RFC-64 M1 7/7: add fail-closed selective coverage gate

[branarakic]

M1 stack

This is PR 7 of 7 in the RFC-64 M1 stack. It depends on the bounded runtime-evidence endpoint from PR 6.

• Exact base: f123856165e168f7d15664d7e07d26badcf9ad81
• Exact head: cb28be01c0759270cdbc396bb75841636d78ac0c
• Final restack: the thirteen pre-existing remote commits are exact 13/13 range-diff matches after replay onto the exact final PR 6 head; one final automatic-trigger provenance commit is exact patch-equivalent and separately reviewable.

Summary

This PR adds the repository-owned, fail-closed RFC-64 M1 selective-coverage gate for three distinct real DKG processes:

• Publisher;
• selectively subscribed Edge;
• automatically covering Core.

It verifies two publication waves, an Edge restart, explicit and automatic synchronization, and a cold-started Core.

The gate requires proof that:

• Edge receives no VM/SWM payload before selection;
• public on-demand selection reaches the exact selected snapshot;
• on-demand state does not advance automatically across restart;
• a second explicit request reaches the exact final snapshot;
• always-on selection refreshes automatically after restart;
• unselected public and all private CGs remain payload-free on Edge;
• Core automatic rounds remain bounded and public-only;
• every public CG enters the anchored scheduler window;
• Core reaches exact final VM and SWM state for every public CG;
• metadata-only responses cannot satisfy a required plane.

Exact state means matching heads, inventory digests, KA counts, and payload triple counts—not trusting synced: true, logs, or metadata presence.

User and operator impact

Release operators get one deterministic collection/verification command after supplying a deployment adapter:

pnpm test:m1:rfc64-selective-coverage

The artifact binds an external corpus and trust anchor, exact network and commit, a clean runtime manifest, expected peer IDs, distinct OS processes, durable Edge identity across restart, and the raw bounded journal snapshots for real automatic Edge/Core jobs. verify-live independently revalidates those retained records.

Operator-supplied corpus and trust-anchor files are decoded through closed schemas before any build, process launch, or artifact verification begins. Malformed JSON, unknown fields, invalid identifiers, and structurally invalid snapshots therefore stop the run at the input boundary instead of flowing through unchecked TypeScript casts.

Unit tests validate the contract and failure modes; they are not a release PASS.

Deployment adapter required

Important

This repository intentionally does not include a deployment-specific adapter executable.

A live run requires an operator-reviewed adapter:

export DKG_RFC64_M1_ADAPTER_COMMAND=/secure/operator/dkg-m1-adapter

The adapter controls real Publisher, Edge, and Core processes through the documented framed JSON-lines protocol. Without it, the command fails before producing evidence. There is no mock, inferred result, or synthetic PASS fallback.

A PASS artifact is written only after the adapter returns every required observation, the verifier accepts all checks, every controlled process stops, and the adapter exits cleanly.

Evidence sequence

1. Validate external corpus and trust anchor.
2. Require clean source and build the exact runtime closure.
3. Start Publisher and Edge as distinct processes.
4. Publish the selected wave and bind Publisher-owned VM/SWM snapshots.
5. Prove Edge payload absence before selection.
6. Issue only anchored on-demand and always-on selections.
7. Publish the final wave.
8. Stop/restart Edge with the same durable directory and prove the old process exited.
9. Bind automatic always-on refresh to the post-restart reconciler journal.
10. Prove on-demand remained at its point-in-time snapshot.
11. Issue the second explicit request and prove final convergence.
12. Start Core cold and consume scheduler-issued automatic rounds only.
13. Prove bounded public-only scheduling and exact final VM/SWM convergence.
14. Stop all roles and close the adapter.
15. Atomically publish the canonical artifact only after every check and cleanup passes.

Before

sequenceDiagram
    participant O as Release operator
    participant N as DKG processes
    participant L as Logs and aggregate status
    participant R as Release decision

    O->>N: Run manual publication and sync steps
    N-->>L: Emit logs and status
    O->>L: Inspect selected observations
    L-->>O: Partial runtime evidence
    O->>R: Make a manual judgment
    Note over O,R: No closed corpus, provenance boundary, or fail-closed artifact

Loading

After

sequenceDiagram
    participant O as Release operator
    participant L as Repository launcher
    participant A as Operator adapter
    participant P as Publisher process
    participant E as Edge process
    participant C as Core process
    participant J as Node-admin journal
    participant V as Fail-closed verifier
    participant F as Evidence artifact

    O->>L: Supply corpus, trust anchor, and adapter command
    L->>L: Verify clean source and runtime manifest
    L->>A: Start Publisher and Edge
    A->>P: Publish selected and final waves
    A->>E: Prove empty state and issue selections
    A->>E: Restart with the same durable directory
    A->>J: Read automatic Edge evidence
    J-->>A: Terminal reconciler entry
    A->>E: Issue second on-demand request
    L->>A: Start Core cold
    A->>C: Run bounded automatic rounds
    A->>J: Read automatic Core evidence
    J-->>A: Frozen plans and terminal completions
    A-->>L: Exact VM and SWM observations
    L->>V: Verify anchored evidence
    V-->>L: PASS or reject reasons
    L->>A: Stop roles and close adapter
    A-->>L: Every process exited
    alt Every check and cleanup passed
        L->>F: Atomically write canonical PASS artifact
        L-->>O: PASS with artifact digest
    else Any check or cleanup failed
        L-->>O: FAIL with no PASS artifact
    end

Loading

Exact and automatic provenance contract

Each VM/SWM plane contains head digest, inventory digest, asset count, payload triple count, separate metadata count, and reported-complete flag. Expected state comes from the external corpus and Publisher observations; Edge/Core output cannot redefine expectations.

