# U1 independent verification

Date: 2026-10-01. Status: **PASS for U1's local model/build boundaries; no blocking findings.** Target supplied by the coordinator: `85935f8`. No git commands, implementation edits, production XCTest reruns, or full app builds were performed by this verifier. The coordinator owns commit correlation and authoritative app-build evidence.

Read `CLAUDE.md`, the original brief, U1/R12/R14/R20 and relevant KTDs in the unified plan, `docs/session-schema.md`, and `docs/validation/verification-matrix.md`. Models were copied to an isolated scratch directory before compiling, excluding concurrent U2 work. The reviewed source imports only Foundation. Core Motion appears only in descriptive strings, not framework imports.

## Evidence

Scratch root: `/tmp/rideform-u1-independent`. Apple Swift 6.4 (`swiftlang-6.4.0.20.104`), with `DEVELOPER_DIR=/Applications/Xcode-beta.app/Contents/Developer` throughout. Compiler module caches were explicitly placed under scratch; the initial default-cache invocation failed sandbox access before compiling, and the corrected invocation succeeded.

The verifier compiled `Models.swift` as its own `RideFormCore` module/library and linked `main.swift` against it. The executable emitted actual production-encoded artifacts, compared their reopened values using direct Foundation `JSONDecoder` rather than production decode, and exported independent IEEE-754 expectations from fixture values. `check.py` used Python's JSON parser and `struct.pack`/`unpack` to verify encoded bits and manually specified raw-field expectations. Expected values were not generated through `SessionCodec`.

| Scenario | Independent result |
|---|---|
| U1.1 common iPhone/Watch inputs | Whole parsed JSON objects identical after removing only `manifest.platform` and `manifest.deviceModel`; both include fused/raw streams, events, calibration samples, and analysis configuration. |
| U1.2 Double/raw-field preservation | 13 exact IEEE-754 checks cover adjacent representable values, positive/negative subnormals, positive/negative maximum finite Double, configuration parameters, and separate stream timestamps. Direct Foundation decode matches the entire fixture. All fused field keys, nine labelled matrix cells, vectors, quaternion keys, raw sequence IDs, `UInt64.max`, calibration input samples, and scheduled/actual cue times checked. |
| U1.3 availability/version rejection | Available-empty differs structurally from unsupported-empty with a reason. Invalid magnetic/heading measurements retain finite raw values and raw validity codes; unavailable heading accuracy retains reason/code. Both session and manifest entry points explicitly reject versions −1, 0, 2, and 999 using minimal headers, demonstrating rejection before unrelated required fields are decoded. |
| U1.4 nonfinite handling | NaN and both infinities rejected with `nonfinite_value` and exact path `motion.samples.Index 0.gravity.y`; diagnostics independently encode to JSON. Numeric strings `NaN`, `Infinity`, and `-Infinity` rejected during decode. |
| Defaults challenged | Default boundaries incomplete; clock mapping unvalidated/no offset; attitude convention unverified; analysis algorithm unimplemented/filter none; observed rate fields omitted rather than zero. Default available-empty streams have zero counts and empty units, consistent with the documented unconfigured-fixture contract. |
| Platform boundary | Isolated frozen model typechecks with `arm64-apple-ios17.0` against the installed iPhoneOS SDK and `arm64-apple-watchos10.0` against the installed WatchOS SDK. Package declares iOS 17/watchOS 10/macOS 13; Xcode app Debug/Release declare iOS 17 and use the local core product. |

