Engineering Standards (the codified quality bar)

The standards a Head of Engineering owns and defends — each justified by the incident class it prevents (P12 Ch. 4). Standards justified by incidents stick; by authority, rot.

Kernel PR checklist (Phase 02)

  • Correctness: reference-comparison test within tolerance + compute-sanitizer clean
  • Honest timing: CUDA events, warmup, median of N, fixed clocks noted
  • Limiter evidence: ncu before/after naming the bound that moved
  • Portability: archs tuned on; occupancy impact noted
  • Prevents: fast-but-wrong kernels, unexplained "speedups" that are measurement bugs.

Runtime contract (Phase 05)

  • No driver alloc/free in steady-state request paths (CI-enforced)
  • Stream-ordered lifetime only (no raw "free now")
  • Pool segregation + reserved/allocated/largest-block metrics exported
  • No device-wide syncs in engine code (lint)
  • Prevents: day-3 fragmentation OOM, cross-stream use-after-free, false serialization.

ABI & conformance discipline (Phase 09)

  • Backend ABI: version-first, append-only, reserved fields
  • Every backend passes the conformance suite (correctness + perf tier)
  • Capability declarations tested, not trusted
  • Prevents: vendor backends breaking on releases, lowest-common-denominator abstraction, declared-but-broken capabilities.

Release gates (Phase 10)

  • Compatibility gate (driver/CUDA/engine matrix) pre-deploy
  • Statistical canary → progressive rollout → auto-rollback on SLO burn
  • Error-budget-governed release pace
  • Prevents: driver-skew fleet incidents, regressions reaching production, "ship and pray."

Security-claim discipline (Phase 11)

  • Every protection stated with its defeat condition; never "uncrackable"
  • Sign licenses, encrypt data; private key in HSM
  • Attestation/confidential computing for high-stakes (not self-checks alone)
  • Prevents: credibility loss with regulated customers, overselling security.

Observability baseline (Phase 10)

  • Correct gauge/counter semantics; bounded label cardinality
  • Alert on SLOs (page) + cause-signals that predict death (Xid/ECC)
  • Every page actionable + has a runbook
  • Prevents: misleading dashboards, alert fatigue, 3am surprises.

How to defend a standard

When a team finds a rule pedantic, cite the incident class it prevents — not your title. Each line above maps to a specific failure from the phases. A standard without a "this exists because of X" is a candidate for deletion.