AQ-SDD-001-S1 — Worked Dossier: Scenario 1, Normal Conditions

Status: DRAFT, not sealed. This document shows sections 1 to 9 as they would be registered before the first run of AQ-NODE-01, and shows sections 10 to 17 unfilled with the reason. It asserts no result.

SECTION 1 — DOSSIER IDENTITY AND REGISTRATION

SECTION 2 — OBJECTIVE

To establish, under bench conditions with no injected fault, the baseline behaviour of the acquisition-to-decision path of AQ-NODE-01 across trust boundaries TB-1 to TB-5, and to produce the first measured distributions from which later thresholds will be defined. The run informs two programme decisions: whether the fault-injection scenarios S2 onward may proceed against this article, and whether any metric in section 9 produces a distribution stable enough to carry a threshold at all. If the control run cannot be interpreted, no fault-injection result against this article can be interpreted either.

SECTION 3 — RESEARCH QUESTION

Under bench conditions with no injected fault, does AQ-NODE-01 hold trust state NORMAL for the full run while every value presented to L4 carries a DC-1 tag, and is every L5 decision taken during the run reconstructable from the Evidence Fabric alone?

SECTION 4 — HYPOTHESIS AND FALSIFICATION CONDITION

H-S1. With all commands valid, authorised and issued at the cadence fixed in section 7, and with no fault injected, the trust state remains NORMAL for the whole run, every L5 evaluation returns execute, every value entering L4 is tagged, and an independent reviewer can rebuild each decision from L6 records without recourse to console logs or operator recollection.

Falsification. H-S1 is falsified by any one of: (a) a transition out of NORMAL that cannot be attributed to a recorded environmental observation; (b) any untagged value reaching L4; (c) any consequential transition that a reviewer cannot rebuild from L6 alone; (d) any Q4 outcome that permits more than Q1 to Q3 allowed.

Secondary hypothesis H-S1b. The characterisation statistics M-06 and M-07 are stationary within the run. The assessment method — the statistic, the window and the comparison — is fixed here before the run; no threshold value is declared, because none can be justified before the first distribution exists.

SECTION 5 — SYSTEM VERSION AND CONFIGURATION RECORD

SECTION 6 — ARCHITECTURE EXERCISED

Trust boundaries. TB-1 exercised (physical bench to system). TB-2 exercised (deterministic acquisition on FPGA). TB-3 exercised (trust reasoning). TB-4 exercised, with the physical effect limited to the bench gate and its indicator. TB-5 exercised (runtime to evidence).

Conflicts and decision boundaries. No conflict case among CF-1 to CF-7 is deliberately induced in S1; a conflict that arises is a section 13 observation and falsifies H-S1 if it moves the trust state. Only the decision boundaries traversed by a NORMAL-state execute path are exercised; every boundary among B-1 to B-5 not traversed is listed in section 16 as untested by this run.

  [L0 optical bench]
        |  TB-1 physical/system
        v
  [L1 entropy]  [L2 timing]
        |            |
        +-----+------+
              |  TB-2 deterministic acquisition (FPGA)
              |  every sample timestamped and tagged MEASURED (DC-1)
              v
     [L4 AQ-TSE-01 trust state]        TB-3 trust reasoning
     state in {NORMAL, RESTRICTED, CRITICAL, DENY, RECOVERING}
     S1 expectation: NORMAL for the whole run
              |
              v
     [L5 command authority]
     Q1 who sent it -> Q2 valid -> Q3 authorised now   (HARD)
                                   -> Q4 execute under this trust state
                                      (may only REDUCE what Q1-Q3 allowed)
              |
              |  TB-4 decision / physical effect, hardware-gated
              v
     outcome in {execute, execute-restricted, safe-hold, abstain, deny}
              |
              |  TB-5 runtime/evidence
              v
     [L6 Evidence Fabric]  -> DC-5 reconstruction source for M-05

  [L8 AI-assisted analysis] NOT PRESENT in S1: advisory only, and
                            no path into L4 or L5 exists in this run.

SECTION 7 — PROTOCOL

• P-01 Record every section 5 field from the article as built; refuse the run if any field is unpopulated.
• P-02 Verify calibration validity dates for every instrument; record certificate ids.
• P-03 Power on with acquisition disabled and the TB-4 gate interlocked; record the cold-state register dump.
• P-04 Start Evidence Fabric recording; write the run start marker and the seal hash reference; confirm the marker is readable back.
• P-05 Warm-up period at the duration fixed in the bench procedure; environmental sample at start and end of warm-up.
• P-06 Baseline acquisition with no commands issued; this window is the source for M-06, M-07 and M-08.
• P-07 Release the TB-4 interlock; issue the synthetic command sequence C-01 onward at the fixed cadence. All commands are valid and authorised by construction.
• P-08 For each command, record the Q1 to Q4 evaluation, the trust state at evaluation time, the outcome, and the gate response at TB-4.
• P-09 Mid-run environmental sample and operator observation note, whether or not anything is observed.
• P-10 Continue to the planned command count.
• P-11 Stop commands, re-interlock the gate, continue acquisition for the tail period.
• P-12 Stop recording; compute and record dataset hashes before leaving the bench.
• P-13 Power down; record the shutdown register dump.
• P-14 Operator writes section 10 deviations at the bench, before leaving it.

Abort criteria. Any condition on the L9 bench abort list; any operator uncertainty about safety; any loss of Evidence Fabric recording. A run that loses recording does not resume — it stops, and a new run identifier is issued, because a gap in L6 makes DC-5 unassessable for the whole run.

SECTION 8 — INPUT AND FAULT CONDITIONS

Controlled: command cadence; command set composition (all valid, all authorised); bench alignment configuration; planned command count; warm-up and tail durations.

Recorded, not controlled: ambient temperature, vibration, supply condition, operator identity, time of day. Each is sampled at the points fixed in section 7; a missing sample is recorded as undetermined under DC-2, never interpolated.

SECTION 9 — METRICS, SUCCESS AND FAILURE CRITERIA

SECTIONS 10 TO 17 — UNFILLED