security(nvsim): guard degenerate input — config panic + NaN silent-corruption + ADR-177 (#1098)

* fix(nvsim): guard degenerate input — config-induced panic + NaN-state poisoning

Beyond-SOTA security review of the ADR-089 NV-diamond simulator (milestone #9,
crate 2 of 4). Two real degenerate-input findings, each pinned fails-on-old:

NVSIM-DT-01 (config panic/DoS, pipeline.rs): an external f_s_hz == 0 made
dt == +Inf, dt_us saturated to u64::MAX, and `sample * dt_us` panicked with
"attempt to multiply with overflow" at sample >= 2 (debug/WASM panic=abort;
garbage t_us in release). Fix: sanitise dt (non-finite/non-positive -> 1 µs
fallback), cap the u64 cast, and saturating_mul the timestamp.

NVSIM-NAN-01 (NaN-state poisoning, digitiser.rs): a non-finite scene parameter
(NaN dipole position / Inf moment / NaN loop radius) bypasses the near-field
clamp (NaN < R_MIN_M is false) and yields a NaN field; at the ADC `NaN as i32`
== 0 silently emitted b_pt=[0,0,0] with ADC_SATURATED CLEAR — indistinguishable
from a legit zero-field reading. Fix at the funnel: adc_quantise treats any
non-finite input as out-of-range -> clamps to code 0 AND raises the saturation
flag, so the corruption is visible downstream.

Determinism integrity, panic-free MagFrame deserialisation, and RNG seeding
confirmed clean with evidence. The published cross-machine witness
(cc8de9b0…93b4) is unchanged — guards only affect degenerate inputs.

cargo test -p nvsim --no-default-features: 50 -> 53 passed, 0 failed.
Workspace green; Python deterministic proof unchanged (f8e76f21…46f7a,
nvsim off the signal proof path). Needs ADR slot 177.

Co-Authored-By: claude-flow <ruv@ruv.net>

* docs(adr): ADR-177 — nvsim degenerate-input hardening

Records the 2 MEASURED MEDIUM fixes in 37764be55 (NVSIM-DT-01 config-induced
overflow panic / WASM-abort DoS; NVSIM-NAN-01 non-finite scene param →
silent fake zero-field reading with saturation flag clear) + 3 pins, and the
clean-with-evidence determinism/deser/div-by-zero verdict. Cross-machine
witness cc8de9b0…93b4 reproduces unchanged.

