Document ephemeral Composer and asynchronous deliveryHEADmain

6 files changed, 168 insertions, 35 deletions

diff --git a/README.md b/README.md
index aad5677..23a4080 100644
--- a/README.md
+++ b/README.md
@@ -69,6 +69,14 @@ configuration, and network policy. The initial `fog-drop`, `fog-mailbox`, and
 `fog-im` features run as Composer-side modules over one common messaging and
 storage protocol, not as distinguishable public services.
 
+FOG messaging is asynchronous. `fog-drop` acts as one cryptographic digital
+dead drop, while `fog-mailbox` and `fog-im` use sequences of rotating,
+capability-addressed dead drops. A Composer may prepare bounded opaque polling
+work for its online blind relay, which can later queue opaque results but
+cannot decrypt them or derive new mailbox capability state. Replica storage,
+relay retrieval, Composer commit, and human reading are different events; FOG
+does not promise real-time delivery.
+
 The Composer can run as a networkless microVM on an online host or as a
 portable bootable USB system on a physically offline computer. High-assurance
 transfer avoids USB shuttling and uses QR or `FOG-SX`, an acknowledgment-free
@@ -79,9 +87,19 @@ physical profiles remain non-active pending implementation, hardware, and
 resource review. Visible light, audio modem, and paper tape remain possible
 future backends.
 
-Composer software boots from an authenticated read-only image and keeps
-mutable secrets in a volume-encrypted, object-authenticated transactional
-vault. Imports are hostile fixed bundles; exports contain only committed
+A rootless Podman `network=none` Composer remains a functional fixture and
+does not protect unlocked state from its host or shared kernel. A non-active
+RAM-only Ephemeral Composer direction is limited to one-shot drops and
+explicitly non-resumable sessions. Closing it abandons its identity, keys,
+capabilities, pending work, and reply ability, without making a secure RAM
+erasure claim. Continuing mailbox and chat use requires a Persistent Composer
+vault.
+
+Composer software boots from an authenticated read-only image and keeps every
+sensitive mutable object in an authenticated encrypted transactional vault.
+Whole-volume encryption such as LUKS2 is highly recommended defense in depth,
+but is not a universal requirement and cannot replace object authentication.
+Imports are hostile fixed bundles; exports contain only committed
 opaque work. A local commitment chain is not presented as complete rollback
 protection. That claim requires an independent monotonic anchor outside the
 vault and host rollback domain. Identity recovery does not resume stale live
diff --git a/docs/FOG-ARCHITECTURE.md b/docs/FOG-ARCHITECTURE.md
index 9060c7c..c6ae166 100644
--- a/docs/FOG-ARCHITECTURE.md
+++ b/docs/FOG-ARCHITECTURE.md
@@ -224,6 +224,13 @@ It MUST NOT:
 modules over shared messaging and storage protocol libraries. They are not
 independent network daemons in the initial architecture.
 
+The rootless Podman `network=none` Composer remains a functional fixture, not
+a claim-bearing endpoint profile. A non-active Ephemeral Composer may keep
+bounded runtime state only in RAM for one-shot drops and explicitly
+non-resumable sessions. Continuing mailbox and conversation state requires a
+Persistent Composer vault. The MicroVM and Portable profiles retain their
+separate host and physical assumptions.
+
 Threats addressed: `TM-ENDPOINT-01`, `TM-ENDPOINT-02`, `TM-ENDPOINT-03`,
 `TM-APP-01`, `TM-CRYPTO-01`, `TM-PKI-02`.
 
@@ -678,6 +685,18 @@ to a stable global username. It MUST NOT become a durable provider mailbox.
 Exact queueing, polling, retransmission, acknowledgment, and SURB behavior is
 defined by the packet, wire, messaging, and storage specifications.
 
