Every numeric default the protocol exposes, anchored to the current development version (v0.0.1-demo at time of writing) — the parameter catalog extracted from architecture.html §14.
v0.0.1-demo at time of writing). architecture.html §10 covers the mechanism of versioning + upgrade — this file is the contents. The two together define what changes when the version bumps: §10 says how an epoch transition activates a new parameter set; this file records the parameter set itself.iris_core::params::CURRENT (deferred — landing alongside the IrisConfig::validate bounds check). Until that lands, this table is the source of truth and the per-config impl Default blocks must mirror it.Two version concepts move together through demo + MVP and may diverge post-v1.0.0:
| Cargo crate version | Protocol version | |
|---|---|---|
| Where it lives | Cargo.toml [workspace.package].version | iris_core::PROTOCOL_VERSION const |
| What it gates | Source-code dep resolution | Wire compat + on-chain semantics + parameter bounds |
| Who reads it | cargo | Other Iris nodes, the on-chain Verifier, governance |
| Bump triggers | Any code change | Wire format change, on-chain change, parameter default outside the compat range |
The version line itself follows Cargo's ^0.0.x semver:
| Range | Meaning | Phase mapping |
|---|---|---|
v0.0.X | Every patch bump is treated as a fresh major. Wire/API may break. | Demo — current. Iterations break compat routinely. |
v0.X.0 | 0.X.x is a stable line; 0.(X+1).0 is breaking. | MVP — wire format stable enough for 0.X.x patches to mean drop-in upgrades. |
v1.0.0+ | Strict semver. Production compat promise. | Post-MVP. Crate version and protocol version may decouple if release cadences diverge meaningfully. |
flowchart LR demo["v0.0.X · Demo (current)
every patch a fresh major;
wire/API may break"] --> mvp["v0.X.0 · MVP
0.X.x stable line;
0.(X+1).0 is breaking"] mvp --> prod["v1.0.0+ · Post-MVP
strict semver;
crate/protocol versions may decouple"]
The Cargo version and iris_core::PROTOCOL_VERSION move in lockstep through the v0.0.X and v0.X.0 runway. Decoupling is deferred to v1.0.0+ and is triggered by (a) any iris-* crate appearing in another project's Cargo.toml, or (b) one crate's patch cadence exceeding ~3× the rest over a release window.
Each subsection enumerates one knob group. Defaults are the values in iris_core::config::*Config::impl Default for the on-protocol knobs; demo-tier overrides live in iris-devnet's CLI and are noted inline.
The pixel-comparison math behind architecture.html §6.3. NormalizationConfig block.
| Parameter | Default | Effect |
|---|---|---|
beta_mad |
1.0 |
Weight on Mean Absolute Distance. Higher β makes pixel-magnitude differences (saturated patches, gross radiometric drift) collapse the score faster. β = 0 disables the MAD term — saturated-style attacks slip through. |
beta_mse |
1.0 |
Weight on Mean Squared Error. Squared error punishes few-pixel extremes harder than uniform drift; tracks beta_mad on whole-frame attacks and diverges on a single-band saturation flare. |
beta_sam |
1.0 |
Weight on Spectral Angle Mapper (per-pixel band-vector angle, radians). Catches cross-sensor band shuffling (e.g., BGR served as RGB). Contributes zero on single-band assets — the angle is undefined for bands = 1. |
band_tolerance_nm |
5.0 |
Maximum per-band centre-wavelength deviation for two AlignedImages to be considered comparable (architecture.html §6.2). Wider tolerates cross-vendor visible-band offsets; below ~3 nm rejects same-sensor pairings as a configuration error. |
acceptance_threshold |
90.0 |
architecture.html §7.4 Tier-1 acceptance gate on the [0, 100] similarity scale. Regular Nodes broadcast a Rejection if their recomputed self-edge falls below. Honest Sentinel-2 devnet rounds score ~96-99, so 90 leaves comfortable margin. The Leader-side pre-publish copy here and the Regular-Node-side copy in ConsensusConfig.acceptance_threshold (§14.2.2) are reconciled at the same default since [4.5.16] — both must agree or the Leader publishes proposals the verifier rejects. |
max_payload_bytes |
1 GiB |
Pre-orthorectification working-set cap. Downsampler triggers when the raw raster exceeds this. Sized so a 16 GB-RAM laptop processes the 16 GiB Sentinel upper bound without OOM (architecture.html §11.3). |
The architecture.html §7.4 Tier-2 spot-check + matrix-equality gates Regular Nodes use to police the Leader. ConsensusConfig block (plus PreCommitConfig at the driver layer).