Co-Authored-By: claude-flow <ruv@ruv.net>

docs/adr/ADR-177-nvsim-degenerate-input-hardening.md

@@ -0,0 +1,92 @@
+# ADR-177: `nvsim` Degenerate-Input Hardening (NV-Diamond Simulator)
+
+| Field | Value |
+|-------|-------|
+| **Status** | Accepted — 2 real MEDIUM bugs fixed + pinned; determinism preserved |
+| **Date** | 2026-06-15 |
+| **Deciders** | ruv |
+| **Codename** | **NVSIM-FAILCLOSED** |
+| **Reviews** | ADR-089 (`nvsim` NV-diamond magnetometer pipeline simulator) |
+| **Milestone** | #9 (ungated-crate security sweep) — crate 2 of 4 |
+
+## Context
+
+`nvsim` (ADR-089) is a standalone, **WASM-ready** deterministic NV-diamond
+magnetometer pipeline simulator — a forward-only leaf:
+`scene → source → propagation → NV ensemble → digitiser → MagFrame + SHA-256
+witness`. It has no network surface, so the real attack surface is **degenerate
+physical-parameter input** crossing the external boundary — specifically the
+WASM `config_json` / `scene_json` entry points.
+
+Two properties matter for this crate that don't for others: it is billed
+**deterministic** (a published cross-machine witness must reproduce bit-exactly),
+and under `panic=abort` WASM any panic **aborts the whole module**. So a
+config-induced panic is a denial-of-service, and a silent numeric corruption
+defeats the simulator's entire purpose.
+
+## Decision
+
+Fix the two reachable degenerate-input bugs at their funnel points, each pinned
+by a fails-on-old test, **without perturbing the deterministic happy path** (the
+guards fire only on non-finite / degenerate input; the published witness is
+unchanged).
+
+### Findings fixed (both MEASURED-reproduced)
+
+| # | Severity | Location | Issue | Fix |
+|---|----------|----------|-------|-----|
+| NVSIM-DT-01 | MEDIUM (DoS) | `pipeline.rs:58,95` | `dt = config.dt_s.unwrap_or(1.0 / f_s_hz)`; an external `f_s_hz == 0.0` → `dt = +Inf` → `(dt*1e6) as u64` saturates to `u64::MAX` → `(sample as u64) * dt_us` **panics `attempt to multiply with overflow`** at `sample ≥ 2` (debug/WASM-abort; garbage `t_us` in release). MEASURED: panic at `pipeline.rs:95:30`. | Sanitise `dt` (non-finite/non-positive → 1 µs fallback), cap the `u64` cast at `u64::MAX`, `saturating_mul` the timestamp — no config can overflow it. |
+| NVSIM-NAN-01 | MEDIUM (silent corruption) | funnel `digitiser.rs::adc_quantise` (root: near-field clamp bypass in `source.rs`) | A non-finite scene param (NaN/Inf dipole position, Inf moment, NaN loop radius) **bypasses the near-field clamp** (`NaN < R_MIN_M == false` → the `1/r³` path runs → NaN field), and at the ADC `NaN as i32 == 0` (Rust saturating cast) emits a frame `b_pt=[0,0,0]` with **`ADC_SATURATED` CLEAR** — indistinguishable from a legitimate zero-field reading. MEASURED: `b=[NaN,NaN,NaN] sat=false` → `b_pt=[0,0,0] flags=0b0000`. | `adc_quantise`: any non-finite input → code `0` **with the saturation flag raised**; the pipeline's existing `adc_sat` OR-reduction propagates `ADC_SATURATED` onto the frame, making the corruption visible downstream. |
+
+This is the same **NaN-fail-open / NaN-poisoning** family seen across
+calibration/vitals/geo and ruview-swarm — non-finite input defeating a guard —
+but bounded here to a single frame (no cross-timestep accumulator).
+
+### Dimensions confirmed clean (with evidence)
+
+1. **Determinism integrity — clean.** One RNG only: `ChaCha20Rng::seed_from_u64(seed)`,
+   fully caller-seeded (grep: one `seed_from_u64`, **zero** `thread_rng`/`getrandom`/
+   `SystemTime`/`Instant`/`HashMap`); `Cargo.toml` pins `rand`/`rand_chacha`
+   `default-features=false` (no OS entropy). Box–Muller draws
+   `gen_range(f64::EPSILON..=1.0)` (avoids `ln(0)=-Inf` by construction). Frame
+   bytes fixed LE; source summation order fixed by `Vec` order. **The published
+   cross-machine witness `cc8de9b0…93b4` (`proof_witness_publishes_a_known_value`)
+   passes UNCHANGED after both fixes** — the happy path is byte-identical; guards
+   touch only degenerate inputs. *Attested caveat (not a finding): libm
+   `cos`/`ln`/`sqrt` could differ x86↔wasm; the witness is documented as
+   x86_64-captured.*
+2. **Panic-free deserialisation — clean.** `MagFrame::from_bytes` validates
+   len/magic/version, then per-field `buf[a..b].try_into().expect(...)` are over
+   fixed sub-ranges of an already-length-checked 60-byte buffer (provably
+   infallible). No `unsafe`, no `panic!`/`unreachable!` in production; every other
+   `unwrap`/`expect` is `#[cfg(test)]`.
+3. **Div-by-zero / numerical landmines — clean.** `dipole_field`/`current_loop_field`
+   clamp `r_norm < R_MIN_M` before `1/r³`,`1/r²` (finite inputs); `shot_noise_floor`
+   guards `denom <= 0`; `vec3_normalise` guards `n < 1e-20`. The only hole was the
+   NaN *bypass* of the clamp — closed at the ADC funnel (NVSIM-NAN-01).
+
+## Validation
+
+- `cargo test -p nvsim --no-default-features` → **50 → 53** passed, 0 failed (+3 pins:
+  `degenerate_zero_sample_rate_does_not_panic`,
+  `non_finite_scene_input_flags_frame_instead_of_silently_zeroing`,
+  `adc_quantise_flags_non_finite_as_saturated`).
+- `cargo test --workspace --no-default-features` → **exit 0**, 0 failed.
+- `python archive/v1/data/proof/verify.py` → **VERDICT: PASS**, hash
+  `f8e76f21…46f7a` unchanged (nvsim off the signal proof path).
+- nvsim's own cross-machine witness `cc8de9b0…93b4` reproduces unchanged.
+
+## Consequences
+
+### Positive
+- A config-induced WASM-abort DoS and a silent NaN→fake-zero-field corruption are
+  closed at their funnel points, each regression-pinned, with the deterministic
+  witness proven intact.
+
+### Negative / Neutral
+- None. Guards affect only degenerate inputs; happy-path output is byte-identical.
+
+## Links
+- ADR-089 — `nvsim` NV-diamond magnetometer simulator
+- ADR-176 — `ruview-swarm` (sibling NaN-fail-open review)
+- ADR-172 — core/cli (where the NaN-bug-class root was settled NO)

