fix(galadriel): bind reciprocal producer evidence

.env.example

@@ -42,6 +42,9 @@
 # CREBAIN_GALADRIEL_ENABLE=0
 # CREBAIN_GALADRIEL_REALM=example/ncp
 # CREBAIN_GALADRIEL_PRODUCER_ID=crebain-example
+# Required when enabled: operator-provisioned, key-safe 1..=64 byte session ID.
+# Provision a new unique value for every process lifetime; CREBAIN checks syntax only.
+# CREBAIN_GALADRIEL_EPOCH=deployment-boot-0001
 # CREBAIN_GALADRIEL_REGISTRY_PATH=/absolute/path/to/deployment-registry.json
 # CREBAIN_GALADRIEL_REGISTRY_DIGEST=<lowercase-canonical-registry-sha256>
 # CREBAIN_GALADRIEL_FRAME_ID=1

CHANGELOG.md

@@ -147,10 +147,13 @@ Open-source readiness and quality hardening.
   safe-action selection, adapter hook, or I/O and is not an active watchdog.
 - **Opt-in Galadriel live evidence producer.** A binary compiled with the
   off-by-default `ncp` feature can, only when
-  `CREBAIN_GALADRIEL_ENABLE=1`, start a managed producer that writes frozen
+  `CREBAIN_GALADRIEL_ENABLE=1` and an explicit key-safe
+  `CREBAIN_GALADRIEL_EPOCH` is supplied, start a managed producer that writes frozen
   sidecar and producer-monitor envelopes to the exact `galadriel-pid` and
   `galadriel-monitor` named-perception keys. Enabled startup fails closed on a
-  strict canonical registry mismatch, selected frame/context mismatch, actual
+  missing/malformed epoch, strict canonical registry mismatch, conflicting
+  immutable content-identifier or projection-algorithm-version digests,
+  selected frame/context mismatch, actual
   effective-fusion-config digest mismatch, actual running-executable digest
   mismatch, malformed queue/heartbeat policy, or secure-mode Zenoh open error.
   Fusion processing now builds one deterministic frozen-prior ledger with

README.md

@@ -319,6 +319,7 @@ prove a deployed Galadriel receiver, TLS/mTLS identities, ACLs, or delivery. See
 | `CREBAIN_BACKEND` | Force a backend: `coreml`, `mlx`, `tensorrt`, `cuda`, `onnx` |
 | `CREBAIN_ENABLE_EXPERIMENTAL_MLX` | Required gate for any MLX use |
 | `CREBAIN_GALADRIEL_ENABLE` | Exact runtime gate (`1`) for a Galadriel producer compiled with `ncp`; enabled startup also requires the documented registry/config/executable/NCP pins |
+| `CREBAIN_GALADRIEL_EPOCH` | Required enabled, operator-provisioned key-safe process-session identity; deployment must make it unique per process lifetime |
 
 The full environment-variable reference, detection/guidance settings, scene
 and asset limits, and the platform matrix are in

docs/CONFIGURATION.md

@@ -26,6 +26,7 @@ the trust-sensitive variables in [../SECURITY.md](../SECURITY.md).
 | `CREBAIN_GALADRIEL_ENABLE` | Exact runtime opt-in for the Galadriel evidence producer in a binary compiled with Cargo feature `ncp`; a non-feature binary fails startup when set to `1` | Absent/`0` off; exactly `1` on |
 | `CREBAIN_GALADRIEL_REALM` | Required enabled NCP realm for both evidence routes | Key-safe NCP realm |
 | `CREBAIN_GALADRIEL_PRODUCER_ID` | Required declared producer identity in each envelope; this string is not by itself a TLS-principal binding | Key-safe identity segment |
+| `CREBAIN_GALADRIEL_EPOCH` | Required operator-provisioned session identity used in both evidence keys; syntax validation does not prove uniqueness or anti-rollback | One key-safe UTF-8 segment, `1..=64` bytes; provision a new unique value for each process lifetime |
 | `CREBAIN_GALADRIEL_REGISTRY_PATH` | Required enabled path to the strict, bounded deployment registry | Readable JSON file, at most 1 MiB |
 | `CREBAIN_GALADRIEL_REGISTRY_DIGEST` | Required expected canonical registry digest | 64 lowercase SHA-256 hex characters |
 | `CREBAIN_GALADRIEL_FRAME_ID` | Required selected frame in the registry | Decimal JSON-safe positive integer |
@@ -66,15 +67,22 @@ The standard release workflow currently omits that feature. An absent/`0` switch
 opens no producer session; an ambiguous value or `1` in a non-feature binary
 fails startup.
 
