Document ephemeral Composer and asynchronous deliveryHEADmain

4 files changed, 129 insertions, 14 deletions

diff --git a/docs/FOG-ARCHITECTURE.md b/docs/FOG-ARCHITECTURE.md
index 9060c7c..c6ae166 100644
--- a/docs/FOG-ARCHITECTURE.md
+++ b/docs/FOG-ARCHITECTURE.md
@@ -224,6 +224,13 @@ It MUST NOT:
 modules over shared messaging and storage protocol libraries. They are not
 independent network daemons in the initial architecture.
 
+The rootless Podman `network=none` Composer remains a functional fixture, not
+a claim-bearing endpoint profile. A non-active Ephemeral Composer may keep
+bounded runtime state only in RAM for one-shot drops and explicitly
+non-resumable sessions. Continuing mailbox and conversation state requires a
+Persistent Composer vault. The MicroVM and Portable profiles retain their
+separate host and physical assumptions.
+
 Threats addressed: `TM-ENDPOINT-01`, `TM-ENDPOINT-02`, `TM-ENDPOINT-03`,
 `TM-APP-01`, `TM-CRYPTO-01`, `TM-PKI-02`.
 
@@ -678,6 +685,18 @@ to a stable global username. It MUST NOT become a durable provider mailbox.
 Exact queueing, polling, retransmission, acknowledgment, and SURB behavior is
 defined by the packet, wire, messaging, and storage specifications.
 
+The Composer MAY prepare a bounded batch of future opaque polling operations
+that the relay transmits later according to the authenticated schedule. The
+relay cannot derive replacement capability state, invent semantic polling
+operations, or decrypt returned storage results. When the prepared batch is
+exhausted, only a later Composer export can replenish it.
+
+FOG retrieval is therefore asynchronous. `fog-drop` is one cryptographic
+digital dead drop; `fog-mailbox` and `fog-im` operate over sequences of
+rotating capability-addressed dead drops. Replica persistence, relay receipt,
+Composer authenticated commit, and human reading are distinct events. No core
+component promises real-time delivery.
+
 Empty reads, hits, misses, replies, retries, and acknowledgments MUST fit the
 same declared external traffic classes. A relay MUST continue its configured
 cover and retrieval schedule independently of whether the Composer has a real
diff --git a/docs/FOG-COMPOSER.md b/docs/FOG-COMPOSER.md
index b517db5..90abd51 100644
--- a/docs/FOG-COMPOSER.md
+++ b/docs/FOG-COMPOSER.md
@@ -15,7 +15,7 @@ transaction and rollback rules, hostile import handling, committed export
 bundles, identity-safe recovery, update verification, local rendering,
 resource limits, and conformance gates.
 
-It also records four non-active implementation candidates:
+It records four non-active implementation candidates:
 
 - `FOG-COMPOSER-CANDIDATE-LINUX-VAULT-1` for a Linux read-only system image,
   LUKS2 defense-in-depth volume encryption, a transactional embedded
@@ -27,6 +27,11 @@ It also records four non-active implementation candidates:
 - `FOG-COMPOSER-CANDIDATE-UPDATE-TUF-1` for offline update metadata derived
   from The Update Framework.
 
+Separately, `FOG-COMPOSER-FIXTURE-EPHEMERAL-CONTAINER-1` records a
+functional-only rootless, networkless, read-only container whose bounded
+runtime state exists only in tmpfs for one-shot drops and explicitly
+non-resumable sessions. It is not a conforming deployment profile.
+
 These candidates have no active numeric profile IDs, do not select final
 libraries or cryptographic parameters, are not authorized for public release,
 and do not establish deployed endpoint-security claims.
@@ -253,7 +258,9 @@ Every Composer profile MUST:
 
 - boot an authenticated read-only software image;
 - omit or disable all network and radio devices and drivers;
-- use one dedicated authenticated encrypted mutable vault;
+- use one dedicated mutable vault with object-level authenticated encryption;
+- strongly recommend whole-volume encryption as defense in depth and disclose
+  the powered-off metadata exposure when it is omitted;
 - separate import quarantine and export spool from active vault state;
 - disable swap, hibernation, core dumps, automatic crash reporting, previews,
   indexing, and host clipboard integration;
@@ -305,8 +312,9 @@ It MUST:
 
 - verify the bootloader, kernel, initramfs, command line, root-image digest,
   and Composer release identity before vault unlock;
-- use a read-only verified root image and a separate encrypted mutable state
-  partition;
+- use a read-only verified root image and a separate mutable state partition
+  with mandatory object-level authenticated encryption;
+- strongly recommend whole-volume encryption for that state partition;
 - refuse automatic internal-disk, network-share, and foreign-filesystem
   mounting;
 - use dedicated receive-only and transmit-only transfer devices in its
@@ -345,6 +353,27 @@ peripheral-compromise claim.
 | Physical peripheral isolation | host-dependent | required and measured | weakened |
 | Endpoint compromise protection while unlocked | not claimed | not claimed | not claimed |
 
