Simulator and Hardware Test Separation

Audience: Cryptography and Plugin guild engineers, plus DevOps and Compliance owners provisioning test runners or production hardware.

Purpose: This is the canonical map of where Stella Ops has a deterministic simulator path (for tests and CI) versus where a surface still requires real hardware or a kernel-enforced runner for production attestation. It records the fail-closed gates that stop simulator output from ever passing as production evidence, and it tracks the hardware/runner gaps that remain operations/compliance procurement decisions.

Closes: Sprint 20260427_019 GAP-G7-019 single completion criterion (“Regional crypto/HSM sprints separate hardware-required tests from simulator-only tests”). GAP-G8-019’s only completion criterion was already satisfied (sub-sprints exist). Authored: 2026-05-04 Owner of this doc: Cryptography Guild + Plugin Guild (cross-cutting) Related:

• EXEC-20260504-eidas-reference-only-canonical-model.md (eIDAS reference-only canonical model)
• SPRINT_20260427_018_Cryptography_eidas_production_evidence.md (eIDAS evidence under reference-only)
• SPRINT_20260428_001_Cryptography_regional_provider_selection.md (regional provider selection)
• SPRINT_20260428_002_Attestor_trust_endpoints_fail_closed.md (Attestor trust endpoints fail-closed)
• SPRINT_20260427_030_Cryptography_regional_simulator_guards.md (regional simulator fail-closed guards)
• SPRINT_20260501_054_Plugin_os_process_confinement.md (Plugin OS process confinement — namespaces, AppArmor sample, SELinux sample, Job Object)
• SPRINT_20260427_026_Integrations_plugin_supply_chain.md (plugin supply chain)
• docs/modules/concelier/operations/hardware-connector-simulator-contract.md (precedent style)

Why this document exists

Stella Ops crypto and plugin-sandbox subsystems each have a simulator path (deterministic software stand-in for tests/CI) and a real-hardware path (production-eligible). The two must never converge: simulator output must never be acceptable as production evidence, and production must fail closed when only the simulator is wired.

This document is the canonical map of:

1. Which surfaces have a simulator and what the simulator covers.
2. Which surfaces still require real hardware (or kernel-enforced runners) for production attestation, and where the hardware procurement is tracked.
3. The fail-closed gates already in place that prevent simulator paths from passing in production-attestation paths.

It supersedes the implicit understanding that lived inside Sprint 019 GAP-G7-019 / GAP-G8-019 BLOCKED notes and lets that coordination sprint be archived.

Invariants (apply to every surface below)

• Simulator emits its own claim state. Crypto simulator outputs carry not-claimed:<reason> (per the eIDAS runtime claim-state vocabulary in EidasRuntimeClaimState.ToWireString()); plugin sandbox simulator strategy emits Strategy = "simulator" (per PluginSandboxStrategyName in src/Plugin/StellaOps.Plugin.Sandbox/Diagnostics/). Production gates refuse these in production-eligible code paths.
• Production paths fail closed when only simulator is configured. Authority and Attestor reject simulator and software-only signing providers in production (see Sprint 030 closures). PluginHost rejects enforced signature verification when paired with NullPluginVerifier. Production external plugin loading requires a real process-isolation provider.
• Simulator paths require explicit opt-in. Configuration default is the production backend; tests/local demos must set the simulator flag explicitly. Pattern: UseProductionBackend=true default, throw NotImplementedException (or fail closed) until the production backend lands; tests flip to false.
• Simulator artefacts are not vendored as production evidence. No simulator output ships in release manifests, Offline Kits, or attestation bundles.

1. Cryptography surfaces (G7-019)

1.1 HSM (PKCS#11) — FIPS 140-3 / FIPS 140-2 production keys

Hardware needed: YubiHSM 2 (lab) / SoftHSM2 (CI integration only, not production) / Thales Luna or equivalent (production). Tracked in: No active sprint — procurement decision is Compliance/Ops scope. This doc is the gap record.

1.2 GOST hardware (CryptoPro / Infotecs / equivalent)

Hardware needed: CryptoPro CSP appliance / Rutoken / JaCarta token (per regional regulatory requirement). Tracked in: No active sprint. Procurement decision is per-deployment regional Compliance.

1.3 SM hardware (commercial Chinese crypto, e.g. SM2/SM3/SM4)

Hardware needed: Vendor SM HSM appliance (per deployment region). Tracked in: No active sprint. Procurement decision is per-deployment regional Compliance.

