Skip to content

STUDIO Vertical

scpn_mif_core.studio is the optional SCPN STUDIO vertical: it makes MIF a federated studio on the shared scpn-studio-platform SDK, so the SCPN Studio Hub can enumerate MIF's verbs and load its evidence at runtime. It is an opt-in extra, installed with pip install scpn-mif-core[studio], and is kept out of the lean core — the core and its hand-rolled forward-compat evidence layer (evidence emitter, capability manifest) carry no SDK dependency.

Because the SDK is an optional dependency, the per-symbol reference lives in the module docstrings (read them in source, or on the repository), not in the SDK-free documentation build. This page is the navigable overview of the vertical's surface.

Surface

scpn_mif_core.studio consumes the SDK and exposes four parts:

  • verbs — the studio identity (STUDIO_ID = "scpn-mif-core") and the four MIF verbs (evaluate, prove, cosimulate, benchmark), each declared with its safety tier, side-effect class, timing, and the evidence schema it produces.
  • evidence — mappers from MIF results onto SDK EvidenceBundle records:
  • a merge-trigger decision → a claim-boundary admission (a reduced-order decision renders bounded-model, never reference-validated — see the honesty rule below);
  • an MIF-010 formal proof → a FormalCertificate whose subject_digest binds it to the exact RTL, so the Hub voids the proof on drift;
  • a local cosimulation → a bit-exact ParityCheck on the explicit simulator substrate (never hardware-validated);
  • a benchmark → its recompute provenance.
  • manifest — build_manifest(), which authors the SDK CapabilityManifest (verbs, evidence schemas, the >=0.11.2,<0.12 platform-SDK range, the UI panel module).
  • federation — build_federation_document(), which wraps the schema-A manifest and the descriptive architecture-map.v2 extension into the ratified two-block envelope the Hub ingests (see Federation).
  • evidence_seal — seal_mif_evidence(), WS-1 sealing of the four evidence bundles into verifiable honesty envelopes. All MIF evidence is recompute-verifiable (the decision, proof, cosim, and benchmark all replay from committed inputs), so sealing is recompute-mode only and fails closed on an attestation-bearing bundle — MIF has no provider-attestation lane and will not misgrade one. Exactness is per class: deterministic surfaces seal bit-exact; a benchmark seals with a tolerance statement that the procedure reproduces while wall-clock numbers are never claimed equal. The production signer is the platform hybrid Ed25519+ML-DSA-65; key custody and the signed-keyring deployment are hub-side, CEO-gated concerns.
  • __init__ — fail-closed re-exports; importing the vertical without the SDK installed raises a clear error rather than degrading silently.

Honesty rule

The vertical mirrors the platform claim-boundary contract exactly: a claim renders as validated only when it is reference-validated AND admitted. A reduced-order merge-trigger decision is admitted (it may fire) but stays bounded-model, so the Hub never presents a reduced-order decision as facility-grade validated. The TypeScript panel (studio-web/) enforces the same rule on the rendering side.

Platform contract era v2 also requires verified-at-source freshness on every admitted reference-validated claim. Mappers therefore default stale inputs to bounded-model; only a caller that actually reran the proof/cosimulation in the current session may pass verified-at-source and receive the validated boundary.

Cosimulation validation is scoped to the reference named in the parity record: Python golden versus local Verilator RTL. The product feed and panel render that scope as cosim:local-verilator alongside hil:hardware-gated. A green bit-true result therefore cannot be mistaken for FPGA waveform equivalence, HIL validation, post-route timing closure, or coil-driver/chamber-path safety.

Float-free formal claim

docs/_generated/studio_formal_proof_claim.json is the keeper hand-off for the mif_trigger_fabric_safety proof. Generate it only after python tools/run_formal.py --suite safety passes, then run:

PYTHONPATH=src python tools/emit_studio_formal_claim.py \
  --checker-version 'Yosys <version>; Z3 <version>'
PYTHONPATH=src python tools/emit_studio_formal_claim.py --check

scpn_mif_core.sealed_claim rejects JSON floats, unsafe integers, path traversal, failed proof status, and dependency drift. The committed claim cites the proof script, the exact RTL subject, the formal manifest, and the observed proof-status digest.

Contract

The v1 schema-B evidence contract and the feature-boundary rules are recorded in the architecture decisions — see ADR 0010 for the merge-window feature boundary and ADR 0001 for the ownership boundary the evidence stays within.

Federation

The Hub consumes docs/_generated/studio_manifest.json, the ratified two-block envelope build_federation_document() emits (regenerated by tools/emit_studio_manifest.py, drift-gated by its --check):

  • schema_a — the gated CapabilityManifest (verbs, evidence schemas, content digest). The Hub's split_manifest_envelope hard-requires this top-level key; it is the pass/fail federation contract.
  • architecture_map — the descriptive architecture-map.v2 extension the Hub ingests tolerantly for the Tier-A architecture view: the decision pipeline, the capability inventory, the fastest-first backend chain, the interface surface (including the UI panel), the cross-boundary wire formats, the per-verb substrates, the cross-repository edges, and the machine-readable evidence badges, and the honest scope boundaries. Every field mirrors the system map and bench/dispatch.toml; a malformed map degrades the view, never blocks federation.

The browser side is studio-web/, a Vite + Module Federation 2.x remote (federation name scpn_mif_core, exposing ./MifStudioPanel). The SCPN Studio Hub loads it at runtime and renders MIF's verbs and honesty-graded claims; the panel mirrors the Python honesty rule and falls back, fail-closed, to a bundled honesty-graded sample when the live feed is unreachable or violates the complete nested runtime contract. The panel also renders additive sealed_streaming_decisions summaries: decision outcome, sample index, safety slack, bounded claim/admission, envelope digest, and key id. These fields identify the signed unit but do not adjudicate it. The MIF feed has no seal-verdict field; the composing Hub passes its trusted-keyring result through the separate hubSealStatuses panel prop. Without that result a decision renders Seal not checked — Hub trust root unavailable, never verified. This keeps signature verification, key custody, and signed-keyring deployment entirely on the Hub side. The browser feed declares studio.mif-feed.v1 and the same scpn-studio-platform>=0.11.2,<0.12 generation as the Python manifest; see the Studio web release notes in studio-web/RELEASE_NOTES.md. A contract smoke runs every committed feed claim through the installed SDK consumer so schema and honesty enum drift cannot pass the release gate silently.

The remote's source API reference is generated with strict TypeDoc from MifStudioPanel.tsx, domain.ts, and feed.ts via pnpm docs:api. Required export and property comments, links, and rendering are checked by required CI and local preflight; generated HTML under studio-web/docs/api/ is ephemeral.