feat(event): add ADR-0010 rotating admission prototype (unwired)

.claude/rules/code_tour.md

@@ -22,15 +22,12 @@ AegisAgent/
 │   └── ...
 ├── config/
 │   └── config.yaml       # YAML config (Qdrant pattern, rest_port + grpc_port)
-├── src/                  # Binary crate (THIN — route wiring ONLY)
-│   ├── main.rs           # CLI (clap), dual-server startup (REST + gRPC)
-│   ├── settings.rs       # YAML config deserialization
-│   ├── axum_app.rs       # REST Router wiring (port 8080)
-│   ├── tonic_app.rs      # gRPC Server wiring (port 6334)
-│   ├── handlers/         # REST handlers (parse → service → respond)
-│   ├── grpc/             # gRPC service impls (tonic::Request → service → tonic::Response)
-│   ├── middleware.rs      # ETag, compression, TLS
-│   └── startup.rs        # graceful shutdown (both servers)
+├── src/src/              # Gateway binary crate (adapters stay THIN)
+│   ├── main.rs           # startup, config/env resolution, dual-server spawn (REST 8080 + gRPC 6334)
+│   ├── routes/           # REST handlers (parse → typed service → respond)
+│   ├── grpc.rs           # gRPC service impls (tonic::Request → typed service → tonic::Response)
+│   ├── sign.rs, mtls.rs, oidc.rs, policy_watcher.rs, …   # focused gateway modules
+│   └── bin/              # auxiliary binaries
 ├── lib/
 │   ├── common/           # aegis-common: errors, crypto, metrics (NO domain logic)
 │   ├── api/              # aegis-api: proto/ definitions + generated code + REST models
@@ -75,11 +72,11 @@ When exploring the codebase, study modules in this order:
    How Cedar evaluates trust level, action classification, and policy decisions.
    Deterministic — scores never gate.
 
-5. **Binary Startup (`src/main.rs`):**
+5. **Binary Startup (`src/src/main.rs`):**
    How config is loaded, both servers (REST + gRPC) are spawned on separate Tokio tasks,
    and `AppState` (shared between both) is constructed.
 
-6. **REST Handlers (`src/handlers/`) + gRPC Impls (`src/grpc/`):**
+6. **REST Handlers (`src/src/routes/`) + gRPC Impls (`src/src/grpc.rs`):**
    Both are THIN — parse → service call → respond. They call the same `lib/` methods.
    Every endpoint exists on both protocols.
 

.github/workflows/ci.yml

@@ -186,6 +186,10 @@ jobs:
             --target x86_64-unknown-linux-gnu \
             -p aegis-event \
             --test admission
+          cargo test -Zbuild-std \
+            --target x86_64-unknown-linux-gnu \
+            -p aegis-event \
+            --test rotating
 
   # ── #1194 (Postgres GA): live Postgres integration smoke test ────────────
   # Closes the biggest concrete gap named in