| Parameter | Default | Effect |
|---|---|---|
spot_check_count (k) |
1 |
Number of random off-diagonal matrix cells each Regular Node verifies per round. Per-round detection probability ≈ k/n with skip-self / skip-medoid prunes. k=1 over 30 rounds = ~10.5% per-round; architecture.html §7.4 calls out multi-round amplification at k=1 as the equilibrium. k=3 triples per-round detection for 3× verifier I/O. |
matrix_tolerance |
1e-6 |
Float epsilon for verify_spot_cell. Honest cross-node divergence on the §7.4 kernel is < 1e-12 — 1e-6 is 6 orders of headroom against floating-point drift. Tighter (1e-9) surfaces cross-architecture determinism bugs; looser (1e-3) masks fraud. |
acceptance_threshold |
90.0 |
Same role as NormalizationConfig.acceptance_threshold (§14.2.1) but consumed by the Regular-Node-side PreCommit verifier. Reconciled to the same default at [4.5.16]; the Leader's pre-publish gate and the verifiers' Tier-1 gate now agree byte-for-byte. The split remains in the type system as a deliberate ergonomic — the verifier crate (iris-consensus) doesn't pull the heavy iris-normalize config dep — and IrisConfig::validate enforces equality across the two before node startup once [4.5.18] lands. |
max_leader_attempts (k) |
1 |
View-change cap (architecture.html §7.1). k=1 single-shots — a LeaderTimeout fails the round. k=3 tolerates 2 successive Leader failures and proportionally scales t1_seconds (validated at config load). |
The dominant wall-clock cost of a round. ConsensusConfig block; iris-devnet overrides where they diverge from library defaults are noted in the right-most column.
| Parameter | Lib default | iris-devnet | Effect |
|---|---|---|---|
observation_phase1_deadline_seconds |
60 |
120 |
Phase 1 absolute deadline per architecture.html §7.2 — by this time every contributing node must have published its TlsCommitment. Renamed from tls_commitment_deadline_seconds in [4.5.17]; the old name conflated what TlsCommitment proves (the TLS handshake succeeded) with when it must land. Old TOML configs keep parsing via the serde alias. With the eager-fetch MockAttestor, this is effectively the whole COG-download budget — open_session does handshake + body in one shot. Four nodes × 30 MB on home broadband = 30-90 s. |
geotiff_body_deadline_seconds |
60 |
30 |
[4.5.17] Phase-2 sub-budget cap on fetch_and_finalize body download. Wraps the in-enclave body-fetch step in a tokio::time::timeout; on overrun the cohort surfaces ObservationFailed::DownloadStalled before the round's manifest_deadline_seconds fires. Under MockAttestor (eager-fetch) this budget is wasted — fetch_and_finalize is sub-100 ms (host-side BLAKE2b(payload) + DiskCache::insert_pair); under real-vendor TEE ([2.4.3-5]) this is the dominant cost. |
manifest_deadline_seconds |
300 |
180 |
Phase 2 absolute deadline from round start. Cross-section invariant (enforced in ConsensusConfig::validate): observation_phase1_deadline + geotiff_body_deadline < manifest_deadline. |
proposal_deadline_seconds |
240 |
240 |
Leader's budget to fetch peer GeoTIFFs, decode, orthorectify, and build the similarity matrix (architecture.html §7.3). Scales O(n²) in committee size, O(grid²) in edge length. ~115 s observed for 2 contributors on a 256×256 grid. |
voting_timeout_seconds |
60 |
120 |
BLS-share collection window (architecture.html §7.5). Regular Nodes' PreCommit is heavier than the Leader's (they must fetch medoid bytes); ~70 s observed. |
t1_seconds |
900 |
— | On-chain requestSubmissionDeadline = blockTimestamp + T1 (architecture.html §7.1.3). Validated as ≥ k·proposal_deadline + manifest_deadline + voting_timeout + finality_margin. |
finality_margin_seconds |
144 |
— | 12 blocks × 12 s on Sepolia. |
epoch_rotation_ttl_seconds |
0 (disabled) |
— | Scheduled DKG re-key TTL (architecture.html §3.4). 0 for devnet, 2_592_000 (30 d) for testnet, 7_776_000 (90 d) for mainnet early. On-chain epochRotationTtl() is authoritative at runtime. |
--asset red --grid-edge 64, the quintet 30 / 30 / 90 / 120 / 30 (phase1 / body / manifest / proposal / voting) runs cleanly. For --asset visual (3-band, ~300 MB), pad observation_phase1_deadline by 2-3× and proposal_deadline by ~30%; leave geotiff_body_deadline at the default under MockAttestor (no effect).How the kernel sees the data — the orthorectified grid + raw input decimation. Surfaced by iris-devnet's CLI; the production node reads these from [normalization].
