test(sync): freeze system-record protocol and evidence for #2052

[Jurij89]

Summary

• Freezes the Revision 17 protocol and resource contract for bounded, authenticated agents system-record synchronization before any daemon path is enabled, including successor-bound order-independent same-authority fork recovery without a cumulative anchor, terminal V1 quarantine for wallet-transition equivocation, audit-only stale resolution branches, bounded availability-only conflict sidecars with generation-fenced provider saturation, literal signed object/envelope schemas, immutable COW inventory, exact framed transport and feasible provider work admission, coordinator-bound cold dependency-closure evidence with crash-safe bounded publication, complete applied-state/root-claim/projection-capacity CAS, and a default-off managed-store session/recovery boundary.
• Adds a deterministic characterization harness and a redacted r27 fixture that byte-rebuilds from its committed sanitized input, covering profile population, identity ambiguity, exact ownership boundaries, inventory limits, and the activation load envelope. A separately supplied trusted coordinator artifact can bind the exact fixture, aggregate closure bytes, fixed capture bounds/sources, and role-specific endpoint sample digests for an executable positive CLI gate; its provenance is an explicit operational trust boundary, not cryptographic attestation. The r27 fixture remains reproducibility of committed evidence, not independent proof of the unavailable original store.
• Fails closed before serialization on unknown or underived subject relationships; fixture-only record, root, peer, and key aliases are canonical and internally bound. It rejects contradictory disposition/population evidence and reports root/peer ambiguity explicitly; activation remains blocked on unknown authority/capability, missing bundle/complete-closure/load evidence, or bounded-resource overflow.
• Changes no daemon behavior. Runtime producer, provider, requester, materializer, activation, and rollback work remains in the later Reconnect-triggered background sync amplification can starve foreground catch-up #2052 stacks.

Related

• Related to Reconnect-triggered background sync amplification can starve foreground catch-up #2052; this is Stack A and intentionally does not close the issue.
• Based directly on testnet-canary at 84c2d1bb8e7ad812092648e36adde05ec7365e82; the six existing Stack A commits remained patch-identical when rebased from the former stacked branch.
• fix(sync): converge public SWM catch-up across bounded repeat passes (#2050) #2076 and SWM catch-up can leave a partial unrecovered tail after phase timeouts under backpressure #2050 remain independent regression surfaces for the later runtime stacks, not branch dependencies of this evidence-only PR.
• Related pressure/correctness work: SWM catch-up can leave a partial unrecovered tail after phase timeouts under backpressure #2050, fix(agent): relieve repeated sync pressure #2053, observability(sync): report net-new progress and per-graph retry pressure #2063, and Edge node 10.0.9: system context graph agents sync fails from every peer; retry pressure pins the single store worker and takes the HTTP API down #1982.

Diagrams

Characterization evidence gate

Before:

sequenceDiagram
    participant NodeStore as Stopped node store
    participant Extractor
    participant Source as Sanitized source
    participant Builder as Fixture builder
    participant Coordinator as Activation coordinator
    participant Gate as Design gate
    NodeStore->>Extractor: Unbounded/manual inspection
    Extractor-->>Source: Ad hoc observations
    Source->>Builder: No committed deterministic input
    Coordinator-->>Gate: Self-described aggregate samples
    Builder->>Gate: Limits inferred from prose
    Gate-->>Builder: Evidence cannot be reproduced

Loading

After:

sequenceDiagram
    participant NodeStore as Stopped node store
    participant Extractor
    participant Source as Sanitized source
    participant Builder as Fixture builder
    participant Coordinator as Activation coordinator
    participant Gate as Design gate
    NodeStore->>Extractor: Bounded localhost SPARQL POST queries
    Extractor-->>Source: Redacted rows plus provenance digests
    Source->>Builder: Committed deterministic input
    Coordinator->>Gate: Trusted fixture-bound closure and endpoint evidence
    Builder->>Gate: Byte-reproducible committed evidence and load envelope
    Gate-->>Builder: Pass bounded checks or fail closed on drift/unknowns

Loading

Files changed

File	What
docs/adr/0002-system-record-sync-v1.md	Freezes authority, canonical record, COW inventory, atomic materialization, crash-safe cache, scheduling, coexistence, activation, and rollback contracts.
devnet/issue-2052-system-records/model.ts	Implements typed fixture decoders, B+tree bounds, profile statistics, and the fail-closed complete-closure load/drain gate.
devnet/issue-2052-system-records/README.md	Documents the reproducibility boundary and distinguishes RDF, bundle, and complete-closure evidence.
devnet/issue-2052-system-records/subjects.ts, population.ts	Centralizes the exact subject/predicate/redaction grammar and canonical population-summary derivation.
devnet/issue-2052-system-records/extract-rdf.ts	Extracts bounded evidence from a stopped localhost Oxigraph copy, decodes SPARQL JSON at one boundary, and emits fixture-only ordinal aliases after validating X25519 derivation.
devnet/issue-2052-system-records/build-fixture.ts	Rebuilds or byte-compares the committed fixture from sanitized source evidence.
devnet/issue-2052-system-records/characterize.ts	Reports the r27 population, ambiguity, resource, inventory, and load-envelope results.
devnet/issue-2052-system-records/*.test.ts	Covers malformed/malicious RDF, identity collisions, resource boundaries, manifest/fixture drift, batching, and fail-closed characterization.
devnet/issue-2052-system-records/inputs/*.json	Stores redacted source evidence and bounded W1 system-sync observations with provenance.
devnet/issue-2052-system-records/fixtures/r27-v1.json	Stores the derived, redacted, reproducible r27 characterization fixture.
.github/workflows/system-record-protocol.yml	Runs fixture reproduction, typecheck, tests, and characterization in a dedicated CI lane.
package.json, pnpm-workspace.yaml, pnpm-lock.yaml	Wires the characterization package and root commands into the workspace.

