Power, latency and thermal behaviour under sustained load
An instrument-agnostic, device-agnostic harness. It integrates energy over the timestamps actually achieved, publishes its uncertainty, and refuses to hand over a figure that was never measured.
Figures for the six governance repositories taken on 21 August 2026, those for Cartocortex on 17 October 2026, by running the test suites. None is copied from the README files.
The published figure differs from the deployment's
Published edge-AI figures are burst figures. A model is loaded, an inference is timed, a wattage is quoted, and all of it happens in the first thirty seconds while the board is still cold. Deployments run warm.
Under continuous inference a passively cooled processor reaches its thermal limit, the governor pulls the clock back, and the throughput that matters, the one in minute four, is a number nobody published. That is the number this harness measures.
A figure that was not measured never leaves without saying so
"Provenance is derived from the instrument, never asserted by the caller."
The export refuses a synthetic report unless asked in as many words, and the phrase "synthetic, not measured" then travels with that figure for as long as it lives. Energy is integrated over the timestamps actually achieved rather than a mean multiplied by wall-clock time, because a mean multiplied by wall-clock time is wrong the moment the sampler stutters. Idle draw is subtracted, without which two devices are not comparable.
$ mh run --device uno-q --instrument synthetic --out ./run
device : uno-q
instrument : synthetic (synthetic)
operations : 18001
idle : 0.601 W
load : 2.400 W mean, 2.425 W peak
energy/op : 35.979 mJ above idle (± 0.000 mJ)
latency : p50 20.0 ms, p95 20.0 ms, p99 20.0 ms
sustained : held, 50.0 -> 50.0 ops/s (+0.0% throughput)
report_id : sha256:22cf9ff073aad8aa30796ce326ab499a9ec076a083aec37e46aee88777300b2a
$ mh energy-model ./run
synthetic-result-refused: report sha256:22cf9ff0… has provenance 'synthetic';
pass allow_synthetic=True to export a rehearsal figure, which will be labelled as oneThe first command produces a complete report. The second refuses to export it as an energy model, because its provenance is synthetic. The refusal follows from the design: provenance comes from the instrument, and the caller cannot assert it.
Five tiers, one hundred and eleven tests
Run on 21 August 2026 against the public repository. Each tier answers a distinct question, and the last two are written to break the claim rather than to confirm it.
| Tier | Tests | The question it answers |
|---|---|---|
smoke | 5 | Does it start at all |
unit | 54 | Does each part behave at its boundary |
functional | 22 | Does the harness meet its specification |
security | 14 | What does it do with input it did not produce |
pentest | 16 | Can the claim be broken |
| Total | 111 | 96 % |
The integration gate chains static analysis, strict typing, source security review, dependency advisories and a 90 per cent coverage floor. Everything in it fails the build.
The known gaps, as the repository states them
The repository's threat model lists five residual risks. The first is also the most important, and no code will fix it.
- The harness cannot audit its own instrument. A driver that halved every reading would produce a report that verifies and is wrong. The mitigation is a bench procedure, not a code path.
- The digest detects editing, not authorship. Nothing signs the reports, so a recomputed forgery verifies.
- Test conditions are declared, not observed. The ambient temperature reported is the one the operator typed in.
- Threaded sampling is at the mercy of the system scheduler, which is precisely why energy is integrated over the timestamps achieved rather than the ones requested.
- No figure has yet been measured on hardware. The INA219 driver is written from the datasheet and refuses to return readings until it has driven the part.
Four documents, in the order they are read
- docs/GETTING_STARTED.mdAssumes no terminal experience, and leads to the first measurement.
- docs/METHOD.mdThe method: what is integrated, what is subtracted, and why.
- docs/BARE_METAL.mdFrom an unboxed board to a recorded figure, wiring included.
- docs/THREAT_MODEL.mdThe five residual risks, stated without mitigation.
A governance claim is verifiable, or it is worth nothing
The code of each link is public. To discuss this work, write to the author.