feat(perception): integrate calibrated operator pipeline

Add calibrated K1 projection, recorded and near-live perception qualification, unified Rerun operator layers, bounded replay admission, audited viewer controls, worker experiments, and lab evidence.

tests/test_xgrids_firmware_credential.py

@@ -0,0 +1,87 @@
+from __future__ import annotations
+
+import io
+import tarfile
+from pathlib import Path
+
+import pytest
+
+import k1link.device_plugins.xgrids_k1.firmware_credential as firmware_credential
+
+FIXTURE_SECRET = b"fixture-only-network-secret"
+
+
+def _tar_gz_member(name: str, payload: bytes) -> bytes:
+    output = io.BytesIO()
+    with tarfile.open(fileobj=output, mode="w:gz") as archive:
+        member = tarfile.TarInfo(name)
+        member.size = len(payload)
+        archive.addfile(member, io.BytesIO(payload))
+    return output.getvalue()
+
+
+def test_exact_official_archive_extracts_one_bounded_declaration(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    prefix = b"synthetic-rk-prefix"
+    apps = (
+        b"\x00" * 17
+        + firmware_credential._AP_PSK_DECLARATION
+        + FIXTURE_SECRET
+        + b"\n"
+        + b"\x00" * 31
+    )
+    image = prefix + apps
+    upgrade = _tar_gz_member(firmware_credential.K1_FW302_RK_IMAGE_MEMBER, image)
+    outer = _tar_gz_member(firmware_credential.K1_FW302_OUTER_MEMBER, upgrade)
+    archive_path = tmp_path / "official-fw.tar"
+    archive_path.write_bytes(outer)
+
+    monkeypatch.setattr(firmware_credential, "K1_FW302_APPS_OFFSET", len(prefix))
+    monkeypatch.setattr(firmware_credential, "K1_FW302_APPS_SIZE", len(apps))
+    monkeypatch.setattr(
+        firmware_credential,
+        "_sha256",
+        lambda _path: firmware_credential.K1_FW302_OFFICIAL_ARCHIVE_SHA256,
+    )
+
+    secret, digest = firmware_credential.extract_k1_fw302_ap_credential(archive_path)
+    try:
+        assert secret.reveal_ascii() == FIXTURE_SECRET.decode("ascii")
+        assert FIXTURE_SECRET.decode("ascii") not in repr(secret)
+        assert digest == firmware_credential.K1_FW302_OFFICIAL_ARCHIVE_SHA256
+    finally:
+        secret.zeroize()
+
+
+def test_archive_hash_mismatch_stops_before_unpack(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    archive_path = tmp_path / "wrong-fw.tar"
+    archive_path.write_bytes(b"not-reviewed")
+    monkeypatch.setattr(firmware_credential, "_sha256", lambda _path: "0" * 64)
+
+    with pytest.raises(
+        firmware_credential.FirmwareCredentialError,
+        match="SHA-256",
+    ):
+        firmware_credential.extract_k1_fw302_ap_credential(archive_path)
+
+
+def test_duplicate_declarations_fail_closed_without_exposing_values() -> None:
+    payload = b"\n".join(
+        [
+            firmware_credential._AP_PSK_DECLARATION + FIXTURE_SECRET,
+            firmware_credential._AP_PSK_DECLARATION + b"second-fixture-secret",
+        ]
+    ) + b"\n"
+
+    with pytest.raises(
+        firmware_credential.FirmwareCredentialError,
+        match="not unique",
+    ) as raised:
+        firmware_credential._credential_from_chunks(iter([payload]))
+
+    assert FIXTURE_SECRET.decode("ascii") not in str(raised.value)