RFC-64 M1 2/7: expose verified VM and SWM convergence

[branarakic]

M1 stack

This is PR 2 of 7 in the RFC-64 M1 stack.

1. RFC-64 M1 1/2: make Edge CG sync explicitly on-demand #2011 — explicit Edge synchronization lifetime
2. This PR — selected-CG VM/SWM convergence is truthful and observable
3. Bounded Core public-CG coverage
4. Adaptive-capacity primitives
5. Role-aware adaptive Core activation and status
6. Bounded operator-only runtime evidence hooks
7. Fail-closed M1 acceptance verifier and real-runtime release launcher

Stack base: codex/rfc64-m1-edge-selection (PR #2011).

Exact stack provenance

• Base: 9471694c55f318f65f7691983bbde4fe5bfddb46
• Head: da58c0c70453b32af4f355b00ca2c7a8fdf78fa9

User and operator impact

When a user selects a Context Graph, the node treats authoritative metadata, finalized VM, and requested SWM as separate required proofs. It no longer reports complete convergence when SWM succeeded but VM did not, when metadata is only a legacy placeholder, or when readiness predates the current attempt.

dkg context-graph catchup-status <cg> and dkg sync catchup-status <cg> now show:

• one canonical attempt status, with current verified convergence reported separately;
• live convergence as pending, partial, or complete;
• which of metadata, VM, and SWM is verified, plus the exact missing planes;
• whether automatic retry remains active and whether selection is on-demand or always-on;
• a nested historical attempt only when the immutable runner outcome differs from the current actionable status;
• the foreground error without allowing it to hide later verified convergence.

A successful lossy public empty round remains a successful attempt (status: done) while its independently computed convergence remains partial. The status changes to unreachable only when a newer persisted readiness update proves that the previously successful attempt was invalidated. This prevents the status endpoint from immediately contradicting a successful runner result without new evidence.

A current authorization denial always wins over historical readiness.

Concurrency semantics

• Catch-up execution is serialized per CG.
• The daemon-lifetime coordinator owns exactly two explicit per-CG slots: durable VM and full VM+SWM.
• A later broader VM+SWM request receives a distinct immutable full-slot job queued behind a running durable job.
• A later narrower VM-only request receives its own durable-slot job settled from an already-running full result without launching duplicate work.
• Backpressure is evaluated only over the planes required by each slot. SWM-only deferral keeps the full job retryable while the durable job completes and persists verified VM readiness.
• Polling an original job ID never changes its requested scope or attempt result; lookup by CG returns the most recently requested slot, including when an existing slot is reused.

Before

sequenceDiagram
    actor User
    participant API
    participant Worker
    participant Store

    User->>API: Request VM and SWM catch-up
    API->>Worker: Start catch-up
    Worker->>Store: SWM succeeds
    Worker--xStore: VM or metadata fails
    API-->>User: done or frozen attempt state
    Note over API,Store: Partial proof could look complete
    Note over API: Later recovery was not reflected truthfully

Loading

After

sequenceDiagram
    actor UserB as VM and SWM caller
    actor UserA as VM-only caller
    participant API
    participant Coordinator as Daemon-lifetime coordinator
    participant Worker
    participant Store as Local proof store

    UserB->>API: Request VM and SWM catch-up
    API->>Coordinator: Fill full slot JF
    Coordinator->>Worker: Run VM and SWM once
    UserA->>API: Request VM while JF runs
    API->>Coordinator: Fill durable slot JD
    Note over Coordinator: JD reuses JF result, no second run
    Worker->>Store: Verify metadata and VM
    Worker--xStore: SWM deferred by local capacity
    Worker-->>Coordinator: VM complete, SWM deferred
    Coordinator-->>UserB: JF deferred
    Coordinator->>Store: Persist scoped VM readiness
    Coordinator-->>UserA: JD done with VM convergence complete

Loading

The inverse case is also coalesced: when VM-only starts first, a later full request fills the full slot and runs serially after the durable job. The two public job IDs remain immutable.

