Document ephemeral Composer and asynchronous deliveryHEADmain

1 files changed, 78 insertions, 14 deletions

diff --git a/docs/FOG-COMPOSER.md b/docs/FOG-COMPOSER.md
index b517db5..90abd51 100644
--- a/docs/FOG-COMPOSER.md
+++ b/docs/FOG-COMPOSER.md
@@ -15,7 +15,7 @@ transaction and rollback rules, hostile import handling, committed export
 bundles, identity-safe recovery, update verification, local rendering,
 resource limits, and conformance gates.
 
-It also records four non-active implementation candidates:
+It records four non-active implementation candidates:
 
 - `FOG-COMPOSER-CANDIDATE-LINUX-VAULT-1` for a Linux read-only system image,
   LUKS2 defense-in-depth volume encryption, a transactional embedded
@@ -27,6 +27,11 @@ It also records four non-active implementation candidates:
 - `FOG-COMPOSER-CANDIDATE-UPDATE-TUF-1` for offline update metadata derived
   from The Update Framework.
 
+Separately, `FOG-COMPOSER-FIXTURE-EPHEMERAL-CONTAINER-1` records a
+functional-only rootless, networkless, read-only container whose bounded
+runtime state exists only in tmpfs for one-shot drops and explicitly
+non-resumable sessions. It is not a conforming deployment profile.
+
 These candidates have no active numeric profile IDs, do not select final
 libraries or cryptographic parameters, are not authorized for public release,
 and do not establish deployed endpoint-security claims.
@@ -253,7 +258,9 @@ Every Composer profile MUST:
 
 - boot an authenticated read-only software image;
 - omit or disable all network and radio devices and drivers;
-- use one dedicated authenticated encrypted mutable vault;
+- use one dedicated mutable vault with object-level authenticated encryption;
+- strongly recommend whole-volume encryption as defense in depth and disclose
+  the powered-off metadata exposure when it is omitted;
 - separate import quarantine and export spool from active vault state;
 - disable swap, hibernation, core dumps, automatic crash reporting, previews,
   indexing, and host clipboard integration;
@@ -305,8 +312,9 @@ It MUST:
 
 - verify the bootloader, kernel, initramfs, command line, root-image digest,
   and Composer release identity before vault unlock;
-- use a read-only verified root image and a separate encrypted mutable state
-  partition;
+- use a read-only verified root image and a separate mutable state partition
+  with mandatory object-level authenticated encryption;
+- strongly recommend whole-volume encryption for that state partition;
 - refuse automatic internal-disk, network-share, and foreign-filesystem
   mounting;
 - use dedicated receive-only and transmit-only transfer devices in its
@@ -345,6 +353,27 @@ peripheral-compromise claim.
 | Physical peripheral isolation | host-dependent | required and measured | weakened |
 | Endpoint compromise protection while unlocked | not claimed | not claimed | not claimed |
 
+### 5.6 Ephemeral container fixture
+
+`FOG-COMPOSER-FIXTURE-EPHEMERAL-CONTAINER-1` is a functional and
+lower-assurance direction, not a substitute for the MicroVM or Portable
+profiles. It uses a rootless container with no configured network interface,
+a read-only container root, bounded tmpfs mounts for runtime state, no
+persistent vault or application log, no host clipboard, and no generic shared
+directory.
+
+The Ephemeral Composer is limited to one-shot `fog-drop` operations and
+sessions whose identity, keys, capabilities, pending work, and reply ability
+are intentionally abandoned at shutdown. It MUST NOT create or resume a
+continuing mailbox, ratchet, voucher, deduplication window, acknowledgment
+stream, or capability sequence after its runtime state is lost.
+
+Container shutdown is only logical best-effort disposal. It does not prove
+erasure from host swap, hibernation, kernel caches, residual RAM, logs,
+display capture, input infrastructure, crash artifacts, or a compromised host.
+The container shares the host kernel, and a hostile host can inspect or alter
+its unlocked plaintext, keys, execution, devices, and transfer channels.
+
 ## 6. Process and Module Architecture
 
 ### 6.1 Security domains
@@ -435,7 +464,8 @@ continue-on-verification-failure modes are forbidden.
 
 The runtime permits only:
 
-- the dedicated encrypted state volume;
+- the dedicated mutable state volume, with whole-volume encryption strongly
+  recommended;
 - a bounded encrypted or memory-backed import quarantine;
 - a bounded export spool containing opaque committed bundles;
 - bounded memory-backed temporary directories;
@@ -468,13 +498,20 @@ hibernation remnants, or physical memory retained no copy.
 
