feat(k1): add offline control execution gate

docs/01_IMPLEMENTATION_PLAN.md

@@ -21,7 +21,7 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 | Stage 7 observation archive | GO (point/pose/telemetry contract) — durable catalog, recovery, capture-clock-bounded RRD preparation, archived metric time series, saved-session timeline and atomic playback are implemented |
 | Stage 7 recorded cameras | GO (contract), acceptance pending — acquisition-owned fMP4 archive and player are implemented/tested; one real archived K1 camera plus point-cloud session has not passed playback yet |
 | Plugin isolation | GO (laboratory control plane) — vendor backend/frontend and optional scene controls are plugin-owned; manifest/runtime descriptor parity, versioned handshake, lifecycle health and transport correlation fail closed while execution remains in-process |
-| K1 application control | PAUSE (exact shadow dialogue implemented) — all 10 retained pre-START requests and START/STOP are byte-matched; BLE-selected live DeviceInfo supplies per-scanner identity while one private application-level OpenAPI authority remains outside Git/Ops; publisher, physical save acceptance and recovery policy remain closed gates |
+| K1 application control | PAUSE (offline execution gate complete) — exact five-batch response-barrier orchestrator passes the retained 10-request dialogue; the 36-byte application authority loads only from macOS Keychain; current publisher boundary is structurally write-disabled and never touches its sink; runtime wiring, physical START/STOP and durable save remain closed gates |
 | Stage 8 product storage | PAUSE — retention, replication, encryption, capacity monitoring and long-run browser/WASM stress remain deployment gates |
 
 USB project copying remains optional ground truth rather than a blocker for the
@@ -33,13 +33,17 @@ private application-level value in this LixelGO build, not a per-scanner
 credential. The selected BLE peripheral returns its own LAN IP; the initial
 unbound `DeviceInfoRequest` then returns vendor ID, serial, model, activation and
 version facts for that live K1. Mission Core's shadow bootstrap reproduces the
-10 observed pre-START requests byte-for-byte: three unbound discovery reads,
-one response-bound time/timezone sync and six further reads. A live-only safety
-layer rejects identity drift or malformed status, and can form a non-executable
-START only from unbound `READY` or STOP only from bound `SCANNING`. Public output
-contains only digests and wire metadata. Secure application-authority loading,
-an authorized response-gated one-shot publisher and durable post-stop save are
-not yet proven. The physical button remains the known-safe fallback.
+10 observed pre-START requests byte-for-byte across five recovered batches:
+initial DeviceInfo binding; ModelingStatus plus RTK read; time sync plus
+DeviceInfo/RTK; NTRIP read; then cloud/RTK/DeviceInfo reads. The first
+ModelingStatus request has no mandatory synchronous response barrier; readiness
+is separately attested through live DeviceStatus. A fixed macOS Keychain loader
+now reads the exact 36-byte authority without environment/file/browser fallback.
+The response orchestrator correlates required headers/results and rejects
+identity/profile drift. The installed publish boundary is a separate
+write-disabled type that cannot call its injected sink. Runtime wiring, a
+reviewed write-capable type and durable post-stop save remain unproven. The
+physical button remains the known-safe fallback.
 
 The Stage 6 live path uses a bounded raw-first bridge: loss in the visualization
 queue cannot discard MQTT evidence. The queue holds four preview messages;
@@ -258,7 +262,7 @@ useful stream is decoded or structurally identified.
 - firmware or internal-Linux analysis;
 - physical end-to-end shared-timeline playback for a newly archived session
   containing point cloud plus one selected K1 camera;
-- private application-level OpenAPI authority loading, authorized command transport
+- operator-owned Keychain provisioning/execution lease, authorized command transport
   and stable-artifact proof after the observed stop lifecycle;
 - long-running large-session WebViewer/WASM memory telemetry;
 - production retention, replication, encryption and cross-platform packaging.

docs/05_K1_MQTT_STREAM_PROFILE.md

@@ -188,6 +188,15 @@ repository shadow bootstrap reproduces all ten retained payloads and their
 topic order byte-for-byte. Time sync is the only mutation before START; the
 other nine requests are reads.
 