Test plan

• pnpm --filter @devnet/issue-2052-system-records typecheck
• pnpm --filter @devnet/issue-2052-system-records test (fixture byte check plus 25/25 tests, including canonical libp2p peer-term rejection, exact inclusive B+tree height/request-budget/closure-load boundaries, exact and first-overflow activation record/bundle/closure/inventory caps, property-order-independent capture digests, exact second-precision activation timestamps, an end-to-end positive trusted-evidence CLI path, fail-closed absent/fixture/source/boundary evidence, contiguous role-specific endpoint validation, paired cold-interval requester/provider consistency, prefix/suffix-trimmed, reordered, gapped, recomputed cross-endpoint, mixed, and marginal-percentile false-positive rejection, measured rate gates, r27 aggregate pins, direct redaction assertions, secret-bearing identifiers, contradictory population evidence, malformed SPARQL, alias collisions, reversed/underived X25519 relationships, endpoint credentials, and redirect rejection)
• pnpm --filter @devnet/issue-2052-system-records characterize (reports 4 active profiles, 3 candidates, 1 ambiguity, and remains activation-ineligible because bundle/complete-closure/load evidence is unavailable)
• pnpm -r --filter @origintrail-official/dkg-agent... --filter '!@origintrail-official/dkg-evm-module' run build
• Manual comparison evidence: pnpm bench:w1-sync-telemetry:smoke (passes the 1 ms/page absolute overhead gate; zero exported batches during measurement). This is intentionally outside the protocol-evidence CI lane because this PR changes no agent runtime path.
• git diff --check
• Independent protocol/safety, resource/storage, and execution/QA Revision 17 review (no remaining blocker or major finding; role-specific digest input types added after the sole non-blocking API note).

[branarakic]

Review: merge with changes — no blockers

C10 verified: the diff touches only devnet/, docs/adr/ and workspace manifests; nothing under packages/*/src, and nothing in packages/ imports the new workspace. The ADR is the strongest part of this PR.

Verified locally at PR head (after pnpm --filter @origintrail-official/dkg-core... build): 14 tests / 14 pass, so C11 is accurate. characterize returns eligible:false with both measurement-unavailable codes. The base pin 308b5bb7d is accurate and is the current tip of fix/2050-public-swm-continuation. profilePopulation arithmetic is internally consistent (1819 = 4 + 245 + 1570).

One flag up front: the test-plan line "Independent protocol/safety, resource/storage, and execution/QA reviews found no remaining blocker or major finding" is falsified by the first inline comment below, at the major level.

Summary of findings

#	Finding	Severity
1	Reproducibility gate binds the fixture only to itself — fabricated evidence passes (reproduced below)	major
2	Ordinal aliasing is invertible; the frozen redactionPolicy string claims otherwise	minor
3	Redaction transform has no effective test coverage (all 3 branches survive identity mutation)	minor
4	No CI job runs this package	minor
5	ADR:609 quotes an owned-subject p99 wrong under the ADR's own definition	minor
6	ADR presumes sealed-KA profile publication; producer migration sized nowhere	minor
7	C8/C6 describe gates the code does not implement	minor

What the PR does well

• The ADR is genuinely careful: it separates cryptographic signature validity from object authority (:150-164), quarantines equivocation rather than resolving by arrival order, makes identity objectDigest-based so alternate signature encodings cannot fork state, and explicitly scopes out the catalog-specific transferred-bundle verifier. It disclaims its own sample at :611-615 and enumerates five unknowns rather than inferring them from r27.
• It refuses to fabricate measurements it does not have. extract-rdf.ts:161-167 nulls every loadMeasurement field because the encoded-bundle codec does not exist at the captured commit, and model.ts:368-386 turns that into eligible:false. Emitting nulls is the fail-closed behavior here.
• The pre-serialization grammar gates are real and tested — C3 and C7 hold on inspection.
• model.ts:595-600 catches evidence-record self-contradiction (peerKeys count vs disposition) before serialization; a non-obvious gate that empirically fires.

_{Findings were produced by multi-lens review with independent adversarial verification: 39 candidates, 23 refuted on inspection (including claims about ADR rollback contradictions, a sha256Canonical key-order break, and a B+tree off-by-one — all failed). The 16 survivors are deduplicated into the above.}