feat(evidence): refuse untrusted payloads as estimator authority

ARCHITECTURE.md

@@ -61,6 +61,7 @@ boundaries above remain the target modular MSA architecture.
 | `tepp_simulation` | known-truth temporal/event data generation |
 | `validation_core` | RMSE, bias, coverage, graph, and Monte Carlo metrics |
 | `tepp_api` | versioned DTO, schema, and export contracts |
+| `payload_semantics` | untrusted payloads are not estimator or posterior authority |
 
 No crate exposes placeholder production behavior in Task 1. This prevents an
 empty façade from becoming a de facto public API before its invariants and tests

CHANGELOG.md

@@ -6,6 +6,8 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ### Added
 
+- `payload_semantics` scientific-role gate: documents, external metadata, serialized records, and LLM outputs cannot become estimator or posterior authority; an LLM output is not source evidence; identity/size/authorization bounds are not scientific semantics; recovered roles match known truth at a higher computed rate than collapsing every payload to an estimator (ADR 0008/0014).
+- `persistence_postgres` retention/deletion/legal-hold (migration `0007`): policy rows, legal holds that block completed deletion, evidence tombstones without raw-source restore, analysis exclusion only for `logical_revocation`/`identity_tombstone` (not `cache_export_removal`), and deletion requests bound to the cited retention policy's tenant/class/purpose.
 - `tepp_api` adaptive orchestration router (ADR 0010): versioned `direct`/`verify`/`committee`/`conductor`/`abstain` selection from CPU `f64` risk, ambiguity, evidence, and token-budget inputs; recorded stages, recursion, decomposition, access lists, and role-specific reasoning effort; fail-closed document-controlled policy/access/credentials; LLM plans remain proposals under deterministic statistical authority; comparable-budget ablation requires a direct baseline; credential-free contextual-orchestrator binding. Live NIM HTTP remains accepted-target.
 - `tepp_api` purpose-bound provider-payload minimization: time-bounded `PurposeGrant` evaluation, fail-closed expired/not-yet-valid/inverted/cross-tenant/impossible-calendar denial, semantic UTC calendar validation, refusal to copy identity mappings into model-provider payloads or ordinary logs, preservation of opaque analytical identifiers and membership roles (no blanket PII mask), a separately authorized scientific re-identification path, and an internally bound FIPS 180-4 SHA-256 audit digest appended through `ReidentificationAuditSink` before disclosure.
 - `persistence_postgres` backup/restore integrity: restored snapshots stay unusable until tenant, canonical `SHA-256`, knowledge-cutoff eligibility, temporal window order, and append-only triggers revalidate; SQL probes raise `restore integrity failed` (ADR 0013).

Cargo.toml

@@ -11,6 +11,7 @@ members = [
     "crates/tepp_simulation",
     "crates/validation_core",
     "crates/tepp_api",
+    "crates/payload_semantics",
 ]
 default-members = [
     "crates/evidence_core",
@@ -23,6 +24,7 @@ default-members = [
     "crates/tepp_simulation",
     "crates/validation_core",
     "crates/tepp_api",
+    "crates/payload_semantics",
 ]
 
 [workspace.package]

README.md

@@ -7,7 +7,7 @@ implemented in Rust.
 ## Current implementation state
 
 This branch establishes the Task 1 Rust workspace and quality-gate foundation.
-The ten bounded crates compile independently but intentionally expose no
+The eleven bounded crates compile independently but intentionally expose no
 placeholder production APIs. Domain behavior begins in Task 2 with immutable
 evidence identifiers and source records.
 
