Module agreement 

2026-09-26: Do the records a PR adds agree with each other and with the head being certified?

Each record is bound to its commit by its signature. check adds two rules over the whole added set:

• Every record must stand at the head (Standing::Stands, from check::record_standing): the diff from the record’s commit to the head touches nothing its gate measures, or the record’s closure excuses what it touches. The rule is content, not ancestry, so records measured at different commits may be added together.
• Speed-class records (Sensitivity::Speed, read from the registry) from more than one signer are accepted only when every cross-signer pair is one box by hardware::equivalence::equivalent, judged from the records’ own hardware and hardware_state captures under the class’s kernels/<hw>/HARDWARE.toml limits. Correctness-class records may come from any number of signers.

The one-box rule for Speed rests on a measurement taken 2026-09-06 on one gate at one commit: dgx2 22.78 tok/s (sigma 0.063, n=10) against dgx3 23.44 (sigma 0.070, n=10), a gap ten times either box’s sigma.

Whether a signer is committed in .github/record-signers/ is checked by gate::signing, not here.

Owner: bench gate. Invariants:

• A benchmark id the registry does not know is reported as Disagreement::UnknownBenchmark, never given a class.
• check returns every disagreement it finds, not only the first.

Structs

AddedRecord

2026-09-26: One record as the agreement rule sees it.

Enums

Disagreement

2026-09-26: Why a set of added records does not hang together.

Functions

check

2026-09-26: Check that the records a PR adds agree with one another.

required_by_class

2026-09-26: Every required gate, split into (Speed, Correctness) by the class that decides its signer rule. A gate the registry does not know is in neither list.

sensitivity_of

2026-09-26: The class a gate’s records belong to, read from the registry and never from the record, so a record cannot choose its own class.

standing_at

2026-09-26: A record’s Standing at head, judged against the coverage entry of its benchmark_id. An id with no coverage entry is Standing::Unknown.