Implementation notes

• VM proof is mandatory for durable catch-up; SWM is additionally mandatory when requested.
• The upstream fail-closed empty-round contract is preserved: transient plane evidence is classified separately from persistable clean-plane evidence, and metadata-only, SWM-only, denied, timed-out, or incomplete results cannot set durable readiness.
• The canonical readiness classifier owns requested-plane backpressure: broad attempts remain deferred for either requested plane, while a durable slot ignores SWM-only deferral. Legacy results without per-plane diagnostics fail closed on the aggregate counter.
• A typed two-phase classification plan owns whether chain-backed metadata is required; pure local deferral and no-clean-response denial settle without metadata reads, while clean evidence is finalized only after the coordinator supplies authoritative metadata.
• A mixed result that contains usable peer data but also requested-plane scheduler deferral remains deferred; it cannot freeze readiness even when another peer denied the same round.
• Stale provenance is ineffective without strict authoritative CG metadata.
• Timestamp gating prevents readiness that existed before an attempt from rewriting a failed attempt as successful.
• The inverse timestamp gate also preserves a successful attempt unless a newer persisted readiness update invalidates it; an incomplete in-memory projection alone cannot rewrite done to unreachable.
• A dedicated daemon-lifetime coordinator owns per-CG serialization through explicit durable/full slots, latest-by-CG lookup, terminal settlement, pruning, and cleanup.
• CatchupTracker remains the original public two-map status index (jobs plus latestByContextGraph); active orchestration stays in the coordinator's private map and never leaks into the tracker contract.
• The internal readiness verdict uses explicit policy booleans; the presentation-oriented convergence snapshot is rendered only at the wire boundary.
• The subscribe route delegates daemon effect wiring to a small adapter; authoritative metadata lookup accepts a narrow capability instead of requiring the full agent type.
• Catch-up status loading now has one canonical boundary that reads subscription intent, authoritative metadata, persisted readiness, and then projects the response; the HTTP route only resolves the job and delegates.
• Public status/result DTOs live in neutral wire-contract modules rather than the runner or HTTP route.
• Per-plane clean-completion evidence has one canonical wire type that the runner imports and re-exports, so execution and readiness cannot drift structurally.
• Internal jobs, coordination, client requests, and CLI rendering use the canonical includeSharedMemory name. The legacy includeWorkspace name is deprecated and normalized only at public input/response compatibility boundaries.
• Shared catch-up fixtures are built from one exhaustive typed result factory, preventing new required diagnostics from silently disappearing in route tests.
• The successful public VM+SWM route test now proves the exact PROJECT_SYNCED event and payload emitted to downstream consumers.
• Existing wire fields remain present; the deprecated includeWorkspace response alias is derived from includeSharedMemory, and convergence and historical-attempt fields are additive.

Non-goals

• No new peer discovery, catalog, or transport protocol.
• No change to Edge persistence policy; that is PR RFC-64 M1 1/2: make Edge CG sync explicitly on-demand #2011.
• No automatic Core all-public scheduling or adaptive capacity policy.
• No claim that local triple counts or metadata-only state prove completeness.

Validation

• Fresh feedback coordinator/convergence/readiness/route/API lane: 8 files, 158/158 tests passed.
• Full daemon HTTP behavior lane: 60/60 tests passed.
• Agent build passed, including TypeScript, type-contract tests, and package-root import test.
• CLI build passed, including runtime asset copy.
• Final rebase range-diff preserved the prior seven PR commits exactly on PR RFC-64 M1 1/2: make Edge CG sync explicitly on-demand #2011 head 9471694c55f318f65f7691983bbde4fe5bfddb46; six additive review-fix commits sit above them.
• git diff --check: passed.
• Live GitHub review and CI on the final pushed head remain the merge-readiness source of truth.

Review focus

1. Authoritative metadata and independently verified VM/SWM are required before complete.
2. Explicit durable/full slots and immutable job IDs preserve each caller's requested scope under broadening and narrowing.
3. Canonical actionable status and historical attempt diagnostics remain distinct.
4. Denial and stale or pre-existing readiness fail closed.
5. Reused slots update latest-by-CG without duplicating execution, and plane-local backpressure cannot leak across scopes.

[branarakic]

Submitting the completed inline feedback responses.

[branarakic]

Submitting the completed inline feedback responses.

[otReviewAgent]

Operational Notice: Review Agent could not complete this review.

Business logic reviewer failed: retry_exhausted

[otReviewAgent]

🟡 Issue: Add a regression test for denial winning over local deferral

What's wrong
The new two-phase classifier preserves ACL denial by excluding denied results from the local-backpressure short-circuit, but the added tests do not directly verify that precedence for a pure denied round. That status is user-facing and actionable, so an untested regression would tell clients to retry for capacity when the real next step is resolving authorization.

Example
A regression that changes line 530 to if (deferredBackpressure > 0) would make a pure ACL denial with scheduler backpressure return deferred instead of denied, and the current tests would still miss that specific precedence case.

Suggested direction
Cover the pure ACL-denial-plus-backpressure branch so future refactors cannot collapse authorization denial into a retryable scheduler status.

For Agents
Add a focused readiness or coordinator test near the new backpressure tests. Build a denied result with denied: true, deniedPeers: 1, deferredBackpressure: 1, no clean plane completions, no inserted data, and assert the classification/job status remains denied with the denial error and no readiness/state effects.