feat(core): add bounded system-record V1 contracts

[Jurij89]

Summary

• Adds the default-unused System Record V1 core contract needed to replace aggregate agents graph replay with bounded, per-record synchronization in later stacks.
• Freezes strict canonical objects, peer/EVM signatures, authority rotation and fork decisions, opaque cold-apply authority proofs, bounded verification closures, applied-state accounting, immutable inventory publication, and byte-budgeted wire frames.
• Keeps runtime behavior unchanged: the API is available only through @origintrail-official/dkg-core/system-record-v1; no producer, provider, requester, materializer, protocol handler, or activation path is registered in this PR.
• Separates the resource-intensive protocol proofs from the existing core suite and runs maximum B+tree/cache boundaries in a serial exhaustive CI lane.
• Incorporates review hardening for authority-sequence bounds, root/control-response kind/network binding, signed-root semantic/physical cache identity, fail-closed EIP-1271 and closure verification, EIP-1271 evidence-to-network binding, factory-only nominal authority/cache values, canonical inventory rebalance decisions, and response-level coverage for every wire payload branch, canonical empty tombstone projections, stable-key rejection ahead of quarantine, centralized closed-record snapshots, and real-signature cold tombstone closures, fail-fast aggregate cache accounting, immutable async verifier inputs and artifacts, and active-head seal/network binding.

Related

• Continues Reconnect-triggered background sync amplification can starve foreground catch-up #2052; this PR does not close it.
• Follows merged contract/characterization PR test(sync): freeze system-record protocol and evidence for #2052 #2089 and is based directly on testnet-canary.
• The live managed materializer and shared agent-runtime boundary remain the next default-unused B2 follow-up.
• PR fix(sync): converge public SWM catch-up across bounded repeat passes (#2050) #2076 remains an independent runtime regression surface and is not a branch dependency of this stack.
• Behavior-neutral internal module decomposition is tracked separately in refactor(core): split System Record V1 protocol ownership modules #2104; later stacks must consume only the frozen public barrel.

Diagrams

Dormant protocol verification flow

Before:

sequenceDiagram
    participant Caller as Future B2 caller
    participant Core as DKG core
    participant Resolver as Exact-object resolver
    participant Runtime as Default node runtime
    Caller->>Core: Request System Record V1 contract
    Core-->>Caller: Contract unavailable
    Note over Caller,Resolver: Canonical objects, closure limits, and authority proof are not implemented
    Note over Runtime: Existing agents graph behavior remains active

Loading

After:

sequenceDiagram
    participant Caller as Future B2 caller
    participant Core as DKG core
    participant Resolver as Exact-object resolver
    participant Runtime as Default node runtime
    Caller->>Core: Verify canonical signed head
    Core->>Resolver: Resolve digest-addressed bounded dependencies
    Resolver-->>Core: Exact canonical bytes
    Core-->>Caller: Bounded closure plus opaque authority summary
    Caller->>Core: Evaluate authority advance and applied-state limits
    Core-->>Caller: Typed accept, stale, quarantine, or reject
    Note over Runtime: No import, registration, storage mutation, or activation in B1

Loading

Files changed

File	What
packages/core/src/system-record-limits-v1.ts	Defines the single machine-readable set of protocol, resource, cache, closure, and wire limits.
packages/core/src/system-record-codec-primitives-v1.ts	Provides dependency-light peer/base64url/digest/error primitives shared by inventory, object, wire, and state codecs.
packages/core/src/system-record-objects-v1.ts	Implements canonical objects, signatures, authority/fork decisions, closure derivation, opaque cold-apply proofs, and cache preflight.
packages/core/src/system-record-applied-state-v1.ts	Implements exact absent/present state schemas, capacity accounting, revisions, roots, and conflict/deletion intent bounds.
packages/core/src/system-record-inventory-v1.ts	Implements immutable bounded B+tree inventory codecs, traversal, copy-on-write publication, and mutation limits.
packages/core/src/system-record-wire-v1.ts	Implements strict framed request/response codecs and byte-budget validation for the future agents-only protocol.
packages/core/src/system-record-v1.ts	Exposes the dormant API through a dedicated package subpath without broad-barrel or runtime loading.
packages/core/test/system-record-*.test.ts	Adds adversarial codec, authority, closure, state, inventory, cache, wire, and boundary coverage.
packages/core/test/fixtures/system-record-v1/	Adds independently generated golden bytes, digests, messages, signatures, and envelopes.
docs/adr/0002-system-record-sync-v1.md	Aligns the frozen protocol contract with executable B1 semantics and resource equations.
.github/workflows/system-record-protocol.yml	Runs focused protocol tests and the serial exhaustive height/cache boundary proof.
packages/core/test/system-record-package-export-v1.mjs	Smoke-tests the real package self-reference and representative exports from every protocol layer.
packages/core/package.json, pnpm-lock.yaml	Adds the dedicated export/dependencies and deterministic test/coverage worker topology.

