feat(k1): add physical acceptance transport

docs/01_IMPLEMENTATION_PLAN.md

@@ -21,7 +21,7 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 | Stage 7 observation archive | GO (point/pose/telemetry contract) — durable catalog, recovery, capture-clock-bounded RRD preparation, archived metric time series, saved-session timeline and atomic playback are implemented |
 | Stage 7 recorded cameras | GO (contract), acceptance pending — acquisition-owned fMP4 archive and player are implemented/tested; one real archived K1 camera plus point-cloud session has not passed playback yet |
 | Plugin isolation | GO (laboratory control plane) — vendor backend/frontend and optional scene controls are plugin-owned; manifest/runtime descriptor parity, versioned handshake, lifecycle health and transport correlation fail closed while execution remains in-process |
-| K1 application control | PAUSE (dormant runtime gate complete) — plugin v0.4.0 exposes operator-confirmed shadow arm/disarm/state; authority is held in a 15–300 s non-exportable lease and revoked on expiry, reprovision, acquisition preparation or shutdown; orchestrator is facade-owned, but no emission method/live sink exists and vendor writes remain false |
+| K1 application control | PAUSE (physical-acceptance software gate complete) — plugin v0.4.0 runtime remains dormant/write-disabled; a separate uninstalled transport now enforces the retained MQTT session, exact response subscriptions, QoS2 one-shot operation keys, five response-gated batches and poison-on-unknown behavior; Keychain provisioning and physical START/STOP remain unexecuted |
 | Stage 8 product storage | PAUSE — retention, replication, encryption, capacity monitoring and long-run browser/WASM stress remain deployment gates |
 
 USB project copying remains optional ground truth rather than a blocker for the
@@ -46,9 +46,15 @@ is now wired into the XGRIDS facade and plugin manifest. Explicit operator arm
 loads the Keychain value into a bounded 15–300 second process-memory lease;
 expiry, disarm, reprovision, acquisition preparation and shutdown drop both the
 lease and orchestrator. Public state contains only lease timing/booleans. There
-is deliberately no batch-emission method, live MQTT sink or UI button. Keychain
-item provisioning, a separately reviewed write-capable type and durable
-post-stop save remain unproven. The physical button is the known-safe fallback.
+is deliberately no batch-emission method, live MQTT sink or UI button in the
+installed runtime. A separate physical-acceptance-only transport and dialogue
+executor now implement the reviewed MQTT exchange without facade/UI wiring.
+Each operation key is consumed before publish, automatic reconnect and
+application retry are forbidden, and any unknown outcome poisons the transport.
+The one-time `k1link authority provision` command delegates secret entry to the
+macOS Keychain TTY prompt and validates through the production loader without
+receiving the value in argv/environment/file/browser state. The command has not
+been run. Physical START/STOP remain untested; the button is the safe fallback.
 
 The Stage 6 live path uses a bounded raw-first bridge: loss in the visualization
 queue cannot discard MQTT evidence. The queue holds four preview messages;
@@ -267,7 +273,7 @@ useful stream is decoded or structurally identified.
 - firmware or internal-Linux analysis;
 - physical end-to-end shared-timeline playback for a newly archived session
   containing point cloud plus one selected K1 camera;
-- operator-owned Keychain item provisioning, separately reviewed emission transport
-  and stable-artifact proof after the observed stop lifecycle;
+- operator-owned Keychain item provisioning, operator-present physical use of
+  the reviewed acceptance transport and stable-artifact proof after STOP;
 - long-running large-session WebViewer/WASM memory telemetry;
 - production retention, replication, encryption and cross-platform packaging.

