# nucleus-flow-projection

[![Crates.io](https://img.shields.io/crates/v/nucleus-flow-projection.svg)](https://crates.io/crates/nucleus-flow-projection)
[![Docs.rs](https://docs.rs/nucleus-flow-projection/badge.svg)](https://docs.rs/nucleus-flow-projection)

**Flow projection lifter** for the Nucleus substrate. Lifts a
Denning-lattice FlowTracker snapshot into the typed body of a
[`Projection::Flow`][p-flow] variant. Verifier enforces
well-formedness and exposes the session's confidentiality /
integrity / authority / taint ceilings to downstream consumers.

## Wire shape

```json
{
  "kind": "flow",
  "body": {
    "version": 1,
    "node_count": 4,
    "session_confidentiality_ceiling": "internal",
    "session_integrity_ceiling": "adversarial",
    "session_authority_ceiling": "no_authority",
    "session_taint_ceiling": "ai_generated",
    "has_adversarial_bid": true,
    "has_ai_derived": true,
    "has_confidential_data": false
  }
}
```

`has_adversarial_bid = true` is the convenience signal that the
auction-hub's G8 IFC observation found at least one bid lacking a
signed externality profile — downstream consumers should refuse to
trust the clearing.

## Verifier invariants

1. Body version matches `FLOW_BODY_VERSION` (1).
2. All four lattice levels are in their stable vocabularies
   (`CONF_LEVELS`, `INTEG_LEVELS`, `AUTHORITY_LEVELS`,
   `TAINT_LEVELS`).
3. CONSISTENCY: `has_adversarial_bid == true` implies
   `session_integrity_ceiling == "adversarial"` (Biba min-over
   semantics).

## License

Dual-licensed under MIT OR Apache-2.0.

[p-flow]: https://docs.rs/nucleus-substrate-core/latest/nucleus_substrate_core/enum.Projection.html#variant.Flow
