[docs] ADR: production encrypted tunnel architecture (post-MVP roadmap)

[jdev-02]

Lane: docs · Owner: P1 (Jon) · Phase: stretch / post-MVP · Priority: P2

Why

The hackathon demo ships USB tether + ML-DSA signed CoT (Phase 3 hero). The sister stretch issues add ML-KEM session encryption if Sun 0700 go/no-go is GO. Either way, the PRD pitch deck and post-hackathon roadmap need a clear architecture document for the production-grade encrypted tunnel — what we'd build for a pilot deployment with a Marine unit or a SAR team.

This issue produces that document. It is a slide-and-deck artifact, not build work. It is what we point xTech / SBIR / OTA reviewers at when they ask "what's the production posture?"

Acceptance criteria

• docs/adrs/2026-05-03-NNN-production-encrypted-tunnel.md exists
• Covers the four production layers:
  1. Physical: USB tether for paired devices; WiFi-Direct + 802.11s mesh for multi-device; LoRa tac-net stretch (low-bandwidth control plane only, not CoT)
  2. Transport: WireGuard (Curve25519 + ChaCha20-Poly1305) with Rosenpass sidecar for ML-KEM-768 hybrid handshake. Standard, supportable, well-tooled.
  3. Identity: hardware-rooted device keys — TPM 2.0 on Jetson, Knox / StrongBox on Samsung. Per-device ML-DSA-65 keypair sealed in hardware. No exportable private material.
  4. Trust distribution: short-lived signed key bundles (CRL-equivalent) distributed via the same TAK channel, signed by a unit-level root.
• Maps each layer to a CNSA 2.0 requirement and a NIST FIPS 203/204 control
• Maps each layer to a transition milestone:
  • T+90 days (pilot): WireGuard + Rosenpass + Knox
  • T+6 months (Tradewind / OTA): FIPS-validated crypto modules replace liboqs
  • T+12 months (ATO path): STIG'd Jetson image, cross-domain solution for multi-classification
• One page max, includes a stack diagram suitable for the pitch deck

File pointers

• docs/adrs/2026-05-03-NNN-production-encrypted-tunnel.md (new)
• May lift sections directly into docs/PRD.md §8.5 (deferred-but-documented)

Dependencies

• None for the writing itself.
• Should reference PRD §7, §8, §10 (business model / dual-use channels), §11 (success metrics).

Defer condition

Lowest priority of the three encrypted-tunnel stretch issues. Defer to post-hackathon if Sun 1000 demo lockdown is consuming all available time. Worst case: become an issue to fill in during finalist deliberations (Sun 1300-1410).

Refs PRD §8.5 (deferred-but-documented), §10 (post-hackathon channels), and PRD §11.3 (north stars).