Test plan

• pnpm install --offline --frozen-lockfile
• pnpm --filter @origintrail-official/dkg-core build
• pnpm --filter @origintrail-official/dkg-core test:system-record-export
• pnpm --filter @origintrail-official/dkg-core test (1,655 core tests passed; dedicated protocol suite: 77 passed, 2 exhaustive tests intentionally skipped)
• pnpm --filter @origintrail-official/dkg-core test:system-record-exhaustive (2 maximum-boundary proofs passed)
• pnpm --filter @origintrail-official/dkg-core test:coverage (existing V8-instrumented 5-second timeout remains red; the same sync-control-object timeout reproduces on untouched base 26c27a99…; this PR does not change that test or weaken its timeout)
• node packages/core/test/fixtures/system-record-v1/generate.mjs --check
• pnpm test:issue-2052:system-records (25 passed)
• pnpm characterize:issue-2052:system-records
• git diff --check
• Independent protocol, resource, and execution audits found no remaining production blocker/high issue.
• No live testnet run: this PR intentionally has no runtime registration or behavior; B2 and later runtime stacks own live-node validation.

[otReviewAgent]

Operational Notice: Review Agent could not complete this review.

Business logic reviewer failed: WARNING: failed to clean up stale arg0 temp dirs: Permission denied (os error 13)

[Jurij89]

Merge-readiness review — 2026-08-06

Findings

No additional blocker or high-severity issue remains after review commit 644332181.

The four fresh findings were valid and are now addressed:

• RED — tombstone projection identity: applied tombstones require the pinned canonical empty-projection digest, while active state rejects it. Positive and negative regressions pin both directions.
• YELLOW — foreign records during quarantine: stable network/peer binding now precedes transition-quarantine short circuits for both heads and transitions.
• YELLOW — cold closure authority coverage: a rotated tombstone closure now uses real peer and EIP-191 signatures for current and historical controls; a tampered historical transition signature fails closed.
• YELLOW — duplicated closed-record probes: record snapshot, null/accessor/symbol handling, and optional presence are centralized in sync-wire-objects.ts; two-step codecs exact-match the frozen probe.

Architecture and risk

The PR still preserves its intended B1 boundary: the System Record V1 contract remains default-unused and subpath-only. No producer, protocol handler, materializer, scheduler, or node activation path is registered, so this round does not add runtime sync load. The changes tighten canonical state and verification boundaries without relaxing closure, cache, frame, inventory, or aggregate resource caps.

Cold noninitial apply remains fail closed: summaries are factory-minted only after the complete digest-addressed authority chain passes real envelope verification. Tombstones now carry unambiguous empty projection/table identity, and quarantined state cannot absorb evidence from another stable record.

Verification

• pnpm --filter @origintrail-official/dkg-core build — passed
• pnpm --filter @origintrail-official/dkg-core test — 1,654 baseline + 61 system-record tests passed; 2 exhaustive tests intentionally skipped
• pnpm --filter @origintrail-official/dkg-core test:system-record-export — passed
• pnpm --filter @origintrail-official/dkg-core test:system-record-exhaustive — both maximum-boundary proofs passed
• git diff --check — passed

Assessment

Code-review ready. I found no remaining production blocker in the current diff. Final merge readiness is pending the fresh GitHub CI run for 644332181; because this is a dormant contract PR, a live testnet run is neither meaningful nor required until the later B2 runtime stack activates it.

[Jurij89]

Dedicated merge-readiness review — final local round

This supersedes my earlier readiness note. A fresh independent audit found four HIGH issues in the prior remote head; all four are fixed in ba9f8bf4e with adversarial coverage.

