Durable causal debugger

This is the installed SlOS causal debugger. The browser is served by a real Hew user program. At right are the simultaneous coordinator and worker consoles, and the host operator log.

I submit a small render job and enrol this worker. The two native SlOS guests exchange actual assignments and calculate the pixels. An independent reference checks the finished image.

The job is complete because every tile has a checked published result. Local inspections are marked proven. Remote HTTP reports remain plausible, because this trusted LAN endpoint does not authenticate its peers.

The receipt lanes separate nodes and boot incarnations. Green links are declared dependencies, blue links are observations, and dashed grey links are identity or content correspondence. Timestamp order is not promoted to causality.

This storage publication receipt identifies the accepted tile and its assignment. The inspector reads that exact receipt again. Upload acknowledgement and transport processing alone do not establish this application commit.

The downloaded explanation contains the actual receipt identities and source coverage. These are bounded observations, with explicit missing evidence, rather than a claim of global causal closure.

Now a configured worker will stop across a real virtual machine power cut. The debugger runs independently of the managed renderer, so it remains available to explain the stalled job.

I disable the installed worker, then cut power and boot its original volume. Disable is durable configuration. The new kernel boot has a different incarnation, and the worker process does not start.

A new job remains pending. The coordinator can prove its local pending state and enrollment. The worker reports disabled. That is a plausible bottleneck, not proof that a packet was lost or work never executed.

Configuration observations connect across boots through matching content and the disable request. Dashed grey correspondence is context, not a newly invented causal edge. The receipt IDs keep the two boots distinct.

I power off the worker again and query the job. Its cached records are still inspectable, but the source is now historical. The debugger stops presenting the old disabled report as live service state.

Next I power cut and reboot the coordinator on its original volume while the worker remains offline. The persisted remote cache survives. Missing live evidence remains visibly missing after reboot.

I boot and enable the worker. Real work resumes, and the completed pixels match the independent reference. The earlier completed job also retains its exact accepted bytes.

Both machines here are native x86 sixty-four QEMU guests. This demonstration does not claim physical hardware support, authenticated HTTP peers, deterministic replay, or exactly once execution.

# In existing SlOS + local Hew consumer checkouts
make -j1 causal-debugger-check ARCH=x86_64 DOOM=0 HEW=/absolute/path/to/hew \
  CAUSAL_DEBUGGER_BROWSER_PYTHON=/path/to/playwright-python
make -j1 causal-debugger-check ARCH=aarch64 BOARD=qemu_virt DOOM=0 \
  HEW=/absolute/path/to/hew CAUSAL_DEBUGGER_BROWSER_PYTHON=/path/to/playwright-python

# Re-record the two actual x86-64 guest sessions, with local speech
make -j1 causal-debugger-videos ARCH=x86_64 DOOM=0 HEW=/absolute/path/to/hew \
  CAUSAL_DEBUGGER_BROWSER_PYTHON=/path/to/playwright-python \
  KOKORO_PYTHON=/path/to/kokoro-python \
  KOKORO_MODEL=/path/to/kokoro-v1.0.onnx \
  KOKORO_VOICES=/path/to/voices-v1.0.bin

The capture used the qualified local working tree and the unchanged hew 0.9.4-dev.28+95340fc71a compiler. This is Slepp's local freestanding port, not an official Hew release or target. The media manifest identifies the recording session, exact delivered and source-capture hashes, durations and local speech assets. Native check evidence remains in the private development checkouts; whole binaries and disk images are not published.

The MP4s pass complete FFmpeg decode and actual Chrome playback/seek checks with decoded video and audio. Speech is generated locally using Kokoro's af_heart voice, with explicit technical-term pronunciation. The Kokoro model is Apache-2.0 licensed; its ONNX wrapper is MIT licensed.