feat(publisher): additive inject lane for live solve-time/score experiments

[wallscaler]

What

A continuous, additive, env-gated challenge-injection lane that runs alongside the native refill loop. Native refill is untouched, so the board never empties even if this lane is off or stalls — best of both worlds. Default OFF (CATHEDRAL_INJECT_ENABLED); with the flag unset the publisher is byte-identical to today.

Purpose: measure, on the live board, how unpredictable / harder SAT instances affect solve time and scores — without risking board availability.

Injected challenges

• Isolated — distinct family_id (default gentest). Native refill counts/retires only synthetic_boolean_v1, so injected challenges never eat native slots and native never retires them.
• Served identically — cnf_source='local', so they're served, HMAC-fetch-gated, witness-verified on submit, and scored exactly like native ones (one signed solve per (challenge, hotkey)).
• Identifiable — challenge_id embeds the family label and still parses to the correct tier: sat-t{N}-random-3sat-gentest-<seed-hex>. Solve-time is a -gentest- filter.
• Unpredictable seed — secrets.randbits(63) (OS entropy) instead of the predictable sha256(utc_hour:tier:seq), with per-tier method/shape overrides to dial difficulty.

⚠️ Moves real income

No zero-value mode — a solved injected challenge pays real tier weight. Enabling it on live shifts scores (that's the signal), so: keep targets small, announce, run bounded. Purely additive and reversible (unset flag → injected challenges age out).

Files

• scaffold/publisher/inject.py — the lane (mirrors refill's env-gated pattern)
• scaffold/publisher/app.py — seed_challenge gains optional family_id; lane wired into lifespan startup/shutdown
• measure_inject.py — read-only solve-time / solver-spread report, inject vs native
• inject_verify.py — gate proving isolation / identifiability / serve-parity
• INJECT.md — env knobs, income caveat, difficulty ladder, run/measure/stop

Verification

• python inject_verify.py → INJECT VERIFY PASS (isolation, identifiability, serve parity, non-interference)
• Smoke-tested inject_once_async: 3 minted into gentest, native count untouched, all cnf_source='local', OS-entropy seeds.

🤖 Generated with Claude Code

[wallscaler]

Review findings addressed (commit 3426ecb)

1. Blocker — seed leaked in the challenge_id. Confirmed and fixed. The id suffix is now sha256(tier:family:seed)[:16] (one-way), not the raw seed. The seed is never published, stored, or logged. inject_verify.py §0 SEED SECRECY now proves the public board fields cannot regenerate the CNF or the planted answer:

[PASS] seed hex does not appear anywhere in the public id
[PASS] id suffix does not decode to the real seed
[PASS] CNF regenerated from the public id does NOT match the served CNF
[PASS] planted answer derived from the public id does NOT solve the served CNF
[PASS] the real planted answer (secret) does solve the served CNF

2. Family isolation depends on one env choice. Fixed. family_is_safe() refuses the native family (synthetic_boolean_v1) and any non-slug value; inject_once_async fails closed (returns []). §5 FAMILY GUARD covers it.

3. Not difficulty calibration. Agreed — it's an additive paid experiment lane, not a calibrator. It does not estimate hardness pre-publish or use a reference solver-time band. INJECT.md frames it as an experiment with the income caveat; a calibrated difficulty ladder remains the separate open question.

---

On the native board (investigated, not a live bug)

The same seed→id math in this repo's refill.py is structurally leaky (int(suffix,16) == seed). But I verified the live board is not exploitable: I pulled real live ids and regenerated the CNFs from int(suffix,16) → sha256 mismatch on both tiers. Reason: live serves CNFs from the background pre-gen queue (seeded by time.monotonic()), which is decoupled from the id's mint_seed. So the public id's seed has nothing to do with the served CNF. Worth a separate hardening pass (make native ids opaque too, for defense-in-depth), but no live emergency.

inject_verify.py → INJECT VERIFY PASS (all 22 checks). The lane remains default-OFF.