Findings addressed

1. Aggregate preflight work was not fail-fast. Cache accounting could traverse millions of closure/sidecar references before applying aggregate limits. The loop now rejects as soon as any live V1 aggregate bound is exceeded, and trailing-accessor tests prove no later row is touched.
2. EIP-1271 evidence had an async mutation race. The signed envelope retained caller-owned nested evidence across awaited verification. Evidence is now snapshotted and frozen before the first await; the regression mutates the source object mid-verification and proves the verifier observes only the validated snapshot.
3. Resolver artifact bytes had an async mutation race. Closure construction parsed and hashed resolver-owned bytes, then awaited authority/bundle callbacks before copying them. Bytes are now copied immediately, retained independently of callback input, and tested under mutation from both resolver ownership and the bundle callback.
4. Active-head network binding was incomplete. A signed head could name one networkId while its graph-scoped seal UAL and asserted chain named another. Active validation now requires the deterministic UAL chain to equal the head network and assertedAtChainId to equal its canonical numeric suffix, with separate negative tests.

The prior review fixes were rechecked as part of this pass: stable-key validation precedes quarantine short-circuits, tombstones use the canonical empty projection digest, cold rotated tombstone closure uses real signatures, and closed-record snapshot helpers are centralized.

Residual risk / follow-up

• Conflict-sidecar objectDigests arrays are only shallowly immutable. They are non-authoritative and do not cross the B1 async authority path, so this is hygiene rather than a merge blocker.
• The copy-on-write updater assumes a structural snapshot produced by the validated builder/update path. B2 should preserve or nominalize that provenance boundary.
• Runtime registration and live pressure behavior remain intentionally deferred; this PR is dormant/default-unused foundation code.

Verification

• Core baseline: 1,654 passed.
• Focused system-record suite: 63 passed, 2 exhaustive cases skipped.
• Exhaustive boundary lane: 2 passed.
• Package-export smoke test: passed.
• TypeScript build and git diff --check: passed.
• Independent reviewer verdict: no remaining merge blockers in the pushed changes.

Merge readiness

Code-review ready. I found no remaining architectural, correctness, security, or resource-bound blocker in ba9f8bf4e. Final merge readiness is conditional only on the fresh CI run for this head completing without a PR-introduced failure.

[otReviewAgent]

Operational Notice: Review Agent could not complete this review.

Business logic reviewer failed: WARNING: failed to clean up stale arg0 temp dirs: Permission denied (os error 13)

[Jurij89]

Final adversarial hardening round

Commit f12241aea addresses every finding from the last independent multi-lens review. No blocker or high-severity issue remains in the pushed tree.

What changed

• Exact snapshotting now covers caller-owned records, arrays, bytes, loader unions, signature inputs, cache inputs, and copy-on-write inventory state.
• Canonical/store trust boundaries fail closed on accessors, inherited keys, symbol keys, forged native methods, mismatched stored canonical bytes, and unsafe string expansion.
• Wire parsing performs bounded intrinsic copies and cheap frame relationship checks before payload allocation.
• Inventory traversal now has an enforceable per-slice deadline: stalled loaders time out, caller abort propagates through a child signal, post-abort work is not dispatched, cleanup is deterministic, and the same traversal can retry.
• Copy-on-write updates remain path-local and validate reused siblings before publishing a new root.

Independent verdicts

• Architecture/contracts: clean; no remaining correctness or contract blocker.
• Resource/liveness: clean; bounded fanout, object loads, writes, encoded bytes, timers, and listeners.
• Security/TOCTOU: clean; no remaining trust-boundary, mutation-race, or abort-semantics blocker.

The only intentional integration obligation is that the later B2 loader honors and drains the supplied abort signal. Core cannot forcibly cancel arbitrary caller code, but late loader settlement cannot mutate traversal state.

Verification

• TypeScript build: passed.
• Core suite: 1,655 passed on this hardening tree.
• Dedicated System Record suite: 77 passed, 2 exhaustive tests skipped.
• Exhaustive height-three and exact 128 MiB proofs: 2 passed.
• Package-export smoke test and golden fixture byte check: passed.
• Issue Reconnect-triggered background sync amplification can starve foreground catch-up #2052 characterization suite: 25 passed.
• git diff --check: passed.

Merge readiness

Ready from local code review. The PR remains dormant/default-unused, so this round does not activate runtime sync or add node pressure. Final merge remains gated only on the fresh GitHub checks and any new remote review finding for f12241aea.

[otReviewAgent]

Operational Notice: Review Agent could not complete this review.

Business logic reviewer failed: WARNING: failed to clean up stale arg0 temp dirs: Permission denied (os error 13)