@@ -22,6 +22,7 @@ crates/corpus_split
 crates/tepp_simulation
 crates/validation_core
 crates/tepp_api
+crates/payload_semantics
 ```
 
 ## Local verification

crates/payload_semantics/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "payload_semantics"
+description = "Untrusted payloads fail closed until scientific semantics validate."
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+readme.workspace = true
+keywords.workspace = true
+categories.workspace = true
+publish = false
+
+[lints]
+workspace = true

crates/payload_semantics/src/error.rs

@@ -0,0 +1,73 @@
+//! Fail-closed payload-semantics errors.
+
+use std::fmt;
+
+/// A fail-closed payload-semantics error.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[non_exhaustive]
+pub enum PayloadSemanticsError {
+    /// An untrusted payload was treated as estimator or posterior authority.
+    UntrustedPayloadIsNotEstimator,
+    /// An LLM output was treated as source evidence.
+    LlmOutputIsNotEvidence,
+    /// A document, metadata, or serialized record was treated as interpretation.
+    EvidenceIsNotInterpretation,
+    /// Identity, size, or authorization bounds were treated as semantics.
+    BoundsAreNotSemantics,
+    /// A recovery slice was empty or length-mismatched.
+    InvalidSemanticsPayload,
+}
+
+impl fmt::Display for PayloadSemanticsError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let message = match self {
+            Self::UntrustedPayloadIsNotEstimator => {
+                "an untrusted payload is not estimator or posterior authority"
+            }
+            Self::LlmOutputIsNotEvidence => "an llm output is not source evidence",
+            Self::EvidenceIsNotInterpretation => {
+                "a document, metadata, or serialized record is not interpretation"
+            }
+            Self::BoundsAreNotSemantics => {
+                "identity, size, and authorization bounds are not scientific semantics"
+            }
+            Self::InvalidSemanticsPayload => "invalid payload-semantics payload",
+        };
+        formatter.write_str(message)
+    }
+}
+
+impl std::error::Error for PayloadSemanticsError {}
+
+#[cfg(test)]
+mod tests {
+    use super::PayloadSemanticsError;
+
+    #[test]
+    fn error_messages_are_stable() {
+        for (error, message) in [
+            (
+                PayloadSemanticsError::UntrustedPayloadIsNotEstimator,
+                "an untrusted payload is not estimator or posterior authority",
+            ),
+            (
+                PayloadSemanticsError::LlmOutputIsNotEvidence,
+                "an llm output is not source evidence",
+            ),
+            (
+                PayloadSemanticsError::EvidenceIsNotInterpretation,
+                "a document, metadata, or serialized record is not interpretation",
+            ),
+            (
+                PayloadSemanticsError::BoundsAreNotSemantics,
+                "identity, size, and authorization bounds are not scientific semantics",
+            ),
+            (
+                PayloadSemanticsError::InvalidSemanticsPayload,
+                "invalid payload-semantics payload",
+            ),
+        ] {
+            assert_eq!(error.to_string(), message);
+        }
+    }
+}

crates/payload_semantics/src/lib.rs

@@ -0,0 +1,24 @@
+#![forbid(unsafe_code)]
+#![deny(missing_docs)]
+#![allow(clippy::cast_precision_loss)]
+//! Untrusted payloads fail closed until scientific semantics validate.
+//!
+//! Documents, external metadata, serialized records, and LLM outputs stay
+//! untrusted as estimator or posterior authority. Passing identity, size,
+//! or authorization bounds is not scientific semantics (ADR 0008/0014).
+
+mod error;
+mod semantics;
+
+/// Fail-closed payload-semantics errors.
+pub use error::PayloadSemanticsError;
+/// Closed vocabulary of untrusted inbound payload kinds.
+pub use semantics::PayloadKind;
+/// Closed vocabulary of claimed scientific roles.
+pub use semantics::ScientificRole;
+/// Refuse to treat identity, size, or authorization bounds as semantics.
+pub use semantics::refuse_bounds_as_semantics;
+/// Refuse an untrusted payload that claims an unauthorized scientific role.
+pub use semantics::refuse_untrusted_scientific_claim;
+/// Fraction of recovered scientific roles that match known truth.
+pub use semantics::semantics_recovery_rate;