Fail-closed inputs
- Missing required feature: error.
- Unknown feature: error.
- Non-integer or out-of-range feature: error.
- Unknown output in feedback: error.
- Feedback for another evaluation: error.
- Altered authority contract, noncanonical JSON, orphan attachment, or Monk mismatch: image-open error.
Portable hard limits
| Resource | Limit |
|---|---|
| Features and outputs | 1..256 each |
| Layers | 1..32 |
| Absolute feature, weight, bias, threshold, scale, and runtime value | 32767 |
| Parameters | Embedded budget, hard maximum 1,000,000 |
| Learning rate | 0..1,000,000 parts per million |
Direct-training limits
| Resource | Hard maximum |
|---|---|
| Records | 10,000, further reduced by the manifest |
| Epochs | 64 |
| Adaptation steps | 100,000, further reduced by the manifest |
| One record | 1 MiB |
| One evidence file | 8 MiB |
| Total loaded corpus | 64 MiB |
Schema version 1 accepts only root-image-owned corpus files. Every path is an explicit canonical path in the manifest or record; no recursive discovery occurs.
These limits keep integer products inside the cross-runtime exactness envelope and make model cost reviewable before inference.
Non-authority contract
The canonical attachment repeats five immutable statements: advisory only; cannot grant VFS authority; cannot override integrity; cannot cross ownership boundaries; cannot rewrite Monk policy. They are validated as data so the artifact describes its own boundary.
Threat-model boundary
The runtime proves deterministic structure and binding. It does not prove that a feature extractor is unbiased, a target is correct, a verifier is trusted, or supporting evidence is authentic. Those are host governance responsibilities. Treat output as evidence, never as an authorization token.