+The Composer MAY prepare a bounded batch of future opaque polling operations
+that the relay transmits later according to the authenticated schedule. The
+relay cannot derive replacement capability state, invent semantic polling
+operations, or decrypt returned storage results. When the prepared batch is
+exhausted, only a later Composer export can replenish it.
+
+FOG retrieval is therefore asynchronous. `fog-drop` is one cryptographic
+digital dead drop; `fog-mailbox` and `fog-im` operate over sequences of
+rotating capability-addressed dead drops. Replica persistence, relay receipt,
+Composer authenticated commit, and human reading are distinct events. No core
+component promises real-time delivery.
+
 Empty reads, hits, misses, replies, retries, and acknowledgments MUST fit the
 same declared external traffic classes. A relay MUST continue its configured
 cover and retrieval schedule independently of whether the Composer has a real
diff --git a/docs/FOG-COMPOSER.md b/docs/FOG-COMPOSER.md
index b517db5..90abd51 100644
--- a/docs/FOG-COMPOSER.md
+++ b/docs/FOG-COMPOSER.md
@@ -15,7 +15,7 @@ transaction and rollback rules, hostile import handling, committed export
 bundles, identity-safe recovery, update verification, local rendering,
 resource limits, and conformance gates.
 
-It also records four non-active implementation candidates:
+It records four non-active implementation candidates:
 
 - `FOG-COMPOSER-CANDIDATE-LINUX-VAULT-1` for a Linux read-only system image,
   LUKS2 defense-in-depth volume encryption, a transactional embedded
@@ -27,6 +27,11 @@ It also records four non-active implementation candidates:
 - `FOG-COMPOSER-CANDIDATE-UPDATE-TUF-1` for offline update metadata derived
   from The Update Framework.
 
+Separately, `FOG-COMPOSER-FIXTURE-EPHEMERAL-CONTAINER-1` records a
+functional-only rootless, networkless, read-only container whose bounded
+runtime state exists only in tmpfs for one-shot drops and explicitly
+non-resumable sessions. It is not a conforming deployment profile.
+
 These candidates have no active numeric profile IDs, do not select final
 libraries or cryptographic parameters, are not authorized for public release,
 and do not establish deployed endpoint-security claims.
@@ -253,7 +258,9 @@ Every Composer profile MUST:
 
 - boot an authenticated read-only software image;
 - omit or disable all network and radio devices and drivers;
-- use one dedicated authenticated encrypted mutable vault;
+- use one dedicated mutable vault with object-level authenticated encryption;
+- strongly recommend whole-volume encryption as defense in depth and disclose
+  the powered-off metadata exposure when it is omitted;
 - separate import quarantine and export spool from active vault state;
 - disable swap, hibernation, core dumps, automatic crash reporting, previews,
   indexing, and host clipboard integration;
@@ -305,8 +312,9 @@ It MUST:
 
 - verify the bootloader, kernel, initramfs, command line, root-image digest,
   and Composer release identity before vault unlock;
-- use a read-only verified root image and a separate encrypted mutable state
-  partition;
+- use a read-only verified root image and a separate mutable state partition
+  with mandatory object-level authenticated encryption;
+- strongly recommend whole-volume encryption for that state partition;
 - refuse automatic internal-disk, network-share, and foreign-filesystem
   mounting;
 - use dedicated receive-only and transmit-only transfer devices in its
@@ -345,6 +353,27 @@ peripheral-compromise claim.
 | Physical peripheral isolation | host-dependent | required and measured | weakened |
 | Endpoint compromise protection while unlocked | not claimed | not claimed | not claimed |
 
+### 5.6 Ephemeral container fixture
+
+`FOG-COMPOSER-FIXTURE-EPHEMERAL-CONTAINER-1` is a functional and
+lower-assurance direction, not a substitute for the MicroVM or Portable
+profiles. It uses a rootless container with no configured network interface,
+a read-only container root, bounded tmpfs mounts for runtime state, no
+persistent vault or application log, no host clipboard, and no generic shared
+directory.
+
+The Ephemeral Composer is limited to one-shot `fog-drop` operations and
+sessions whose identity, keys, capabilities, pending work, and reply ability
+are intentionally abandoned at shutdown. It MUST NOT create or resume a
+continuing mailbox, ratchet, voucher, deduplication window, acknowledgment
+stream, or capability sequence after its runtime state is lost.
+
+Container shutdown is only logical best-effort disposal. It does not prove
+erasure from host swap, hibernation, kernel caches, residual RAM, logs,
+display capture, input infrastructure, crash artifacts, or a compromised host.
+The container shares the host kernel, and a hostile host can inspect or alter
+its unlocked plaintext, keys, execution, devices, and transfer channels.
+
 ## 6. Process and Module Architecture
 
