[R2] External network-device observability and controlled deception-exposure adapters

[01rabbit]

Parent program: Azazel#83
Depends on: Azazel-Fabric external interoperability profile, Deception#35,
Azazel-Edge#325/#358

Purpose

Implement an adapter boundary through which Azazel-Deception can observe
external network-device state and describe bounded deception exposure changes.
It must make Edge/Nexus integration first-class without becoming a generic
firewall/switch/SDN control framework.

Adapter classes and rollout

Phase A: read-only NetworkObservationAdapter
  firewall/router session and policy-event observation
  DNS/NDR observation
  switch/VLAN/segment capability observation

Phase B: dry-run ExposureAdapter
  validates an ExposureChangeProposal against declared adapter capabilities
  renders a non-executing provider change preview and rollback preview

Phase C: approved bounded adapter
  applies only an independently approved, signed, expiring decision/lease
  observes postcondition, reports DeviceChangeObservation, and withdraws on
  expiry, health loss, or explicit termination

No Phase B/C adapter is enabled by default. Each provider adapter supports one
declared capability subset, e.g. redirect to a named isolated decoy segment,
temporary DNS response selection, or observe-only mirror input. It may not
accept arbitrary routes, firewall expression text, device scripts, VLAN IDs,
or general configuration objects from a package, M.I.O., or external API.

Required inputs and binding

An enabled exposure action requires all of:

1. a verified Deception package/environment identity and isolation profile;
2. an allowed adapter capability and target scope reference;
3. a valid, unexpired Edge/Nexus-owned approved decision/lease verified outside
   Fabric's descriptive contract;
4. an independent management path or local-console failsafe for high-impact
   change;
5. pre-change snapshot, rollback path, resource/health/topology eligibility;
6. an explicit termination/expiry condition.

The adapter binds decision, package digest, environment, adapter identity,
target-scope reference, generation, and expiry. Any mismatch, replay, stale
state, failed attestation, or missing management failsafe rejects the action.

Isolation and observation invariants

• A decoy has no route to protected production assets; its egress is denied by
  default.
• Device adapters never expose Edge/Nexus management, runtime sockets, or
  credentials to an attacker-facing network.
• A provider acknowledgement is an execution fact only. The adapter must
  independently observe the declared postcondition before reporting it as
  observed.
• Decoy interaction, source-device telemetry, and Knowledge inference remain
  separate evidence classes with coverage/confounder fields.
• Emergency stop/lease expiry withdraws only the adapter-owned bounded change;
  it preserves evidence and never performs an unbounded device reset.

Operational records

Persist append-only records for capability discovery, proposal validation,
approval binding, pre-change snapshot digest, apply receipt, observed
postcondition, heartbeat, expiry/withdrawal, failure, and reset evidence.
Every record includes device-adapter identity/version, environment/package,
decision/lease reference, observation window, evidence refs, and limitations.

Test and HIL gates

• Static tests reject nested provider directives, credentials, arbitrary
  selectors, and authority fields.
• Dry-run reference adapter proves capability mismatch, stale proposal,
  wrong decision/environment binding, and rollback-preview behavior.
• A fake device adapter proves provider receipt is not postcondition proof.
• HIL proves isolation, decoy egress denial, management-path preservation,
  expiry withdrawal, restart/reconciliation, and evidence preservation for each
  enabled provider capability.
• Device loss, route drift, heartbeat failure, exhausted resource budget,
  and rollback failure fail closed and visibly degrade/terminate exposure.
• Edge/Nexus absence never permits a Deception adapter to self-authorize.

[01rabbit]

Program parent: Azazel#83. Shared contract dependency: Azazel-Fabric#25. Existing Lite/assurance work remains Deception#35; Edge authority/security gates remain Azazel-Edge#325 and #358; Nexus#16 owns integrated adapter admission. This issue adds no self-authorizing device control.

[01rabbit]

effect_contracts consumer の候補としての受入条件

Deception は Edge の DefensiveEffectRef を入力に Presented Terrain との binding を検証する consumer 候補である。これは Edge の判断権限を受け取ることではない。

• accepted effect は provenance、trace、classification、expiry を検証し、terrain record との対応だけに用いる。
• accepted effect があっても、実際の露出・変更には独立した Edge decision/action lease と既存の安全 gate が必要である。
• Fabric #51 が定義する decision/non-decision terrain binding を実装し、取り違え・期限切れ・未署名・shadow を含む拒否試験を行う。
• これらが実運用経路で確認されるまで、R1c の consumer 2 として数えない。

関連: Fabric #23、Fabric #51、Edge #325/#358。