1.4 RFC 3161 TSA + OCSP/CRL + EU LOTL/TSL (eIDAS-adjacent)

Per EXEC-20260504-eidas-reference-only-canonical-model.md (PM-binding 2026-05-04), Stella Ops adopts reference-only-no-vendoring as the canonical eIDAS production model. No simulator-vs-hardware separation is needed at the Stella Ops repo boundary because:

• Loader 1 (static offline trust-material pack) is operator-supplied at deploy time. CI uses sealed deterministic test fixtures.
• Loader 2 (per-transaction evidence) is operator-supplied per release.
• Production gate: runtime emits not-claimed:eidas-pack-not-loaded until both loaders are configured and an authorised QTSP agreement is loaded; emits claimed-against:<qtsp-pack-version> otherwise. Fail-closed posture already implemented and tested (Sprint 005 EIDAS-VENDOR-005-04/-05 — 27+ tests passing).

Hardware needed: None at Stella Ops repo boundary. Operator brings their own QTSP arrangement. Air-gap operators ship the pack into the appliance themselves. Tracked in: Sprint 018 (under the new reference-only scope). Not a hardware-procurement gap for Stella Ops.

1.5 Cross-cutting fail-closed gates already in place (G7)

• Authority and Attestor production signing reject simulator and software-only providers (Sprint 030).
• Explicit crypto provider hints fail closed when unknown (Sprint 028).
• Attestor unsupported anchors/proofs/verify routes return 501/feature_not_implemented (Sprint 002).
• TrustVerdict OCI configuration fails validation until real registry workflows exist (Sprint 002).
• Offline Rekor break-glass no longer marks invalid inclusion proofs valid (Sprint 002).

2. Plugin sandbox surfaces (G8-019)

2.1 OS process confinement (Sprint 054 status)

Cross-cutting fail-closed gates (G8):

• PluginHost rejects enforced signature verification when no real verifier is configured or when paired with NullPluginVerifier (Sprint 026).
• Integrations external directory plugin loading rejects missing trust material and NullPluginVerifier under enforcement (Sprint 026).
• Production external plugin loading fails closed unless a real process-isolation provider exists (Sprint 026).
• A deterministic child-process runner handshake exists for stellaops.pluginhost.process.v1 (Sprint 026 / Sprint 054 PLG-OS-CONF-01).
• External/community plugin operation execution remains denied until the IPC + lifecycle + restart-policy + cross-process capability slice lands.

2.2 Structured sandbox events (Sprint 054 PLG-OS-CONF-05 PARTIAL)

Hardware/runner needed: Linux runners for AppArmor and SELinux integration tests. Tracked in Sprint 054 PLG-OS-CONF-02/03/05 residuals.

3. CI testing contract

• Simulator path is tested end-to-end only by explicit opt-in. Test projects flip the per-component simulator flag; nothing else does.
• Default/production path is fail-closed. Tests assert default options select production mode and that the simulator flag throws/refuses outside test environments.
• Future production behavior must be tested with recorded local fixtures and mocked HTTP layers / fake hardware. Do not add live-network tests. Do not let CI tests reach a real HSM, real EU LOTL/TSL, real CryptoPro CA, or real Rekor instance.
• Conformance tests (e.g. DeterminismCallSiteConformanceTests, EidasClaimControlTests, WindowsResourceLimiterEventEmissionTests) run in CI without hardware. Hardware-specific tests live in dedicated runner-tagged test classes (e.g. [Trait("Hardware", "Linux-AppArmor")]) and are gated by runner availability.

4. Hardware procurement matrix

The following hardware/runner gaps are not scheduled in any active Stella Ops engineering sprint. They are operations/compliance procurement decisions:

Until each row is procured, the corresponding simulator path stays the only test path and fail-closed production gates ensure no production attestation is issued from a simulator-only configuration.

5. What this means for Sprint 019

Sprint 019 (docs/implplan/SPRINT_20260427_019_DOCS_fake_gap_closure_coordination.md) was a coordination tracker for the 2026-04-27 fake-implementation sweep. Its two BLOCKED rows close as follows:

• GAP-G7-019: completion criterion (“Regional crypto/HSM sprints separate hardware-required tests from simulator-only tests”) is satisfied by this document. Hardware procurement is no longer a coding-sprint task; it is documented in §4 as an operations/compliance gap.
• GAP-G8-019: completion criterion (“Plugin/Integrations sprints exist with startup and negative unsigned-plugin tests”) was already checked. The residual hardware/runner gap is owned by Sprint 054 (its PLG-OS-CONF-02/03/05 residuals) and is documented in §2 above.

Both rows can flip to DONE; Sprint 019 archives. Hardware procurement and Sprint 054’s residual runner work continue in their own homes.

6. Maintenance

Append to this document when:

• A new hardware-dependent surface is introduced (add a row to §1 or §2 and to the procurement matrix).
• A simulator path’s invariants change (update §“Invariants”).
• A hardware row is procured and a real-hardware test class lands (move from “Hardware needed” to “Tracked in” or “Closed in”).
• A fail-closed gate is added or revised (update the §1.5 / §2.1 fail-closed bullet lists).

Do not delete history; mark superseded rows with a strikethrough or “(closed YYYY-MM-DD)” note.