RFC-49 ciphertext→catalog cutover (WS-A..E) — full reconciliation onto the agent half#1203
Conversation
…ild-green) Strip 68b80e1 reconciled via 3-way merge (base #1164) keeping main's additions + the curator-ack gate + Gate-A + recovery meta-replace; surgical cutover applied to dkg-publisher.ts; ack-collector/storage-ack-handler taken wholesale (cutover rewrites that collapsed the V2 ciphertext path). All 10 packages build green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…k-handler) where ours==main
…llapsed by the strip)
…ampling + remove obsolete V2 self-ACK test dkg-agent-publish.ts auto-merged so the strip's catalog publish-routing drifted; applied the strip's 3-hunk cutover onto ours (curator-ack preserved). Built the random-sampling package (catalog-extractor; was missing from the build sweep). rfc49-catalog-parity.e2e now PASSES (rebuilt catalog root == on-chain getCatalogRoot).
…0.3 (pre-existing drift on main, unrelated to cutover)
…ublish is valid post-cutover)
…xt:false) OT-RFC-49 WS-A defaults stripCiphertext ON (cores hold zero ciphertext), so handleGetCiphertextChunk declines before reaching the keying/auth/replay logic these tests verify. The serving handler still exists for nodes that opt into custody — disable the strip in the test responder so the logic is exercised. NOTE: publish-jsonld.test async failures are pre-existing environmental Hardhat nonce flakiness (automining/shared-chain), not a cutover regression — the only async-lift change here is the chunkedCommitment->catalogCommitment field rename.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
otReviewAgent
left a comment
otReviewAgent
left a comment
There was a problem hiding this comment.
Operational Notice: Review Agent could not complete this review.
Business logic reviewer failed: [Errno 7] Argument list too long: '/var/lib/review-agent/toolchain/codex/node_modules/.bin/codex'
Phase 4 — comprehensive devnet validation ✅Ran on a fresh devnet brought up with the cutover contracts. Two layouts. 4a — no-regression on the M2 SWM gates (5 nodes: 3 cores + 2 edge curator/member):
4b — the cutover itself (
Caveats (honest scoping — one observed, one not isolated):
|
branarakic
left a comment
branarakic
left a comment
There was a problem hiding this comment.
Codex review findings.
| kcs.setCiphertextChunksCommitment(p.id, p.newCiphertextChunksRoot, p.newCiphertextChunkCount); | ||
| } else if (kcs.getLatestCiphertextChunksRoot(p.id) != bytes32(0)) { | ||
| kcs.setCatalogCommitment(p.id, p.newCatalogRoot, p.newCatalogLeafCount); | ||
| } else if (kcs.getCatalogRoot(p.id) != bytes32(0)) { |
There was a problem hiding this comment.
🔴 Bug: This makes every update to a curated KA that already has a catalog commitment require a fresh (newCatalogRoot,newCatalogLeafCount), but the TS publisher update path never computes or passes those fields into v10UpdateACKProvider or updateKnowledgeCollectionV10; they default to bytes32(0),0 in the adapter. A post-RFC-49 curated KA will therefore publish successfully and then revert on its first update with IncompleteCatalogCommitment. Please mirror the publish-side catalog partition/root computation in DKGPublisher.update, pass the pair through ACK collection and the chain adapter, and add a curated-update regression test.
| BigInt(newMerkleLeafCount), | ||
| ciphertextRootForAckDigest(intent.newCiphertextChunksRoot), | ||
| BigInt(intent.newCiphertextChunkCount ?? 0), | ||
| catalogRootForAckDigest(intent.newCatalogRoot), |
There was a problem hiding this comment.
🔴 Bug: Update ACKs now sign newCatalogRoot/newCatalogLeafCount, but the encrypted/curated update branch above never rebuilds that catalog root from an inline public catalog or persists it to <cg>/_catalog the way publish does. A publisher can therefore collect valid core ACKs for an arbitrary catalog commitment that no core can later serve/prove, and the contract only enforces the pair is non-zero. Please make curated updates carry the public catalog N-Triples, verify computeCatalogRoot(catalogCommittedLeaves(...)) against these fields before signing, and replace the local _catalog graph on success.