| Parameter | Default | Effect |
|---|---|---|
grid_edge |
128 (iris-devnet) |
Reference-grid edge length, in pixels. Math kernel is O(grid² × bands × n²) for the matrix build. 256 ≈ 4× slower than 128 and 4× more sensitive to small spatial features. Used by both Leader proposer and Regular Node verifier so cells reproduce within matrix_tolerance. |
grid_bands |
derived | Computed at runtime as min(loaded_raws.band_count(), configured_cap).max(1). Configured cap stays as an upper bound — the kernel no longer zero-pads bands the rasters don't carry. |
input_edge_cap |
2048 (--resolution normal) |
Per-edge cap applied at TIFF load (deterministic box-filter decimation). --resolution fast = 1024, normal = 2048, slow = 4096, raw = unlimited. Larger = finer spatial detail in MAD, linearly more decode + memory. |
| Reproject resampler | bilinear (hard-coded) | architecture.html §6.1 bilinear interpolation. Switching to nearest-neighbor would preserve hard pixel edges but quantize cross-contributor comparisons. Not currently exposed as a knob. |
| DEM resampler | ConstantPlaneResampler(0.0) (devnet) |
Flat-Earth at h = 0 m for AoIs with negligible terrain. Production wires IpfsDemFetcher against the SRTM-tile manifest (see DemConfig). |
input_edge_cap ≥ grid_edge. The reverse wastes upscaling work — the orthorectifier upsamples a low-resolution raster onto a higher-resolution grid, producing per-pixel zeros for the gap.Budgets for the architecture.html §4.5 /iris/geotiff/1.0.0 and /iris/attestation/1.0.0 direct streams. TransferConfig block.
| Parameter | Default | Effect |
|---|---|---|
geotiff_timeout_seconds |
3600 |
Per-fetch wall-clock cap on a direct stream. 1 hour handles a 16 GiB transfer at ~5 MB/s. The Leader's per-fetch timeout (60 s, hard-coded in IrisLeaderProposer) is the actually-tight one in practice — this wire-level cap rarely fires. |
max_payload_bytes |
16 GiB |
Hard upper bound from architecture.html §4.5. Lower it to reject scenes that would OOM small nodes. Cross-section invariant: normalization.max_payload_bytes ≤ network.transfer.max_payload_bytes. |
max_concurrent_transfers |
10 |
libp2p mesh-side fan-out cap. The Leader currently fetches contributors sequentially in prepare_proposal; this knob matters once bounded-parallel fetch lands (architecture.html §11.3 calls for 8 in-flight). |
The architecture.html §5.4 TEE policy — what the verifier will accept. AttestationConfig block.