+The retained request/response timing further divides the dialogue into five
+bounded batches. DeviceInfo response establishes identity before later bound
+requests. Required response barriers are correlated by topic, exact session,
+vendor identity, application authority and numeric success. The initial
+ModelingStatus request is intentionally not treated as a required synchronous
+response: the clean cycle continued without one, and readiness belongs to the
+live DeviceStatus gate. The offline orchestrator completes over the retained
+payloads without substitution or skipped requests.
+
 The repository now contains an inert bounded encoder/response parser and a
 fail-closed device-status state machine for this exact profile. A live-only
 shadow planner accepts START only from `READY` with no project and STOP only
@@ -195,9 +204,12 @@ from `SCANNING` with a bound project. It emits only a non-executable digest and
 wire metadata, uses QoS 2 with retain false, and declares automatic retry
 forbidden. It has no MQTT publish dependency and cannot send a command.
 
-Publishing remains deliberately disabled: the private application authority
-still needs a secure runtime loader and the complete stop/save sequence has not
-physically proved a durable vendor project. A correlated STOP success, stream quiescence, return to
+Publishing remains deliberately disabled. The exact 36-byte authority now has a
+read-only macOS Keychain loader with no environment, file, browser or API
+fallback, but it is not wired to the live facade. The current one-shot boundary
+is structurally write-disabled and cannot touch its injected sink. The complete
+stop/save sequence has not physically proved a durable vendor project. A
+correlated STOP success, stream quiescence, return to
 `READY`/steady-green hardware state and appearance of a reusable native project
 are separate gates. The verified physical double-click remains the acquisition
 control until a separately reviewed one-shot write gate closes.

docs/06_K1_LIVE_VIEWER.md

@@ -148,7 +148,8 @@ observed pre-START requests plus START/STOP, correlates DeviceInfo and modeling
 responses, and classifies live device states without importing MQTT or
 publishing anything. One private application-level OpenAPI authority is kept
 separate from the transient vendor ID/serial returned by the BLE-selected K1.
-Secure authority loading and durable save completion after stop remain open, so
+The fixed Keychain loader and offline response orchestrator now exist, but live
+execution-lease wiring and durable save completion after stop remain open, so
 `vendor_writes_enabled` is false and the physical-button workflow is canonical.
 
 ## Automatic Rerun source and lifecycle
@@ -331,8 +332,8 @@ listener and its process memory must be closed unconditionally.
   separate generic media path. Historical sessions predating that archive have
   no recoverable video.
 - Physical double-click remains the K1 scan start/stop control. Any MQTT command
-  publisher needs reviewed private application-authority loading, response-gated
-  one-shot behavior and a proven durable-save completion gate.
+  publisher needs reviewed Keychain provisioning/execution-lease wiring,
+  response-gated one-shot behavior and a proven durable-save completion gate.
 - No terrain map, elevation model, obstacle segmentation, localization fusion,
   mission planner or vehicle control is implemented by this viewer milestone.
 - Exact coordinate axes and the scanner-to-vehicle transform remain a mounting

docs/07_MISSION_CORE_MONOREPO.md

@@ -148,7 +148,8 @@ START/STOP, correlates live DeviceInfo/modeling responses and maps bounded
 device-status values into an observation-only state machine. The OpenAPI value
 is one private application-level authority; vendor ID and serial come from the
 BLE-selected live K1 and are cross-checked against status. No MQTT publisher
-exists. Secure authority loading and stable-artifact proof after STOP remain
+exists. A fixed Keychain loader and offline response orchestrator are present;
+operator execution-lease wiring and stable-artifact proof after STOP remain
 unresolved, so `vendor_writes_enabled=false`.
 
