Add SCTP production hardening readiness gate

Author: ammarheidari

README.md

@@ -66,7 +66,7 @@ The first production milestone is M3UA over a transport abstraction. SCCP, TCAP,
 | Maintained peer lab automation | Phase 28 foundation-ready: executable run manifest, deterministic environment file rendering, command script rendering, artifact digest manifests, comparison report, run report, evidence bundle, manual self-hosted workflow template, commercial readiness bridge, and automation status reporting are available; commercial release still requires real retained maintained-peer evidence |
 | Maintained peer lab runner | Phase 29 foundation-ready: runner workspace, execution input bundle, output artifact materialization, preflight, command manifest, evidence collection, digest generation, comparison handoff, workflow readiness, and status reporting contracts are available; commercial release still requires execution against a real maintained external peer |
 | Maintained peer lab runner operations | Phase 30 foundation-ready: file materialization plan rendering, execution log, command outcome, artifact verification, runner provenance, failure classification, retry policy, evidence package manifest, operator handoff, and operations status contracts are available; commercial release still requires execution against a real maintained external peer |
-| Native SCTP production hardening | Phase 31 in progress: outbound stream/PPID framing, association lifecycle journal, reconnect schedule, send backpressure, cancellation/timeout, multi-homing readiness, fault recovery, and transport diagnostics contracts are available; production readiness still requires retained Linux SCTP evidence |
+| Native SCTP production hardening | Phase 31 in progress: outbound stream/PPID framing, association lifecycle journal, reconnect schedule, send backpressure, cancellation/timeout, multi-homing readiness, fault recovery, transport diagnostics, and production hardening readiness gates are available; production readiness still requires retained Linux SCTP and external peer evidence |
 
 ## Requirements
 
@@ -221,7 +221,7 @@ Phase 27 completed the maintained external peer lab foundation, including packag
 Phase 28 completed the automation and evidence handoff layer above that foundation, including a single run manifest, deterministic environment file rendering, command script rendering, comparison reporting, run reporting, digest manifests, an evidence bundle, a manual self-hosted workflow template, a commercial readiness bridge, and automation status reporting for retained lab artifact handoff.
 Phase 29 completed the maintained peer lab runner materialization layer, including deterministic runner workspace paths, execution input bundles, output artifact mapping, preflight checks, command manifests, evidence collection, digest generation, comparison handoff, workflow readiness, and status reporting for real lab execution.
 Phase 30 completed the maintained peer lab runner operationalization layer, including reviewable file materialization, structured execution logs, command outcomes, artifact verification, runner provenance, failure classification, retry policy, evidence package manifests, operator handoff reports, and operations status reporting for real lab execution.
-Phase 31 hardens native SCTP production contracts, starting with outbound stream and PPID framing, association lifecycle journaling, reconnect scheduling, send backpressure, cancellation/timeout policy, multi-homing readiness, deterministic fault recovery, and transport diagnostics snapshots.
+Phase 31 hardens native SCTP production contracts, including outbound stream and PPID framing, association lifecycle journaling, reconnect scheduling, send backpressure, cancellation/timeout policy, multi-homing readiness, deterministic fault recovery, transport diagnostics snapshots, and production hardening readiness gates.
 5. Harden MAP SMS with external interoperability vectors and operator-profile validation.
 6. Use completed interoperability tooling to run external lab validation, native SCTP verification, and release automation hardening.
 7. Complete commercial readiness gates and publish governed release candidates.

docs/PHASE31_NATIVE_SCTP_PRODUCTION_HARDENING.md

@@ -107,6 +107,19 @@ This gives production transports a single decision point for association recover
 
 This gives production transports and operations tooling a single diagnostic envelope for logs, traces, health checks, and retained evidence artifacts.
 