docs/05_K1_MQTT_STREAM_PROFILE.md

@@ -211,7 +211,26 @@ operator confirmation, a connected/attested K1, idle runtime and no active
 acquisition. Its non-exportable process-memory lease is limited to 15–300
 seconds and is revoked by expiry, disarm, reprovision, acquisition preparation
 or shutdown. The current one-shot boundary is structurally write-disabled,
-exposes no emission method and cannot touch its injected sink. The complete
+exposes no emission method and cannot touch its injected sink.
+
+A separate physical-acceptance-only implementation now exists outside the
+facade/runtime. Retained-PCAP re-audit fixes its MQTT contract at 3.1.1,
+`clean_session=false`, keepalive 60, the three ordered 9/5/42-topic control
+subscription groups, separation from the point-cloud client, QoS 2
+request/PUBCOMP completion and
+`lixel/application/response/modeling`. It performs one connection attempt,
+consumes every ordinal/action operation key before publish, never reconnects or
+retries, rejects stale/duplicate/unexpected responses and poisons every unknown
+post-publish outcome. A 15–120 second permit requires explicit operator-present,
+owner-controlled-device, LixelGO-closed, battery/storage and expected-state
+confirmations. START additionally requires the complete five-batch bootstrap;
+STOP requires its own separate permit. This code is not installed as a plugin
+action and has never emitted to the K1.
+
+The one-time Keychain administration command uses `security -w` as the final
+argument so Apple's own TTY prompt receives the authority. Mission Core never
+accepts it through CLI argv and validates the resulting fixed item through the
+production loader. The command has not yet been run. The complete
 stop/save sequence has not physically proved a durable vendor project. A
 correlated STOP success, stream quiescence, return to
 `READY`/steady-green hardware state and appearance of a reusable native project

docs/06_K1_LIVE_VIEWER.md

@@ -150,8 +150,9 @@ publishing anything. One private application-level OpenAPI authority is kept
 separate from the transient vendor ID/serial returned by the BLE-selected K1.
 The fixed Keychain loader, bounded execution lease and dormant facade
 orchestrator now exist. No emission method or live MQTT sink is installed, and
-durable save completion after stop remains open, so `vendor_writes_enabled` is
-false and the physical-button workflow is canonical.
+an acceptance-only transport exists outside the facade. Keychain provisioning,
+physical START/STOP and durable save completion remain open, so
+`vendor_writes_enabled` is false and the physical-button workflow is canonical.
 
 ## Automatic Rerun source and lifecycle
 
@@ -333,8 +334,8 @@ listener and its process memory must be closed unconditionally.
   separate generic media path. Historical sessions predating that archive have
   no recoverable video.
 - Physical double-click remains the K1 scan start/stop control. Any MQTT command
-  publisher needs reviewed Keychain item provisioning, a new write-capable
-  emission type, response-gated one-shot behavior and durable-save proof.
+  promotion needs reviewed Keychain item provisioning, operator-present use of
+  the uninstalled response-gated transport and durable-save proof.
 - No terrain map, elevation model, obstacle segmentation, localization fusion,
   mission planner or vehicle control is implemented by this viewer milestone.
 - Exact coordinate axes and the scanner-to-vehicle transform remain a mounting

docs/07_MISSION_CORE_MONOREPO.md

@@ -150,8 +150,9 @@ is one private application-level authority; vendor ID and serial come from the
 BLE-selected live K1 and are cross-checked against status. No MQTT publisher
 exists. A fixed Keychain loader, bounded lease and dormant facade orchestrator
 are present, but there is no emission method or live MQTT sink. Keychain item
-provisioning and stable-artifact proof after STOP remain unresolved, so
-`vendor_writes_enabled=false`.
+provisioning and stable-artifact proof after STOP remain unresolved. A separate
+acceptance-only transport is not imported by the facade, so
+`vendor_writes_enabled=false` remains authoritative.
 
 ## Semantic lifecycle
 
@@ -224,8 +225,8 @@ views.
    read-only RTSP/H.264 adapter for each target OS, add disk-backed sealed media
    caching and evolve same-host MSE delivery toward an authenticated Edge media
    plane. Keep the modeling-command publisher disabled until operator-owned
-   Keychain item provisioning, reviewed emission and durable-save confirmation
-   gate.
+   Keychain item provisioning, physical acceptance of the reviewed uninstalled
+   transport and durable-save confirmation gate.
 
