Rust driver trace comparison v1

Synchronous fixed-corpus harness · 5 September 2026 · not public transport

Result and executable boundary

Thirteen shared traces match the Python model and Rust scheduler harness at every recorded step. Expectations are generated by model/driver_vectors.py calling the existing model/driver.py; they are not recorded from Rust output. This is a comparison between separately written model and implementation paths, not review by an independent team or proof of full implementation refinement.

The Rust harness executes actual signature verification, the bounded verification queue, alternating commit lanes, the reserved-mode ledger, journal sync, and clean reopen. It reads the independently signed fixed fixture corpus. Its only successful acknowledgement path follows a successful return from the durable ledger.

Cases cover commit-before-ack and exact replay, queue expiry, commit lease expiry, old-epoch fencing, invalid signatures, per-source caps and rotation, signature budgets, ordinary commit-lane saturation, local evidence and pending deduplication, local routing after restart, lost response/replay, and output deadline closure. The trace snapshots compare queue/lane sizes, ledger claims/quarantine counts, pending-response and delivered-acknowledgement counts, credit balances, and epoch after each step. They do not compare response bytes or receipt identity fields.

Model projection and limitations

This is a deliberate subset of the broader driver simulation. Sessions 1–32 are pre-established. All offered timestamps are whole seconds, while credits use the model's 100-ms window rule; subsecond queue-age behavior is not compared. Virtual 0 ms maps to the corpus's timestamp 100; epoch 0 maps to corpus epoch 7. All fixture leases end at virtual 100,000 ms. The next epoch begins there.

A commit step selects one lane, revalidates, writes, and syncs synchronously. In the Python model the same step combines start-write and successful completion. There is no exposed in-flight interval, asynchronous syscall, injected IO error, handshake, partial-frame parser, or network in this comparison. The broader model's 13 targeted scenarios are a different set; this suite does not cover all of them.

Descriptor lookup is restricted to preloaded fixtures. Logical fixture identities map to actual signed claims; arbitrary descriptor encoding, mixed leases, issuer policies, and open-cost behavior are not covered here. Signature validity in the model is an explicit input; the Rust path verifies the actual bytes.

The harness is under examples/conformance/, outside the deployed node runtime. It is bounded to 96 trace steps, 128 pending verification jobs, two 16-entry commit lanes, 32 response slots, and 64 local/foreign accounting slots. These are logical bounds, not an allocator or process-RAM measurement. Synchronous disk operations can block indefinitely; the conformance runner's deadline is not syscall cancellation.

Small library additions

The queue can now discard a closed source's pending jobs, reclaiming its accounting and preserving the remaining sources' rotation. A new test fills all 128 slots, removes one source, admits a replacement, and checks the next source served.

Ledger::has_local_slot exposes read-only membership for routing already verified evidence. Membership is not signature validity, receipt usability, or permission. The harness checks it only after verification and still asks the ledger to validate again at commit. Default admission policy and journal formats are unchanged.

Reproduction and next gate

python3 model/driver_vectors.py
cargo build --locked --offline --features peer-recovery --example core_conformance
python3 conformance/run.py --suite conformance/driver-v1.json \
  --output docs/results/driver-rust-v1.json \
  target/debug/examples/core_conformance
cargo test --locked --offline --features peer-recovery --test admission_queue

The driver_trace adapter accepts a steps array. Operations are offer (source, fixture, optional corrupt signature), verify, commit, receive (source), tick (ms), restart, and rollover. The suite contains exact requests and expected snapshots. It is a local test interface, not a wire protocol.

Next: expose a controlled in-flight writer in the harness and compare timeout, uncertain-result, and recovery traces. Then exercise bounded framing and memory accounting with loopback sockets. The full model's 128,000 generated events have not been replayed through Rust. Public admission remains disabled.

Follow-up

docs/DRIVER_COMPLETION_V1.md adds eleven controlled worker-completion traces. They gate delivery after a real operation or skip the call; they do not pause an operating-system fsync. The synchronous suite and its historical results remain.