 ### 6.1 Security domains
@@ -435,7 +464,8 @@ continue-on-verification-failure modes are forbidden.
 
 The runtime permits only:
 
-- the dedicated encrypted state volume;
+- the dedicated mutable state volume, with whole-volume encryption strongly
+  recommended;
 - a bounded encrypted or memory-backed import quarantine;
 - a bounded export spool containing opaque committed bundles;
 - bounded memory-backed temporary directories;
@@ -468,13 +498,20 @@ hibernation remnants, or physical memory retained no copy.
 
 ### 8.1 Vault layers
 
-The Composer uses both:
+The Composer always uses:
+
+1. object-level authenticated encryption for every sensitive logical record.
 
-1. full-volume encryption to hide filesystem metadata, database pages,
-   journals, temporary files, and free space while powered off;
-2. object-level authenticated encryption for every sensitive logical record.
+The Composer strongly recommends, but does not universally require:
 
-The Linux candidate evaluates LUKS2 for layer 1. It does not rely on ordinary
+2. full-volume encryption to hide filesystem metadata, database pages,
+   journals, temporary files, and free space while powered off.
+
+A profile that omits layer 2 MUST disclose that loss of defense in depth and
+MUST NOT weaken layer 1, key separation, transaction integrity, or message
+end-to-end encryption.
+
+The Linux candidate evaluates LUKS2 for layer 2. It does not rely on ordinary
 sector encryption to authenticate logical records. Any LUKS2 integrity mode
 requires separate maturity, performance, recovery, and power-failure review.
 
@@ -1478,15 +1515,35 @@ Secure Boot without a narrowly controlled FOG release root, root-image
 verification without an authenticated root digest, or a TPM without a reviewed
 state-binding protocol does not satisfy the complete candidate.
 
-### 21.4 Activation gates
+### 21.4 Ephemeral container fixture
+
+`FOG-COMPOSER-FIXTURE-EPHEMERAL-CONTAINER-1` evaluates:
+
+- rootless Podman with `network=none` and no published port;
+- a read-only container root and bounded tmpfs mounts for `/run`, `/tmp`, and
+  runtime state;
+- no persistent volume, host filesystem, generic bind mount, application log,
+  swap-dependent security claim, or secret-bearing standard output;
+- capability removal, no-new-privileges, resource ceilings, core-dump denial,
+  and one bounded import and export interface;
+- fresh one-shot identity and protocol state that cannot be resumed after
+  shutdown.
+
+This candidate can demonstrate functional network absence and ordinary
+storage minimization. It cannot demonstrate secure memory erasure, host
+protection, physical isolation, durable mailbox behavior, or production
+endpoint security.
+
+### 21.5 Activation gates
 
 Before any candidate receives an active numeric profile, FOG MUST freeze and
 verify:
 
 1. exact operating system, kernel, bootloader, firmware assumptions, image
    format, and immutable-root construction;
-2. exact LUKS2, Argon2id, AEAD, KDF, hash, database, filesystem, and library
-   revisions and parameters;
+2. exact AEAD, KDF, hash, database, filesystem, and library revisions and
+   parameters, plus exact LUKS2 parameters when whole-volume encryption is
+   selected;
 3. byte-exact vault object, commitment, bundle, record, recovery, and update
    serialization;
 4. nonce uniqueness, key-purpose separation, wrapping, rotation, and deletion;
@@ -1518,6 +1575,8 @@ negative tests for:
 - MicroVM clipboard, shared directory, qrexec, device, and guest-agent denial;
 - Portable radio, internal-disk mount, foreign-filesystem, and directional
   device denial;
+- Ephemeral container network, writable-layer, persistent-volume, bind-mount,
+  log, core-dump, restart, and tmpfs-boundary denial;
 - keyslot creation, unlock, wrong secret, rewrap, rotation, and partial header
   update;
 - object AEAD, associated data, nonce, padding, generation, key epoch, wrong
@@ -1591,6 +1650,7 @@ FOG-COMPOSER does not yet establish:
 
