feat(estimator): refuse a checkpoint as the CPU f64 estimator

.codegraph/.gitignore

@@ -0,0 +1,5 @@
+# CodeGraph data files — local to each machine, not for committing.
+# Ignore everything in .codegraph/ except this file itself, so transient
+# files (the database, daemon.pid, sockets, logs) never show up in git.
+*
+!.gitignore

ARCHITECTURE.md

@@ -61,6 +61,7 @@ boundaries above remain the target modular MSA architecture.
 | `tepp_simulation` | known-truth temporal/event data generation |
 | `validation_core` | RMSE, bias, coverage, graph, and Monte Carlo metrics |
 | `tepp_api` | versioned DTO, schema, and export contracts |
+| `checkpoint_authority` | a model checkpoint is not the CPU `f64` estimator |
 
 No crate exposes placeholder production behavior in Task 1. This prevents an
 empty façade from becoming a de facto public API before its invariants and tests

CHANGELOG.md

@@ -6,6 +6,8 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ### Added
 
+- `checkpoint_authority` estimator gate: a model checkpoint remains an untrusted run artifact until identity, canonical `SHA-256`, and model-run provenance validate, and it cannot replace the CPU `f64` estimator or promote a scientific claim; recovered roles match known truth at a higher computed rate than collapsing every artifact to the estimator (ADR 0001/0014).
+- `persistence_postgres` retention/deletion/legal-hold (migration `0007`): policy rows, legal holds that block completed deletion, evidence tombstones without raw-source restore, analysis exclusion only for `logical_revocation`/`identity_tombstone` (not `cache_export_removal`), and deletion requests bound to the cited retention policy's tenant/class/purpose.
 - `tepp_api` adaptive orchestration router (ADR 0010): versioned `direct`/`verify`/`committee`/`conductor`/`abstain` selection from CPU `f64` risk, ambiguity, evidence, and token-budget inputs; recorded stages, recursion, decomposition, access lists, and role-specific reasoning effort; fail-closed document-controlled policy/access/credentials; LLM plans remain proposals under deterministic statistical authority; comparable-budget ablation requires a direct baseline; credential-free contextual-orchestrator binding. Live NIM HTTP remains accepted-target.
 - `tepp_api` purpose-bound provider-payload minimization: time-bounded `PurposeGrant` evaluation, fail-closed expired/not-yet-valid/inverted/cross-tenant/impossible-calendar denial, semantic UTC calendar validation, refusal to copy identity mappings into model-provider payloads or ordinary logs, preservation of opaque analytical identifiers and membership roles (no blanket PII mask), a separately authorized scientific re-identification path, and an internally bound FIPS 180-4 SHA-256 audit digest appended through `ReidentificationAuditSink` before disclosure.
 - `persistence_postgres` backup/restore integrity: restored snapshots stay unusable until tenant, canonical `SHA-256`, knowledge-cutoff eligibility, temporal window order, and append-only triggers revalidate; SQL probes raise `restore integrity failed` (ADR 0013).
@@ -62,7 +64,7 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 - Topic correlation, consensus clustering, TDT, CHRONOS, and evidence-grounded LLM interpretation requirements.
 - APA 7th research traceability, source archive manifests, ADRs, governance, security, and contribution contracts.
 - Hourly centralized PR-maintenance workflow and a documented requirement for a future credential-separated NVIDIA NIM/OpenCode product-development loop.
-- Rust 1.97.1 virtual Cargo workspace with ten explicit modular foundation crates.
+- Rust 1.97.1 virtual Cargo workspace with eleven explicit modular foundation crates.
 - Repository contract, public-rustdoc, line-coverage, and nightly branch-coverage gates.
 - Pinned `cargo-nextest` 0.9.140, `cargo-llvm-cov` 0.8.6, `cargo-deny` 0.19.7, and Coverage.py 7.15.2 quality tooling.
 - Task 1 architecture decision and workspace-foundation validation report.

