One accelerator contract, three kinds of silicon.

The object model is small on purpose: contexts, buffers, programs, execution queues, submissions, and events. Everything else is built out of those six.

Most protocol proposals stop at the document. This one ships the guest, device, transport, queue, and TOSA layers as working no_std Rust, and three host backends that put the same artifact on real hardware. You can read the spec, but you can also run it.

The portable layers know nothing about Linux ioctls, macOS frameworks, Windows APIs, guest physical addresses, or vendor command formats — which is the whole point. The part nobody should have to rewrite per platform doesn't get rewritten per platform. Host integrations live in adapter crates the facade never depends on.

This is pre-standardization work and it claims no Virtio device ID. Protocol 1.0 is stable enough to build against and to argue with; it is not an approved Virtio specification.

Fifteen crates, published together in dependency order, with dependencies pointing downward only. Each is pinned to a portability tier that CI enforces by building for bare-metal aarch64, riscv64, and wasm32 — so a core crate cannot pick up a host dependency without the build noticing.

Eleven forbid unsafe outright. The three host adapters forbid it everywhere except their own platform, where the FFI stays in a single audited module. The TOSA crate denies rather than forbids, which lets the official generated FlatBuffers accessors live in a private module behind bounded verification instead of hand-rolling a parser for a format someone else already specified.

Fixed headers and payloads for device discovery, contexts, buffers, programs, execution queues, submissions, and events. Two decisions shape most of the API.

Unknown values stay raw. Unrecognized opcodes, statuses, and event states remain integers until something validates them, so decoding a hostile byte stream can never construct an invalid Rust enum. And failure still returns an event: a successful submit yields one, and an indeterminate failure must too, because the device still owns those resources and someone has to be able to ask what became of them. Object IDs are opaque, kind-tagged, generational, and never reused once a generation is exhausted.

Two codecs read every canonical frame — the primary zerocopy ABI, and a clean-room implementation written without the shared protocol types. They exchange bytes and nothing else, so the cross-check is genuinely independent and never becomes a production dependency.

The device side doesn't have to be Rust. include/virtio_accel.h is a packed C projection of the wire contract — a projection, not a plugin ABI. CI compiles it as C11 and C++11 and derives its size, alignment, and offset assertions from the same frozen layout manifest the Rust structures are checked against, so neither side can drift on its own.

Implement the Accelerator contract from virtio-accel-core, then run the semantic suite against it. The suite is transport-free — no wire format, no virtqueue, no OS, no vendor SDK — and it checks the things that are easy to get subtly wrong: memory sharing, transfer permissions, context isolation, cancellation races, resource lifecycle.

There is a fault-injection harness for the paths you cannot reach on purpose, and optional hooks for resource accounting and progress reporting. If you would rather wrap an existing provider than write a backend from scratch, the vAccel adapter crate gives you that seam with the copy-path counters already in place.

Disagreement is welcome, including with the frozen decisions — a reasoned objection is worth more than a workaround built on top of one. Wire changes get classified before any code merges.

MSRV is 1.85 on edition 2024, checked in CI. MIT or Apache-2.0, your choice, contributions dual-licensed on the same terms, and no separate CLA.