R3-2 slice 2: the die's DNA as a signed receipt field (v2 message) #7452

Part of epic #6655, Round 3 item R3-2, slice 2. Follows slice 1 (#7439, PR #7446: the DNA read and decoded) and R3-1 (#7332, PR #7416: the signed message).

Goal

Put the die's 57-bit DNA inside the signed receipt bytes so a verifier can tell which die a receipt names, and so R3-3 can count distinct dies across a run's placements.

Approach

• Contract (specs/verified/die_binding.t27): a v2 message under the domain t27-receipt-v2 whose fields are v1's nine plus device_dna after full_idcode. The line format is signed_receipt.t27's, unchanged.
• Producer rule: write device_dna only when FUSE_DNA and XSC_DNA name one die before the run and again after it, and it is the same die (die_read_first_wrong). A board swapped mid-run is refused.
• Verifier rule, judged in order: authorship (level >= AUTHOR, so the DNA is inside verified bytes), field present, text is 15 lowercase hex digits. Result DIE_NAMED or DIE_NONE; a run's die level is its lowest receipt's.
• distinct_dies3 counts the dies named by three placements. R3-3 decides what count to require.
• Tool half (after verified: t27c runs receipt decisions, message and hex generated from signed_receipt.t27 (Refs #7332) #7416 merges): generated Rust wired into t27c. Thin glue runs the openocd read from device_dna.t27's header before and after silicon, and signs v2. run-record reports the die level.

Honest ceiling

The DNA is a name, not a secret. A signed DNA is the signer's claim about which die it used. It catches honest mistakes (wrong board, swapped cable) and makes cross-operator claims checkable. It does not stop a dishonest signer. Device rooting needs a secret held only by the die, such as a fabric PUF answering the verifier's nonce, or a key inside a bitstream that only this die's eFUSE/BBRAM key decrypts. That is a later slice. DIE_ROOTED_LEVELS stays 0 here, and signed_receipt.t27's comment calling a signed DNA "device-rooted" is corrected.

Competitors (2026-10-07): a TEE quote (Phala, NVIDIA CC) is rooted in a die secret, with the vendor holding the root. Gonka and EigenAI name an operator key, not a die. DIE_NAMED is weaker than a TEE quote against a dishonest host, and it needs no vendor.

Acceptance

• t27c test-report specs/verified/die_binding.t27: 0 vacuous, Railway lab.
• Mutation check (about 20 mutants) with the score recorded.
• Seals for die_binding and the re-sealed signed_receipt.
• Tool half: a live receipt on the Wukong carries device_dna = 050d58218fd9854, and run-record reports DIE_NAMED for it.
• Hand-written foreign code inside the own-language budget (at most 40 lines per file, 80 per diff).

Boundary

• No reflashing; no gate files edited.
• No device-rooted level is claimed.