-Enabled startup validates the registry, selected identities, effective fusion
-configuration, and running executable before opening the secure-mode NCP Zenoh
-session. The effective configuration is the parsed/default `FusionConfig` after
+Enabled startup validates the explicit process epoch, registry, selected
+identities, effective fusion configuration, and running executable before
+opening the secure-mode NCP Zenoh session. The effective configuration is the
+parsed/default `FusionConfig` after
 the `CREBAIN_PID_JSONL` innovation-emission override. Its fully materialized
 compact JSON SHA-256 must equal both the environment pin and selected registry
 context. The actual running executable file SHA-256 must likewise equal the
 environment and context software pins. Provision the latter from the final
 post-signing/post-packaging executable.
 
+CREBAIN does not mint the process epoch. Deployment orchestration must set
+`CREBAIN_GALADRIEL_EPOCH` to a new unique value for every process lifetime and
+must prevent reuse across restarts. The producer validates only that the value
+is one key-safe `1..=64` byte segment; it cannot prove freshness, durable
+uniqueness, or anti-rollback.
+
 Once active, the startup-loaded fusion engine is immutable for the producer
 epoch. Renderer `fusion_init` calls are readiness checks and their supplied
 defaults are ignored; `fusion_set_config` accepts only the already pinned

docs/GALADRIEL_PRODUCER.md

@@ -31,6 +31,7 @@ Every enabled deployment requires:
 |---|---|
 | `CREBAIN_GALADRIEL_REALM` | NCP realm used to construct both evidence keys |
 | `CREBAIN_GALADRIEL_PRODUCER_ID` | Declared, key-safe producer identity carried in envelopes |
+| `CREBAIN_GALADRIEL_EPOCH` | Operator-provisioned `1..=64` byte key-safe UTF-8 session segment used in both evidence keys |
 | `CREBAIN_GALADRIEL_REGISTRY_PATH` | Path to the bounded deployment-registry JSON |
 | `CREBAIN_GALADRIEL_REGISTRY_DIGEST` | Lowercase SHA-256 of the registry's canonical JSON form |
 | `CREBAIN_GALADRIEL_FRAME_ID` | Positive JSON-safe frame identifier present in the registry |
@@ -39,6 +40,12 @@ Every enabled deployment requires:
 | `CREBAIN_GALADRIEL_CONFIGURATION_DIGEST` | Lowercase SHA-256 expected for the effective fusion configuration and selected registry context |
 | `NCP_ZENOH_CONFIG` | Readable NCP Zenoh configuration used by secure mode |
 
+CREBAIN does not mint or persist the epoch. Deployment orchestration must
+provision a new unique `CREBAIN_GALADRIEL_EPOCH` for every process lifetime and
+prevent reuse across restarts. Startup proves only that the supplied value is a
+single key-safe segment; it does not prove freshness, durable uniqueness, or
+anti-rollback.
+
 `CREBAIN_GALADRIEL_FUSION_CONFIG_PATH` is optional. When present, it names a
 nonempty JSON file of at most 64 KiB. `FusionConfig` rejects unknown and duplicate
 fields, validates numeric and cardinality bounds, materializes serde defaults,
@@ -89,7 +96,9 @@ trust anchor only when the deployment protects it independently.
 
 The registry itself is limited to 1 MiB, rejects unknown fields, is normalized
 and hashed canonically, and fixes the selected frame/context, applicability,
-expected modalities, opportunity policy, and queue ceilings. Content references
+expected modalities, opportunity policy, and queue ceilings. Repeated immutable
+content identifiers must retain one digest globally, and repeated projection
+algorithm identifier/version pairs must retain one digest. Content references
 inside it are declarations: CREBAIN does not fetch or hash referenced
 calibration, transform, or projection-algorithm artifacts. The executable and
 effective fusion configuration are the only referenced deployment artifacts
@@ -112,8 +121,8 @@ The four lane capacities must also fit the aggregate monitor-event cap of 8,192.
 
