SSMT – Device Passport, Auto Lens Policy, and Audit Stability (2.10–2.11)

How SSMT travels with hardware, and how to lock in a lens without surprises.

2.10 Device passport snippet (ships with firmware)
Think of the “passport” as the ID card your device carries forever.
It says:

  • “Here is how I turn raw °C/°F/K into symbols like e_T.”
  • “Here are the pivots and guardrails I was born with.”
  • “Here’s what I’m allowed to emit.”

Why this matters:
When a sensor transmits e_T, an auditor or regulator should be able to pick up that sensor, read its passport, and recreate e_T offline. No guessing. No vendor lock. No secret scaling.

Copy-ready example:

SSMT_passport:
  manifest_id: "SSMT-ACME-2025-09-001"
  version: "1.1"
  lens: "log"

  anchors:
    T_ref: 298.15       # Kelvin baseline
    DeltaT: null        # only for linear
    E_unit: null        # only for kBT
    c_T: null           # only if emitting a_T
    tau: null           # only for hybrid
    alpha: null         # only for qlog

  phase_block:
    T_m_list: []        # no phase dial in this device
    rho: 0.90           # default hysteresis memory (only used if phase is enabled later)
    k_side: 2.0         # default soft edge sharpness

  guards:
    clamp_a_eps: 1e-6
    eps_TK: 1e-6
    T_valid_range_K: [180.0, 500.0]

  outputs:
    emit_e_T: true
    emit_a_phase: false
    emit_a_T: false

  # optional:
  # privacy: { mode: "P1", step: 0.02 }   # quantize before sending out of secure zone
  # gate: { enabled: false }              # env-gate block (Section 3.1)

Key points:

• manifest_id

  • This ID must appear in every payload the device emits.
  • Anyone with this ID + passport can reproduce e_T and check compliance.

• version

  • Declares which SSMT spec the device claims to follow (for example “1.1”).
  • This is important in audits and in post-incident reviews.

• lens and anchors

  • Hard commitments. If this device says "lens": "log" with T_ref = 298.15, you cannot silently flip to "linear" tomorrow.
  • Silent flips break comparability, and that breaks trust.

• T_valid_range_K

  • Declares the range in which the readings are considered meaningful for this device.
  • Anything outside that range must set health.range_ok := false and tag oor.

• outputs

  • Makes it explicit what leaves the device.
  • For a simple S1 device: only e_T. No a_T, no pooling, no Q_phase.
  • This keeps liability, privacy, and complexity low at start.

This passport travels with the device. If you sell, ship, or redeploy that device, the passport goes with it. That means downstream users can reason about its data without chasing the original vendor.

2.11 Optional — declared auto lens policy (fleet-level, deterministic)
Sometimes one fleet spans wildly different regimes — cryogenic lines, warm habitat modules, high-temperature exhaust. You don’t want 30 different “modes” flipping on the fly. You want one deterministic policy decided at commissioning, then frozen.

That’s what the auto lens policy is for.

High-level rule:

  • You define a small decision tree.
  • You run it once at commissioning (for that stream or that sub-fleet).
  • You record the resolved lens in the manifest.
  • You do NOT re-run it per reading.

Copy-ready shape:

auto_lens_policy:
  enabled: false
  rules:
    - if:   { min_K: "<= 1.0" }      then: { lens: "qlog" }
    - if:   { span_K: ">= 500" }     then: { lens: "log" }
    - if:   { min_K: "< 100" }       then: { lens: "beta" }
    - if:   { span_K: "<= 50" }      then: { lens: "linear" }
    - else: { lens: "hybrid", tau: 5.0 }

  # publish the resolved choice:
  resolved_lens: "log"
  T_qsafe: 1.0   # K threshold for near-zero safety selection

How to read this:

• rules

  • Human-readable criteria like “if the minimum expected Kelvin is below 1 K, force qlog,” or “if we span more than 500 K, force log.”
  • You’re basically encoding common-sense physics + domain constraints into a frozen decision.

• resolved_lens

  • After applying the rules to expected operating conditions, you lock in the final answer (for example "log").
  • That final answer is what actually goes in lens: in the manifest.
  • The rest of the rules are just records of why you chose that lens.

• Why forbidden to auto-switch per reading

  • If lens changes mid-run, yesterday’s e_T = 0.4 and today’s e_T = 0.4 might not mean the same thing.
  • That destroys comparability and ruins downstream ML, policy, and audit.
  • So SSMT says: pick once, publish it, stay with it.

• T_qsafe

  • A practical guard like T_qsafe = 1.0 K lets you declare: “Below this, we consider ourselves in the ‘near-zero Kelvin danger zone’, so use qlog.”
  • This is critical in cryogenics and deep space, where normal log math can blow up near 0 K.

The spirit here is governance, not cleverness. SSMT is not asking you to be fancy. It’s asking you to be honest, up front, and reproducible.

Navigation
Previous: SSMT – Profiles and Upgrade Path (2.7–2.9)
Next: SSMT – Why SSMT Works in the Real World: Zero Drama, Safety Dials, Fleet Control (3.1–3.3)

Directory of Pages
SSMT – Table of Contents