feat(adr-118/p3.5): SignatureHasher (BLAKE3-keyed) — 117/117 GREEN

Iter 15. Lands ADR-120 §2.3 — the cryptographic foundation of invariant
I3 ("cross-site identity correlation is impossible"). rf_signature_hash
is now derived from a per-site secret and a daily epoch, so two nodes
observing the same physical person produce uncorrelated 256-bit digests.

Added (no_std-compatible):
- blake3 = "1.5", default-features = false (no_std, no SIMD by default)
- src/signature_hasher.rs:
  * Constants SECONDS_PER_DAY (86_400), SITE_SALT_LEN (32), RF_SIGNATURE_LEN (32)
  * SignatureHasher { site_salt: [u8; 32] } with new(salt) const ctor
  * compute(day_epoch, &features) -> [u8; 32]  (BLAKE3 keyed mode)
  * compute_at(unix_secs, &features) -> [u8; 32] convenience
  * day_epoch_from_unix_secs(unix_secs) -> u32 helper (floor(t / 86400))
- pub use SignatureHasher, RF_SIGNATURE_LEN, SITE_SALT_LEN from lib.rs

tests/signature_hasher.rs (8 named tests, all green):
  deterministic_under_identical_inputs
  different_site_salts_produce_different_hashes
  different_day_epochs_rotate_the_hash
  different_features_produce_different_hashes
  output_length_is_32_bytes
  day_epoch_from_unix_secs_matches_floor_division
    (covers 0, 86_399, 86_400, and the 1.7e9 modern timestamp)
  compute_at_matches_compute_with_derived_day
  cross_site_hamming_distance_is_statistically_high
    *** ADR-120 §2.7 AC2 acceptance test ***
    Runs 100 trials with distinct (salt_a, salt_b) pairs observing
    identical features, computes per-trial Hamming distance, asserts
    mean >= 120 bits and min >= 80 bits. Empirically lands at ~128 bits
    mean (the expected value for two independent 256-bit hashes), with
    no trial below 80 bits — i.e., zero suspicious near-collisions.

ACs progressed:
- ADR-120 §2.7 AC2 — structurally enforced cross-site isolation, now
  proven empirically by the Hamming-distance test. This is the
  cryptographic half of invariant I3 in code, not just docs.
- ADR-118 invariant I3 — first runtime witness that two sites with
  independent site_salts cannot correlate the same person's signature.

Test config:
- cargo test --no-default-features → 72 passed (64 + 8; signature_hasher is no_std)
- cargo test                       → 117 passed (109 + 8)

Out of scope (next iter target):
- Wire SignatureHasher into BfldEmitter: replace caller-supplied
  rf_signature_hash with hasher.compute_at(ts, &features) so the
  pipeline produces correct hashes end-to-end.
- IdentityFeatures canonical-bytes encoder so callers don't need to
  hand-serialize per-feature representations.

Co-Authored-By: claude-flow <ruv@ruv.net>

v2/crates/wifi-densepose-bfld/src/lib.rs

@@ -26,6 +26,7 @@ pub mod identity_risk;
 pub mod payload;
 #[cfg(feature = "std")]
 pub mod privacy_gate;
+pub mod signature_hasher;
 pub mod sink;
 
 pub use coherence_gate::{CoherenceGate, MatchOutcome, NullOracle, SoulMatchOracle};
@@ -43,6 +44,7 @@ pub use frame::BfldFrame;
 pub use payload::BfldPayload;
 #[cfg(feature = "std")]
 pub use privacy_gate::PrivacyGate;
+pub use signature_hasher::{SignatureHasher, RF_SIGNATURE_LEN, SITE_SALT_LEN};
 pub use sink::{check_class, LocalSink, MatterSink, NetworkSink, Sink};
 
 /// Privacy classification carried in every `BfldFrame`. See ADR-120 §2.1.

v2/crates/wifi-densepose-bfld/src/signature_hasher.rs

@@ -0,0 +1,75 @@
+//! `SignatureHasher` — BLAKE3 keyed-hash for `rf_signature_hash`. ADR-120 §2.3.
+//!
+//! Computes a per-site, per-day, identity-features digest that **structurally
+//! prevents** cross-site identity correlation (BFLD invariant I3):
+//!
+//! ```text
+//! rf_signature_hash = BLAKE3-keyed(site_salt, day_epoch || features)
+//! ```
+//!
+//! - **Site isolation**: `site_salt` is a 256-bit secret unique to each node
+//!   and never transmitted. Two nodes observing the same physical person
+//!   produce uncorrelated hashes — there is no key an operator (or an
+//!   attacker who compromises one node) can use to bridge sites.
+//! - **Daily rotation**: `day_epoch = floor(unix_time_utc / 86_400)` flips at
+//!   UTC midnight, so the same person's hash changes once per day.
+//!
+//! See ADR-120 §2.7 AC2 for the cross-site Hamming-distance acceptance
+//! criterion. `tests/signature_hasher.rs` exercises it directly.
+
+use blake3::Hasher;
+
+/// Number of seconds in a UTC day; the daily-rotation modulus.
+pub const SECONDS_PER_DAY: u64 = 86_400;
+
+/// Length of the keyed `site_salt`, fixed by BLAKE3 keyed mode at 32 bytes.
+pub const SITE_SALT_LEN: usize = 32;
+
+/// Output length — always 32 bytes (BLAKE3 default).
+pub const RF_SIGNATURE_LEN: usize = 32;
+
+/// Per-node hasher carrying the secret `site_salt`. Construct once at boot
+/// from the persistent secret store (TPM, KMS, or strict-mode file).
+#[derive(Debug, Clone)]
+pub struct SignatureHasher {
+    site_salt: [u8; SITE_SALT_LEN],
+}
+
+impl SignatureHasher {
+    /// Build a hasher from an existing `site_salt`. The salt is **never
+    /// transmitted** from this point on; callers must keep it in secure storage.
+    #[must_use]
+    pub const fn new(site_salt: [u8; SITE_SALT_LEN]) -> Self {
+        Self { site_salt }
+    }
+
+    /// Compute the daily epoch from a UTC unix-seconds timestamp.
+    #[must_use]
+    pub const fn day_epoch_from_unix_secs(unix_secs: u64) -> u32 {
+        (unix_secs / SECONDS_PER_DAY) as u32
+    }
+
+    /// Compute the `rf_signature_hash` for the supplied (day, features) pair.
+    /// `features` is the canonical-bytes representation of the current
+    /// identity-features tuple — the caller is responsible for deterministic
+    /// serialization (e.g., `bincode` with sorted keys, or a hand-rolled
+    /// fixed-order byte layout).
+    #[must_use]
+    pub fn compute(&self, day_epoch: u32, features: &[u8]) -> [u8; RF_SIGNATURE_LEN] {
+        let mut hasher = Hasher::new_keyed(&self.site_salt);
+        hasher.update(&day_epoch.to_le_bytes());
+        hasher.update(features);
+        *hasher.finalize().as_bytes()
+    }
+
+    /// Convenience: compute from a unix-seconds timestamp instead of an
+    /// explicit `day_epoch`.
+    #[must_use]
+    pub fn compute_at(
+        &self,
+        unix_secs: u64,
+        features: &[u8],
+    ) -> [u8; RF_SIGNATURE_LEN] {
+        self.compute(Self::day_epoch_from_unix_secs(unix_secs), features)
+    }
+}