OES-32 Membrane Shield: capability-gated 32-slot state machine with dual-approval calibration
Abstract
Python reference implementation of a state-machine contract for externally authorized updates to a 32-slot state vector. The shield verifies short-lived, payload-bound Ed25519 capabilities against public keys (private keys never enter the shield), requires independent approvals from distinct CALIBRATEUR and GARDIEN authorities for calibration, rejects and latches on a max-absolute residual strictly greater than τ (the ADR-001 rule; default τ = 0.08, Profile A sidecar), applies EVEN / ODD / FOLD8 symmetry sectors, and keeps a bounded audit ring. Evidence tags. Unit, end-to-end and deterministic fuzz tests use SYNTHETIC inputs. Simulation output is SYNTHETIC; latency figures are machine-dependent diagnostics. Independent security review of v2: UNRUN (the included audit covers the superseded v1 HMAC design only). Relationship to ADR-001. The residual rule matches oes32-residual@b77b612; τ and sectors follow the Profile A sidecar in oes32_engine. Scope and limits. Research software. Not certified safety-critical software, not a key-management or identity system, not hardware, field or medical software. No production-readiness claim is made. Evidence tags follow sparkainlp-x/.github (SYNTHETIC / REPORTED / TARGET / UNRUN).