Cargo.toml

@@ -11,6 +11,7 @@ members = [
     "crates/tepp_simulation",
     "crates/validation_core",
     "crates/tepp_api",
+    "crates/checkpoint_authority",
 ]
 default-members = [
     "crates/evidence_core",
@@ -23,6 +24,7 @@ default-members = [
     "crates/tepp_simulation",
     "crates/validation_core",
     "crates/tepp_api",
+    "crates/checkpoint_authority",
 ]
 
 [workspace.package]

README.md

@@ -7,7 +7,7 @@ implemented in Rust.
 ## Current implementation state
 
 This branch establishes the Task 1 Rust workspace and quality-gate foundation.
-The ten bounded crates compile independently but intentionally expose no
+The eleven bounded crates compile independently but intentionally expose no
 placeholder production APIs. Domain behavior begins in Task 2 with immutable
 evidence identifiers and source records.
 
@@ -22,6 +22,7 @@ crates/corpus_split
 crates/tepp_simulation
 crates/validation_core
 crates/tepp_api
+crates/checkpoint_authority
 ```
 
 ## Local verification

crates/checkpoint_authority/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "checkpoint_authority"
+description = "A model checkpoint is not the CPU f64 estimator."
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+readme.workspace = true
+keywords.workspace = true
+categories.workspace = true
+publish = false
+
+[lints]
+workspace = true

crates/checkpoint_authority/src/authority.rs

@@ -0,0 +1,201 @@
+//! Checkpoint artifacts versus the CPU `f64` estimator.
+
+use crate::CheckpointAuthorityError;
+
+/// Closed vocabulary of scientific-authority roles for a run artifact.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ArtifactRole {
+    /// The production CPU `f64` reference estimator.
+    CpuF64Estimator,
+    /// A serialized model checkpoint produced by a run.
+    ModelCheckpoint,
+}
+
+impl ArtifactRole {
+    /// Return the stable wire role name.
+    #[must_use]
+    pub const fn wire_name(self) -> &'static str {
+        match self {
+            Self::CpuF64Estimator => "cpu_f64_estimator",
+            Self::ModelCheckpoint => "model_checkpoint",
+        }
+    }
+
+    /// Parse a stable wire role name.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`CheckpointAuthorityError::InvalidAuthorityPayload`] for
+    /// unrecognized names.
+    pub fn from_wire_name(name: &str) -> Result<Self, CheckpointAuthorityError> {
+        match name {
+            "cpu_f64_estimator" => Ok(Self::CpuF64Estimator),
+            "model_checkpoint" => Ok(Self::ModelCheckpoint),
+            _ => Err(CheckpointAuthorityError::InvalidAuthorityPayload),
+        }
+    }
+}
+
+/// Identity, digest, and run provenance required to accept a checkpoint
+/// as an artifact (never as the estimator).
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct CheckpointOffer<'a> {
+    /// Opaque artifact identity assigned by the owning boundary.
+    pub artifact_identity: &'a str,
+    /// Canonical lowercase hex `SHA-256` of the checkpoint bytes.
+    pub content_digest: &'a str,
+    /// Model-run identity that produced the checkpoint.
+    pub model_run_identity: &'a str,
+}
+
+/// Refuse to treat a checkpoint as the CPU `f64` estimator.
+///
+/// # Errors
+///
+/// Returns [`CheckpointAuthorityError::CheckpointIsNotEstimator`] when
+/// `role` is [`ArtifactRole::ModelCheckpoint`].
+pub fn refuse_checkpoint_as_estimator(role: ArtifactRole) -> Result<(), CheckpointAuthorityError> {
+    match role {
+        ArtifactRole::ModelCheckpoint => Err(CheckpointAuthorityError::CheckpointIsNotEstimator),
+        ArtifactRole::CpuF64Estimator => Ok(()),
+    }
+}
+
+/// Accept a checkpoint only as a validated run artifact.
+///
+/// Identity, model-run provenance, and a canonical digest are required.
+/// Success does not grant estimator authority.
+///
+/// # Errors
+///
+/// Returns a missing-field or digest error when the offer is untrusted.
+pub fn accept_checkpoint_artifact(
+    offer: &CheckpointOffer<'_>,
+) -> Result<(), CheckpointAuthorityError> {
+    if offer.artifact_identity.is_empty() {