 The registered `fusion_process` command remains the fusion entry point. In an
 enabled deployment it additionally constructs and admits one immutable frame
-ledger. It can write only these named-perception keys for its fresh process
-epoch:
+ledger. It can write only these named-perception keys for its explicitly
+configured process epoch:
 
 ```text
 {realm}/session/{epoch}/sensor/galadriel-pid

docs/HAZARD_LOG.md

@@ -33,7 +33,7 @@ No hazard in this baseline is controlled or accepted. Every P0 entry blocks L1.
 | HAZ-010 | Model failure or miscalibration creates an unsafe decision | P1 | open | Signed model contract; calibrated advisory use only |
 | HAZ-011 | Missing, censored, stale, or dropped evidence appears nominal | P0 | partial | Producer outcomes/misses/summaries, strict time eligibility, upstream/track-cap loss degradation, sequence gaps, lane counters, and heartbeat semantics exist; wire numeric attribution and receiver enforcement remain absent |
 | HAZ-012 | Resource exhaustion starves watchdog or emergency handling | P0 | partial | One monitor owns one worker/slot, and other kernel/data bounds exist; global monitor count, JSONL blocking, scheduler reservation, and combined-load/deadline timing remain unresolved |
-| HAZ-013 | Restart or reconnect resurrects stale authority | P0 | partial | Process-local generation guards, caller-reported monitor generation mismatch, and fresh producer epochs exist; the apply observation adds no evidence because generation equality neither binds its command to the health vehicle/frame instance nor proves durable currentness; autonomous rotation observation, durable boot/session anti-rollback, and topology restart tests remain absent |
+| HAZ-013 | Restart or reconnect resurrects stale authority | P0 | partial | Process-local generation guards, caller-reported monitor generation mismatch, and an explicit key-safe producer-epoch input exist; the apply observation adds no evidence because generation equality neither binds its command to the health vehicle/frame instance nor proves durable currentness; deployment-proven epoch uniqueness, autonomous rotation observation, durable boot/session anti-rollback, and topology restart tests remain absent |
 | HAZ-014 | Operator confuses connected/delivered with applied/observed | P1 | open | Controlled vocabulary and distinct authority/effect UX |
 | HAZ-015 | Gazebo/local mutation contaminates flight evidence | P1 | partial | Separate binaries, identities, profiles, and evidence labels |
 | HAZ-016 | Mission, mode, arm, takeoff, land, or disarm bypasses policy | P0 | open | Typed hazardous-action transaction or exclusion from L1 |
@@ -158,7 +158,8 @@ loss retains the newest bounded inputs; registry trimming and whole-cluster
 track-capacity rejection latch degraded/truncated frame state. Sparse finite-edge
 assignment and maximum all-infinite short-circuit behavior are component-tested.
 The producer also exposes sequence gaps and sticky degradation, generates
-heartbeats, and uses a fresh randomized process epoch. This narrows
+heartbeats, and requires an explicit key-safe process epoch. Deployment remains
+responsible for making that value unique and preventing reuse. This narrows
 HAZ-009/011/012/013 mechanics, but no P0 hazard is
 controlled: there is no deployed Galadriel tap/assembler, registry agreement,
 authenticated principal binding, proven router/receiver receive-size policy,

docs/NCP_BRIDGE_HANDOFF.md

@@ -16,7 +16,7 @@ standalone. NCP is not on the default runtime path:
 |---------|---------------|
 | Rust `src-tauri/src/ncp/mod.rs` | Compiles only with the off-by-default `ncp` feature; provides `NcpBridge`, validated feature-neuron RPCs, and a wired fail-closed `CommandPlant` action loop as library APIs |
 | Rust Tauri commands | Defined, but `NcpHandle` is not managed and the four `ncp_*` commands are not registered |
-| Rust Galadriel producer | Compiles with `ncp`; managed by the app only when `CREBAIN_GALADRIEL_ENABLE=1` and all registry/config/executable pins pass; writes only two named perception evidence routes |
+| Rust Galadriel producer | Compiles with `ncp`; managed by the app only when `CREBAIN_GALADRIEL_ENABLE=1`, an explicit key-safe process epoch is supplied, and all registry/config/executable pins pass; writes only two named perception evidence routes |
 | TypeScript `src/neuro` | Thin guarded re-export of `@sepahead/ncp`; imported by no product component/hook |
 | Vite-dev `window.__ncpDrone` | Manual in-browser wire-shaped command injection; no NCP transport/session; absent from production builds |
 | Live CREBAIN↔Engram action/control loop | Not implemented or enabled |
@@ -139,8 +139,9 @@ product integration updates the registry, Tauri handler, tests, and UI together.
    executable integration documentation.
 
 The Galadriel producer does not complete any item in this action/authority list.
-Its remaining deployment work is receiver-side tap/assembler and registry
-agreement; actual TLS identities/certificates/ACLs; principal-to-`producer_id`
+Its remaining deployment work is to run the available receiver-side
+tap/assembler on the exact topology and retain registry-agreement evidence;
+actual TLS identities/certificates/ACLs; principal-to-`producer_id`
