AQ-Y1A-001 — Year-1 Prototype Architecture

SCOPE AND STANDING

This document defines the Y1 tier subset only: the elements the bootstrap laboratory intends to build in the first year, funded from EduRankAI revenue and disciplined reinvestment. External capital, partnership and collaboration would accelerate this work; none of it is a precondition for the work existing. Nothing here has been built and no element has reached laboratory validation; every entry is an intended design with a target evidence level, not an achieved one.

Year-1 stays entirely on rung 1 of the reach ladder — the optical bench. It does not advance to metro fibre, free-space, HAPS relay, CubeSat, operational satellite or constellation. The purpose of Year-1 is not a link; it is to prove that the trust architecture behaves as specified when the physical layer is deliberately trivial, so that later rungs inherit a boundary discipline that has been exercised rather than assumed.

Y1 ELEMENT REGISTER

BENCH TOPOLOGY

   AQ-NODE-01 (bench)                    AQ-NODE-02 (bench)
 +--------------------------+          +--------------------------+
 | L0 optical bench + env   |          | L0 optical bench + env   |
 | sensing          (TB-1)  |          | sensing          (TB-1)  |
 +------------+-------------+          +------------+-------------+
              | PHY frames                          |
 +------------v-------------+          +------------v-------------+
 | FPGA acquisition + stamp |          | FPGA acquisition + stamp |
 | L1 / L2          (TB-2)  |          | L1 / L2          (TB-2)  |
 +------------+-------------+          +------------+-------------+
              |                                     |
 +------------v-------------+  wired   +------------v-------------+
 | L3 identity / signing    |  bench   | L3 identity / signing    |
 | L4 AQ-TSE-01             |<-------->| L4 AQ-TSE-01             |
 |    OBSERVE ONLY   (TB-3) |  link    |    OBSERVE ONLY   (TB-3) |
 +------------+-------------+ AQ-ICD-  +--------------------------+
              |               NET-001
              | shadow outcome (recorded, not applied)
 +------------v-------------+
 | L5 command authority     |
 | Q1 Q2 Q3 -> hardware gate|
 | Q4 evaluated + recorded  |
 |            (TB-4)        |
 +------------+-------------+
              | gate signal; fail-state = non-acting
 +------------v-------------+
 | benign bench effect      |
 | shutter / indicator load |
 | no effect leaves the lab |
 +------------+-------------+
              |
 +------------v------------------------------------------------+
 | L6 Evidence & Provenance Fabric, both articles      (TB-5)   |
 +------------+------------------------------------------------+
              | export only
 +------------v-------------+
 | L8 advisory analysis     |  reads exported evidence.
 | offline, out of loop     |  No return path into L4 or L5.
 +--------------------------+

• Every command record carries three fields: executed_outcome (from Q1–Q3), shadow_outcome (what Q4 would have returned), and divergence (true where they differ).
• Observe-only is permitted only while the physical effect is confined to the benign bench load defined in Y1-E7. If any effect with consequence outside the enclosure is ever wired to the gate, observe-only is withdrawn on that article immediately and Q4 becomes binding.
• Observe-only does not relax DC-4: the engine must still degrade monotonically on a single qualifying observation and still refuse to raise state outside the recovery sequence. What is suspended is only the effect of its output, never its discipline.
• Promotion criterion out of observe-only: a recorded divergence corpus across the full absence campaign and failure-injection set, with every divergence explained and no unexplained execute where the shadow outcome was deny. Promotion is a gate decision by L9, recorded, and is not a configuration flag an engineer may set.
• The mode flag itself is carried on AQ-ICD-TRUST-001 and written into every evidence record, so that no future reader can mistake an observe-only run for a binding one.

STAGE GATES

Gates are sequential in dependency, not in calendar. A gate may not be passed by argument: it is passed by an injection run whose records are archived, or it is not passed. No numeric performance target is set anywhere in this document; where a target belongs, the metric is defined at Y1-G1..Y1-G4 and its first value is whatever measurement returns.

EXCLUSIONS — DELIBERATELY NOT IN YEAR-1

This table exists so that scope creep is visible as a change request rather than as a surprise. Anything below entering Year-1 work without an L9-recorded admission is a scope breach.

OPEN ITEMS CARRIED INTO Y1-G0

• AQ-ICD-NET-001 is at S0 and blocks Y1-E9; it must reach S2 before the second article is wired.
• The benign bench effect for Y1-E7 must be selected and hazard-assessed such that its worst-case assertion is harmless with the gate stuck asserted.
• The divergence corpus format for observe-only promotion is undefined and must be fixed before Y1-G5, not after, so the corpus is not retrofitted to the conclusion.
• The absence campaign harness in Y1-E10 must be able to fail the system; a harness that has never produced a failure has not been shown to work.