1# Goq hardware proof matrix23This file is the normative contract for unqualified hardware-proof claims.4One successful machine is useful reference-host evidence, but it does not prove5a hardware class or transfer automatically to a later commit.67## Required rows89Both rows must pass with the same exact source commit and candidate artifact10set before Goq may use `matrix-proven` or an unqualified `hardware-proven`11claim. Hardware and vendor identifiers are evidence, not admission rules;12render-node and encoder selection remain capability-based.1314| Row ID | Required class | Status | Evidence report |15| --- | --- | --- | --- |16| native-1280x800-handheld | Upstream SteamOS Gamescope handheld with a native 1280x800 panel and integrated GPU | pending | pending |17| physically-headless-desktop-dgpu | Physically headless Gamescope desktop with a discrete GPU on SteamOS or a SteamOS-inspired distribution | pending | pending |1819The handheld row prevents Bazzite-specific Gamescope behavior from standing in20for upstream SteamOS. The desktop row may use SteamOS or a SteamOS-inspired21distribution such as Bazzite or CachyOS. A display manager, render-node number,22encoder factory name, driver name, or GPU vendor is not part of the product23contract.2425The committed GPD Pocket 4/Bazzite run at26[`7920c5d21434`](7920c5d21434/REPORT.md) is reference-host evidence only. Its27panel is natively 2560x1600, so its 1280x800 encoded leg does not satisfy the28native-1280x800 handheld row. It is not a discrete-GPU or physically headless29desktop and cannot satisfy that row either.3031## Claim levels3233- `reference-host proven` means one named host passed one named, immutable34 commit and evidence run. Public text must name that host and commit or link35 its report.36- `matrix-proven` means both required rows passed the same exact development37 candidate commit and artifact set.38- `release-matrix-proven` means both required rows passed the same immutable,39 signed Sigil and Portal release candidates under the public-alpha contract.4041A later commit does not inherit an earlier proof. Until both required rows42pass, public claims must remain qualified as reference-host evidence and must43not say `hardware-proven` without qualification.4445## Evidence contract4647Each passing row must link a distinct committed report at48`docs/hardware-uat/<12-char-commit>/<row-id>/REPORT.md`. Both reports must49reference the same50`docs/hardware-uat/<12-char-commit>/candidate-artifacts.env`; its SHA-256 is51the `Candidate artifact set SHA256`. The manifest uses the exact52`goq-hardware-matrix-artifacts-v1` schema and binds the full commit, whether the53candidate is `development` or `release`, and distinct safe Sigil and Portal54asset names plus their nonzero SHA-256 digests. The repository gate recomputes55the manifest digest instead of trusting a report-provided value.5657Each report must bind exactly one matrix row, exact source commit, numeric58workflow run, candidate-manifest path and digest, and adjacent `EVIDENCE.env`.59The evidence file uses the exact `goq-hardware-matrix-evidence-v1` schema.60Unknown, missing, empty, duplicated, or unterminated fields fail the gate. Its61structured fields bind:6263- host model, integrated/discrete topology, connector state, native resolution64 and refresh rate; the handheld row requires upstream SteamOS, an integrated65 GPU, and a connected native 1280x800 panel, while the desktop row requires a66 discrete GPU and a physically headless SteamOS or SteamOS-inspired host;67- OS, kernel, Gamescope, Mesa, GStreamer, and encoder plugin versions;68- the capability-discovered render node and encoder factory, without assuming69 `/dev/dri/renderD128`, `amdgpu`, or `vah264enc`;70- passing fixed and native capture outcomes, zero post-encode drops, measured71 cadence, and at least 55 fps for the fixed 1280x800 leg;72- a preferred-Iroh/MoQ control-v2 generation with three simultaneous viewers,73 one shared video/audio producer and adaptive actuator, monotonic survivor74 progress, at most one slot-0 holder, measured focus handoff, slow-viewer75 isolation, same-peer replacement, live revocation, reconnect, bounded76 resource percentiles, and final-viewer cleanup;77- a separate legacy-exclusive session with explicit second-client rejection;78- restoration of the installed service, configuration, identity, and release79 activation after the run.8081The two reports must name the same exact commit and `Candidate artifact set82SHA256`. Unsigned development evidence can establish `matrix-proven`, but83never `release-matrix-proven`; the gate rejects that public claim unless both84reports use one release candidate manifest.8586Committed evidence must retain the existing redaction boundary: no endpoint or87peer IDs, invitations, identities, secrets, private addresses, or unsanitized88raw logs. The gate proves that the committed evidence is complete, internally89consistent, commit-reachable, and bound to explicit candidate digests. Human90review still confirms that the sanitized values came from the named workflow91and machines; the repository must not fabricate replacement evidence merely to92make the gate pass.