Automatic evidence must be terminal, retained, untruncated, and verified across metadata/durable/SWM:

• Edge entries are periodic always-on edge-reconciler-job records.
• Core entries are core-automatic-round records with no explicit-selection work relabeled as automatic.
• Core automatic provenance accepts only connection-open, peer-update, or periodic-reconciler; manual catch-up cannot satisfy the automatic-coverage gate.
• Every per-CG Core completion carries its real parent round job ID.
• A Core round's effective batch size cannot exceed its configured batch size, and every claimed automatic ID must fit within that actual planned capacity.
• Runtime limits match PR 6 exactly: 256 entries, 32 CG IDs per entry, 256 characters per ID.

Compatibility and safety

• No production synchronization behavior changes.
• Inputs use closed schemas and canonical serialization; unknown keys, duplicates, ambiguity, and stale digests fail closed.
• Corpus is bounded to 64 CGs and automatic evidence to 256 rounds. One round is capped at the producer journal's 32-ID bound; larger corpora span multiple rounds.
• Every scheduled Core ID requires an exact same-round terminal completion; a later round cannot repair missing admission proof.
• Adapter responses are nonce/sequence-bound and capped at 1 MiB per line.
• Adapter result envelopes are exact closed success/failure schemas; extra, contradictory, or non-boolean status fields fail closed.
• Every adapter command result is decoded through a closed schema at the process boundary.
• Corpus and trust-anchor files are decoded through the same closed domain schemas used by the verifier; unchecked operator-input casts were removed.
• Evidence, runtime-wire, and journal readers compose one shared set of strict JSON boundary primitives while retaining forward-compatible journal producer fields. Exhaustive typed record descriptors make model-field drift fail at typecheck time, and duplicated artifact/runtime shapes reuse one decoder.
• The collector and verifier share one canonical Edge operation plan, including exact phase and corpus order.
• M1 canonical serialization uses an explicitly named compact, no-LF, safe-integer helper; the older Gate 0/1 stableJson contract remains narrow and pinned by tests.
• Corpus, trust-anchor, and artifact paths are stripped from the spawned adapter environment and covered by a regression test.
• Timeouts are bounded from 1 second to 1 hour, defaulting to 120 seconds.
• The external trust anchor is not sent to the adapter for echoing.
• Restart evidence proves the prior Edge instance exited before replacement and reused its durable directory.
• Adapter spawn failures cannot hang cleanup, while non-terminal child errors cannot falsely satisfy the process-exit proof; repeated child errors remain handled until authoritative exit/close.
• A shutdown acknowledgement is insufficient on its own: non-zero/signal exits, grace-period timeouts, and forced termination all fail the gate before artifact publication.
• Cleanup failure prevents artifact publication.

Validation

• M1 contract, verifier, runtime, adapter, restart, cleanup, large-corpus, input-boundary, and cross-contract tests: 69/69 pass.
• M1 root and package-level TypeScript checks: pass.
• Gate 0 shared-serialization regression lane: 20/20 pass; TypeScript check: pass.
• Gate 1 shared-serialization regression lane: 26/26 pass; TypeScript check: pass.
• Dependency-aware Agent build, type-contract tests, and package-root check: pass.
• Actual final PR 6 producer shapes pass both Core and Edge journal parsers.
• The first thirteen commits are exact 13/13 range-diff matches after replay onto the exact PR 6 head; the final automatic-trigger provenance commit is exact patch-equivalent and separately reviewable.
• git diff --check: pass.
• Real three-process live gate: intentionally not claimed; it requires operator adapter and external trust inputs.

Review focus

1. No metadata-only, synthetic, inferred, or mock path can produce PASS.
2. Expected state is externally anchored and Publisher-bound.
3. Restart and cleanup are proven before artifact publication.
4. Automatic work is tied to real bounded journal provenance.

[otReviewAgent]

Operational Notice: Review Agent could not complete this review.

Business logic reviewer failed: retry_exhausted

[otReviewAgent]

Operational Notice: Review Agent could not complete this review.

Business logic reviewer failed: retry_exhausted

[otReviewAgent]

Operational Notice: Review Agent could not complete this review.

Business logic reviewer failed: retry_exhausted

[otReviewAgent]

Operational Notice: Review Agent could not complete this review.

Business logic reviewer failed: retry_exhausted

[branarakic]

Review feedback addressed; implementation details are recorded in the inline replies.

[branarakic]

Review feedback addressed; implementation details are recorded in the inline replies.