CLAUDE.md

@@ -37,6 +37,7 @@ lib/api/                   protobuf and shared current models
 lib/storage/               StorageBackend, SQLite/PostgreSQL, migrations
 lib/policy/                Cedar and trust provenance
 lib/soc/                   detection, correlation, response, Qdrant adapter
+lib/event/                 unwired ADR-0006..0010 event-fabric prototypes (target crate; no production traffic)
 lib/tool-broker-*          canonical actions, credentials, connectors
 bins/aegis-node-sensor/    polling sensor, durable spool, signed commands
 bins/aegis-cage-runner/    sandbox execution
@@ -47,7 +48,7 @@ ui-next/                   React SOC console
 sdk-{python,typescript,go}/ fail-closed SDKs
 ```
 
-Target modules are introduced only through accepted ADRs and the sequence in `ROADMAP.md`.
+Target modules are introduced only through the ADR process (a Proposed ADR permits only unwired prototypes; production wiring requires acceptance) and the sequence in `ROADMAP.md`.
 
 ## Coding rules
 

ROADMAP.md

@@ -70,8 +70,11 @@ oracle, append-only published-prefix, and failure-atomic single-page admission
 prototypes under Proposed ADR-0006 through ADR-0009, and a design-only
 Proposed ADR-0010 specifying bounded page rotation with generation-tagged
 reuse (fixed pool of P slots, epoch-addressed, single released-epoch
-reclamation edge, typed PageQuotaExhausted backpressure) — no rotation
-code exists yet. The volatile composite
+reclamation edge, typed PageQuotaExhausted backpressure) with an unwired
+`RotatingAdmissionChannel` prototype (rotation seams, quota refusal,
+seam-shortfall/generation-skip terminal fixtures, caught-unwind rotation
+fault, Loom seam model, cross-thread rotation stress; prototype rebind
+allocates one bounded page per rotation — in-place reuse precedes shadow). The volatile composite
 validates before reservation, Release-publishes the page before the ring,
 withholds capacity until a must-use validated frame lease commits, and reports
 clean, faulted, and orphaned-prefix terminal states. Test sources include safe

docs/Documentation_Quality_Report.md

@@ -88,7 +88,7 @@ Pages are sorted by structural coverage, then path. Improve factual accuracy and
 | [adr/0007-sealed-generation-tagged-slab-pages.md](adr/0007-sealed-generation-tagged-slab-pages.md) | decision | 267 | A | 100% |
 | [adr/0008-append-only-published-prefix-slab-pages.md](adr/0008-append-only-published-prefix-slab-pages.md) | decision | 409 | A | 100% |
 | [adr/0009-failure-atomic-slab-ring-admission.md](adr/0009-failure-atomic-slab-ring-admission.md) | decision | 427 | A | 100% |
-| [adr/0010-bounded-page-rotation-generation-reuse.md](adr/0010-bounded-page-rotation-generation-reuse.md) | decision | 289 | B | 83% |
+| [adr/0010-bounded-page-rotation-generation-reuse.md](adr/0010-bounded-page-rotation-generation-reuse.md) | decision | 312 | B | 83% |
 | [adr/index.md](adr/index.md) | decision | 53 | B | 83% |
 | [adr/template.md](adr/template.md) | decision | 46 | A | 100% |
 | [AegisAgent_Agent_Cage.md](AegisAgent_Agent_Cage.md) | guide | 581 | B | 78% |

docs/Implementation_Status.md

@@ -20,7 +20,7 @@ separate documentation change.
 
 | Artifact | Status | Evidence in this checkout | Authority / traffic | Remaining gates |
 |---|---|---|---|---|
-| Unwired SPSC, slab-page, published-prefix, and single-page admission prototypes | current | `lib/event/`; ring FIFO/full/wrap/drop/layout plus cancelable permits and commit-delayed claims; safe sealed and short-trace differential oracles; packed page publication; page-before-ring admission; must-use frame leases; clean/faulted/orphan terminal checks; native stress; shipping-algorithm Loom; Miri-oriented borrow/drop tests; ASan/TSan CI lanes defined; zero-allocation append/resolve and admission/claim checks; ADR-0006 through ADR-0009 | No production or `shadow` traffic; cannot carry protected evidence; volatile admission is not a receipt or durability acknowledgement; no performance claim | Formal ADR acceptance/security review, green hosted sanitizer artifacts, UBSan support, authenticated registry, bounded page rotation/outstanding pages + generation reuse (design Proposed as ADR-0010, no prototype yet), WAL durability/replay, epochs for any multi-reader future, NUMA-owner reclamation, priority lanes, production shadow wiring, release-artifact rollback, qualification |