Commands, from repository root:

```sh
cp Packages/RideFormCore/Sources/RideFormCore/Models.swift /tmp/rideform-u1-independent/Models.swift
DEVELOPER_DIR=/Applications/Xcode-beta.app/Contents/Developer xcrun swiftc -module-cache-path /tmp/rideform-u1-independent/module-cache -emit-library -emit-module -module-name RideFormCore /tmp/rideform-u1-independent/Models.swift -o /tmp/rideform-u1-independent/libRideFormCore.dylib -emit-module-path /tmp/rideform-u1-independent/RideFormCore.swiftmodule
DEVELOPER_DIR=/Applications/Xcode-beta.app/Contents/Developer xcrun swiftc -module-cache-path /tmp/rideform-u1-independent/module-cache -I /tmp/rideform-u1-independent -L /tmp/rideform-u1-independent -lRideFormCore /tmp/rideform-u1-independent/main.swift -o /tmp/rideform-u1-independent/check
DYLD_LIBRARY_PATH=/tmp/rideform-u1-independent /tmp/rideform-u1-independent/check
python3 /tmp/rideform-u1-independent/check.py
DEVELOPER_DIR=/Applications/Xcode-beta.app/Contents/Developer xcrun --sdk iphoneos swiftc -sdk /Applications/Xcode-beta.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk -target arm64-apple-ios17.0 -module-cache-path /tmp/rideform-u1-independent/ios-cache -typecheck /tmp/rideform-u1-independent/Models.swift
DEVELOPER_DIR=/Applications/Xcode-beta.app/Contents/Developer xcrun --sdk watchos swiftc -sdk /Applications/Xcode-beta.app/Contents/Developer/Platforms/WatchOS.platform/Developer/SDKs/WatchOS.sdk -target arm64-apple-watchos10.0 -module-cache-path /tmp/rideform-u1-independent/watch-cache -typecheck /tmp/rideform-u1-independent/Models.swift
```

All corrected commands exited 0. Text results: `swift-results.txt`, `python-results.txt`. Fixtures: `phone.json`, `watch.json`, `defaults.json`, `empty-unavailable.json`, `expected-bits.json`, and `diagnostic-{nan,positive-infinity,negative-infinity}.json`, under the scratch root. Scratch artifacts are temporary and must be retained elsewhere before cleanup if required for later audit.

SHA-256 identities:

| Artifact | SHA-256 |
|---|---|
| Frozen `Models.swift` | `a578d3c1027a62710be22981c32b44431c045a782a60308174cd38b43705b6b6` |
| Reviewed `Package.swift` | `4f00768206fc6e316c80c81dfbc193a9e3d7a32eca027f06590ad2de91bb88a4` |
| Reviewed `project.pbxproj` | `d38ee9fe55253a56bf9e350799d86fe5eef6a67957c96011b3003e86d9aa5031` |
| `main.swift` | `203a8747e5301ba855c9402fa6fbb69d694f25bc527ed8c95282c523f2ccdd9c` |
| `check.py` | `115730c19bfbaec0a22a6521dcb2019548c59ca9f3b451ab406c770e55355ef8` |
| `phone.json` | `8adb3b7dda0ff56c43ce3aec9365de383ec49a677b93e657cfb2ca27e842cd18` |
| `watch.json` | `81d9b68d50ab250565e368809005cc82e2a415ed133f773fbd8cf2561dc712a4` |

## Findings and limits

**Informational follow-up for U4:** Codable/`SessionCodec` enforce encoding types, finite numbers, and supported decoded schema version; they do not validate semantic consistency between manifest counts/capabilities/units and stream rows, calibration identity, or completion boundaries. The default session encodes empty units and unconfigured available streams. Before marking a master complete, the acquisition/writer boundary must populate metadata and reconcile accepted/written/loss counts and capability reasons. This is a future-unit obligation, not a U1 failure.

R12 is currently a representable contract, not an implemented master-bundle writer. R14 records configuration and provides portable inputs; no analyzer exists in U1. R20 proves the common model compiles for Watch's deployment boundary and accepts Watch metadata; it does not prove Watch capture/runtime or numerical analyzer parity.

The attitude fixture deliberately exercises representation preservation using distinct arbitrary component values; it is not a physically valid attitude or a future rotation-transform oracle. No transform assertion was needed for U1. U3 must add self-consistent noncommuting neutral/current rotations to distinguish multiplication order and physical sign checks to establish Apple's adapter direction. No hardware, garage, clock-mapping, sensor-rate, physical mount, or acoustic-onset outcomes are asserted here.