+        return Err(CheckpointAuthorityError::MissingIdentity);
+    }
+    if offer.model_run_identity.is_empty() {
+        return Err(CheckpointAuthorityError::MissingProvenance);
+    }
+    validate_sha256_hex(offer.content_digest)
+}
+
+/// Fraction of recovered artifact roles that match known truth.
+///
+/// # Errors
+///
+/// Returns [`CheckpointAuthorityError::InvalidAuthorityPayload`] when either
+/// slice is empty or the lengths differ.
+pub fn authority_recovery_rate(
+    truth: &[ArtifactRole],
+    decided: &[ArtifactRole],
+) -> Result<f64, CheckpointAuthorityError> {
+    if truth.is_empty() || truth.len() != decided.len() {
+        return Err(CheckpointAuthorityError::InvalidAuthorityPayload);
+    }
+    let mut matches = 0_u32;
+    for (truth_role, decided_role) in truth.iter().zip(decided) {
+        if truth_role == decided_role {
+            matches += 1;
+        }
+    }
+    Ok(f64::from(matches) / truth.len() as f64)
+}
+
+fn validate_sha256_hex(digest: &str) -> Result<(), CheckpointAuthorityError> {
+    if digest.is_empty() {
+        return Err(CheckpointAuthorityError::MissingDigest);
+    }
+    if digest.len() != 64
+        || !digest
+            .bytes()
+            .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
+    {
+        return Err(CheckpointAuthorityError::InvalidDigest);
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{
+        ArtifactRole, CheckpointOffer, accept_checkpoint_artifact, authority_recovery_rate,
+        refuse_checkpoint_as_estimator,
+    };
+    use crate::CheckpointAuthorityError;
+
+    #[test]
+    fn local_branches_cover_roles_payloads_and_wire_names() {
+        assert_eq!(
+            refuse_checkpoint_as_estimator(ArtifactRole::ModelCheckpoint),
+            Err(CheckpointAuthorityError::CheckpointIsNotEstimator)
+        );
+        refuse_checkpoint_as_estimator(ArtifactRole::CpuF64Estimator).expect("estimator");
+        for role in [ArtifactRole::CpuF64Estimator, ArtifactRole::ModelCheckpoint] {
+            assert_eq!(
+                ArtifactRole::from_wire_name(role.wire_name()).expect("round-trip"),
+                role
+            );
+        }
+        assert_eq!(
+            ArtifactRole::from_wire_name("posterior_summary"),
+            Err(CheckpointAuthorityError::InvalidAuthorityPayload)
+        );
+        let offer = CheckpointOffer {
+            artifact_identity: "artifact-01",
+            content_digest: &"cd".repeat(32),
+            model_run_identity: "run-01",
+        };
+        accept_checkpoint_artifact(&offer).expect("artifact");
+        assert_eq!(
+            accept_checkpoint_artifact(&CheckpointOffer {
+                artifact_identity: "",
+                ..offer
+            }),
+            Err(CheckpointAuthorityError::MissingIdentity)
+        );
+        assert_eq!(
+            accept_checkpoint_artifact(&CheckpointOffer {
+                model_run_identity: "",
+                ..offer
+            }),
+            Err(CheckpointAuthorityError::MissingProvenance)
+        );
+        assert_eq!(
+            accept_checkpoint_artifact(&CheckpointOffer {
+                content_digest: "",
+                ..offer
+            }),
+            Err(CheckpointAuthorityError::MissingDigest)
+        );
+        assert_eq!(
+            accept_checkpoint_artifact(&CheckpointOffer {
+                content_digest: "ab",
+                ..offer
+            }),
+            Err(CheckpointAuthorityError::InvalidDigest)
+        );
+        assert_eq!(
+            accept_checkpoint_artifact(&CheckpointOffer {
+                content_digest: &"gh".repeat(32),
+                ..offer
+            }),
+            Err(CheckpointAuthorityError::InvalidDigest)
+        );
+        let matched = authority_recovery_rate(
+            &[ArtifactRole::ModelCheckpoint],
+            &[ArtifactRole::ModelCheckpoint],
+        )
+        .expect("rate");
+        assert!((matched - 1.0).abs() < f64::EPSILON);
+        assert_eq!(
+            authority_recovery_rate(&[], &[]),