 Complex equipment will likely be assembled from separately useful component
 plugins into configured hardware packs, while standalone equipment remains

docs/09_OBSERVATION_SESSIONS.md

@@ -513,5 +513,5 @@ viewer/WASM payload. That is a packaging optimization item, not a failed gate.
 No retained physical K1 session contains the new canonical camera archive, so a
 real point-cloud plus one-camera recorded playback remains an explicit hardware
 acceptance test. Automated protocol tests also do not authorize K1 modeling
-publishing: operator-owned Keychain item provisioning, reviewed emission and
-durable save remain separate physical/security gates.
+publishing: operator-owned Keychain item provisioning, operator-present
+physical acceptance and durable save remain separate physical/security gates.

docs/adr/0009-device-plugin-observation-runtime-and-k1-extraction.md

@@ -114,8 +114,8 @@ The operator project name is normalized and validated by the K1 contribution,
 stored as display/catalog metadata and never used as a path component. This ADR
 does not claim that it reaches the scanner: the inert application-control codec
 has no publisher, and automatic K1 writes remain disabled pending reviewed
-operator-owned Keychain item provisioning, reviewed emission and durable
-post-stop save evidence.
+operator-owned Keychain item provisioning, physical acceptance of the
+uninstalled transport and durable post-stop save evidence.
 
 ADR 0011 subsequently places the action control plane behind a versioned
 descriptor/handshake/health transport seam. Observation discovery and export

docs/adr/0012-device-bound-k1-command-authority.md

@@ -103,10 +103,33 @@ shadow arm/disarm/state actions and redacted snapshots. The coordinator has no
 request-emission method and the installed sink is explicitly uninstalled; this
 runtime wiring does not widen write authority.
 
+`application_mqtt.py` and `application_acceptance.py` provide the next, still
+uninstalled physical-acceptance boundary. The MQTT type repeats the retained
+3.1.1 session (`clean_session=false`, keepalive 60), subscribes only to exact
+known response topics, admits only reviewed request topics and QoS2/retain-false
+envelopes, and consumes explicit bootstrap ordinals/modeling actions before the
+first publish call. It performs one connect attempt with no reconnect. PUBCOMP
+and every required application response are separate barriers; stale,
+duplicate, unexpected, oversized or timed-out responses poison the transport.
+An unknown post-publish outcome can only be reconciled physically/status-wise;
+the same operation key can never be attempted again by that transport.
+
+The acceptance executor requires a 15–120 second single-action permit backed by
+five explicit operator confirmations. START cannot skip the five recovered
+bootstrap batches; STOP uses a separate permit. These types are not imported by
+the facade, declared as plugin actions or represented by UI controls.
+
+`MacOSKeychainApplicationAuthorityProvisioner` invokes Apple's interactive
+`security add-generic-password ... -w` prompt with `-w` last. The private value
+therefore never enters Mission Core argv, environment, files, logs or browser
+state, and the resulting item is immediately validated by the fixed loader.
+The repository CLI exposes this as an explicit one-time admin command, but the
+command has not been executed in this milestone.
+
 ## Promotion gate
 
-A future publisher requires separate review and an operator-present physical
-acceptance:
+Promotion now requires operator-present physical acceptance of the uninstalled
+transport:
 
 1. provision the reviewed private authority into the fixed local Keychain item;
 2. confirm battery/storage and select one K1 over BLE;

docs/lab/002_LIXELGO_IPHONE_LOCAL_PROTOCOL_20260716.redacted.md

@@ -65,6 +65,20 @@ Observed K1 transports:
 
 No LixelGO UDP flow was observed.
 
+The retained clean-cycle control connection was subsequently re-audited without
+capturing new traffic. MQTT CONNECT used protocol level 4 / MQTT 3.1.1,
+`clean_session=false` and keepalive 60. Control and point-cloud subscriptions
+used separate 19-byte client IDs; their values remain private. The control
+client issued three ordered subscription groups containing 9, 5 and 42 topics
+before issuing requests. The separate point-cloud client then issued groups of
+1 and 1 topic; their values are the already documented legacy/current point
+channels. The control group order, topic names and requested QoS values are now
+locked by public synthetic regression without exposing client IDs or payloads.
+The modeling acknowledgement topic is
+`lixel/application/response/modeling`; request QoS was 2 while the K1 delivered
+the observed application response PUBLISH packets at QoS 0. These redacted
+facts bound the acceptance transport but do not authorize it.
+
 ## Start and static initialization
 
 The application start transaction is now physical wire evidence rather than