[PIR][WP7] Build latent-channel anomaly quarantine (net-new — no verified "LATTE" prior art exists)

Epic: #837 · Plan: docs/research/perpetual-intelligence-runtime/03-program-plan.md

⚠️ Read before writing any code, ADR, or commit message

This is NOT an implementation of "LATTE." No such paper exists.

The program's evidence review searched exhaustively — direct phrase search plus all major term combinations — and found no paper proposing anomaly quarantine for multi-agent latent communication under that name. It did find eight-plus unrelated papers using "LATTE" as an acronym: a latent diffusion transformer for video, atomic environment descriptors, hyperbolic Lorentz attention for EEG, a robotics trajectory transformer, quantum error-correction decoding, federated test-time adaptation, bank-transaction embeddings, and linear-time attention. None are related.

Citing "LATTE" here would be citing a paper that does not exist. Program risk #2 is precisely that this distinction gets lost downstream. Treat this as original work — the genuinely better position, since the contribution is ours to claim.

Goal

Build quarantine for anomalous latent-channel updates as a first-party contribution, combining two things that do exist:

1. Integrity half — arXiv:2606.28958, "When Latent Agents Lie: KV-Cache Integrity in Multi-Agent LLM Collaboration." Verified: an HMAC-SHA256 manifest-based integrity/tamper-detection scheme, reporting 774 honest payloads accepted and 295 tampered rejected. This is cryptographic verification — it catches tampering, not a well-formed-but-anomalous payload.
2. Provenance half — rvm-witness records, per the shared witness record schema agreed in WP8.
3. The statistical-anomaly-quarantine half is genuinely net-new. No prior art covers it. Design and document it as such.

Acceptance criteria

• An injected-anomaly test suite shows tampered and anomalous latent payloads are quarantined before reaching a receiving agent. This is the criterion that matters most.
• HMAC-manifest integrity verification on latent payloads, modeled on arXiv:2606.28958. Report our own accept/reject counts rather than restating the paper's.
• Statistical anomaly detection catching payloads that are cryptographically valid but distributionally anomalous — the case integrity checking structurally cannot catch. This is the novel contribution; state the detection criterion explicitly.
• A quarantine state distinct from both accepted and rejected: quarantined frames are held, logged, and reviewable rather than silently dropped.
• Every quarantine decision emits a witness record against the WP8 schema.
• False-positive rate measured on known-good traffic. A quarantine that fires on healthy channels gets disabled in practice, which is worse than not shipping it.
• The ADR states plainly that the quarantine mechanism is original work and cites arXiv:2606.28958 for the integrity component only. A review checklist item confirms no draft cites "LATTE."
• Published as @ruvector/latent-quarantine per the existing @ruvector/* release flow.

Dependencies

WP5 (#848) and WP6 (#849) — a quarantine decision changes what the channel carries, so it must itself pass the causal audit. Relies on WP8's witness record schema.

Start with docs/research/perpetual-intelligence-runtime/03-program-plan.md, then read the WP8 witness-record schema and review dependencies #848 and #849. Define the quarantine design, integrity and anomaly criteria, reviewable state, measurements, ADR, tests, and @ruvector/latent-quarantine release work described in the acceptance criteria; done means all criteria are demonstrated and documented.