Decision requested

Approve an implementation plan for the dedicated suite host selected by #9 and ADR 0001. This issue specifies the first safe slice: a separate process/package running in read-only shadow mode. It does not authorize creating a repository, publishing a package, or enabling outbound writes.

Why this is P0 before host-attested use

table-kit currently publishes table.event/1.0 and table.evaluation/1.0, and the four tools have installed-package conformance gates (#7, #8; PRs #11–#15). Those contracts correctly label current evidence self_attested. No existing tool can truthfully mint host_attested results because no independent principal owns the protected session descriptor, durable source cursors, evaluator execution, and result commit.

MVP boundary

The host MUST run under a service/OS identity distinct from adapters and evaluators and MUST own:

• protected session descriptors and immutable descriptor digests;
• append-only canonical TableEvent storage;
• per-source durable cursors and replay/idempotency records;
• evaluator configuration/policy digests and invocation records;
• committed EvaluationResult envelopes and audit metadata;
• export/deletion/retention state.

Adapters may submit observations and source-native IDs but may not advance canonical cursors. Evaluators may read a bounded event snapshot and return a candidate result but may not attest or commit it. The shadow MVP receives no Discord/VTT post credential and exposes no write-to-table capability.

Protected session descriptor

Define and version a machine-readable descriptor containing at minimum:

• campaign ID, session ID, creation/close timestamps;
• roster, normalized principals, roles, and source-identity bindings;
• system/edition and canonical source-set selection;
• enabled evaluators, versions, policy/config digests;
• consent, visibility, retention, export, and deletion policy;
• source instances and required event families;
• descriptor version, digest, and supersession lineage.

Changes create a new digest and explicit supersession record; they never rewrite prior evidence authority.

Ingestion and commit protocol

1. Adapter submits a page with source instance, source-native IDs, prior cursor, ordering evidence, and TableEvents.
2. Host validates schema, descriptor binding, identity, contiguity, duplicate/replay semantics, and required redaction metadata.
3. Host atomically commits accepted events and the next cursor. Any gap, fork, malformed row, or partial write leaves the prior cursor authoritative and records a typed refusal.
4. Host invokes each evaluator against an immutable event range plus descriptor/config/policy digests.
5. Host validates semantic invariants, evidence references, coverage, and evaluator identity before committing the result.
6. authority_status=host_attested is allowed only when the committed envelope carries the host binding required by table.evaluation/1.0; otherwise it remains self_attested or unknown.

Recovery and lifecycle requirements

• exactly-once effects over at-least-once delivery;
• deterministic replay and byte-stable result reproduction for the same inputs;
• crash recovery before/after event write, cursor commit, evaluator return, and result commit;
• explicit rotate/truncate/fork/source-reset handling; never infer continuity;
• restart-safe session open/close and late-event behavior;
• correction and human-ruling events remain distinct from machine findings;
• consent withdrawal, scoped export, retention expiry, and deletion produce auditable tombstone/control records without silently rewriting prior outputs.

Minimum operator/agent surface

The implementation MAY choose CLI, local API, or both, but must provide typed, machine-readable operations equivalent to:

• initialize host storage;
• create/read/supersede/close a session descriptor;
• ingest and query source progress;
• request evaluation and read committed results;
• export/delete according to descriptor policy;
• inspect health and recovery state.

Human prose must be additive; an AI agent must not have to parse logs to know success, refusal, incompleteness, or next action.

Acceptance criteria

• Architecture records the process/package and repository decision without making table-kit the trusted host.
• Descriptor schema, canonical digest rules, and compatibility policy are reviewed.
• Capability matrix proves adapters/evaluators cannot mint attestation or advance canonical state.
• One table-kit stream and dmcheck evaluation complete end to end in shadow mode.
• CharacterCheck and SRDCheck candidates are accepted through the same generic evaluator boundary.
• Gaps, duplicates, replay, forks, malformed/redacted required content, mixed sessions, unknown event types, and evaluator failure all fail closed.
• Kill-point tests cover event/cursor/result atomicity and restart recovery.
• Credential-isolation test proves the shadow host cannot post to a table.
• Descriptor forgery, evaluator impersonation, cursor rollback, result replay, and storage tamper tests cannot yield host_attested output.
• Export/deletion/retention and consent transitions have deterministic tests.
• Installed-artifact four-tool conformance remains green.
• The pilot in the companion UXR issue can run without privileged manual database edits.

Explicit non-goals for this issue

• outbound Discord/VTT posting;
• autonomous DM rulings or changes to game state;
• public package release;
• choosing a repository/package name before approval;
• claiming production readiness from synthetic fixtures alone.

Dependencies and closure

Depends on #7, #8, and #9. Close only when an independently protected implementation passes the adversarial acceptance suite and produces a valid host-bound shadow result. Contract publication or another in-process adapter is not sufficient.