# 2.0 Dispatch And Performance Matrix
This document is the frozen Commit 34 selection policy. It distinguishes
automatic runtime selection, exact/static execution, and included candidate
implementations. A kernel existing in the source tree is not by itself an
admission claim.
## Automatic `std` Matrix
Thresholds are input bytes presented to the operation. Strict-decode thresholds
therefore count encoded bytes. `-` means there is deliberately no automatic
threshold.
| all | encode/decode | scalar | 0 | none | always admitted fallback |
| x86/x86_64 | encode | SSSE3/SSE4.1 | 12 | scalar | admitted |
| x86/x86_64 | encode | AVX2 | 24 | SSSE3/SSE4.1 | admitted |
| x86/x86_64 | encode | AVX-512 VBMI | 192 | AVX2 | admitted |
| x86/x86_64 | strict decode | SSSE3/SSE4.1 | 16 | scalar | admitted |
| x86/x86_64 | strict decode | AVX2 | 32 | SSSE3/SSE4.1 | admitted |
| x86/x86_64 | strict decode | AVX-512 VBMI | - | AVX2 | exact/static only |
| little-endian AArch64 | encode | NEON | 192 | scalar | admitted |
| little-endian AArch64 | strict decode | NEON | 256 | scalar | admitted |
| wasm32 SIMD artifact | encode | `simd128` | 12 | scalar artifact | admitted artifact |
| wasm32 SIMD artifact | strict decode | `simd128` | 16 | scalar artifact | admitted artifact |
| Linux SpacemiT X60 | encode | RVV 1.0 | 384 | scalar | exact-profile admitted; final integrated-source bundle required |
| Linux SpacemiT X60 | strict decode | RVV 1.0 | 1024 | scalar | exact-profile admitted; final integrated-source bundle required |
| other RISC-V | encode/decode | RVV 1.0 | - | scalar | not admitted |
| AArch64 Linux/Android | encode/decode | SVE | - | NEON/scalar | included, non-dispatchable |
| big-endian targets | encode/decode | vector candidate | - | scalar | no admitted vector backend |
Selection is operation-specific. A detected AVX-512 CPU can report AVX-512 as
the strongest candidate while ordinary strict decode selects AVX2. Quarantine,
an unavailable narrower feature, an unsupported alphabet, or a below-threshold
length walks the documented fallback chain. Unknown CPUs and targets select
scalar unless an admitted detector proves the complete feature bundle.
The automatic matrix applies only to ordinary Standard and URL-safe encode and
strict decode, including documented staged/validated forwarding surfaces.
Custom alphabets, secret/CT operations, and line or whitespace processing
remain scalar.
## Static `no_std` Matrix
Safe `no_std` builds do not probe CPU capabilities. Without complete compiler
target features, `StaticBackendToken::for_compiled_target()` returns `None` and
ordinary safe dispatch remains scalar.
| SSSE3/SSE4.1 | `+ssse3,+sse4.1` | complete CPU/OS feature proof when using `assume_supported` | direct encode/decode KAT, atomic generation, quarantine | token is thread-bound; x86 ABI preserves required state | AMD Ryzen 9 9950X3D Linux plus compile matrix |
| AVX2 | `+avx2` | complete CPU/OS feature proof when using `assume_supported` | direct encode/decode KAT, atomic generation, quarantine | token is thread-bound; AVX state and `vzeroupper` contract | AMD Ryzen 9 9950X3D Linux plus compile matrix |
| AVX-512 VBMI | `+avx512f,+avx512bw,+avx512vl,+avx512vbmi` | complete CPU/OS/XSTATE proof when using `assume_supported` | direct encode/decode KAT, atomic generation, quarantine | token is thread-bound; ZMM/opmask state and cleanup contract | AMD Ryzen 9 9950X3D Linux plus compile matrix; strict decode is exact/static only |
| little-endian AArch64 NEON | `+neon` | complete CPU/OS feature proof when using `assume_supported` | direct encode/decode KAT, atomic generation, quarantine | token is thread-bound; AAPCS64 vector-state contract | Apple Silicon macOS and Neoverse-N1 Linux execution; retained performance bundle still required |
| wasm `simd128` | `+simd128` | host must instantiate the matching artifact | direct encode/decode KAT where pointer-width atomics exist | host JIT/runtime remains outside guest attestation | Node/V8, Wasmtime, Chromium, Firefox, Safari smoke; exact-package benchmark only |
| RVV 1.0 | internal candidate cfg only | no public static token admission | candidate KAT/evidence only | safe `no_std` remains scalar; no deployment identity probe exists | dual-VLEN QEMU compile/execution only |
| AArch64 SVE | internal candidate cfg only | no public static token admission | candidate KAT/evidence only | native ABI, signal, per-thread VL, cleanup, and performance evidence missing | 128/256/512-bit QEMU only |
`assume_supported` is unsafe because a false deployment attestation can execute
an unsupported instruction during the mandatory KAT. Static tokens are bound
to one thread and one backend-health generation. Quarantine invalidates later
use; it cannot synchronously cancel a call that already borrowed a healthy
generation.
