Struct VerificationReport 

pub struct VerificationReport {

    pub verified: bool,
    pub bitwise_parity: bool,
    pub verdict: Verdict,
    pub no_result_reason: Option<NoResultReason>,
    pub infrastructure_error: Option<InfrastructureError>,
    pub comparison: Option<ComparisonReport>,
    pub compared_log_messages: Option<ComparedLogMessages>,
    pub compared_outputs: Option<ComparedOutputs>,
    pub dbt_counted_branches: Option<DbtCountedBranchComparison>,
    pub runtime: Option<VerificationRuntime>,
    pub guest_exit_code: Option<i32>,
    pub guest_signal: Option<i32>,
    pub first_divergent_scheduler_turn: Option<u64>,
    pub first_divergent_virtual_nanoseconds: Option<u64>,
    pub first_divergent_record: Option<u64>,
    pub first_divergent_syscall: Option<u64>,
    pub first_divergent_left_message: Option<String>,
    pub first_divergent_right_message: Option<String>,
    pub exact_branch_counter: Option<BranchCounterVerdict>,
}

The complete machine-readable report written by --verify-json.

This type is shared by the Hermit producer, the manifest runner, the compatibility pressure test, and the scorecard. The serialized field order is retained because existing report bytes are hashed as evidence.

Fields

verified: bool

bitwise_parity: bool

verdict: Verdict

no_result_reason: Option<NoResultReason>

infrastructure_error: Option<InfrastructureError>

comparison: Option<ComparisonReport>

None when the producer reached no verdict. This is a DOCUMENTED producer state, not a malformed report: VerificationReport::no_result() in hermit-cli sets it, and its doc says “null when no verdict was reached”. Declaring it non-optional made a legitimate no-result deserialise as “unreadable report”, which reported an infrastructure fault where the truth was that nothing had been recorded.

compared_log_messages: Option<ComparedLogMessages>

compared_outputs: Option<ComparedOutputs>

Exact output/status evidence for both executions. Optional only so retained reports written before this field remain readable.

dbt_counted_branches: Option<DbtCountedBranchComparison>

runtime: Option<VerificationRuntime>

Runtime totals for the two compared executions when the producer could read both run summaries.

guest_exit_code: Option<i32>

The guest’s exit code when an exited status was available to the producer. None means either that guest_signal records a signal disposition, or that execution did not return a guest status at all; current producers must not leave this null for ExitStatus::Exited.

guest_signal: Option<i32>

The guest’s signal when a signaled status was available to the producer. When both disposition fields are null, the writer had no guest status.

first_divergent_scheduler_turn: Option<u64>

WHERE the divergence began, in scheduler-turn units. None when the logs matched, when no comparison ran, or when the report predates the field.

#[serde(default)] is deliberate here and is the OPPOSITE choice from ComparisonReport::record_envelope above. That field is an admission gate, so a missing value must never be supplied on the producer’s behalf. This one is a diagnostic position: absent means “not located”, which is exactly what None says. Requiring it would turn every retained pre-field report into an unreadable-report ERROR and misclassify old evidence as an infrastructure fault – the same trap documented on comparison just above.

first_divergent_virtual_nanoseconds: Option<u64>

WHERE the divergence began, in virtual-nanosecond units. Same tolerant-default rationale as the field above.

NOTE both of these are the position of the PRECEDING scheduler COMMIT, so when no COMMIT precedes the differing record they collapse to the origin and BOUND the divergence rather than locating it. The field below is the one that locates it.

first_divergent_record: Option<u64>

1-based index of the first differing compared record – the LOCATION of the divergence rather than a bound on it, and the only one of the three that is a true log prefix. It shares a unit with compared_log_messages, so record / compared is the fraction of the log that was deterministic.

null and 0 are not the same claim: null is “no divergence located”, while 0 would mean the very first record differed. Nothing writes 0 – the index is 1-based. Same tolerant-default rationale as its siblings.

first_divergent_syscall: Option<u64>

How many syscalls the guest had COMPLETED when the divergence appeared, from detcore’s own finish syscall #N counter.

NOT interchangeable with first_divergent_record: one counts guest work and the other counts compared log records, and they move at completely different rates. Measured on one real divergence: record 98, syscall 37. null also covers a genuine state – a run that diverged before any syscall completed.

first_divergent_left_message: Option<String>

First differing compared message from the left execution, with the separately recorded syscall number, scheduler turn, and committed time removed. Older reports omit it and remain readable.

first_divergent_right_message: Option<String>

Corresponding first differing compared message from the right execution.

exact_branch_counter: Option<BranchCounterVerdict>

Whether the retired-branch counter that this run’s virtual clock and preemption points came from was exact on the producing host: the same verdict hermit host-capabilities reports as exact_branch_counter (https://github.com/rrnewton/hermit/issues/3794). Present for a run on a backend that reads that counter (ptrace, e9patch, and record start); absent for another backend, and in a report written before this field.

Implementations

impl VerificationReport

pub fn no_result() -> Self

pub fn from_json_slice(bytes: &[u8]) -> Result<Self, String>

Parse the complete typed receipt. A top-level JSON object is not enough: every nested field used by admission must deserialize successfully.

pub fn from_json_value(value: Value) -> Result<Self, String>

pub fn from_current_json_slice(bytes: &[u8]) -> Result<Self, String>

Parse a report written by the current producer and require every field it promises to emit, preserving duplicate-field refusal from the original bytes. Parsing only a Value would silently collapse duplicate object keys.

pub fn from_current_json_value(value: Value) -> Result<Self, String>

Parse a report written by the current producer and require every field that producer promises to emit. Retained-report readers use Self::from_json_value instead so fields added after an old run remain honest absence rather than making the whole report unreadable.

pub fn from_retained_cell_json_slice(bytes: &[u8]) -> Result<Self, String>

Parse a retained cell receipt from before exact output evidence was added. Preserve that absence while retaining the other producer-field and duplicate-key requirements. This is not current producer admission and must not be used for either operand of backend parity.

pub fn require_canonical_comparison(&self) -> Result<(), String>

Prove that the invocation actually compared the canonical INFO evidence. This is separate from whether that comparison matched: a canonical divergence is a product result, while a stripped/output-only/empty-log comparison is incomplete evidence and therefore an infrastructure result.

pub fn require_exact_output_match(&self) -> Result<(), String>

Require complete, identical guest outputs for a current strict operand. Historical log-only receipts retain their separate admission path.

pub fn require_canonical_match(&self) -> Result<(), String>

Admit a green only when both the canonical comparison and the match claim agree. verified=true alone is intentionally insufficient: KVM’s output-only fallback can report it with zero compared INFO messages.

Trait Implementations

impl Clone for VerificationReport

fn clone(&self) -> VerificationReport

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VerificationReport

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for VerificationReport

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for VerificationReport

fn eq(&self, other: &VerificationReport) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for VerificationReport

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for VerificationReport