| Parameter | Default | Effect |
|---|---|---|
attestation_freshness_window_seconds |
900 (lib), 86_400 (loopback tests) |
architecture.html §5.4 step 7 — |vendor_timestamp − block_ts| must lie within this window. 900 s tolerates cross-node wall-clock drift without admitting cross-day attestation replay. A vendor_timestamp = 0 (Unix epoch) attack is rejected at the 900 s default but admitted at an "infinite" window. |
approved_provider_hosts |
[] (empty) |
DNS hostname allowlist for architecture.html §5.4 step 3 (Server Identity Check). Empty = reject everything. Regular Nodes populate this with the Data Provider CDNs they trust (e.g., sentinel-cogs.s3.us-west-2.amazonaws.com). |
local_attestor |
Mock |
Vendor this node uses when constructing its own iris-fetch enclave. Must be enabled in accepted.<vendor> on this node. |
Governance-tunable parameters carry an allowed range — outside the range, IrisConfig::validate refuses to start the node. Machine-enforced since [4.5.18] via the typed iris_core::params::RANGE const and the iris_core::params::validate_against_protocol cross-section gate (wired into IrisConfig::validate as the last step). Values outside the range constitute a hard fork — they require a PROTOCOL_VERSION bump and an IrisGovernance epoch transition. The same gate enforces the [4.5.16] cross-section equality invariant: normalization.acceptance_threshold == consensus.acceptance_threshold byte-for-byte.
| Parameter | v0.0.1-demo range | Hard-fork bump triggered when |
|---|---|---|
beta_mad, beta_mse, beta_sam |
[0.0, 10.0] |
Default value moves outside the range — re-tuning the score function changes which contributors clear the acceptance gate. |
acceptance_threshold (both copies) |
[50.0, 100.0] |
Default moves. Below 50 admits scenes with > 50% radiometric divergence; that is a different protocol. |
band_tolerance_nm |
[0.0, 20.0] |
Default moves. > 20 nm starts admitting visible-vs-NIR pairings as comparable. |
spot_check_count |
[1, 16] |
Default moves outside. 0 disables Tier-2 entirely; > 16 starts approaching deterministic full-matrix verification — different complexity class. |
matrix_tolerance |
[1e-12, 1e-3] |
Default moves. Below 1e-12 exceeds f64 mantissa precision; above 1e-3 masks fraud. |
max_leader_attempts |
[1, 7] |
Default moves. > 7 stretches the round budget past the on-chain t1_seconds headroom. |
observation_phase1_deadline_seconds |
[10, 600] |
Default moves outside. |
geotiff_body_deadline_seconds |
[10, 600] |
Default moves outside. |
manifest_deadline_seconds |
> observation_phase1_deadline + geotiff_body_deadline + 30, ≤ 3600 |
Cross-section invariant; violated values refuse to load. |
proposal_deadline_seconds |
[30, 1800] |
Same. |
voting_timeout_seconds |
[10, 600] |
Same. |
attestation_freshness_window_seconds |
[60, 86_400] |
Below 60 burns honest rounds on wall-clock drift; above 1 day admits cross-day replay — different threat model. |
max_payload_bytes (transfer) |
[1 MiB, 64 GiB] |
Default moves. Upper bound > 16 GiB exceeds current architecture.html §4.5 protocol max. |
max_payload_bytes (normalization) |
[1 MiB, transfer.max_payload_bytes] |
Cross-section invariant; violated values refuse to load. |
Operator-only knobs (approved_provider_hosts, local_attestor, cache_dir, etc.) are not governance-tunable — they shape which providers and TEEs this node trusts, not whether the protocol's acceptance contract holds. Operators set them freely.
The set of (mission, processing_level, radiometric_units) tuples the architecture.html §6.1.1 dispatch table accepts at the current protocol version. Each row carries the upstream preprocessing the vendor performs, the handler the Iris pipeline uses, and the Demo / MVP / V1 support state. New rows are additive — a tuple absent from this table is rejected with UnsupportedProduct (or UnsupportedAtDemo for tuples that have an explicit fail-closed stub, signalling "the code knows about you but the handler is MVP-tier").
ProcessingLevel is Iris's normalized vocabulary, not a passthrough of whatever the vendor prints on the product. The letter suffixes are per-mission and do not carry across providers, so this is the translation layer: read it before adding a row below, and never infer a tuple from a vendor's level string alone. See: glossary § Vendor Level-Name Collision; crates/iris-core/src/types.rs.