 binding; and loss, reorder, duplicate, restart, saturation, heartbeat-deadline,
 and shutdown evidence on the exact topology.
 

docs/RELEASE_ACCEPTANCE.md

@@ -26,7 +26,7 @@ target environment.
 | Zenoh limitations | Every ROS telemetry topic/plain-key topology and both NCP evidence keys are documented/tested separately; unsupported services/custom arrays remain explicit; a re-key bridge is present for direct `rmw_zenoh_cpp` claims | Treating `RMW_IMPLEMENTATION=rmw_zenoh_cpp` alone as interoperability, treating secure config loading as TLS/ACL proof, or widening the evidence writer into generic publish/service authority |
 | Sensor fusion | Config plus 512-measurement/1,024-live-track and numeric/string/metadata envelopes pass; newest-preserving upstream/registry admission, whole-cluster track-cap rejection, strict sensor-clock/exact-time rules, deleted-channel purge, invalid-gate refusal, sparse components, and all-infinite assignment are exercised; disconnect/coast/expiry behavior remains covered | Invalid config, unbounded growth, false hit credit, stale track/time state, overlapping cycles, rejected input poisoning the renderer clock, fabricated v1/gate evidence, executing unverified transform references, or claiming component assignment tests as deployed deadline evidence |
 | NCP action/control opt-in | Default runtime remains independent; NCP feature compiles/tests; missing secure config fails closed; quiet development is explicit; lifecycle `ok`, payload/command bounds, subscriber cleanup, raw ESTOP, malformed dev-call HOLD, per-entity sequencing, TTL, and final-HOLD failure reporting are tested | Registering/invoking dormant action paths accidentally, accepting inferred success, sharing action state across entities, or claiming a live Engram/action/TLS-secure loop without deployment evidence |
-| Galadriel producer opt-in | Default artifacts omit `ncp`; non-feature `ENABLE=1` fails; feature build absent/`0` opens no producer; exact `1` validates strict bounded registry/config, selected IDs, canonical registry pin, actual effective-config and executable three-way pins; active initialization is readiness-only and replacement requires the same digest; frozen routes/codecs, exact-time/projection eligibility, upstream/capacity degradation, bounded lanes/sequence gaps, heartbeat generation, put timeout, and finite owned-task shutdown are tested | Missing/malformed/mismatched pins do not fail before session open; runtime config can drift; any key widens; upstream/queue drops appear nominal; log-only numeric upstream loss is treated as receiver-visible; `published` is called received; the separate JSONL writer is treated as forcibly aborted; or component tests are presented as TLS/ACL/receive-size, receiver, combined-load/heartbeat-deadline, calibration, scientific, or authority evidence |
+| Galadriel producer opt-in | Default artifacts omit `ncp`; non-feature `ENABLE=1` fails; feature build absent/`0` opens no producer; exact `1` validates an explicit key-safe process epoch, strict bounded registry/config and global immutable content identities, selected IDs, canonical registry pin, actual effective-config and executable three-way pins; active initialization is readiness-only and replacement requires the same digest; frozen routes/codecs, exact-time/projection eligibility, upstream/capacity degradation, bounded lanes/sequence gaps, heartbeat generation, put timeout, and finite owned-task shutdown are tested | Missing/malformed/mismatched pins do not fail before session open; runtime config can drift; any key widens; upstream/queue drops appear nominal; log-only numeric upstream loss is treated as receiver-visible; `published` is called received; the separate JSONL writer is treated as forcibly aborted; or component tests are presented as TLS/ACL/receive-size, receiver, combined-load/heartbeat-deadline, calibration, scientific, or authority evidence |
 | PID JSONL | Candidate proves local append/parser/basic NIS behavior, whole-batch validation/serialization before first write, flush-error propagation, and documents `ncp` startup preflight, the effective-config-pin change, regular-local-file policy, synchronous no-producer command latency, active capacity-16 drop-new archive admission, permanent degradation/worker termination on I/O failure, and the two-second writer shutdown wait | FIFO/device/socket/remote-mount use; missing saturation/exit/partial-OS-write evidence; claiming the batch write is filesystem-atomic or a blocked standard writer is forcibly aborted; or claiming Galadriel correlation, PID control, ACL, versioned streaming, or live NCP from JSONL-only tests |
 | Manual smoke | `docs/MANUAL_SMOKE_TEST.md` records target platform/model/topology and has no release blocker | Critical path incomplete, inconsistent diagnostics, data loss, or unsafe boundary behavior |
 | Performance claims | Clean exact source plus the release-command report and its digest, approved model/fixture identities, external target hardware/runtime record, trusted baseline digest, pre-approved threshold, and raw samples are archived | Any numeric claim without candidate-specific evidence; treating declared source/hardware or a provider label as attestation; baseline digest obtained from the file under test; reusing a result across materially different identities |