+            Err(CheckpointAuthorityError::InvalidAuthorityPayload)
+        );
+        assert_eq!(
+            authority_recovery_rate(&[ArtifactRole::ModelCheckpoint], &[]),
+            Err(CheckpointAuthorityError::InvalidAuthorityPayload)
+        );
+    }
+}

crates/checkpoint_authority/src/error.rs

@@ -0,0 +1,74 @@
+//! Fail-closed checkpoint-authority errors.
+
+use std::fmt;
+
+/// A fail-closed checkpoint-authority error.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[non_exhaustive]
+pub enum CheckpointAuthorityError {
+    /// A checkpoint was treated as the CPU `f64` estimator.
+    CheckpointIsNotEstimator,
+    /// Artifact identity was missing or empty.
+    MissingIdentity,
+    /// Model-run provenance was missing or empty.
+    MissingProvenance,
+    /// Content digest was missing or empty.
+    MissingDigest,
+    /// Content digest was not canonical lowercase hex `SHA-256`.
+    InvalidDigest,
+    /// A recovery slice was empty or length-mismatched.
+    InvalidAuthorityPayload,
+}
+
+impl fmt::Display for CheckpointAuthorityError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let message = match self {
+            Self::CheckpointIsNotEstimator => "a model checkpoint is not the cpu f64 estimator",
+            Self::MissingIdentity => "checkpoint artifact is missing identity",
+            Self::MissingProvenance => "checkpoint artifact is missing model-run provenance",
+            Self::MissingDigest => "checkpoint artifact is missing content digest",
+            Self::InvalidDigest => "checkpoint artifact digest is not canonical sha-256",
+            Self::InvalidAuthorityPayload => "invalid checkpoint-authority payload",
+        };
+        formatter.write_str(message)
+    }
+}
+
+impl std::error::Error for CheckpointAuthorityError {}
+
+#[cfg(test)]
+mod tests {
+    use super::CheckpointAuthorityError;
+
+    #[test]
+    fn error_messages_are_stable() {
+        for (error, message) in [
+            (
+                CheckpointAuthorityError::CheckpointIsNotEstimator,
+                "a model checkpoint is not the cpu f64 estimator",
+            ),
+            (
+                CheckpointAuthorityError::MissingIdentity,
+                "checkpoint artifact is missing identity",
+            ),
+            (
+                CheckpointAuthorityError::MissingProvenance,
+                "checkpoint artifact is missing model-run provenance",
+            ),
+            (
+                CheckpointAuthorityError::MissingDigest,
+                "checkpoint artifact is missing content digest",
+            ),
+            (
+                CheckpointAuthorityError::InvalidDigest,
+                "checkpoint artifact digest is not canonical sha-256",
+            ),
+            (
+                CheckpointAuthorityError::InvalidAuthorityPayload,
+                "invalid checkpoint-authority payload",
+            ),
+        ] {
+            assert_eq!(error.to_string(), message);
+        }
+    }
+}

crates/checkpoint_authority/src/lib.rs

@@ -0,0 +1,24 @@
+#![forbid(unsafe_code)]
+#![deny(missing_docs)]
+#![allow(clippy::cast_precision_loss)]
+//! A model checkpoint is not the CPU `f64` estimator.
+//!
+//! Checkpoints stay untrusted run artifacts until identity, digest, and
+//! model-run provenance validate. They cannot replace the reference
+//! estimator or promote a scientific claim (ADR 0001/0014).
+
+mod authority;
+mod error;
+
+/// Closed vocabulary of scientific-authority roles for a run artifact.
+pub use authority::ArtifactRole;
+/// Identity, digest, and run provenance for one checkpoint offer.
+pub use authority::CheckpointOffer;
+/// Accept a checkpoint only as a validated run artifact.
+pub use authority::accept_checkpoint_artifact;
+/// Fraction of recovered artifact roles that match known truth.
+pub use authority::authority_recovery_rate;
+/// Refuse to treat a checkpoint as the CPU `f64` estimator.
+pub use authority::refuse_checkpoint_as_estimator;
+/// Fail-closed checkpoint-authority errors.
+pub use error::CheckpointAuthorityError;