# ECP-0109: Local HDHomeRun publishers submit observation rail commitments

Status: Draft

## Problem / context

`ecp-forge` has the Ethereum / OP Stack direction and observation ledger contracts, while local
nodes have the HDHomeRun tuners and can already produce verified manifests. The missing bridge is a
publisher path that can run on the local LAN, observe real tuner-derived epochs, and submit compact
observation headers to the remote chain without moving media bytes on chain.

## Decision

Add an optional observation-rail sink to `ec-node moq-publish`:

- each published manifest epoch can become one `EveryChannelObservationLedger.ObservationHeader`,
- `streamHash` is `keccak256(stream_id)`,
- `epochHash` is `keccak256(epoch_id)`,
- `dataRoot` is the manifest's Ethereum data-root commitment,
- `locatorHash` commits to a compact JSON locator for the manifest and MoQ broadcast,
- `observedUnixMs` and `sequence` come from the manifest body, and
- submission uses a configured RPC URL, ledger address, and witness private key.

The sink is disabled unless explicitly configured. It is intended for a local publisher talking to
the remote every.channel chain through the remote host's local-only RPC surface, typically via an
SSH tunnel. The OP Stack L2 RPC uses a distinct local port from the full Ethereum nodes on the same
host so publisher submissions do not accidentally target mainnet or Sepolia L1 RPC.

## Consequences

- Local HDHomeRun boxes can act as reality witnesses without running the full chain locally.
- The chain stores compact observation commitments only; media segments and full manifests remain
  on MoQ / iroh / archive storage.
- The first implementation uses Foundry `cast` for transaction submission so the repo can validate
  end-to-end with Anvil before committing to an embedded Rust transaction signer.
- A quorum greater than one still requires additional witnesses to attest; the local publisher only
  proposes and self-attests when the configured key is a registry witness.

## Alternatives considered

- Run the full chain locally next to the HDHomeRuns. Rejected because the desired validation target
  is the remote every.channel chain, and a local chain would hide remote reachability/configuration
  failures.
- Push full media or manifests on chain. Rejected because the observation rail only needs compact
  commitments and locators.
- Add an embedded Rust transaction signer immediately. Deferred until the end-to-end rail proves
  useful with Foundry tooling.

## Rollout / teardown

1. Add manifest-to-observation derivation in `ec-eth`.
2. Add optional `ec-node moq-publish` flags and environment fallbacks for observation submission.
3. Add an ignored HDHomeRun + Anvil E2E test and a wrapper script.
4. Point local publishers at the remote RPC once the remote chain is reachable.

Teardown is simply disabling the observation options; local manifest publication remains unchanged.