| Vendor's own product name | What it actually is | Iris tuple |
|---|---|---|
ESA Sentinel-2 L1C | Orthorectified TOA reflectance on a fixed UTM grid | (Sentinel2Msi, L1C, Toa) |
ESA Sentinel-2 L2A | Surface reflectance via sen2cor | (Sentinel2Msi, L2A, Boa) |
USGS Landsat L1TP | Terrain-corrected Level-1; TOA reflectance via MTL.txt coefficients | (Landsat9Oli, L1C, Toa) |
USGS Landsat L2SP | Surface reflectance via LaSRC | (Landsat9Oli, L2A, Boa) |
Planet PSScene 3B / ortho_analytic_* | Orthorectified TOA reflectance. The "3" is Planet's orthorectified marker, not a NASA Level-3 gridded composite. | (PlanetScope, L1C, Toa) |
Planet ortho_analytic_*_sr | Surface reflectance via LUT-based 6SV | (PlanetScope, L2A, Boa) |
Maxar Standard (2A) / Ortho Ready Standard (OR2A) | Map-projected to a plane at average or constant elevation, RPCs supplied for the consumer's own terrain correction; TOA reflectance via absCalFactor. Not atmospherically corrected. | (WorldView3, L1C, Toa) |
Maxar Basic (1B) | Sensor geometry, RPCs supplied, not map-projected | not accepted — no row below |
L2A is bottom-of-atmosphere surface reflectance. Maxar's Standard (2A) is a geometric level whose radiometry is still top-of-atmosphere. Mapping Maxar 2A onto ProcessingLevel::L2A on the strength of the shared spelling would put a TOA product into a cohort the verifier treats as BOA — and since processing_level is bound into the attestation's user_data and a round's cohort is assumed homogeneous in level, the mismatch would not be caught as a mislabel. It would surface only as inflated μ₁/μ₂/μ₃ against a boundary nobody declared. RadiometricUnits is what keeps the two apart; declare it from the product's physics, never from its name.Sentinel-2 (ESA Copernicus, MSI push-broom optical). Two Demo-supported product levels; both arrive already orthorectified by ESA.
| Tuple | Upstream preprocessing | Iris handler | State |
|---|---|---|---|
(Sentinel2Msi, L1C, Toa) |
Geometric / geometric+radiometric calibration ⟶ orthorectification to UTM zones using PlanetDEM 90 (baselines ≤ 04.00) or Copernicus GLO-30 (baselines ≥ 05.00) ⟶ TOA reflectance scaled by QUANTIFICATION_VALUE = 10_000 |
optical_parallax_warp (the existing [3.6] pure-Rust DEM-driven warp; runs over already-orthorectified pixels — see architecture.html §6.1 concern (a)) |
✅ Demo |
(Sentinel2Msi, L2A, Boa) |
L1C chain + ESA sen2cor atmospheric correction ⟶ BOA reflectance + scene-classification layer (SCL) |
optical_parallax_warp (same handler; the BOA radiometry feeds the spectral-angle metric μ₃ cleanly; SCL is not currently consumed at Demo) |
✅ Demo |
Sentinel-1 (ESA Copernicus, C-band SAR). Two product levels documented; both fail closed at Demo. The MVP track is a separate handler — Range-Doppler terrain correction operates on slant-range geometry rather than collinearity-equation reprojection, so it cannot share a code path with the optical warp.
| Tuple | Upstream preprocessing | Iris handler | State |
|---|---|---|---|
(Sentinel1Sar, L1Grd, Sigma0Db) / (_, _, Sigma0Linear) |
Focusing ⟶ ground-range projection ⟶ multilook (e.g. 5×1 IW) ⟶ thermal-noise correction ⟶ radiometric calibration to σ⁰ (linear or dB) | Err(UnsupportedAtDemo) — MVP plan: orbit-file ingest, Range-Doppler terrain correction against IrisDEM, refined Lee speckle filter, then dB conversion before feeding the optical metrics with a SAR-specific β-tuning |
🟡 MVP-pending |
(Sentinel1Sar, L1Slc, _) |
Focusing ⟶ complex slant-range single-look (per-swath, per-burst, interferometry-ready) | Err(UnsupportedAtDemo) — MVP plan extends the GRD chain with deburst + TOPS deramping before the Range-Doppler stage |
🟡 MVP-pending |
Landsat-9 OLI (USGS / NASA, multispectral push-broom optical). Vendor-orthorectified products distributed via the USGS Collection-2 Tier-1 surface — the closest analog to Sentinel-2's L1C / L2A split and the obvious second optical mission to bring online at V1+.