 - protection of plaintext or keys from a compromised unlocked Composer;
 - protection of a MicroVM from its malicious host or hypervisor;
+- protection of an Ephemeral container from its host or shared kernel;
 - detection of a complete coherent rollback without an independent anchor;
 - safe binding or endurance of a concrete TPM, secure element, or token;
 - secure deletion from every RAM, flash, snapshot, backup, or physical copy;
@@ -1613,7 +1673,11 @@ before an active profile or implementation:
 
 - exact supported Linux distribution, kernel, boot, immutable-image,
   filesystem, and hardware profiles;
-- exact LUKS2, Argon2id, AEAD, KDF, database, and secure-memory selections;
+- exact Argon2id, AEAD, KDF, database, and secure-memory selections, plus an
+  exact LUKS2 selection for profiles that enable whole-volume encryption;
+- exact rootless container runtime, no-network configuration, tmpfs limits,
+  logging behavior, host swap and hibernation assumptions, and bounded
+  import/export adapters for the Ephemeral candidate;
 - byte-exact vault, state commitment, bundle records, recovery envelope, and
   update metadata integration;
 - an independent monotonic-anchor construction with proven state binding,
diff --git a/docs/FOG-MESSAGING.md b/docs/FOG-MESSAGING.md
index 69b1ffd..6ac8456 100644
--- a/docs/FOG-MESSAGING.md
+++ b/docs/FOG-MESSAGING.md
@@ -74,6 +74,19 @@ recipient. Fixed envelope size also does not hide timing, polling, retries, or
 conversation activity unless the external traffic profile supplies sufficient
 cover and scheduling.
 
+### 3.1 Asynchronous dead-drop model
+
+`fog-drop` is one cryptographic digital dead drop. `fog-mailbox` and `fog-im`
+use sequences of rotating capability-addressed dead drops in FOG-STORAGE. The
+sender and recipient do not need to be online together, and the recipient
+Composer does not connect directly to a sender or replica.
+
+A blind relay MAY transmit bounded opaque polling work prepared earlier by the
+Composer and queue opaque results for later controlled import. It cannot hold
+mailbox capability roots, derive new semantic operations, decrypt results, or
+turn relay receipt into a message acknowledgment. FOG-MESSAGING is
+asynchronous and does not promise real-time delivery.
+
 ## 4. Protocol Invariants
 
 ### MSG-INV-01: No global contact identifier
@@ -141,6 +154,13 @@ Copying Composer files, restoring a stale backup, or adding a second device
 MUST NOT create two active copies of one ratchet. Restored conversation state
 enters recovery and requires a new authenticated session.
 
+### MSG-INV-11: Ephemeral sessions do not resume
+
+A RAM-only Ephemeral Composer MUST NOT resume an identity, ratchet, voucher,
+capability sequence, deduplication window, acknowledgment stream, or pending
+delivery after shutdown. Continuing `fog-mailbox` and `fog-im` sessions require
+the Persistent Composer state contract defined by `FOG-COMPOSER`.
+
 ## 5. Contact Model
 
 ### 5.1 Pairwise identity
diff --git a/docs/FOG-SX.md b/docs/FOG-SX.md
index 336acae..67383ee 100644
--- a/docs/FOG-SX.md
+++ b/docs/FOG-SX.md
@@ -764,6 +764,18 @@ The high-assurance construction requires:
 - schematics, bill of materials, board photographs, continuity tests, optical
   direction tests, and teardown evidence for the exact hardware revision.
 
