selected

Date: 2026-08-02

Visibility: private NAUX architecture/governance record. This ADR is not public roadmap material.

Related: ADR-0041, ADR-0045, ADR-0049, ADR-0050, ADR-0051, ADR-0055

Extends: ADR-0055 by explaining its exact rejected policy-1.5 measurement before another encoder candidate is permitted

Preserves: the frozen Gate B workload and claim policy; all accepted correctness identities; encoder policy 1.4 as the sole globally selected policy; the non-authoritative status of every prospective transform

Context

ADR-0055 measured the exact ADR-0051 candidate through the matched standalone process boundary. The pinned release observation records a 3.824029928x candidate/hand-baseline median ratio, a candidate CV pass, a baseline CV failure, and a fixed 2.0x threshold failure. It therefore admits no performance claim and gives policy 1.5 no global authority.

The result proves that the candidate is slow, but does not by itself explain why. End-to-end elapsed time includes process creation, startup, protocol decoding, input copying, target execution, output encoding, and teardown. Static target size alone also cannot explain dynamic cost: the policy-1.5 candidate is 3,214 bytes, while the hand target is 158 bytes, but a byte that executes once and a byte that executes hundreds of millions of times are not equivalent.

ADR-0045 and ADR-0049 already provide a sovereign basis for attribution. The canonical target evaluator records exact logical event counts and the raw encoder records a complete byte partition. For the prospective policy-1.5 image, every atom additionally binds its physical span, semantic event, execution authority, template class, execution count, and weighted bytes. That evidence is deterministic, replayable, and does not instrument timed native execution.

The next optimization must not be selected from intuition, external tooling, or a post-hoc benchmark variation. NAUX first needs an independently sealed cost inventory and a matched process/body diagnostic. Neither is a hardware cycle proof or a performance claim.

Decision drivers

Use only exact accepted policy-1.4, policy-1.5, hand-baseline, workload, and measurement identities.
Attribute all candidate bytes and all weighted template bytes exactly once.
Retain class totals in canonical order and rank them deterministically.
Distinguish deterministic structural weight from measured elapsed time.
Estimate fixed process/startup cost without changing the frozen Gate B observation or reusing its claim type.
Keep raw timing samples, use checked integer arithmetic, and reject missing, reordered, zero, failed, or output-mismatched samples.
Do not require perf, objdump, LLVM, an SMT solver, or any third-party decoder. External tools may corroborate locally but never become normative evidence.
Select at most one successor optimization class and grant it proof-only design authority, not encoder or execution authority.

Considered options

1. Implement policy 1.6 directly from the 3.824x result

The timing result identifies a gap, not its cause. Rejected.

2. Make Linux `perf` and disassembly output normative

Hardware counters and third-party decoders are useful corroboration, but their availability, schemas, event definitions, and trust roots are outside NAUX. Making them normative violates production sovereignty. Rejected.

3. Select solely from weighted template bytes

The proxy is exact for target-plan events and emitted spans, but it is neither decoded instruction count nor hardware cycles. ADR-0049 reduced this proxy without producing a faster end-to-end candidate. Insufficient alone.

4. Combine a sealed structural inventory with a separate matched timing

diagnostic

This preserves sovereign deterministic attribution while requiring an independent runtime signal before choosing the next class. Accepted.

Decision

1. Sealed structural cost inventory

The inventory consumes only a replay-verified frozen Gate B weighted profile. It binds:

Gate B weighted-profile root
policy-1.4 target plan/code/semantic identity
policy-1.5 realization/capsule/target identity
hand-baseline target identity
frozen workload identity and element visits

It carries canonical class totals for both the selected policy-1.4 image and the exact policy-1.5 prospective image. Candidate totals are recomputed from the complete prospective atom partition; caller-supplied totals are never accepted. For every class it records site/atom count, static bytes, executions, and weighted bytes. All sums use checked arithmetic and must reconcile with the source profile’s complete totals.

The inventory also records exact control counts needed to interpret dominant costs, including tail transfers, tail argument values, tail argument words, branches, checked array reads, and element visits. Static-size ratios to the 158-byte hand target are exact integer numerator/denominator pairs rather than rounded claims.

A compact frozen ledger is permitted for ordinary verification only after one complete 2.526-billion-step profile replay has generated it and an independent acceptance gate has matched every field. The ledger seal is not a substitute for that acceptance replay.

2. Canonical ranking and selection rule

Classes rank by descending candidate weighted bytes, then canonical class tag. A successor class may be selected only when:

the class is complete and dominant in the sealed structural inventory;
its proposed transform names the exact bytes/state movement it removes;
the matched timing diagnostic shows that non-empty target work, rather than fixed process/startup work alone, explains a material part of the candidate/baseline gap; and
no accepted semantic, effect, Bounds, ABI, ownership, or fallback contract is weakened.

If those conditions do not identify one class, the decision remains InsufficientEvidence. Ties do not permit multiple implementations.

The joint decision freezes three deliberately separate integer comparisons:

candidate/baseline zero-work medians       within symmetric 5/4
candidate incremental/full median share   at least 3/4
candidate/baseline incremental medians    strictly above 2/1

Selection additionally requires a release build pinned to exactly one logical CPU. These thresholds choose a proof obligation; they do not replace Gate B’s CV or slowdown admission policy.

