PhysicalQuasicrystallineClock -- Design

The physical clock is the operational form of QuasicrystallineClock. The logical Lean spec lives at open-source/gnosis/lean/Lean/ForkRaceFoldTheorems/QuasicrystallineClock.lean and proves drift bounds in the abstract; this module instantiates that spec against real wall-clock hardware.

Architecture

process.hrtime.bigint()              <-- nanosecond monotonic source
        |
        v
  delta = ts - epoch                 <-- relative ns since clock construction
        |
        v
  index = floor(delta / scale)       <-- bucket into lattice units (~100ms)
        |
        v
  witness = (F[n-1], F[n], F[n+1])   <-- Cassini triple at index n
        |
        v
  PhysicalClockReading               <-- exchanged on the wire

The encoding is additive over the existing logical clock: it imports evaluatePhase and pisotF from the same primitives that pisotCassini and frf_master are built on, so any reading produced by the physical clock can be plugged directly into the existing fork/race/check pipeline.

Mapping ns -> Pisot index

encodeIndex(deltaNs) divides nanoseconds by LATTICE_SCALE_NS (100_000_000 ns = 100 ms) and wraps modulo PHYSICAL_CLOCK_INDEX_CAP = 60 to keep Fibonacci values inside the precomputed table from betti/pisot-primitive.

The cap is the only number that matters for safety. With a 100 ms bucket:

• 60 lattice units = 6 seconds before wraparound
• max accepted drift defaults to 1000 lattice units, then circular distance caps the meaningful spread at cap/2 = 30 units (= 3 s)

For longer windows, raise the cap (and the Fibonacci table in betti/pisot-primitive) or move to a 64-bit Cassini representation.

Drift model

The relevant theorem is drift_bounded_k_rounds (§8 of the Lean spec): under a per-round Lipschitz-1 metric on the lattice, the cumulative drift of an honest clock over k rounds is <= k.

Plugging in real numbers:

• Bucket width: 100 ms per lattice unit
• NTP-style jitter: typically +/-50 ms (well-conditioned LAN: +/-1-5 ms)
• Cassini margin: +/-1 lattice unit

Because |jitter| < bucket / 2, two honest clocks polled "at the same time" either land on the same bucket or on adjacent buckets -- exactly the gap-1 Cassini phase the kernel-level evaluatePhase already gates on. The operational drift bound is therefore the same <= k bound the Lean theorem gives, with k measured in poll rounds.

The validate() two-stage gate is:

1. Cassini check -- the witness triple must satisfy F[n+1]*F[n-1] = F[n]^2 +/- 1, and the triple must match the claimed index. This rejects bit-flipped or fabricated readings.
2. Drift check -- circular distance between local index and remote index must be <= maxDrift.

Use cases

• Distributed inference layer node coordination -- coordinator and 10 layer nodes each emit a PhysicalClockReading per token; coordinator fork/races them and folds with validate() instead of trusting raw timestamps.
• Knotgraph batch flush timestamps -- writers tag each batch with a reading; readers refuse to interleave batches whose witnesses fail Cassini.
• Dashrelay event ordering -- readings provide a Lipschitz-1 ordering that is robust to small NTP perturbations without a coordinator.

Open follow-ups

• Hardware timestamps (PTP) -- replace process.hrtime.bigint() with a PTP-disciplined source (chrony / linuxptp) and tighten LATTICE_SCALE_NS to 1 ms.
• GPS clock as ground truth -- treat a GPS-PPS edge as an authoritative reading and sync() against it.
• Real network jitter test -- run two clocks across a real LAN/WAN link and characterize the empirical drift histogram against the Cassini margin.
• Wraparound elimination -- replace the modulo-cap encoding with a true big-int Fibonacci index (no cap), at the cost of a larger witness payload.
• 64-dim Pisot lattice -- combine Phi/Pell/Tribonacci as in the 3D logical clock so the witness encodes phase across multiple gears.