| Tuple | Upstream preprocessing | Iris handler | State |
|---|---|---|---|
(Landsat9Oli, L1C, Toa) |
USGS Collection-2 Level-1 Terrain-Corrected (L1TP) processing — geometric calibration ⟶ orthorectification using the GLS2000 ground control points + a DEM (NED, GTOPO30, or RAMP depending on latitude) ⟶ TOA radiance ⟶ TOA reflectance scaled by per-band REFLECTANCE_MULT / REFLECTANCE_ADD (from the MTL.txt companion) |
optical_parallax_warp (same handler as Sentinel-2 L1C; the σ_px/m envelope from [5.12]'s SensorRegistry carries the OLI-specific spatial-error budget — broader than Sentinel-2 by ~2× due to OLI's wider GSD) |
⚪ V1+ |
(Landsat9Oli, L2A, Boa) |
L1TP chain + LaSRC atmospheric correction (USGS Land Surface Reflectance Code; the L2SP Collection-2 product) ⟶ BOA surface reflectance + pixel QA (cloud / cloud shadow / snow / water mask) |
optical_parallax_warp (BOA radiometry feeds μ₃ cleanly; the QA layer is not consumed at V1, deferred to a future panel-class that supports per-pixel masking) |
⚪ V1+ |
PlanetScope (Planet Labs, RGB/NIR/Red-edge SuperDove constellation, ~3 m GSD). Planet ships analysis-ready products; the upstream chain is largely opaque to the consumer (Planet runs it on their own infrastructure) but the output is documented at the Item Type level via the Planet Data API.
| Tuple | Upstream preprocessing | Iris handler | State |
|---|---|---|---|
(PlanetScope, L1C, Toa) |
PSScene Item Type, ortho_visual / ortho_analytic_4b / ortho_analytic_8b asset family — radiometrically + geometrically corrected, orthorectified using a 30 m global DEM (SRTM / Copernicus GLO-30 depending on AoI latitude), TOA reflectance scaled by radiometricScaleFactor (reflectance_coefficients in the per-scene XML) |
optical_parallax_warp (same handler; the 8-band SuperDove output exposes red-edge + NIR-2 that the metric kernel can use without code changes once the band registry catches up) |
⚪ V1+ |
(PlanetScope, L2A, Boa) |
L1C chain + Planet's ortho_analytic_*_sr asset — atmospheric correction via 6SV (LUT-based, not full radiative-transfer) ⟶ BOA surface reflectance |
optical_parallax_warp (BOA radiometry feeds μ₃; cloud-cover annotation lives in the scene XML, not the raster, so QA masking is deferred to the same V1+ panel-class as Landsat L2A) |
⚪ V1+ |
Maxar WorldView-3 (8-band VNIR + 8-band SWIR very-high-resolution optical, 0.31 m pan / 1.24 m MS). WorldView products use RPC (Rational Polynomial Coefficient) geometric models rather than direct orthorectification, so the V1+ handler will need a GDAL Warp pass (against the round's DEM) instead of the existing optical_parallax_warp over pre-orthorectified pixels. Settled in design_q1_effective_nadir_angle.md §1.3.3.c.
| Tuple | Upstream preprocessing | Iris handler | State |
|---|---|---|---|
(WorldView3, L1C, Toa) |
Maxar Standard imagery (Level 2A archive product) — radiometric calibration ⟶ TOA reflectance (per-band absCalFactor / effectiveBandwidth) + RPC coefficients in the .RPB companion; not pre-orthorectified (the consumer applies the RPC + DEM to produce a map-projected raster) |
New worldview_rpc_warp handler (V1+) — invokes gdalwarp -rpc -to RPC_DEM=<irisdem-tile> to project pixels onto the request grid, then feeds the warped reflectance into μ₁/μ₂/μ₃. Cannot share the optical handler because the input geometry is fundamentally different. |
⚪ V1+ |
Sentinel-3 OLCI (ESA Copernicus, 21-band ocean / land colour spectrometer, 300 m GSD). Along-track scanning push-broom; useful for the wide-area / low-resolution panel class. Two product levels relevant to the optical pipeline.