+| Unwired SPSC, slab-page, published-prefix, and single-page admission prototypes | current | `lib/event/`; ring FIFO/full/wrap/drop/layout plus cancelable permits and commit-delayed claims; safe sealed and short-trace differential oracles; packed page publication; page-before-ring admission; must-use frame leases; clean/faulted/orphan terminal checks; native stress; shipping-algorithm Loom; Miri-oriented borrow/drop tests; ASan/TSan CI lanes defined; zero-allocation append/resolve and admission/claim checks; ADR-0006 through ADR-0009 | No production or `shadow` traffic; cannot carry protected evidence; volatile admission is not a receipt or durability acknowledgement; no performance claim | Formal ADR acceptance/security review, green hosted sanitizer artifacts, UBSan support, authenticated registry, bounded page rotation/outstanding pages + generation reuse (ADR-0010 Proposed with an unwired prototype; in-place slot reuse still required before shadow), WAL durability/replay, epochs for any multi-reader future, NUMA-owner reclamation, priority lanes, production shadow wiring, release-artifact rollback, qualification |
 | Thread-per-core reactor | target | `ARCHITECTURE.md`, `docs/LLD.md` | None | runtime ADR, core-affinity/io_uring implementation, migration and benchmark gates |
 | HCMT telemetry store | target | `ARCHITECTURE.md`, `docs/LLD.md` | None; SQL remains authoritative/current | WAL/segment ADR, recovery corpus, dual write, shadow equality, qualification |
 

docs/adr/0010-bounded-page-rotation-generation-reuse.md

@@ -4,11 +4,11 @@
 **Date:** 2026-07-14
 **Issue/PR:** pending
 
-> **Design-first ADR.** No implementation accompanies this document. Per
-> [architecture.md](../architecture.md) §14 and the ADR index rule, a Proposed
-> ADR permits only unwired prototypes, and this one intentionally lands before
-> any prototype so the rotation state machine is reviewed as a design, not as
-> a diff. ADR-0009 §"Revisit when" required exactly this stop.
+> **Design-first ADR.** The design above landed before any code (ADR-0009
+> §"Revisit when" required that stop); an **unwired prototype**
+> (`lib/event/src/rotating.rs`) accompanies it in the same review with the
+> deviations disclosed in §Prototype notes. Proposed status still permits
+> only unwired prototypes.
 
 ## Context
 
@@ -145,6 +145,27 @@ last frame commit for epoch e, ring-tail Release [C]
   A descriptor whose generation fails slot equality is the ADR-0009 terminal
   identity mismatch — never a skip, never a fallback read.
 
+### Prototype notes (disclosed deviations)
+
+The `current` prototype (`RotatingAdmissionChannel<N, P>`) deviates from the
+target in three bounded, disclosed ways:
+
+1. **Rebind allocates.** Rebinding constructs a fresh page (one bounded
+   allocation per rotation, zero per event) instead of reusing the slot
+   allocation in place. In-place reuse — which requires a mutable-generation
+   page state with its own ordering proof — is required before any `shadow`
+   wiring and stays inside this ADR's design envelope.
+2. **Reader handoff ring.** The successor epoch's reader travels
+   producer→consumer over a second bounded SPSC ring of capacity `P`. Its
+   publication Release-store precedes the data ring's `[R]` for the epoch's
+   first descriptor, so a consumer observing that descriptor observes the
+   handoff; an absent handoff at a seam is terminal, never transient. The
+   quota check `[A]` still governs reclamation — the handoff ring observing
+   `Full` despite quota is a terminal invariant violation.
+3. **`P` is a power of two** (the handoff ring shares the SPSC capacity
+   rule) and the construction rejects `P < 2` and a nonzero
+   `arena_generation` (epochs own the tag, starting at zero).
+
 ### Terminal-state extension
 
 The composite terminal word and its `OPEN/CLEAN/FAULTED` values are unchanged.