+### 5.6 Ephemeral container fixture
+
+`FOG-COMPOSER-FIXTURE-EPHEMERAL-CONTAINER-1` is a functional and
+lower-assurance direction, not a substitute for the MicroVM or Portable
+profiles. It uses a rootless container with no configured network interface,
+a read-only container root, bounded tmpfs mounts for runtime state, no
+persistent vault or application log, no host clipboard, and no generic shared
+directory.
+
+The Ephemeral Composer is limited to one-shot `fog-drop` operations and
+sessions whose identity, keys, capabilities, pending work, and reply ability
+are intentionally abandoned at shutdown. It MUST NOT create or resume a
+continuing mailbox, ratchet, voucher, deduplication window, acknowledgment
+stream, or capability sequence after its runtime state is lost.
+
+Container shutdown is only logical best-effort disposal. It does not prove
+erasure from host swap, hibernation, kernel caches, residual RAM, logs,
+display capture, input infrastructure, crash artifacts, or a compromised host.
+The container shares the host kernel, and a hostile host can inspect or alter
+its unlocked plaintext, keys, execution, devices, and transfer channels.
+
 ## 6. Process and Module Architecture
 
 ### 6.1 Security domains
@@ -435,7 +464,8 @@ continue-on-verification-failure modes are forbidden.
 
 The runtime permits only:
 
-- the dedicated encrypted state volume;
+- the dedicated mutable state volume, with whole-volume encryption strongly
+  recommended;
 - a bounded encrypted or memory-backed import quarantine;
 - a bounded export spool containing opaque committed bundles;
 - bounded memory-backed temporary directories;
@@ -468,13 +498,20 @@ hibernation remnants, or physical memory retained no copy.
 
 ### 8.1 Vault layers
 
-The Composer uses both:
+The Composer always uses:
+
+1. object-level authenticated encryption for every sensitive logical record.
 
-1. full-volume encryption to hide filesystem metadata, database pages,
-   journals, temporary files, and free space while powered off;
-2. object-level authenticated encryption for every sensitive logical record.
+The Composer strongly recommends, but does not universally require:
 
-The Linux candidate evaluates LUKS2 for layer 1. It does not rely on ordinary
+2. full-volume encryption to hide filesystem metadata, database pages,
+   journals, temporary files, and free space while powered off.
+
+A profile that omits layer 2 MUST disclose that loss of defense in depth and
+MUST NOT weaken layer 1, key separation, transaction integrity, or message
+end-to-end encryption.
+
+The Linux candidate evaluates LUKS2 for layer 2. It does not rely on ordinary
 sector encryption to authenticate logical records. Any LUKS2 integrity mode
 requires separate maturity, performance, recovery, and power-failure review.
 
@@ -1478,15 +1515,35 @@ Secure Boot without a narrowly controlled FOG release root, root-image
 verification without an authenticated root digest, or a TPM without a reviewed
 state-binding protocol does not satisfy the complete candidate.
 
-### 21.4 Activation gates
+### 21.4 Ephemeral container fixture
+
+`FOG-COMPOSER-FIXTURE-EPHEMERAL-CONTAINER-1` evaluates:
+
+- rootless Podman with `network=none` and no published port;
+- a read-only container root and bounded tmpfs mounts for `/run`, `/tmp`, and
+  runtime state;
+- no persistent volume, host filesystem, generic bind mount, application log,
+  swap-dependent security claim, or secret-bearing standard output;
+- capability removal, no-new-privileges, resource ceilings, core-dump denial,
+  and one bounded import and export interface;
+- fresh one-shot identity and protocol state that cannot be resumed after
+  shutdown.
+
+This candidate can demonstrate functional network absence and ordinary
+storage minimization. It cannot demonstrate secure memory erasure, host
+protection, physical isolation, durable mailbox behavior, or production
+endpoint security.
+
+### 21.5 Activation gates
 
 Before any candidate receives an active numeric profile, FOG MUST freeze and
 verify:
 
 1. exact operating system, kernel, bootloader, firmware assumptions, image
    format, and immutable-root construction;
-2. exact LUKS2, Argon2id, AEAD, KDF, hash, database, filesystem, and library
-   revisions and parameters;
+2. exact AEAD, KDF, hash, database, filesystem, and library revisions and
+   parameters, plus exact LUKS2 parameters when whole-volume encryption is
+   selected;
 3. byte-exact vault object, commitment, bundle, record, recovery, and update
    serialization;
 4. nonce uniqueness, key-purpose separation, wrapping, rotation, and deletion;
@@ -1518,6 +1575,8 @@ negative tests for:
 - MicroVM clipboard, shared directory, qrexec, device, and guest-agent denial;
 - Portable radio, internal-disk mount, foreign-filesystem, and directional
   device denial;
+- Ephemeral container network, writable-layer, persistent-volume, bind-mount,
+  log, core-dump, restart, and tmpfs-boundary denial;
 - keyslot creation, unlock, wrong secret, rewrap, rotation, and partial header
   update;
 - object AEAD, associated data, nonce, padding, generation, key epoch, wrong
@@ -1591,6 +1650,7 @@ FOG-COMPOSER does not yet establish:
 