v2/crates/nvsim/src/digitiser.rs

@@ -39,7 +39,20 @@ pub const DEFAULT_SAMPLE_RATE_HZ: f64 = 10_000.0;
 pub const DEFAULT_F_MOD_HZ: f64 = 1_000.0;
 
 /// Quantise one input sample (T) to a signed ADC code. Returns `(code, saturated)`.
+///
+/// A **non-finite** input (`NaN` / `±Inf`) is treated as an out-of-range
+/// condition: it clamps to code `0` and raises the saturation flag. This is
+/// the funnel point that stops the NaN-state-poisoning class — a non-finite
+/// physical field (e.g. produced by a degenerate scene with a NaN dipole
+/// position) would otherwise coerce silently to code `0` *with the saturation
+/// flag clear*, yielding a frame indistinguishable from a legitimate
+/// zero-field reading. Flagging it preserves the "every frame is honest about
+/// its own validity" contract the proof bundle relies on.
 pub fn adc_quantise(b_in_t: f64) -> (i32, bool) {
+    if !b_in_t.is_finite() {
+        // Non-finite => not representable on the ±FS scale; mark saturated.
+        return (0, true);
+    }
     let code_f = (b_in_t / ADC_LSB_T).round();
     let max_code = (1_i32 << (ADC_BITS - 1)) - 1; // 32_767 for 16-bit signed
     let min_code = -max_code; // symmetric
@@ -153,6 +166,23 @@ mod tests {
         }
     }
 
+    #[test]
+    fn adc_quantise_flags_non_finite_as_saturated() {
+        // Security pinning (NaN-state-poisoning guard): a non-finite field
+        // value must clamp to code 0 AND raise the saturation flag, so the
+        // pipeline can flag the frame rather than emitting it as a silent,
+        // indistinguishable zero-field reading. Pre-fix this returned
+        // (0, false) for NaN — a silent corruption.
+        for bad in [f64::NAN, f64::INFINITY, f64::NEG_INFINITY] {
+            let (code, sat) = adc_quantise(bad);
+            assert_eq!(code, 0, "non-finite input {bad} must clamp to code 0");
+            assert!(sat, "non-finite input {bad} must raise the saturation flag");
+        }
+        // A finite in-range value is unaffected (no false positives).
+        let (_, sat) = adc_quantise(1.0e-7);
+        assert!(!sat, "a finite in-range value must NOT be flagged saturated");
+    }
+
     #[test]
     fn adc_saturates_above_full_scale() {
         let (code_pos, sat_pos) = adc_quantise(20.0e-6);

