spark-membrane: a fail-closed console that orchestrates pinned OES repositories without merging them

Abstract

spark-membrane is an offline, standard-library Python console that audits SYNTHETIC native 32-channel frames against the existing Spark AI NLP OES repositories, pinned by commit SHA and never copied or merged. Small labelled reference re-implementations are tested against outputs of the pinned upstream code. Read first. On the locked NASA SMAP/MSL protocol, OES32 did not meet its pre-stated success criterion (oes-resilience v0.5.0). On the oes-telemetry-bench synthetic held-out set, max-abs matched OES32 (6/7) with fewer false alarms (11.54/h vs 23.08/h). The multi-quantum-oes stress evaluation found no demonstrated advantage. oes32-hls synthesis and the qldpc_decoder_cpp kernel are UNRUN. In its own seed-42 demo the gate accepts a slow drift that only the advisory EWMA/CUSUM detect. What it does. A T=0 audit accepts a frame only if the protocol hash, the normative residual, the oes32_engine Profile A sidecar and the weighted score all pass. Max-abs, EWMA and CUSUM are advisory; EWMA and CUSUM are calibrated on a separate event-free stream and restart after alarms. The two OES-32 formulas are never blended. The console names the failing engine and index and reports engine disagreement (7 of 40 frames for seed 42). A seeded, protocol-capped one-index explorer (new code, inspired by an external dual-engine idea) reports REPAIRED_IN_SIM or LATCH_HELD in simulation only. A capability gate admits nothing on role policy alone and verifies Ed25519 capabilities with an optional extra. Runs are hash-chained (measurement-trail format), rendered as an evidence passport, and passed through a claims gate. v0.2.0. Hardening after an internal audit: the claims gate normalises Unicode and refuses paraphrased, look-alike, zero-width and line-split overclaims, binds labels and sources; the trail rejects backwards timestamps and non-integer fields and is anchored (record count and head) so truncation is detected; every trail payload digest is recomputed from the published files; and the capability gate rejects small-order and non-canonical Ed25519 keys and signature R values (the same fix was made upstream in oes32-membrane-shield). Seed-42 verdict counts are unchanged. Limits. Everything is SYNTHETIC classical simulation, and every threshold is an UNCALIBRATED placeholder (docs/PROTOCOL.md). Not a medical device, not control software, not sensor fusion; no field-performance or superiority claims; it makes no quantum, QEC, consciousness, medical or gravity claims.