feat: add guarded hardware-submit candidate

[rblake2320]

Scope

Implements the guarded focus + hardware-submit candidate tracked by issue #22. This PR remains draft and unmerged, does not close #22, and makes no production-readiness, HA, process-identity, or Windows Terminal per-tab claim.

R7 Durable Protocol

• Stable receiver operation identity is the authenticated SHA-256 of the exact canonical semantic operation: message/challenge, input digest and byte count, logical peers, and the closed nested target identity. Request/response key IDs, timestamp, and attemptNonce are attempt metadata and are excluded.
• The receiver durably persists that full-operation digest at first admission and exact-compares every retry. A changed target or input length is rejected and cannot mint an ACK for a completed prior operation.
• Every authenticated attempt has a fresh CSPRNG nonce and timestamp. Attempt consumption commits before operation lookup, so exact replay remains denied after a binding rejection or crash.
• Fresh in-window attempts recover the same completed decision after the original request expires. Processing remains single-claimant and never resubmits the physical processor.
• Receipts are freshly signed per attempt and bind the stable operation digest, selected response key, attempt nonce, ACK nonce, decision, requested digest, and processor-attested digest.
• Request-auth and response-signing keys are independent. Rotation may change either key for an unchanged operation; revoked or expired response keys fail before admission. Peer IDs use a nonempty bounded safe-ASCII grammar and message IDs are exact lowercase UUID hex.

Storage And Audit

• Sender schema v3 and receiver schema v3 attest exact canonical sqlite_master table definitions, ordered columns/types/nullability/PKs, exact UNIQUE sets, and absence of extra persistent indexes/triggers.
• CHECK text hidden in comments, missing or extra uniqueness, and an AFTER INSERT audit-rewrite trigger are rejected.
• Unknown future versions refuse before database mutation. Only exact recognized legacy catalogs migrate; nonempty legacy receiver state requires governed offline migration.
• Both stores attest actual journal_mode=DELETE and synchronous=FULL. ACK nonces are globally unique; receiver attempt nonce and request digest are durable unique keys.
• Receiver authority rows are trusted-storage state, not independently authenticated row-by-row. Direct same-account database mutation is outside this candidate claim because that identity can also replace the running code; changed-operation rejection assumes this authority store remains untampered.
• Sender finalization persists and operation/receipt-binds the canonical strict audit envelope with the authenticated receipt. A pending retry ignores caller event content and audits only the revalidated stored envelope.
• The evidence file receives an owner-logon-SID/SYSTEM DACL. Its parent directory is an explicit deployer-controlled precondition and is not attested; parent replacement, same-logon administrators, and off-host compromise remain outside scope.

Authority, Deadline, And Pipe Boundary

• The claim is limited to exported guarded_submit running in a trusted, non-monkeypatched interpreter. Private helpers, test harnesses, module mutation/reflection, interpreter compromise, and hostile same-process code are outside scope.
• Physical authorities must implement the bounded deadline contract. Unbounded injected authorities are refused before invocation.
• Production body, focus, and checked 2/2 Enter share one monotonic deadline. The implementation checks the deadline immediately before each native call; an entered native call may finish after the deadline.
• A post-call expiry is fail-closed but ambiguous: the call may already have taken effect. This PR does not guarantee that an entered native call completes before the deadline and does not claim cancellation of native effects.
• Processor stdin and bounded 4096-byte stdout run asynchronously under the same deadline. A non-reading child cannot block indefinitely, and the direct child is killed without fixed post-deadline joins.
• Descendants are prohibited by contract but are not contained or recursively terminated.
• Pipe ABI setup is locked and one-time. OVERLAPPED connect/read/write/confirmation retains structures, closures, and native buffers until kernel completion.
• Win32 security calls use explicit pointer-width ctypes prototypes, including ImpersonateNamedPipeClient, RevertToSelf, and SetFileSecurityW.

R7 Attack Coverage

• good pending envelope + audit failure + evil retry cannot replace durable intent
• CHECK-comment spoof, extra trigger, and malformed UNIQUE catalogs fail attestation
• unbounded hung physical authority is refused without invocation
• 12 KiB stdin to a non-reading child returns at the 100 ms processor deadline
• exact attempt replay, binding conflict, post-freshness recovery, lease takeover, and global ACK nonce collision
• changed target/input length under a completed operation, old request/ACK schemas, unsafe or unbounded IDs, old/new and new/new real pipe signing, and revoked/expired response-key denial

Validation At 99013fd

• implementation head captured by the refreshed evidence: 4355898d4f11f91a73e926b3cbdaf83ed7bf47ea; later commits bind evidence metadata and claims only
• targeted Ruff: pass
• focused guarded protocol + Windows suite: 144 passed, 1 skipped
• full suite: 806 passed, 10 skipped
• full release gate with tests, Ruff, and wheel: 48 passed, 0 failed, 0 warned
• explicit interactive Windows proof: 1 passed with 34/34 Unicode console records, 2/2 Enter events, authenticated stable full-operation digest, per-attempt response-key binding, durable stores, and stale-HWND refusal
• hosted CI run 29653545602: passed on exact head (all jobs and substantive steps successful)

Candidate evidence: experiments/win32_probe/results/guarded_hardware_submit_LIVE_PASS_redacted.json (selfconnect.guarded-hardware-submit-live.v5). The artifact records source digest 2fb046a12d19cc89be5c2807c119bb8513caaa3752fffd0a21401bd599bae9b5 and prior implementation head 4355898d4f11f91a73e926b3cbdaf83ed7bf47ea. Issue #22 remains open.