# HXP-006 — Optical-PUF Enrollment and Matching

Status: Validation Protocol 0.1

The deterministic optical design proves that the carrier was generated from the work evidence root. It is copyable in principle. Physical differentiation comes from stochastic manufacturing variation measured after fabrication.

Enrollment records the unit, lot, reader profile, challenge conditions, raw protected observations, normalized feature template, quality metrics, and template digest. Only the digest travels in the public token envelope; protected raw enrollment data remains access-controlled.

Controlled observations use registered geometry, illumination, wavelength or angle, polarization, focus, and fiducials. Normalized correlation is the initial comparison metric; later extractors require new profile identifiers and conformance vectors.

Certification targets are a false-acceptance upper 95% confidence bound of at most `10^-6`, false-rejection upper bound of at most `1%`, and indeterminate rate at most `2%` within the qualified envelope. Same-mask overruns, reconstructed templates, high-resolution copies, and malicious-manufacturer samples are mandatory negatives.