## Performance Gate
Automatic native rows use 15 samples per matrix cell. Admission requires both:
- the median candidate/fallback throughput ratio to meet the frozen threshold;
- a one-sided paired sign test with `p <= 0.05`.
The ordinary native minimum is 1.02. Automatic AVX-512 encode additionally
requires 1.05 relative to AVX2. Environment variables may make these gates
stricter but cannot lower them. Exact/static-only backends require complete,
finite observational rows but do not claim to outperform the automatic
fallback.
The retained x86 campaign is
[`performance-baselines/dispatch-commit-34-amd-9950x3d-linux`](../performance-baselines/dispatch-commit-34-amd-9950x3d-linux/).
It is bound to clean signed source commit
`32cd285be9ab90a80db59b68ae49f1077b79a6a3`. The campaign admitted the frozen
x86 encode tiers and SSSE3/SSE4.1 plus AVX2 strict decode. It rejected automatic
AVX-512 strict decode, which is why that row has no threshold.
NEON keeps its previously admitted conservative thresholds and retained
15-sample performance evidence from Apple Silicon macOS and server-class
AArch64 Linux. Wasm retains exact-package runtime measurements; those do not
generalize across JITs or browsers. RVV publishes the measured 384-byte encode
and 1024-byte encoded strict-decode crossovers only for the Linux SpacemiT X60
profile. SVE publishes no threshold because native evidence is missing.
Capture each NEON admission-host bundle from a clean checkout of the exact
frozen pre-seal source. Use the platform-specific retained destination:
```sh
# Apple Silicon macOS
scripts/capture-2.0-neon-admission.sh \
performance-baselines/dispatch-2.0-neon-apple-silicon
# Server-class AArch64 Linux
scripts/capture-2.0-neon-admission.sh \
performance-baselines/dispatch-2.0-neon-aarch64-linux
```
The script runs correctness before and after measurement, enforces the frozen
statistics, rechecks source immutability, and writes raw samples, allowlisted
CPU/OS metadata, and checksums. Hostnames, UUIDs, home paths, and unrelated
system-wide `sysctl` state are excluded from publishable evidence.
`scripts/validate-neon-admission-bundle.py` independently checks the exact
inventory, manifest schema, source ancestry, host class, metadata allowlist,
checksums, and performance policy. Ordinary per-commit CI treats a valid older
bundle as historical evidence. Candidate and release gates additionally require
runtime-source identity and therefore reject stale captures. Apple Silicon and
server Linux bundles must remain distinct and must name the same source commit.
## Evidence Gaps
- A second, preferably Intel, AVX-512 microarchitecture remains a 2.0.1
corroboration target before broadening any x86 crossover claim. It is not a
2.0.0 blocker because 2.0.0 retains exact-host wording.
- Wasm numbers remain runtime-local and are not a browser-wide guarantee.
- RVV needs the final post-integration X60 bundle retained against the exact
release source; no result generalizes to other RISC-V processors.
- SVE needs two real systems with different vector lengths and the corresponding
correctness, ABI, signal-state, cleanup, and benchmark evidence.
- Big-endian acceleration remains unavailable on stable Rust and has only
scalar QEMU portability evidence.