+FOG does not assume that a PC provides a native TOSLINK port. The intended
+high-assurance profile uses dedicated offline `TOTX` and online `TORX` boards
+with narrowly allowlisted local interfaces. A consumer optical audio port or
+adapter may support a functional experiment but does not establish physical
+directionality.
+
+The optical diode constrains data flow through the selected fiber only. It
+cannot stop a compromised offline Composer from placing plaintext, keys, or a
+covert signal into the permitted offline-to-online output, and it cannot
+protect unlocked Composer state from compromised local firmware, drivers,
+peripherals, or host software.
+
 TOSLINK defines optical transmitter and receiver device classes, not the
 complete FOG-SX modulation. Before activation the candidate must fix the exact
 NRZ or self-clocking line code, bitrate, transition density, preamble, clock
diff --git a/merkle-tree.txt b/merkle-tree.txt
index 8aa3446..3e87ec8 100644
--- a/merkle-tree.txt
+++ b/merkle-tree.txt
@@ -9,13 +9,13 @@ leaf-count: 18
 
 leaves:
 L00 0b4f19bb2a960317da8d1e30f53fa40e086954d2b7aa4009739c90dc10a3419d 1271 LICENSE.md
-L01 9c7ea83701e50826881d00807068c708426d6d6a64f5f4255c564afc5936fb47 9870 README.md
+L01 cbdc8212320da1a6bf16929fc75724a9da0d86ab1ed15ba4128ce5c727ab0b02 10978 README.md
 L02 fe03bca95fb7970575feb1ee14735751ef5cb6d9d321db8ee47eb35661a2e05d 8809 docs/FOG-ALPHA.md
-L03 50eeae3e905a5342bb9f8f45a004949c5c8d10968ce2fd994c817cbee645565a 55832 docs/FOG-ARCHITECTURE.md
-L04 adb3fcd7ff4946398c4868c0f062cbcffaa8a11797aba2375c6c3bdff1a61c41 78489 docs/FOG-COMPOSER.md
+L03 5b41fc681fe690e561b3f07d7d47a9f2330b8fd1e48393e80a300dfae604209e 56948 docs/FOG-ARCHITECTURE.md
+L04 559bfcafe914e4a64e617388b9177a7d50024bda293c4ce60aa37f313b27dcbe 81857 docs/FOG-COMPOSER.md
 L05 8c9d2f59b2a205815daff3d04c7fdba6ab3169fee1bd1bc75dde95a13d4a4684 36901 docs/FOG-CRYPTO-SUITES.md
 L06 012d873502c9bb3dae72ab98b5b72bab37cffe54b7d3213ac93099e0aded3102 16204 docs/FOG-LOCAL-POC.md
-L07 a1cb8c3915ce87a95215a22c4d77055ab9aeb055458d239f1910499c09218ad4 46508 docs/FOG-MESSAGING.md
+L07 35cc1648a31327ee4572618a1036275302398d05e5af52946e95a9c25e1c6d14 47544 docs/FOG-MESSAGING.md
 L08 682b534264fecb4ed31210529d9aeb85f9bbea88d29cd36c081662171d21f4a8 31602 docs/FOG-OBSERVABILITY.md
 L09 99c0c0d1c130741a2fbf330aadf7bf1c6a4677028d5b413a656dc90ce53e1396 67845 docs/FOG-PKI.md
 L10 d7c3bc29d9e0bb979c8cd5847267de9cbf816020fdf525dfb52275b1b1c74bf0 6955 docs/FOG-POC-PRESERVATION.md
@@ -23,27 +23,27 @@ L11 e36d9acf73343eb088a5ccac6c5528ab7334a40f5d88cae973674532279b0c22 6716 docs/F
 L12 94050ece3310571d3758f80eb2b1867c1bb2ae7e2fe933814732fcf3ff1b32db 13908 docs/FOG-SIMULATION.md
 L13 a7ffb9df81a23ab6763f9a3bcf9d1ba72836ac3b364fb3ee33fd70d53c2a4588 46240 docs/FOG-SPHINX-PROFILES.md
 L14 9c9017d04486a377ffd1d189a99c5cda1efe33040e9a22f28633d214d1aa6e97 67516 docs/FOG-STORAGE.md
-L15 9ec2dbb5b0d0c439aa3424e9da64fb26b4798e7fea7acaa3eb2c2290f98d6a36 43156 docs/FOG-SX.md
+L15 72b1b1d596dc5f35fdd89c5203c7c6fff2a9d1ac87682184ef456a142352d636 43811 docs/FOG-SX.md
 L16 0595a5fe5da9fb8dbee2fac17b059f78028bc75d5ebc8863f1ac9a913c23bdde 43740 docs/FOG-THREAT-MODEL.md
 L17 370bba48b1424040bd9d74eace070b87afac1cc912f175d371f5838c2235c052 54012 docs/FOG-WIRE.md
 
