Model low-risk ESP32-C3 permission boundary

[zoahdev]

Stack order

This Draft PR is intentionally stacked on #10, which is stacked on #11. Review/merge in this order: #11 → #10 → #9. The remaining diff here is the non-normative ESP32-C3 device-boundary experiment only.

What changed

• add experimental host/device command, challenge, acknowledgement, and replay models under kinegrant.experimental;
• require one atomic device-command issuance per gate-consumed VerifiedCapability;
• add persistent issuance and simulated device replay state across restart;
• add strict bounded NDJSON framing that fails closed on malformed, oversized, truncated, duplicated-key, non-finite, or encoding-invalid input;
• publish four Draft 2020-12 evidence/device Schemas and an independent physical-proof evidence verifier;
• document a reviewed low-risk paper-barrier hardware/power boundary and prohibited devices.

Truthful status

This is design and simulation evidence only. The physical evidence template validates only as NOT_RUN. No hardware movement, physical PASS, functional-safety property, production readiness, or certification is claimed.

Why

The software ActionGate is insufficient if an actuator still accepts arbitrary serial commands. This experimental profile makes the host-to-device boundary reviewable before firmware and hardware are introduced, while preserving KGP-001 v0.1 unchanged.

Implementer impact

No normative KGP wire-object change. The model is isolated under kinegrant.experimental. Future firmware must preserve fail-closed invariants, and a physical result must contain byte-verified firmware, wiring, logs, video, receipts, and device acknowledgements before the independent verifier can return PHYSICAL_PASS.

Validation

• 74 tests passed locally;
• physical evidence template: NOT_RUN as required;
• concurrent one-winner and restart-persistence regressions passed;
• strict serial framing regressions passed;
• compileall passed;
• wheel and sdist passed;
• git diff --check passed.