@@ -259,10 +280,12 @@ The implementing PR must provide, mirroring ADR-0009's evidence classes:
 
 ## Migration and rollback
 
-While Proposed, nothing ships. The implementing PR lands
-`RotatingAdmissionChannel` as isolated, unwired prototype code beside the
-single-page composite, which remains the reviewed baseline and differential
-reference. Rollback deletes the rotating module and this ADR's index row;
+While Proposed, the implementation is `current` only as isolated, unwired
+prototype code (`lib/event/src/rotating.rs`) beside the single-page
+composite, which remains the reviewed baseline and differential reference.
+It receives no production or `shadow` traffic, cannot carry protected
+evidence, and has no performance claim. Rollback deletes the rotating module
+and this ADR's index row;
 ADR-0006..0009 artifacts are untouched. Production wiring still additionally
 requires WAL durability/replay, authenticated registry lookup, NUMA-owner
 reclamation policy, priority lanes, shadow equality, qualification, and

docs/adr/index.md

@@ -3,8 +3,8 @@
 **Issue:** [#1197](https://github.com/lavkushry/AegisAgent/issues/1197)
 
 > **Status:** ADR-0001 through ADR-0005 are Accepted. ADR-0006 through ADR-0010
-> are Proposed and permit only unwired prototypes until accepted (ADR-0010 is
-> design-only: no prototype accompanies it yet). A changed
+> are Proposed and permit only unwired prototypes until accepted (ADR-0010
+> landed design-first; its unwired prototype follows in the same review). A changed
 > decision requires a new ADR and a supersedes link; do not silently rewrite
 > historical rationale.
 
@@ -33,7 +33,7 @@ a new ADR and mark the old one "Superseded by ADR-NNNN."
 | [0007](0007-sealed-generation-tagged-slab-pages.md) | Sealed generation-tagged slab-page ownership oracle (Proposed) |
 | [0008](0008-append-only-published-prefix-slab-pages.md) | Append-only published-prefix slab pages (Proposed) |
 | [0009](0009-failure-atomic-slab-ring-admission.md) | Failure-atomic single-page slab/ring admission (Proposed) |
-| [0010](0010-bounded-page-rotation-generation-reuse.md) | Bounded page rotation with generation-tagged reuse (Proposed, design-only) |
+| [0010](0010-bounded-page-rotation-generation-reuse.md) | Bounded page rotation with generation-tagged reuse (Proposed) |
 
 ## Security and Review
 

lib/event/src/admission.rs

@@ -686,7 +686,7 @@ pub struct AdmittedSequence {
 }
 
 impl AdmittedSequence {
-    const fn from_descriptor(descriptor: TelemetryDescriptor) -> Self {
+    pub(crate) const fn from_descriptor(descriptor: TelemetryDescriptor) -> Self {
         Self {
             arena_id: descriptor.arena_id,
             arena_generation: descriptor.arena_generation,

lib/event/src/lib.rs

@@ -1,8 +1,8 @@
 //! Bounded event-transfer primitives for the target AegisAgent data plane.
 //!
-//! This crate contains unwired prototypes governed by Proposed ADR-0006,
-//! ADR-0007, ADR-0008, and ADR-0009. It does not carry production telemetry or
-//! protected evidence.
+//! This crate contains unwired prototypes governed by Proposed ADR-0006
+//! through ADR-0010. It does not carry production telemetry or protected
+//! evidence.
 //!
 //! The optional `loom` feature is model-checking infrastructure, not a runtime
 //! configuration. Loom-backed primitives must execute only inside
@@ -14,6 +14,7 @@ mod admission;
 mod descriptor;
 mod published_slab;
 mod ring;
+mod rotating;
 mod slab;
 
 pub use admission::{
@@ -29,6 +30,10 @@ pub use ring::{
     Consumer, OccupiedSlot, Producer, RingConfigError, RingInvariantError, RingLayout, SpscRing,
     TryClaimError, TryPopError, TryPushError, TryReserveError, VacantSlot, CACHE_LINE_BYTES,
 };
+pub use rotating::{
+    RotatingAdmissionChannel, RotatingAdmittedEvent, RotatingConfigError, RotatingConsumer,
+    RotatingFinishError, RotatingProducer, TryRotatingAdmitError, TryRotatingConsumeError,
+};
 pub use slab::{
     SealedSlabPage, SlabAppendError, SlabConfigError, SlabPageBuilder, SlabPageConfig,
     SlabPageReader, SlabReadError, SlabResource, MAX_SLAB_DESCRIPTORS, MAX_SLAB_PAGE_BYTES,