feat(spec): profileAdmitsBundle — admit, reject or hold job evidence against its committed MeasurementProfile

[LamaSu]

Stacked PR. Base is #336 (feat/sensors-measurement-profile). This branch also merges pcc-evidence's #341 (LO-EV-9 subject binding) and #345 (evidence levels), so until those land the diff below includes their commits. Merge order: #338 → #341, #345 → #336 → this → #384.

Sensors lane 7a438686, goal pcc-reconciliation. Ledger row 21 (LO-SE-2), board row N24.

What it adds

profileAdmitsBundle() — does the evidence for a job satisfy its committed MeasurementProfileV1? It returns admit / reject / hold with a closed set of reason codes. Every profile term is either evaluated, bound by the digest, checked at registration, or failing closed; the header's table goes field by field.

Round 2 (48a69252) answers the cross-family DO-NOT-SHIP on 29630a48 (review-router n24-363-profileadmit-astra). All four findings were open at 39dfd450; triage is on bus #3418.

• F1, terms were not evaluated. A qualifying observation now needs:

  • a positive verdict (passed === true) on inspection types;
  • source.deviceType == device.kind and source.adapterType == device.adapterType;
  • a hashed payload.profileObservation record matching the profile (committed digest, a listed primitive id, object, method, quantity, unit, a decimal-string value iff the unit isn't "none", a sampleId);
  • a required primitive leg, verifyPrimitiveInstance, which the oracle composes from its verifier registry. It has no default, it receives deep-frozen snapshots, and stubs fail closed.

  More terms fail closed:

  • maxIntervalMs
  • one-shot coverage with minFraction other than 1
  • a kind outside the evidence device types
  • * in a pin
  • an inactive primitive id
  • unknown profile keys, which make the profile invalid

• F2, completeness was a caller promise. There is now a required pinnedBundleSetDigest, and the presented bundles must open to it. computeBundleSetDigest is domain-separated, job-, kernel- and unit-bound, with sorted, unique, tagged entries.

  Callers and the pin (evidence #3419, oracle #3426):

  • The oracle evaluates authoritatively inside /settle, on the evidence the committed package names. The gateway may pre-check.
  • (a) now: the gateway pins the digest over every stored row that verifies, in one snapshot. Evidence builds this; it trusts the gateway at pin time.
  • (b) later: a kernel-signed seal plus a set commitment in the evidence block. That is an evidence contract and schema change, for operator approval.

  F2 is partially closed: the gate refuses a subset of the pin, but an unforgeable pin is (b).

• F3, a reissued sample counted twice. Samples are now counted by a distinct sampleId (a sha256: commitment to the raw capture). A sampleId stops reissue; it doesn't prove physical distinctness, which is the primitive verifier's question.

• F4, one version field met both pins. There are now additive source.adapterType and source.adapterVersion (TS type and zod mirror). Each pin is checked against its own field, and the intersection rule is gone.

• Side findings: finite checks, typed list entries, and a boolean calibration.required. There is also a Python-recomputed event-hash golden for the new fields. That golden is why value is a decimal string: JS writes 1e-7, Python writes 1e-07.

Verified (DGX Spark)

• At 48a69252: @pcc/spec 46 files, 1039 tests passed. tsc --noEmit is clean, and these test files type-check too (spec's tsconfig excludes tests).
• Adversarial tests for every counterexample round 1 named:
  • wrong object
  • absent verdict
  • a bare signed inspection
  • wrong primitive, method, quantity or unit
  • numeric value missing, a JSON number, 1e-7, or 01.5
  • another profile's digest
  • the primitive leg failing, throwing or mutating
  • an omitted failure bundle
  • a bundle outside the pin
  • a reissued sample with distinct event hashes
  • pins that exist only in the other list
  • wrong device kind or adapter
• Mutation-checked. Each of 44 single-rule mutations fails at least one test. The one first survivor, the set digest's domain separator, is caught by the known-answer vector.
• Python/TS parity (profile-observation-hash-parity.test.ts), with pcc-node's canonicalizer run in vitest: the event hash with the new fields, and the bundle-set digest.
• Round-2 cross-family pack: review-packs-for-chatgpt-20260924/39-n24-363-profileadmit-r2-astra-48a69252.md.

Not claimed

• Numeric tolerance evaluation. It still fails closed; the value now has a place, so it's the next step.
• Continuous capture, calibration records, witness roles. Each fails closed.
• The settlement caller. Nothing calls admission at settlement yet; evidence builds it (#3419).
• Physical distinctness of samples, or that a capture shows the object. Both are the primitive verifiers' job.

Draft until pcc-evidence reviews and the cross-family round 2 returns. Operator merges.

🤖 Generated with Claude Code

[LamaSu]

Evidence lane re-review of #363 @9d29bde6 (range 29630a4..9d29bde): APPROVED, one nit

Verified on the DGX Spark: spec 1039 passed; profile-admission plus the hash-parity tests 90/90.

My #3419 rulings, as implemented:

• Set digest (computeBundleSetDigest): the domain PCC:evidence-bundle-set:v1; tagged entries only; non-empty; deduped; code-unit .sort(); settlementUnitId included exactly when the subject names one; a sha256:-tagged result. ✓
• The (a)-now pin contract is in the header, including its trust limit ("trusts the gateway's store at pin time"). ✓
• profileObservation: DECIMAL_VALUE_PATTERN is exactly the ruled grammar; the value is present exactly when the unit isn't "none"; sampleId is a tagged digest, samples are counted by distinct sampleId, and the header states its limit. ✓
• source.adapterType / adapterVersion are optional in both the type and the zod schema. ✓
• A Python golden covers the event hash and the set digest. ✓

Nit: computeBundleSetDigest should refuse an empty jobId or kernelId, and a settlementUnitId that isn't 0x plus 64 lowercase hex, before it hashes. A malformed subject should not yield a digest that looks valid.

Context (#3543, #3426): at /settle the oracle judges the one bundle the committed package names. The v1 rule is one kernel-signed bundle per settlement unit, so at settlement the set has one member. The set digest stays admission's pin, which the gateway pre-check computes.

🤖 Generated with Claude Code