…commitment reverts The OT-RFC-49 WS-B proof-race rewrite of submitProof (reads the snapshotted challengeRoot/challengeLeafCount from the grown RandomSamplingLib.Challenge struct) changed RandomSampling's behavior but left _VERSION at 10.0.4 — identical to the live base_sepolia deployment, while its coupled storage contract already moved to 10.1.0. Bump so a redeploy is not read as a no-op. Also adds the previously-zero-assertion catalog-commitment integrity reverts (KnowledgeAssetsLifecycle), incl. IncompleteCatalogCommitment (the PR #1198 lifecycle regression): partial commitment + public-CG-with-catalog on BOTH the publish and update paths, and the already-committed zero-pair stranding guard.
|
OT-RFC-49 WS-C: deterministic coverage of the prover's curated branch — a curated CG proves the PUBLIC _catalog (extract catalog -> hashTripleV10 leaves -> flat-kc build -> submit), plus the unsynced-catalog -> kc-not-synced skip. Previously only the public flat-kc path and the soft-warn devnet leg covered this; the devnet strip-OFF discriminator did not fire in-window, so this is the first deterministic proof of the catalog-sampling dispatch. NOTE: 8 PRE-EXISTING failures in this file (public-path 'leaf-count-mismatch', red at HEAD before this commit, unrelated to the catalog cutover) are left as a separate follow-up — this commit is purely additive (the 2 curated tests pass).
Verified-against-source runbook for the coordinated redeploy: the non-proxy new-address constraint (grown Challenge struct), the two RandomSamplingStorage hazards (reward/score state zeroing -> epoch-boundary pin; clearOutstanding- Challenges no-op vs a fresh deploy), the version-keyed deployed-flag mechanic, the ordered procedure, post-cutover validation, and the known gaps (curated UPDATE not cut over, curator-restart re-confirm, strip-OFF hatch).
otReviewAgent
left a comment
otReviewAgent
left a comment
There was a problem hiding this comment.
Operational Notice: Review Agent could not complete this review.
Business logic reviewer failed: [Errno 7] Argument list too long: '/var/lib/review-agent/toolchain/codex/node_modules/.bin/codex'
2 participants
Stacked on #1201 (the RFC-49 agent half). This applies the OT-RFC-49 "Hosting Follows Access" contract/ciphertext strip — cores hold zero private ciphertext for curated CGs; the on-chain random-sampling proof target moves from the private
ciphertextChunksRootto the public_catalog(catalogRoot). Member-side encryption stays (members exchange ciphertext via SWM); only the on-chain commitment + core ACK + pricing move to the catalog.How it was reconciled (not a naive merge)
The strip (
#1196, commit68b80e18a) was built on a pre-Track-C base, so a wholesale merge regresses main's post-base additions. Instead:skipContextGraphEnsure) and the strip's cutover.dkg-publisher.tsanddkg-agent-publish.ts(where ours and the strip both heavily edit the publish path).ack-collector.ts,storage-ack-handler.ts).Validation (all green)
rfc49-catalog-parity.e2e— rebuilt catalog root == on-chaingetCatalogRootNote:
publish-jsonld.testasync cases fail with a Hardhat nonce/automining error — pre-existing environmental flakiness (the only async-lift change here is achunkedCommitment→catalogCommitmentfield rename, which doesn't touch tx sequencing). Not a cutover regression.Behavior change to be aware of
A curated CG can now publish catalog-only (the catalog is the on-chain commitment), so "nothing shared into SWM" is no longer a precondition error for curated CGs — it proceeds. The public "No quads in shared memory" precondition still holds (tested via a public CG).
Comprehensive devnet validation (curated publish → catalog cutover + cores-hold-zero, curator-ack gate, converge/recovery) to follow on this PR.
🤖 Generated with Claude Code