 ### 8.1 Vault layers
 
-The Composer uses both:
+The Composer always uses:
+
+1. object-level authenticated encryption for every sensitive logical record.
 
-1. full-volume encryption to hide filesystem metadata, database pages,
-   journals, temporary files, and free space while powered off;
-2. object-level authenticated encryption for every sensitive logical record.
+The Composer strongly recommends, but does not universally require:
 
-The Linux candidate evaluates LUKS2 for layer 1. It does not rely on ordinary
+2. full-volume encryption to hide filesystem metadata, database pages,
+   journals, temporary files, and free space while powered off.
+
+A profile that omits layer 2 MUST disclose that loss of defense in depth and
+MUST NOT weaken layer 1, key separation, transaction integrity, or message
+end-to-end encryption.
+
+The Linux candidate evaluates LUKS2 for layer 2. It does not rely on ordinary
 sector encryption to authenticate logical records. Any LUKS2 integrity mode
 requires separate maturity, performance, recovery, and power-failure review.
 
@@ -1478,15 +1515,35 @@ Secure Boot without a narrowly controlled FOG release root, root-image
 verification without an authenticated root digest, or a TPM without a reviewed
 state-binding protocol does not satisfy the complete candidate.
 
-### 21.4 Activation gates
+### 21.4 Ephemeral container fixture
+
+`FOG-COMPOSER-FIXTURE-EPHEMERAL-CONTAINER-1` evaluates:
+
+- rootless Podman with `network=none` and no published port;
+- a read-only container root and bounded tmpfs mounts for `/run`, `/tmp`, and
+  runtime state;
+- no persistent volume, host filesystem, generic bind mount, application log,
+  swap-dependent security claim, or secret-bearing standard output;
+- capability removal, no-new-privileges, resource ceilings, core-dump denial,
+  and one bounded import and export interface;
+- fresh one-shot identity and protocol state that cannot be resumed after
+  shutdown.
+
+This candidate can demonstrate functional network absence and ordinary
+storage minimization. It cannot demonstrate secure memory erasure, host
+protection, physical isolation, durable mailbox behavior, or production
+endpoint security.
+
+### 21.5 Activation gates
 
 Before any candidate receives an active numeric profile, FOG MUST freeze and
 verify:
 
 1. exact operating system, kernel, bootloader, firmware assumptions, image
    format, and immutable-root construction;
-2. exact LUKS2, Argon2id, AEAD, KDF, hash, database, filesystem, and library
-   revisions and parameters;
+2. exact AEAD, KDF, hash, database, filesystem, and library revisions and
+   parameters, plus exact LUKS2 parameters when whole-volume encryption is
+   selected;
 3. byte-exact vault object, commitment, bundle, record, recovery, and update
    serialization;
 4. nonce uniqueness, key-purpose separation, wrapping, rotation, and deletion;
@@ -1518,6 +1575,8 @@ negative tests for:
 - MicroVM clipboard, shared directory, qrexec, device, and guest-agent denial;
 - Portable radio, internal-disk mount, foreign-filesystem, and directional
   device denial;
+- Ephemeral container network, writable-layer, persistent-volume, bind-mount,
+  log, core-dump, restart, and tmpfs-boundary denial;
 - keyslot creation, unlock, wrong secret, rewrap, rotation, and partial header
   update;
 - object AEAD, associated data, nonce, padding, generation, key epoch, wrong
@@ -1591,6 +1650,7 @@ FOG-COMPOSER does not yet establish:
 
 - protection of plaintext or keys from a compromised unlocked Composer;
 - protection of a MicroVM from its malicious host or hypervisor;
+- protection of an Ephemeral container from its host or shared kernel;
 - detection of a complete coherent rollback without an independent anchor;
 - safe binding or endurance of a concrete TPM, secure element, or token;
 - secure deletion from every RAM, flash, snapshot, backup, or physical copy;
@@ -1613,7 +1673,11 @@ before an active profile or implementation:
 
 - exact supported Linux distribution, kernel, boot, immutable-image,
   filesystem, and hardware profiles;
-- exact LUKS2, Argon2id, AEAD, KDF, database, and secure-memory selections;
+- exact Argon2id, AEAD, KDF, database, and secure-memory selections, plus an
+  exact LUKS2 selection for profiles that enable whole-volume encryption;
+- exact rootless container runtime, no-network configuration, tmpfs limits,
+  logging behavior, host swap and hibernation assumptions, and bounded
+  import/export adapters for the Ephemeral candidate;
 - byte-exact vault, state commitment, bundle records, recovery envelope, and
   update metadata integration;
 - an independent monotonic-anchor construction with proven state binding,