v2/crates/nvsim/src/pipeline.rs

@@ -51,11 +51,28 @@ impl Pipeline {
     /// (sensor × sample) — i.e. `n_samples · scene.sensors.len()` frames
     /// in scene-major / sample-minor order.
     pub fn run(&self, n_samples: usize) -> Vec<MagFrame> {
-        let dt = self
+        // `dt` is derived from caller-supplied config — an external boundary
+        // (e.g. the WASM `config_json`). A degenerate `f_s_hz == 0` makes
+        // `1.0 / f_s_hz == +Inf`; a non-finite or non-positive `dt_s` is
+        // equally hostile. Sanitise before any arithmetic that could panic.
+        let raw_dt = self
             .config
             .dt_s
             .unwrap_or(1.0 / self.config.digitiser.f_s_hz);
-        let dt_us = (dt * 1.0e6) as u64;
+        // Fall back to a 1 µs step (the smallest physically meaningful
+        // sample interval here) when `dt` is non-finite or non-positive, so
+        // the run produces well-defined frames instead of garbage / a panic.
+        let dt = if raw_dt.is_finite() && raw_dt > 0.0 {
+            raw_dt
+        } else {
+            1.0e-6
+        };
+        // `dt` is now finite & positive, so `dt * 1e6` is finite. Cap the
+        // `u64` cast defensively (a huge but finite `dt` could still exceed
+        // `u64::MAX`) and use `saturating_mul` for the per-sample timestamp so
+        // a pathological config can never trigger a multiply-with-overflow
+        // panic (debug / WASM panic=abort) or wrap to a garbage timestamp.
+        let dt_us = (dt * 1.0e6).min(u64::MAX as f64) as u64;
         let nv = NvSensor::new(self.config.sensor);
 
         let mut out: Vec<MagFrame> =
@@ -92,7 +109,7 @@ impl Pipeline {
                 ];
 
                 let mut frame = MagFrame::empty(sensor_idx as u16);
-                frame.t_us = (sample as u64) * dt_us;
+                frame.t_us = (sample as u64).saturating_mul(dt_us);
                 frame.b_pt = b_pt;
                 frame.sigma_pt = sigma_pt;
                 frame.noise_floor_pt_sqrt_hz = (reading.noise_floor_t_sqrt_hz * 1.0e12) as f32;
@@ -205,6 +222,62 @@ mod tests {
         }
     }
 
+    #[test]
+    fn degenerate_zero_sample_rate_does_not_panic() {
+        // Security pinning (panic / DoS guard): an externally-supplied
+        // `f_s_hz == 0` makes `1/f_s_hz == +Inf`; pre-fix that produced
+        // `dt_us == u64::MAX`, and `sample * dt_us` panicked with
+        // "attempt to multiply with overflow" (debug / WASM panic=abort) at
+        // sample >= 2, or wrapped to a garbage timestamp in release. The
+        // sanitised `dt` + `saturating_mul` must keep the run finite.
+        let scene = fixture_scene();
+        let cfg = PipelineConfig {
+            digitiser: crate::digitiser::DigitiserConfig {
+                f_s_hz: 0.0,
+                f_mod_hz: 1000.0,
+            },
+            ..PipelineConfig::default()
+        };
+        let frames = Pipeline::new(scene, cfg, 42).run(8);
+        assert_eq!(frames.len(), 8);
+        for f in &frames {
+            // Timestamps are monotone-well-defined, not garbage.
+            assert!(f.t_us < u64::MAX);
+        }
+    }
+
+    #[test]
+    fn non_finite_scene_input_flags_frame_instead_of_silently_zeroing() {
+        // Security pinning (NaN-state-poisoning guard): a NaN dipole position
+        // makes `r_norm` NaN, which bypasses the near-field clamp
+        // (`NaN < R_MIN_M` is false) and yields a NaN field. Pre-fix the
+        // digitiser silently coerced that NaN to code 0 with the saturation
+        // flag CLEAR — a frame indistinguishable from a real zero-field
+        // reading. Post-fix the frame must carry ADC_SATURATED so the
+        // corruption is visible downstream.
+        let mut scene = Scene::new();
+        scene.add_dipole(DipoleSource::new([f64::NAN, 0.0, 0.5], [0.0, 0.0, 1.0e-3]));
+        scene.add_sensor([0.0, 0.0, 0.0]);
+        let cfg = PipelineConfig {
+            sensor: NvSensorConfig {
+                shot_noise_disabled: true,
+                ..NvSensorConfig::default()
+            },
+            ..PipelineConfig::default()
+        };
+        let frames = Pipeline::new(scene, cfg, 0).run(4);
+        for f in &frames {
+            assert!(
+                f.has_flag(flag::ADC_SATURATED),
+                "non-finite field must raise ADC_SATURATED, not emit a silent zero frame"
+            );
+            // And the emitted value is a defined number, not NaN.
+            for b in f.b_pt {
+                assert!(b.is_finite());
+            }
+        }
+    }
+
     #[test]
     fn adc_saturation_flag_fires_above_full_scale() {
         // Place a dipole close enough to drive the field above ±10 µT FS.