Requirements become qualified capabilities through evidence.

Acceptance: Deadline and jitter budgets, WCET analysis, admitted workload and overload response

Observed boundary: Original carrier virtual scheduler; hosted JS event loops

Required evidence: Host RTOS and clock-qualified timing measurement; nanosecond guarantee not demonstrated

Acceptance: Independent address spaces, capability boundaries, MMU/IOMMU and restart containment

Observed boundary: Sandboxed document and authenticated server admission

Required evidence: Kernel, DMA and driver containment qualification

Acceptance: Fixed memory regions, CPU budgets and demonstrated starvation freedom

Observed boundary: Bounded checkpoint bytes and record quotas

Required evidence: Target-host partitions and measured interrupt/preemption budgets

Acceptance: Allocation-free critical execution including libraries, queues and error paths

Observed boundary: Current DOM/JavaScript implementation allocates dynamically

Required evidence: Separate critical host implementation and heap/GC instrumentation

Acceptance: Independent channels, bounded voter latency and common-mode fault analysis

Observed boundary: No three-channel physical actuation demonstrated

Required evidence: Three hardware channel interfaces, voter design and fault-injection records

Acceptance: Core affinity, interrupt ownership, cache interference and load budgets

Observed boundary: Virtual runtime processes are source-defined

Required evidence: Target cores, hardware scheduling and interference qualification

Acceptance: Grandmaster profile, PHY timestamping, asymmetry and holdover bounds

Observed boundary: Logical time retained in semantic continuations

Required evidence: Instrumented timestamp-capable nodes and network timing evidence

Acceptance: Root provisioning, measured/verified boot, binary admission and key rotation

Observed boundary: SHA-256 custody of package/checkpoint bytes

Required evidence: HSM/TPM identity and actual binary verification path; hashes are not signatures

Acceptance: Sequence accounting, bounded buffering, backpressure and explicit loss alarms

Observed boundary: No million-point zero-loss result asserted

Required evidence: Frozen workload, rates, resource limits and overload/fault measurement

Acceptance: Model provenance, warning lead time, false alarm/miss rates and fallback

Observed boundary: No physics model qualification asserted

Required evidence: Dataset, trained model, baseline and held-out field evaluation

Acceptance: Hazard-dependent transition guards, watchdogs, priorities and recovery criteria

Observed boundary: Failed custody/readback is rejected without displaying verified state

Required evidence: Actual safety state machine and hardware interlocks for each sector

Acceptance: Distinct principals bound to command digest, expiry, expected state and independent interlocks

Observed boundary: Personal-volume deletion has confirmation and a durable tombstone

Required evidence: Separate mission-command authority registry and irreversible actuator; personal-data deletion is a different scope

Acceptance: Versioned model, theorem/invariant, assumptions, tool output and implementation refinement

Observed boundary: Deterministic regression and concurrency/fault tests

Required evidence: Machine-checked proof / bounded model-check receipt not supplied by tests

Acceptance: Versioned transitions, complete guard conditions and invalid-transition rejection

Observed boundary: CAS revisions, same-event retry and terminal deletion state

Required evidence: Domain-specific mission transitions and sensor-interlock qualification

Acceptance: Signing identity, trusted clock, retention enforcement and external audit readback

Observed boundary: Digest-linked custody records; no WORM or signature claim

Required evidence: Immutable retention configuration, signer/key custody and independent verifier

Acceptance: ECC reporting, scrubbing, watchdog escalation and common-cause fault injection

Observed boundary: Checkpoint tampering rejected in software

Required evidence: Radiation/SEU test plan for declared components and environment