Stability contract
Five explicit states, safe holds, retry safety, and a signed record around every maintained run.
UNLOCKED means no ordinary acquisition has been consumed. IDENTIFYING means the local writable response or the confirmation window is still being established. CONVERGED means the declared tolerance held for the complete confirmation window. DEGRADED means the contract is not confirmed while correction or a safe hold remains active. DECLINED is terminal for that session.
Every client 0.5.0 start and step carries an idempotency identifier. A transport retry replays the original response and advances state once, including concurrent duplicate delivery. Reusing an identifier with a different payload is rejected.
The layer keeps the last configuration observed inside tolerance. An in-tolerance acquisition is held while confirmation completes. A stale acquisition is held without a controller update. Repeated misses of a caller-declared acquisition deadline decline the session and return the safest known configuration.
Conditions expose stable codes, summaries, aggregate health counts, remedies, and evidence tiers. They do not expose private controller constants or per-channel threshold flags that could be used to reconstruct them.
opt = SWCOptimizer(key, n=len(x0), mode="regulation", target=target)
x = opt.start(x0)
for _ in range(rounds):
x = opt.step(measure(x), target=target)
proof = opt.end()Controls and observables may differ
n is the number of observed responses. Set n_controls and assign when several writable controls serve each observable. Every control maps to exactly one observable, and every observable must be served. The 18-control, 6-observable assignment used in the manuscript is accepted directly.
Configuration bounds require explicit units. Shared and per-control bounds are supported. Bounds live in writable-configuration space, not response space.
Attestation
end() returns an Ed25519-signed record by default. It contains the session fingerprint, key fingerprint, declared geometry, tolerance, confirmation window, state transitions, scalar RMS trajectory, conditions, active family member, resource class, and runtime, contract, registry, build, and machine identifiers.
The record excludes the raw key, session token, measurement vectors, target vector, and configuration vectors. Verify it through the public verification endpoint or with the published Ed25519 public key from /api/runtime/status.
The record attests what the deployed layer observed and enforced. It does not convert deployment behavior into a manuscript experiment or guarantee an untested hardware instance.
Run preflight, inspect the evidence scope, then compare the active default and your incumbent under one measured budget.