+## Unit 9 - Production Hardening Readiness Gate
+
+`SctpProductionHardeningReadiness` now reports the SCTP hardening gate separately from retained production evidence. It provides:
+
+- Foundation capability counting.
+- Stream and PPID framing readiness.
+- Lifecycle, reconnect, backpressure, timeout, multi-homing, fault recovery, and diagnostics readiness.
+- Retained Linux SCTP evidence gating.
+- Retained external peer evidence gating.
+- Production-ready evaluation only when foundation and evidence are both complete.
+
+This prevents the SDK from claiming production SCTP hardening readiness until real Linux SCTP and external peer traffic artifacts have been retained.
+
 ## Validation
 
 Each unit in this phase is validated with:

docs/SCTP_TRANSPORT.md

@@ -112,6 +112,14 @@ The snapshot summarizes transport state as healthy, degraded, or faulted. Health
 
 Transport implementations should emit this snapshot into structured logs and retained lab traces when diagnosing SCTP behavior.
 
+## Production Hardening Readiness
+
+`SctpProductionHardeningReadiness.GetReport(...)` reports whether the SCTP hardening foundation is complete and whether retained production evidence is available.
+
+The foundation gate covers stream and PPID framing, association lifecycle journal, reconnect schedule, send backpressure, operation timeout policy, multi-homing readiness, fault recovery, and transport diagnostics. The production gate additionally requires retained Linux SCTP evidence and retained external peer traffic evidence.
+
+This keeps source-level SDK readiness separate from production claims backed by lab artifacts.
+
 ## Reconnect Policy
 
 `SctpReconnectPolicy` defines reconnect attempt count and bounded exponential backoff.

docs/SDK_ROADMAP.md

@@ -275,7 +275,7 @@ Status: Phase 30 is foundation-complete. It has reviewable file materialization
 - Add reconnect orchestration, backpressure policy, cancellation contracts, multi-homing readiness, association lifecycle journaling, fault classification, and recovery decisions.
 - Keep production readiness blocked until retained Linux SCTP and external peer evidence prove the hardened contracts against real traffic.
 
-Status: Phase 31 is in progress. The outbound stream and PPID framing contract, association lifecycle journal, reconnect schedule, send backpressure policy, cancellation/timeout policy, multi-homing readiness checks, fault recovery decisions, and transport diagnostics snapshots are available.
+Status: Phase 31 is in progress. The outbound stream and PPID framing contract, association lifecycle journal, reconnect schedule, send backpressure policy, cancellation/timeout policy, multi-homing readiness checks, fault recovery decisions, transport diagnostics snapshots, and production hardening readiness gate are available. Production readiness remains blocked until retained Linux SCTP and external peer evidence are complete.
 
 ## Recommended First Deliverable
 

src/Sigtran.NET.Tests/Program.cs

@@ -293,6 +293,7 @@
 Run("SCTP reconnect schedules produce deterministic attempts", SctpReconnectSchedulesProduceDeterministicAttempts);
 Run("SCTP transport health snapshots expose association details", SctpTransportHealthSnapshotsExposeAssociationDetails);
 Run("SCTP transport diagnostics snapshots summarize state", SctpTransportDiagnosticsSnapshotsSummarizeState);
+Run("SCTP production hardening readiness gates evidence", SctpProductionHardeningReadinessGatesEvidence);
 Run("TCP SCTP adapter exposes development metadata and health", TcpSctpAdapterExposesDevelopmentMetadataAndHealth);
 Run("SCTP transport readiness reports foundation status", SctpTransportReadinessReportsFoundationStatus);
 Run("M3UA Payload Data uses network byte order and RFC-style TLV length", M3uaPayloadDataUsesNetworkOrder);
@@ -4696,6 +4697,25 @@ static void SctpTransportDiagnosticsSnapshotsSummarizeState()
     Assert(faulted.RequiresAttention, faulted.Describe());
 }
 