3. Matched fixed-cost/body diagnostic

The diagnostic is a new evidence domain. It uses the exact ADR-0054 candidate executable and exact admitted hand baseline with the shared fresh process runner. Each ordinal contains four invocations:

candidate, zero-work input
candidate, frozen full-work input
hand baseline, zero-work input
hand baseline, frozen full-work input

Order rotates deterministically by ordinal so no engine or workload is always first. Zero work is the canonical BranchMix input with an empty value array and zero repetitions; both engines must return exact +0.0. Full work is the unchanged ADR-0041 input and output. The diagnostic runs five warmup ordinals and 30 measured ordinals, retains every raw duration and output hash, and performs no retry, deletion, filtering, threshold, or claim admission.

For each engine and ordinal, checked full - zero is recorded only when full is not less than zero. A negative delta rejects the diagnostic rather than being clamped or discarded. Medians and p95 values use the accepted ADR-0041 integer statistic mechanics. The delta is explicitly an end-to-end incremental-work proxy: it still includes input-size-dependent protocol and copying costs and is not a target-only cycle measurement.

4. Capability separation

Structural inventory, timing diagnosis, and successor selection have distinct types and seals. None converts into:

an ADR-0041 or ADR-0055 performance claim;
source-bound target, native runner, process, standalone, or ELF authority;
global encoder policy selection; or
permission to change workload, statistics, CV, or slowdown thresholds.

Any successor candidate must repeat finite correctness, process isolation, standalone correspondence, and candidate-matched Gate B admission through new ADRs.

Consequences

NAUX gains its own replayable cost-accounting substrate instead of depending on an external profiler for architectural decisions.
The failed policy-1.5 experiment becomes reusable evidence rather than a discarded optimization attempt.
The next implementation may target a deeper representation change than peephole rewriting, but only after exact attribution.
Full profile regeneration remains deliberately expensive; the compact ledger keeps normal governance gates finite without pretending the replay never occurred.

Accepted evidence

The complete release profile regenerated all 2,526,207,757 canonical evaluation steps and produced compact inventory root:

004b3aa514ec558c99ed19526182a6356561026b4db2bcae6e7cb1439c59b338

Exact selected-policy/candidate totals are:

policy 1.4 static / weighted bytes      3,097 / 2,927,032,491
candidate 1.5 static / weighted bytes   3,214 / 2,574,710,635
candidate TailTransfer weighted bytes           1,459,623,437
candidate FusedCompare weighted bytes             427,823,394
candidate RegisterInstruction weighted bytes      328,022,560
tail transfers                                     118,263,305
tail argument values                             1,182,632,968
tail argument words                              1,309,284,945

The candidate’s TailTransfer class is the unique structural leader at about 56.69% of candidate weighted bytes. Policy 1.5 reduced total structural weight but left this dominant state-transfer burden intact.

The accepted pinned CPU0 release diagnostic is sealed by observation root e910825c54ce12cb0fbdba68968004b10b24ebb48ba1277ea69c3cbea479f302:

                                  candidate       hand baseline
zero-work median*2 ns             4,425,995          4,400,588
full-work median*2 ns            53,716,683         13,490,382
incremental median*2 ns          49,338,450          8,978,713
incremental p95 ns               26,206,353          5,185,115

Fixed process/startup cost is essentially symmetric, candidate incremental work accounts for more than 90% of its full median, and candidate incremental median is more than 5x the hand baseline. The joint decision passes all three frozen comparisons and selects only:

TailStateTransferElimination
decision root 800fd0f7937ed25a490716e0c391d1ccf8a3d181df87fb719cefb3cca2b16f67

This token authorizes the next proof design only. Encoder policy remains 1.4.0; policy 1.5 remains rejected and no performance claim is admitted.

Validation required before acceptance

Full release profile replay regenerates the inventory from the exact accepted Gate B profile and policy-1.5 prospective atom partition.
Baseline and candidate class totals cover their complete code and reconcile exact weighted totals with no gap, overlap, duplicate, or overflow.
Wrong profile/candidate/baseline/workload/control/class/rank/selection/seal fields fail even after local resealing.
Canonical ranking is independent of insertion order and rejects duplicate or missing classes.
Candidate and hand zero-work outputs are exact +0.0; full-work outputs equal the frozen Gate B result.
Exactly five warmup and 30 measured four-member ordinals execute under the canonical rotating schedule with no retries or sample deletion.
Any timeout, signal, abnormal status, stderr, inherited pipe, malformed output, zero duration, negative delta, reordering, or cleanup failure rejects the entire timing diagnostic.
Statistics and deltas replay from all raw samples with checked integer arithmetic.
Static inventory and timed diagnostic jointly select at most one proof-only successor class, or explicitly record insufficient evidence.
Static authority audit finds no consumer in ordinary claim, executable, or global encoder-selection paths; encoder policy remains 1.4.0.

Acceptance execution

All required gates passed before this ADR moved to accepted:

the complete release cost profile replayed all 2,526,207,757 canonical evaluation steps and reproduced the inventory root above;
the pinned CPU0 release diagnostic completed its five warmup plus 30 measured four-member ordinals and reproduced the observation and decision roots above;
cargo test --workspace --all-features passed, including 365 core unit tests with the six intentionally ignored heavyweight replays;
cargo test --release --workspace --all-features passed;
cargo clippy --workspace --all-targets --all-features -- -D warnings, cargo fmt --all -- --check, and git diff --check passed;
all 22 governance script tests and all eight strict refinement closed-loop tests passed;
the static authority audit found no executable or claim-path consumer of the proof-only successor decision.