 - protection of plaintext or keys from a compromised unlocked Composer;
 - protection of a MicroVM from its malicious host or hypervisor;
+- protection of an Ephemeral container from its host or shared kernel;
 - detection of a complete coherent rollback without an independent anchor;
 - safe binding or endurance of a concrete TPM, secure element, or token;
 - secure deletion from every RAM, flash, snapshot, backup, or physical copy;
@@ -1613,7 +1673,11 @@ before an active profile or implementation:
 
 - exact supported Linux distribution, kernel, boot, immutable-image,
   filesystem, and hardware profiles;
-- exact LUKS2, Argon2id, AEAD, KDF, database, and secure-memory selections;
+- exact Argon2id, AEAD, KDF, database, and secure-memory selections, plus an
+  exact LUKS2 selection for profiles that enable whole-volume encryption;
+- exact rootless container runtime, no-network configuration, tmpfs limits,
+  logging behavior, host swap and hibernation assumptions, and bounded
+  import/export adapters for the Ephemeral candidate;
 - byte-exact vault, state commitment, bundle records, recovery envelope, and
   update metadata integration;
 - an independent monotonic-anchor construction with proven state binding,
diff --git a/docs/FOG-MESSAGING.md b/docs/FOG-MESSAGING.md
index 69b1ffd..6ac8456 100644
--- a/docs/FOG-MESSAGING.md
+++ b/docs/FOG-MESSAGING.md
@@ -74,6 +74,19 @@ recipient. Fixed envelope size also does not hide timing, polling, retries, or
 conversation activity unless the external traffic profile supplies sufficient
 cover and scheduling.
 
+### 3.1 Asynchronous dead-drop model
+
+`fog-drop` is one cryptographic digital dead drop. `fog-mailbox` and `fog-im`
+use sequences of rotating capability-addressed dead drops in FOG-STORAGE. The
+sender and recipient do not need to be online together, and the recipient
+Composer does not connect directly to a sender or replica.
+
+A blind relay MAY transmit bounded opaque polling work prepared earlier by the
+Composer and queue opaque results for later controlled import. It cannot hold
+mailbox capability roots, derive new semantic operations, decrypt results, or
+turn relay receipt into a message acknowledgment. FOG-MESSAGING is
+asynchronous and does not promise real-time delivery.
+
 ## 4. Protocol Invariants
 
 ### MSG-INV-01: No global contact identifier
@@ -141,6 +154,13 @@ Copying Composer files, restoring a stale backup, or adding a second device
 MUST NOT create two active copies of one ratchet. Restored conversation state
 enters recovery and requires a new authenticated session.
 
+### MSG-INV-11: Ephemeral sessions do not resume
+
+A RAM-only Ephemeral Composer MUST NOT resume an identity, ratchet, voucher,
+capability sequence, deduplication window, acknowledgment stream, or pending
+delivery after shutdown. Continuing `fog-mailbox` and `fog-im` sessions require
+the Persistent Composer state contract defined by `FOG-COMPOSER`.
+
 ## 5. Contact Model
 
 ### 5.1 Pairwise identity
diff --git a/docs/FOG-SX.md b/docs/FOG-SX.md
index 336acae..67383ee 100644
--- a/docs/FOG-SX.md
+++ b/docs/FOG-SX.md
@@ -764,6 +764,18 @@ The high-assurance construction requires:
 - schematics, bill of materials, board photographs, continuity tests, optical
   direction tests, and teardown evidence for the exact hardware revision.
 
+FOG does not assume that a PC provides a native TOSLINK port. The intended
+high-assurance profile uses dedicated offline `TOTX` and online `TORX` boards
+with narrowly allowlisted local interfaces. A consumer optical audio port or
+adapter may support a functional experiment but does not establish physical
+directionality.
+
+The optical diode constrains data flow through the selected fiber only. It
+cannot stop a compromised offline Composer from placing plaintext, keys, or a
+covert signal into the permitted offline-to-online output, and it cannot
+protect unlocked Composer state from compromised local firmware, drivers,
+peripherals, or host software.
+
 TOSLINK defines optical transmitter and receiver device classes, not the
 complete FOG-SX modulation. Before activation the candidate must fix the exact
 NRZ or self-clocking line code, bitrate, transition density, preamble, clock