 ## Semantic lifecycle
@@ -221,8 +222,8 @@ views.
 4. Physically accept a newly archived left/right K1 session, then package the
    read-only RTSP/H.264 adapter for each target OS, add disk-backed sealed media
    caching and evolve same-host MSE delivery toward an authenticated Edge media
-   plane. Keep the modeling-command publisher disabled until private application
-   authority loading and durable-save confirmation close its separate safety
+   plane. Keep the modeling-command publisher disabled until operator-owned
+   Keychain execution-lease wiring and durable-save confirmation close its safety
    gate.
 
 Complex equipment will likely be assembled from separately useful component

docs/09_OBSERVATION_SESSIONS.md

@@ -513,5 +513,5 @@ viewer/WASM payload. That is a packaging optimization item, not a failed gate.
 No retained physical K1 session contains the new canonical camera archive, so a
 real point-cloud plus one-camera recorded playback remains an explicit hardware
 acceptance test. Automated protocol tests also do not authorize K1 modeling
-publishing: private application-authority loading and durable save completion
+publishing: operator-owned Keychain execution lease and durable save completion
 remain separate physical/security gates.

docs/adr/0009-device-plugin-observation-runtime-and-k1-extraction.md

@@ -114,7 +114,7 @@ The operator project name is normalized and validated by the K1 contribution,
 stored as display/catalog metadata and never used as a path component. This ADR
 does not claim that it reaches the scanner: the inert application-control codec
 has no publisher, and automatic K1 writes remain disabled pending reviewed
-private application-authority loading and durable post-stop save evidence.
+operator-owned Keychain execution-lease wiring and durable post-stop save evidence.
 
 ADR 0011 subsequently places the action control plane behind a versioned
 descriptor/handshake/health transport seam. Observation discovery and export

docs/adr/0012-device-bound-k1-command-authority.md

@@ -77,24 +77,30 @@ captured special relation
 
 ## Current implementation boundary
 
-`application_bootstrap.py` provides the bounded application authority type,
-DeviceInfo response correlation/decoding and the exact non-executable ten-step
-shadow plan. Its retained clean-cycle regression is 10/10 payloads and topic
-order. `LiveModelingControlSafety` independently binds that DeviceInfo identity
-to live status and creates non-executable START/STOP plans.
+`application_bootstrap.py` provides DeviceInfo decoding, the exact ten-request
+shadow plan and a five-batch response-barrier orchestrator. Its private retained
+regression completes with 10/10 request payload/topic matches and correlated
+required responses. `ModelingStatusRequest` remains non-blocking exactly where
+the capture had no synchronous response. `application_authority.py` reads the
+exact 36-byte authority only from a fixed macOS Keychain item and offers no
+plaintext fallback. `LiveModelingControlSafety` independently binds DeviceInfo
+identity to live status and creates non-executable START/STOP plans.
 
 Public state contains only booleans, counts and wire metadata. Private identity,
-authority and payload bytes stay out of repr/API output. Both shadow paths are
-blocked by `vendor-writes-disabled` and `publisher-not-installed`; no MQTT
-publisher or automatic retry path exists.
+authority and payload bytes stay out of repr/API output.
+`application_publish.py` defines reviewed one-shot envelopes plus a current
+write-disabled publisher type. That type has no enable switch and raises before
+its injected transport sink can be called. Both shadow paths remain blocked by
+`vendor-writes-disabled` and `publisher-not-installed`; no MQTT publisher or
+automatic retry path exists.
 
 ## Promotion gate
 
 A future publisher requires separate review and an operator-present physical
 acceptance:
 
-1. load the private application authority through a reviewed local secret
-   mechanism;
+1. provision the reviewed private authority into the fixed local Keychain item
+   and load it for one operator-owned execution lease;
 2. confirm battery/storage and select one K1 over BLE;
 3. run the exact response-gated bootstrap and attest activated FW 3.0.2;
 4. confirm READY identity against DeviceInfo and review shadow metadata;