| Tuple | Upstream preprocessing | Iris handler | State |
|---|---|---|---|
(Sentinel3Olci, L1B, RadianceWm2) |
ESA Copernicus S3 OLCI Level-1B product — radiometric / spectral / geometric calibration ⟶ TOA spectral radiance in W·m⁻²·sr⁻¹·µm⁻¹ per band ⟶ geo-referenced (tie-point grid, not orthorectified — the 300 m GSD makes terrain parallax negligible at most latitudes but the tie-point grid still needs resampling onto a regular grid) |
New olci_radiance_resampler (V1+) — gdalwarp from the tie-point grid onto the request ReferenceGrid; downstream metrics use μ₁ (MAD on radiance) and μ₃ (SAM on radiance, dimensionally fine) but skip μ₂ (MSE units are squared radiance, not directly comparable to reflectance) |
⚪ V1+ |
(Sentinel3Olci, L2A, Boa) |
L1B chain + OLCI Level-2 Land Full Resolution (L2_LFR) processor — atmospheric correction + per-pixel land flags ⟶ BOA surface reflectance + OGVI / OTCI ecosystem-state indices |
optical_parallax_warp (reuses the optical handler at 300 m GSD; the OGVI / OTCI layers are not consumed at V1+, deferred until a derived-product panel class) |
⚪ V1+ |
Sentinel-5P TROPOMI (ESA Copernicus, atmospheric-chemistry spectrometer, 5.5 × 3.5 km GSD). Trace-gas vertical-column-density (VCD) products rather than imagery-style reflectance. Listed for matrix completeness; not a natural fit for the per-AoI medoid pipeline (one pixel covers ~20 km²), and unlikely to be the first non-optical mission V1+ activates.
| Tuple | Upstream preprocessing | Iris handler | State |
|---|---|---|---|
(Sentinel5pTropomi, L2A, _) |
ESA Copernicus S5P Level-2 product — DOAS spectral fit ⟶ columnar vertical density (NO₂, SO₂, CH₄, HCHO, CO, O₃; one product per gas) ⟶ per-pixel QA flag | Err(UnsupportedProduct) at V1+ — TROPOMI's product semantics (per-gas VCD raster, units in mol·m⁻²) don't match the panel-content invariants [4.5.23] assumes (a single radiometric raster per Manifest). Also: the current RadiometricUnits enum has no mol·m⁻² variant, so even the tuple is unrepresentable without a wire-format break. A future atmospheric-panel class would dispatch through a separate trait surface and grow the enum to fit. |
⚪ V1+ (matrix-only; tuple awaits RadiometricUnits extension) |
Manifest declaring a tuple in the Demo rows passes Tier-1 preprocessing and proceeds.Manifest declaring a 🟡 MVP-pending tuple is rejected at Demo with Rejection { kind: "preprocessing", reason: "unsupported-at-demo:<mission>:<level>" }. The contributor's peer score is not penalized (declaring SAR on a Demo network is a configuration error, not malice).Manifest declaring a tuple not in any row is rejected with Rejection { kind: "preprocessing", reason: "unsupported-product:<mission>:<level>:<units>" } and the contributor's peer score is penalized — the tuple is well-formed but outside the protocol's accepted set, a misconfiguration that risks committee-wide consistency.Manifest whose declared tuple disagrees with what the attestation actually bound is rejected at architecture.html §5.4 step 6 with VerifyError::UserDataMismatch (cryptographic, not preprocessing-layer). This is the [4.5.1.11] mislabeled-product attack path.Per-version snapshots. Each row records the parameter set that was authoritative when the protocol version was current. Bumps to iris_core::PROTOCOL_VERSION add a new row; default changes within a version line are not allowed (they would be a hard fork — see §14.2.7).
| Protocol version | Activated at epoch | Parameter set | Notes |
|---|---|---|---|
v0.0.1-demo |
— (pre-epoch / pre-chain) | §14.2 | Initial demo cut. The architecture.html §7.4 acceptance gate carries two type-system copies (NormalizationConfig for Leader-side, ConsensusConfig for verifier-side) reconciled to 90.0 at [4.5.16]; cross-section equality enforcement deferred to [4.5.18]. |
Future rows arrive with each iris_core::PROTOCOL_VERSION bump; the column "Activated at epoch" is populated once IrisVerifier is live (architecture.html §8.3).