Struct PrecisionGuarantee 

pub struct PrecisionGuarantee {
    pub bit_stable_on_same_hardware: bool,
    pub max_ulp: Option<u32>,
    pub max_relative: Option<f64>,
    pub max_absolute: Option<f64>,
    pub notes: &'static str,
}

What this kernel guarantees about its numerical behavior.

Replaces the binary-flag OracleGrade concept that pre-architecture drafts used; per architecture v1.0 every kernel registration carries a structured precision statement so the optimizer can reason about tolerance budgets and pick comparators for calibration.

bit_stable_on_same_hardware is the strongest property. The always-built backend (fuel-cpu-backend by convention) commits to providing at least one bit_stable_on_same_hardware: true kernel per primitive op as the architecture v1.0 coverage commitment; step 7 enforces this via a CI lint.

The Optional fields encode the bound’s flavor (ULP / relative / absolute). Multiple may be present; the optimizer takes the intersection (a budget is admissible only if every populated bound satisfies it). Absent bounds mean “this kernel makes no claim about that flavor.”

Fields

bit_stable_on_same_hardware: bool

True iff this kernel produces bit-identical output for bit-identical inputs on the same hardware (no nondeterminism from kernel scheduling, atomic ordering, etc.).

max_ulp: Option<u32>

Maximum unit-in-last-place error vs the IEEE-754 correctly- rounded result. Tighter than max_relative for low-magnitude values; many vendor math libraries quote ULPs.

max_relative: Option<f64>

Maximum relative error: |out - ref| / max(|ref|, eps).

max_absolute: Option<f64>

Maximum absolute error: |out - ref|.

notes: &'static str

Free-text qualifier — for audited claims, this carries the audit reason (vendor citation, scheduler-dependence note, implementation hint). For the UNAUDITED sentinel, this is a fixed placeholder string the coverage lint matches against to distinguish unaudited placeholders from audited claims that happen to have no static bound. If you change UNAUDITED.notes, the lint’s detector picks up the new value automatically — it reads PrecisionGuarantee::UNAUDITED.notes at test time, not a hardcoded string.

Implementations

impl PrecisionGuarantee

pub const REFERENCE: PrecisionGuarantee

“Reference” guarantee: bit-stable on same hardware, no error claim above that. Used by reference-grade CPU kernels that commit to deterministic IEEE-754 evaluation.

pub const PRIMITIVE_DETERMINISTIC_CPU: PrecisionGuarantee

Phase 7.6 step 7b: shared precision guarantee for the always-built CPU backend’s primitive kernels — elementwise unary/binary, reductions, matmul, casts, comparisons, indexing, scalar ops, transcendentals (Exp/Log/Sin/Cos/Tanh/Sigmoid/ Gelu/Silu), etc. All claim:

• bit_stable_on_same_hardware: true (deterministic iteration order; no atomic FP adds; sequential nested loops)
• F32 accumulator for BF16/F16 inputs, native F32 / F64 / U32 for matching dtypes
• No specific ULP / relative / absolute bound claimed at this layer — the empirical calibration framework in step 8 populates per-op-per-shape bounds via reference comparisons

This is the default value bulk-applied by crate::kernel::KernelBindingTable::fill_unset_cpu_precision at the end of register_cpu_kernels. Sites that need a different claim must call crate::kernel::KernelBindingTable::register_with_precision explicitly with the weaker guarantee — those don’t get bulk-overwritten because the fill only touches UNAUDITED entries.

pub const UNAUDITED: PrecisionGuarantee

Default placeholder for kernels whose precision hasn’t been audited yet. Identified by the coverage lint via notes- equality against PrecisionGuarantee::UNAUDITED.notes — the only way a registration ends up with this specific notes string is by using the literal UNAUDITED const (the default in unannotated register(...) / register_with_caps(...) calls).

For kernels audited and concluded “no static bound applies” (e.g. Vulkan subgroup reductions where FADD order is scheduler-determined per dispatch), use none instead. It returns a structurally-similar PrecisionGuarantee but with the audit reason in notes, captured at the registration site. The lint accepts any notes value other than UNAUDITED’s specific text.

pub const fn none(reason: &'static str) -> PrecisionGuarantee

Constructor for the “audited, no static guarantee could be established” conclusion. Used by Vulkan subgroup reductions (where FADD order is scheduler-determined per dispatch) and similar kernels whose numerical character can’t be summarized by static ULP / relative / absolute bounds.

The reason is captured in notes, so the audit reasoning lives at the registration site — visible in code review, not buried in a separate lint allowlist file. Any reason other than UNAUDITED.notes makes the resulting value pass the coverage lint.

Distinguished from UNAUDITED by notes content alone (the value-field shape is identical). The lint uses precision.notes == PrecisionGuarantee::UNAUDITED.notes as the unaudited detector — robust to UNAUDITED’s notes text drifting because it reads from the const itself.

pub fn makes_no_static_claim(&self) -> bool

Does this guarantee assert nothing machine-checkable — no bit-stability, no ULP / relative / absolute bound?

True for BOTH UNAUDITED and none: they are field-identical, because they make the same (empty) set of claims. What separates them is provenance, not claim content — see Self::is_audited_no_bound.

pub fn is_audited_no_bound(&self) -> bool

Is this an audited conclusion that no static bound applies (none(reason)) rather than the never-audited placeholder (UNAUDITED)?

Why this is a method and not an open-coded check (GAP-095)

These two states are field-identical apart from notes, so any consumer that must tell them apart is forced to key on a string. Two consumers previously invented their own predicate and disagreed: the bit-stable coverage lint compared notes against UNAUDITED.notes, while KernelBindingTable::fill_unset_cpu_precision looked only at the four value fields — and therefore silently rewrote an audited “no static bound applies” conclusion into a bit_stable_on_same_hardware: true claim the audit had declined to make.

One definition, so the next consumer inherits the distinction instead of re-deriving it. This is a seam, not a cure: a &'static str remains the load-bearing discriminator, and only making the two states structurally distinct would make conflation unrepresentable. That change is priced at ~64 PrecisionGuarantee literals across three crates and is tracked separately; when it lands, this method’s body changes and its callers do not.

Trait Implementations

impl Clone for PrecisionGuarantee

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for PrecisionGuarantee

impl Debug for PrecisionGuarantee

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.