Module policy 

2026-09-26: The hardware verdicts: may a benchmark start (precheck), and may the numbers of a finished run be believed (postcheck).

Owner: bench hardware. Invariants:

• No I/O; the only environment read is PolicyOptions::from_env.
• A Correctness run is never refused, and a Speed run is refused only while the kill switch is off.
• Validity::Valid only when all three thermal counters were read on both captures and none advanced.

Record first, gate second

The absolute-temperature ceilings warn by default and refuse only under METRALE_HW_TEMP_GATE=1: they are calibrations, and a ceiling that refuses a healthy box teaches operators to set the kill switch. The two checks that need no threshold refuse a Speed run by default: a thermal throttle reason asserted before the run, and more than MAX_FOREIGN_COMPUTE_APPS foreign GPU compute processes. Everything is recorded either way.

Sensitivity, not benchmark id

The policy keys on Sensitivity, which every benchmark declares on its crate::BenchmarkDescriptor. There is no list of benchmark ids here: the registry is the one source of which benchmarks exist.

Structs

PolicyOptions

2026-09-26: The two operator switches, read from the environment only in PolicyOptions::from_env, and the box class’s temperature ceilings.

Postcheck

Precheck

2026-09-26: A verdict plus every concern that fed it, gating or not.

TempCeilings

2026-09-26: The two absolute-temperature lines a pre-run capture is judged against.

Enums

Decision

2026-09-26: The pre-run decision.

Sensitivity

2026-09-26: Whether this benchmark’s number is a speed number.

Validity

2026-09-26: Whether the numbers a completed run produced may be believed.

Constants

KILL_SWITCH_ENV

2026-09-26: Env var that suppresses refusal. Read only by PolicyOptions::from_env.

MAX_FOREIGN_COMPUTE_APPS

2026-09-26: GPU compute processes, other than this one, that a Speed run tolerates: one, the server of the model under test. A second means something else is resident.

TEMP_GATE_ENV

2026-09-26: Env var that makes the absolute-temperature ceilings refuse.

Functions

postcheck

2026-09-26: May a finished run’s numbers be believed? Reads the delta, not the absolute state, and ignores _options.

precheck

2026-09-26: May this benchmark start?