Performance
Fast enough to prove.
Honest about the clock.
Kirra's performance discipline starts with a rule most benchmarks break: host timing is indicative, never worst-case-execution-time. Every number below is labeled with what it is — a budget, a gate, or a measurement — and where it came from.
The verdict budget
100 µs to decide. Crypto excluded by design.
The governor verdict has a 100 µs deployment target (SG9's fail-closed timeout) and a 10× CI regression ceiling gated on p99.9 over 100,000 iterations — not on the mean, because tails are where timing claims go to die. The Ed25519 release signature deliberately rides the actuation path, outside the verdict budget (ADR-0031).
Assembled in-line loop — read → validate → decide → sign → verify → release
Release build, CI hardware. Host-indicative regression tripwire, not certified WCET.
Structural boundedness
The verdict path carries an O(1) structural argument, not just measurements: no allocation, no unbounded loops, worst cases enumerated — containment's worst case is exactly 50 × 256 × 4 = 51,200 polygon-edge tests, gated at 10 ms.
A timing substrate built for the target
The measurement library is no_std, zero-dependency, integer-only, O(1) per record — and it
refuses to label a host run as certified: only a QNX-target-under-FIFO environment qualifies.
Why the tail matters
On a stock Jetson kernel, the repository measured a reproducible ~47–51 ms scheduling tail under zero-copy transport — precisely why certified WCET is defined on QNX under FIFO, and why we don't quote Linux numbers as guarantees.
tools/iceoryx2-spike/results/orin-nx-16gb-linux-isolated.txtdocs/safety/WCET_MEASUREMENT_METHODOLOGY.md
Transport measurements
Nanoseconds where it counts
The enforced path avoids serialization entirely: a seqlock read over a frozen
#[repr(C)] struct. The repository's own benches put that read at ~60 ns p50 — roughly 16×
cheaper than a UDP + serde hop — and read + validate + decode at ~297 ns.
Read latency by transport — p50, host
From the iceoryx2 spike bench and the SHM carrier README.
tools/iceoryx2-spike/src/bin/latency_bench.rscrates/kirra-hv-carrier/README.md
Zero-copy, isolated on purpose
The iceoryx2 evaluation lives in its own workspace so the dependency can never leak into the safety tree before it's earned adoption. It carries the production frozen contract over a real channel, passes a 9-class fault matrix in full and minimal feature configurations — and eliminated torn headers at the transport layer entirely.
On real Jetson Orin NX silicon with isolated cores: 1.4 µs p50 round-trip, 2.3 µs p99.9 — with the Linux scheduling tail documented right next to the good news.
tools/iceoryx2-spike/README.mdtools/iceoryx2-spike/results/orin-nx-16gb-linux-isolated.txt
Build discipline
Tuned control plane. Untouched safety element.
LTO, target-cpu flags, and PGO are applied to the untrusted control-plane binaries only. The certification-track judge builds with fixed, conservative flags — no LTO, no PGO, no target-cpu — because a reproducible artifact beats a fast one where it counts. And CI double-builds the QNX judge and byte-compares the results.
docs/PERFORMANCE_BUILD_TUNING.md.github/workflows/ci.yml:122
READ THE SOURCE
Every number, labeled.
Budgets, gates, and measurements are different things. The repository keeps them separate — and so does this page.