Wire HDHomeRun observations and recover Forge OP Stack

evolution/proposals/ECP-0109-local-hdhr-publishers-submit-observation-rail.md

@@ -0,0 +1,56 @@
+# ECP-0109: Local HDHomeRun publishers submit observation rail commitments
+
+Status: Draft
+
+## Problem / context
+
+`ecp-forge` has the Ethereum / OP Stack direction and observation ledger contracts, while local
+nodes have the HDHomeRun tuners and can already produce verified manifests. The missing bridge is a
+publisher path that can run on the local LAN, observe real tuner-derived epochs, and submit compact
+observation headers to the remote chain without moving media bytes on chain.
+
+## Decision
+
+Add an optional observation-rail sink to `ec-node moq-publish`:
+
+- each published manifest epoch can become one `EveryChannelObservationLedger.ObservationHeader`,
+- `streamHash` is `keccak256(stream_id)`,
+- `epochHash` is `keccak256(epoch_id)`,
+- `dataRoot` is the manifest's Ethereum data-root commitment,
+- `locatorHash` commits to a compact JSON locator for the manifest and MoQ broadcast,
+- `observedUnixMs` and `sequence` come from the manifest body, and
+- submission uses a configured RPC URL, ledger address, and witness private key.
+
+The sink is disabled unless explicitly configured. It is intended for a local publisher talking to
+the remote every.channel chain through the remote host's local-only RPC surface, typically via an
+SSH tunnel. The OP Stack L2 RPC uses a distinct local port from the full Ethereum nodes on the same
+host so publisher submissions do not accidentally target mainnet or Sepolia L1 RPC.
+
+## Consequences
+
+- Local HDHomeRun boxes can act as reality witnesses without running the full chain locally.
+- The chain stores compact observation commitments only; media segments and full manifests remain
+  on MoQ / iroh / archive storage.
+- The first implementation uses Foundry `cast` for transaction submission so the repo can validate
+  end-to-end with Anvil before committing to an embedded Rust transaction signer.
+- A quorum greater than one still requires additional witnesses to attest; the local publisher only
+  proposes and self-attests when the configured key is a registry witness.
+
+## Alternatives considered
+
+- Run the full chain locally next to the HDHomeRuns. Rejected because the desired validation target
+  is the remote every.channel chain, and a local chain would hide remote reachability/configuration
+  failures.
+- Push full media or manifests on chain. Rejected because the observation rail only needs compact
+  commitments and locators.
+- Add an embedded Rust transaction signer immediately. Deferred until the end-to-end rail proves
+  useful with Foundry tooling.
+
+## Rollout / teardown
+
+1. Add manifest-to-observation derivation in `ec-eth`.
+2. Add optional `ec-node moq-publish` flags and environment fallbacks for observation submission.
+3. Add an ignored HDHomeRun + Anvil E2E test and a wrapper script.
+4. Point local publishers at the remote RPC once the remote chain is reachable.
+
+Teardown is simply disabling the observation options; local manifest publication remains unchanged.