Spatiax

cantools already exists and is trusted, so a new CAN decoder is only worth building if it is demonstrably correct rather than merely plausible. The previous version of this repository made the point for me: three bugs in its decoder produced traces that looked entirely reasonable — a DBC parser that loaded every message with zero signals, Motorola bit extraction that walked bits the Intel way, and extended identifiers parsed without masking the DBC flag bit. In telemetry that is the expensive kind of wrong, because nobody re-checks a trace that looks fine; an engineer chases a fault that does not exist and it costs a test session.

I deleted 8,200 lines across six crates and rebuilt one library whose product is its evidence. Correctness is checked four independent ways on every CI push: reference vectors computed by hand, property tests over every signal layout from 1 to 64 bits in both byte orders, a differential harness that generates valid databases and frames and requires exact agreement with cantools, and the parser run over a corpus of real production vehicle databases pinned by commit. Each oracle is fetched rather than vendored, and CI fails when one is missing, so no layer of the evidence can quietly decay into a no-op.

52 of 58 real production databases parse, and on the 49 cantools also accepts the two implementations agree field-for-field across 3,242 messages and 23,985 signals with no differences — a comparison that found three real parser bugs the first time it ran. The decode path allocates nothing and benchmarks at 25M frames/s, and an exported MoTeC .ld file opens in i2 Pro with its session and channels intact. Every published number has a command that reproduces it, and CI re-derives them on each push.