+static void SctpProductionHardeningReadinessGatesEvidence()
+{
+    SctpProductionHardeningReadinessReport current = SctpProductionHardeningReadiness.GetReport();
+    AssertEqual(8, SctpProductionHardeningReadiness.RequiredFoundationCapabilityCount, "SCTP hardening capability count");
+    AssertEqual(8, current.FoundationCapabilityCount, "SCTP hardening completed capability count");
+    Assert(current.FoundationReady, current.Describe());
+    Assert(!current.EvidenceReady, current.Describe());
+    Assert(!current.ProductionReady, current.Describe());
+    Assert(current.Describe().Contains("linuxEvidence=False", StringComparison.Ordinal), current.Describe());
+
+    SctpProductionHardeningReadinessReport evidenced = SctpProductionHardeningReadiness.GetReport(
+        hasRetainedLinuxSctpEvidence: true,
+        hasRetainedExternalPeerEvidence: true);
+    Assert(evidenced.FoundationReady, evidenced.Describe());
+    Assert(evidenced.EvidenceReady, evidenced.Describe());
+    Assert(evidenced.ProductionReady, evidenced.Describe());
+    Assert(SctpProductionHardeningReadiness.ProductionGateDescription.Contains("Retained Linux SCTP", StringComparison.Ordinal), SctpProductionHardeningReadiness.ProductionGateDescription);
+}
+
 static void TcpSctpAdapterExposesDevelopmentMetadataAndHealth()
 {
     TcpListener listener = new(IPAddress.Loopback, 0);