 internal-nodes-postorder:
-N[0,2) f2f224b2b97e15918c9b65b39c48a2abaa12b9fe7710b13beb7d4e6608dcc923
-N[2,4) bb46edc9a40afd896c0ee12721b1422386e99f41b3e77c09327159f4133b2835
-N[0,4) 15d6985a2f22f9189d40f90b93558c16f4369a6a00320a348e321c3a55496acf
-N[4,6) 1aa7cb2810493f62805f7109888a93f05065c3bd326874232deb94f2233fa4cc
-N[6,8) 11fd5d6e48fe3294ba015335adaa0d32ee30da80ee8dc50623d3d97108073db8
-N[4,8) 1a5bd44b77702e9d81d6223f5ba7eabc0ab0d2283b9d47871f2f2c0b80e1db57
-N[0,8) 529949f8d439b6eeb93c1fd90b4fc01bc26a77b5bab6e763145a594a1e6052ee
+N[0,2) d4d62982814cdf1e796d59ec7913678f6a38a8e24562f6d4a32778a5338db5c2
+N[2,4) 4998f1537b4b747093d58fcba59d61e1af9a5a068b7de5c121a87477e4baf963
+N[0,4) fc327ee7be68afe897edc2e2024a257f678a55c13146d559c153ec7491767a38
+N[4,6) f3d4dd3d696e5151727c966f42672376790e39661f9b1a3dc0a2a32a8cd06b89
+N[6,8) d07d1906f9bdd2f75d89eb71027c27e3c02de280477ce1cb12c2c37b12384e13
+N[4,8) 6f943ddd5c458811a0caf0fd0413bad2c57937fe41e2dc3479a179cdcba09660
+N[0,8) 07b491421ca80ba374460a9dc55254f6c5c11f6a32670bb5e4a60a4f8a5aa9e5
 N[8,10) e9aa47870d7a3588f84560fb52166daf74d020cbc9ed5c4cf6cdc5b8b4e1ea60
 N[10,12) 0209fcd7426eff6b86a6bc12cc573eb63b5e7181670fce0853b728a920dd89b2
 N[8,12) b7553affab219bf252ed299be9fd2150e47d5a9584e23ee6020ebc1161c4324b
 N[12,14) 523cd1487b44ab3cff12f523316507b8ad7b4a7a89bffb5d40bad255a21b8c41
-N[14,16) 2051bc8fd348330c541879147cee36984648eb77e810101872607d9fb929b7d2
-N[12,16) f0c33de1391d527aed952c72e0b286878eb83581555ef15f2e8c26ed10949151
-N[8,16) c0303420cbb72a32ae5a29856a37406430c61b838ffd6af2597d5a26da42a17c
-N[0,16) 21389ee3b4c84f9fc5e147235c7d7e507c526f0cafa96ae6e6800e14d26d5db4
+N[14,16) b919d5696b7eaa65fbeb53e0309be7a2f3fb1f98ff116cce407ed24cd4f4ee42
+N[12,16) 12b3e35c5dbcdacca92029dd7a7e4c064a8adb7fca21a6d4b9110d7b8b26e0e1
+N[8,16) 4e83b2beafc96e1d8e3851c8a9ad12264a7d260a7248842cf4768040d6980bb2
+N[0,16) 6a822c28f8538ec3aa9a36b0806700b267a627232c6fac4b4922c2b3b6380d52
 N[16,18) 36a18347a69583877658b211e3a6ad55c4d8f538b8abcbd16cfb783cf7272d14
-N[0,18) 0d11acb73d12f17c6ab284f4d3e9920d5b9682158923486360955492319109f0
+N[0,18) cade27b8580e51a406b9dc12601770e40dbe4be68e366cbede6b31c418eaf6b4
 
-root: 0d11acb73d12f17c6ab284f4d3e9920d5b9682158923486360955492319109f0
+root: cade27b8580e51a406b9dc12601770e40dbe4be68e366cbede6b31c418eaf6b4