src/Sigtran.NET/Layers/SCTP/SctpProductionHardeningReadiness.cs

@@ -0,0 +1,137 @@
+namespace Sigtran.NET.Layers.SCTP;
+
+/// <summary>
+/// Reports native SCTP production hardening readiness.
+/// </summary>
+public sealed class SctpProductionHardeningReadinessReport
+{
+    /// <summary>Creates an SCTP production hardening readiness report.</summary>
+    /// <param name="hasStreamAndPpidFraming">Whether outbound stream and PPID framing is available.</param>
+    /// <param name="hasAssociationLifecycleJournal">Whether association lifecycle journaling is available.</param>
+    /// <param name="hasReconnectSchedule">Whether reconnect scheduling is available.</param>
+    /// <param name="hasSendBackpressurePolicy">Whether send backpressure policy is available.</param>
+    /// <param name="hasOperationTimeoutPolicy">Whether operation timeout policy is available.</param>
+    /// <param name="hasMultiHomingReadiness">Whether multi-homing readiness checks are available.</param>
+    /// <param name="hasFaultRecovery">Whether fault recovery decisions are available.</param>
+    /// <param name="hasTransportDiagnostics">Whether transport diagnostics snapshots are available.</param>
+    /// <param name="hasRetainedLinuxSctpEvidence">Whether retained Linux SCTP evidence is available.</param>
+    /// <param name="hasRetainedExternalPeerEvidence">Whether retained external peer evidence is available.</param>
+    public SctpProductionHardeningReadinessReport(
+        bool hasStreamAndPpidFraming,
+        bool hasAssociationLifecycleJournal,
+        bool hasReconnectSchedule,
+        bool hasSendBackpressurePolicy,
+        bool hasOperationTimeoutPolicy,
+        bool hasMultiHomingReadiness,
+        bool hasFaultRecovery,
+        bool hasTransportDiagnostics,
+        bool hasRetainedLinuxSctpEvidence,
+        bool hasRetainedExternalPeerEvidence)
+    {
+        HasStreamAndPpidFraming = hasStreamAndPpidFraming;
+        HasAssociationLifecycleJournal = hasAssociationLifecycleJournal;
+        HasReconnectSchedule = hasReconnectSchedule;
+        HasSendBackpressurePolicy = hasSendBackpressurePolicy;
+        HasOperationTimeoutPolicy = hasOperationTimeoutPolicy;
+        HasMultiHomingReadiness = hasMultiHomingReadiness;
+        HasFaultRecovery = hasFaultRecovery;
+        HasTransportDiagnostics = hasTransportDiagnostics;
+        HasRetainedLinuxSctpEvidence = hasRetainedLinuxSctpEvidence;
+        HasRetainedExternalPeerEvidence = hasRetainedExternalPeerEvidence;
+    }
+
+    /// <summary>Whether outbound stream and PPID framing is available.</summary>
+    public bool HasStreamAndPpidFraming { get; }
+
+    /// <summary>Whether association lifecycle journaling is available.</summary>
+    public bool HasAssociationLifecycleJournal { get; }
+
+    /// <summary>Whether reconnect scheduling is available.</summary>
+    public bool HasReconnectSchedule { get; }
+
+    /// <summary>Whether send backpressure policy is available.</summary>
+    public bool HasSendBackpressurePolicy { get; }
+
+    /// <summary>Whether operation timeout policy is available.</summary>
+    public bool HasOperationTimeoutPolicy { get; }
+
+    /// <summary>Whether multi-homing readiness checks are available.</summary>
+    public bool HasMultiHomingReadiness { get; }
+
+    /// <summary>Whether fault recovery decisions are available.</summary>
+    public bool HasFaultRecovery { get; }
+
+    /// <summary>Whether transport diagnostics snapshots are available.</summary>
+    public bool HasTransportDiagnostics { get; }
+
+    /// <summary>Whether retained Linux SCTP evidence is available.</summary>
+    public bool HasRetainedLinuxSctpEvidence { get; }
+
+    /// <summary>Whether retained external peer evidence is available.</summary>
+    public bool HasRetainedExternalPeerEvidence { get; }
+
+    /// <summary>The implemented foundation capability count.</summary>
+    public int FoundationCapabilityCount =>
+        Count(HasStreamAndPpidFraming)
+        + Count(HasAssociationLifecycleJournal)
+        + Count(HasReconnectSchedule)
+        + Count(HasSendBackpressurePolicy)
+        + Count(HasOperationTimeoutPolicy)
+        + Count(HasMultiHomingReadiness)
+        + Count(HasFaultRecovery)
+        + Count(HasTransportDiagnostics);
+
+    /// <summary>Whether all SDK hardening foundation capabilities are available.</summary>
+    public bool FoundationReady => FoundationCapabilityCount == SctpProductionHardeningReadiness.RequiredFoundationCapabilityCount;
+
+    /// <summary>Whether retained production evidence is available.</summary>
+    public bool EvidenceReady => HasRetainedLinuxSctpEvidence && HasRetainedExternalPeerEvidence;
+
+    /// <summary>Whether native SCTP hardening can be claimed production-ready.</summary>
+    public bool ProductionReady => FoundationReady && EvidenceReady;
+
+    /// <summary>Formats a compact readiness summary.</summary>
+    /// <returns>The readiness summary.</returns>
+    public string Describe()
+    {
+        return $"sctpHardeningFoundationReady={FoundationReady} sctpHardeningProductionReady={ProductionReady} foundationCapabilities={FoundationCapabilityCount}/{SctpProductionHardeningReadiness.RequiredFoundationCapabilityCount} linuxEvidence={HasRetainedLinuxSctpEvidence} externalPeerEvidence={HasRetainedExternalPeerEvidence}";
+    }
+
+    private static int Count(bool value)
+    {
+        return value ? 1 : 0;
+    }
+}
+
+/// <summary>
+/// Provides native SCTP production hardening readiness information.
+/// </summary>
+public static class SctpProductionHardeningReadiness
+{
+    /// <summary>The required native SCTP hardening foundation capability count.</summary>
+    public const int RequiredFoundationCapabilityCount = 8;
+
+    /// <summary>Explains the production evidence gate.</summary>
+    public const string ProductionGateDescription = "Retained Linux SCTP and external peer traffic evidence are required before production SCTP hardening can be claimed.";
+
+    /// <summary>Returns the current SCTP production hardening readiness report.</summary>
+    /// <param name="hasRetainedLinuxSctpEvidence">Whether retained Linux SCTP evidence is available.</param>
+    /// <param name="hasRetainedExternalPeerEvidence">Whether retained external peer evidence is available.</param>
+    /// <returns>The current SCTP production hardening readiness report.</returns>
+    public static SctpProductionHardeningReadinessReport GetReport(
+        bool hasRetainedLinuxSctpEvidence = false,
+        bool hasRetainedExternalPeerEvidence = false)
+    {
+        return new(
+            hasStreamAndPpidFraming: true,
+            hasAssociationLifecycleJournal: true,
+            hasReconnectSchedule: true,
+            hasSendBackpressurePolicy: true,
+            hasOperationTimeoutPolicy: true,
+            hasMultiHomingReadiness: true,
+            hasFaultRecovery: true,
+            hasTransportDiagnostics: true,
+            hasRetainedLinuxSctpEvidence,
+            hasRetainedExternalPeerEvidence);
+    }
+}