@origintrail-official/dkg-agent 10.0.21 → 10.0.23

package/dist/dkg-agent-swm-host.js

@@ -7,6 +7,9 @@
  * `this: DKGAgent` so cross-calls resolve against the composed class.
  */
 import { orderVmRecoveryCandidates } from './vm-recovery-candidate-order.js';
+import { isCanonicalAuthoritativeContextGraphId, localContextGraphIdMatchesCommittedNameHash, } from './context-graph-binding-state.js';
+import { isAdmittedContextGraphSubscription } from './context-graph-subscription-policy.js';
+import { normalizeContextGraphNameHash } from './context-graph-name-candidate.js';
 import { createHash } from 'node:crypto';
 import { createSwmHostModeHandler } from './internal/gossip/host-mode-handler.js';
 import { Buffer } from 'node:buffer';
@@ -252,6 +255,14 @@ export class SwmHostModeMethods extends DKGAgentBase {
             this.log.debug(createOperationContext('system'), `Could not seed discovery rate-limit aggregate from disk: ${msg}`);
         }
         this.log.info(createOperationContext('system'), `SWM host-mode store initialized at ${join(this.config.dataDir, 'swm-host')} (role=${role})`);
+    }
+    /** Restore disk intent after the durable subscription admission plan exists. */
+    async restoreSwmHostModeSubscriptions() {
+        if (!this.swmHostModeStore)
+            return;
+        const session = this.gossipSession;
+        if (session.live() === null)
+            return;
         // OT-RFC-38 LU-6 B3 — restore persisted host-mode subscriptions
         // BEFORE the chain-event poller starts. Chain events older than
         // the poller's lookback window would otherwise be silently lost
@@ -261,6 +272,8 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // shortcut that keeps the per-restart re-derivation cheap.
         try {
             const previouslySubscribed = await this.swmHostModeStore.listHostModeSubscribedCgs();
+            if (!session.active || this.gossipSession !== session)
+                return;
             if (previouslySubscribed.length > 0) {
                 // OT-RFC-49 WS-A — persisted host-mode subscriptions are curated by
                 // construction (the curated check ran when each was first wired). With
@@ -283,6 +296,10 @@ export class SwmHostModeMethods extends DKGAgentBase {
                     // authority check on every envelope ingest still catches
                     // revocations even if curator state has changed since.
                     try {
+                        if (!session.active || this.gossipSession !== session)
+                            return;
+                        if (!this.automaticSwmHostModeAdmissionAllowed(cgId))
+                            continue;
                         this.wireSwmHostModeHandler(cgId, SUBSCRIPTION_SOURCES.RECONCILER, true);
                         // Codex PR #620 R2: also re-probe registration state.
                         // Without this, a host-only CG that was registered while
@@ -292,6 +309,9 @@ export class SwmHostModeMethods extends DKGAgentBase {
                         // sees local store graphs, so the periodic reconciler
                         // can't heal it later either.
                         await this.maybeMarkRegisteredForHostMode(cgId);
+                        if (!session.active || this.gossipSession !== session)
+                            return;
+                        this.automaticSwmHostModeAdmissionAllowed(cgId);
                     }
                     catch (err) {
                         const msg = err instanceof Error ? err.message : String(err);
@@ -318,6 +338,8 @@ export class SwmHostModeMethods extends DKGAgentBase {
             return;
         if (!this.swmHostModeStore)
             return;
+        if (!this.automaticSwmHostModeAdmissionAllowed(contextGraphId))
+            return;
         if (Object.values(SYSTEM_CONTEXT_GRAPHS).includes(contextGraphId))
             return;
         if (!this.rfc64LegacySwmGossipAllowedForContextGraph(contextGraphId)) {
@@ -351,44 +373,30 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 await this.isCuratedForHostMode(contextGraphId)) {
                 // A manually hosted CG can become curated later. Upgrade the cached
                 // classification so the existing handler starts stripping immediately.
-                if (!session.active || this.gossipSession !== session)
+                if (!session.active || this.gossipSession !== session
+                    || !this.automaticSwmHostModeAdmissionAllowed(contextGraphId)
+                    || this.swmHostModeAccessPolicy(contextGraphId) === 0)
                     return;
                 session.swmHostModeCurated.set(hostKey, true);
             }
+            if (!session.active || this.gossipSession !== session
+                || !this.automaticSwmHostModeAdmissionAllowed(contextGraphId))
+                return;
             await this.maybeMarkRegisteredForHostMode(contextGraphId);
+            if (!session.active || this.gossipSession !== session)
+                return;
+            this.automaticSwmHostModeAdmissionAllowed(contextGraphId);
             return;
         }
         // Only host curated CGs. Public CGs already have plaintext SWM
         // distribution and don't need an opaque ciphertext custodian.
         //
-        // OT-RFC-38 / LU-6 Phase B — three-source curation probe in
-        // cheapest-first order. The local SPARQL probe (the original
-        // gate) only finds the access-policy triple for CGs the local
-        // node CREATED or JOINED with metadata; for a chain-event-
-        // driven host-only core OR a beacon-driven pre-reg auto-host,
-        // no local meta exists and `isPrivateContextGraph` returns
-        // false, stranding the subscription. We supplement it with:
-        //
-        //   (a) `subscribedContextGraphs[contextGraphId].onChainHash` —
-        //       set ONLY by code paths that already proved curation
-        //       (chain-event handler with accessPolicy==1, beacon
-        //       handler with accessPolicy==BEACON_ACCESS_POLICY_CURATED,
-        //       successful curator-side `registerContextGraph` on a
-        //       curated CG). Cheapest of the three.
-        //   (b) `onChainAccessPolicyCache` — populated by the chain-
-        //       event poller; keyed by on-chain numeric id. Falls
-        //       through to the existing per-CG cache for CGs whose
-        //       cleartext is unknown locally.
-        //
-        // Any of the three returning "curated" is sufficient. If all
-        // three return "not curated", we bail (same as before). The
-        // probe is shared with `enableSwmHostModeFor` via
-        // {@link isCuratedForHostMode} so the operator-hatch close
-        // (OT-RFC-49 WS-A) sees the SAME curation answer as auto-host —
-        // critically, the host-only-core case where there's no local
-        // `_meta` and `isPrivateContextGraph` alone returns false.
+        // A numeric policy, verified curated beacon or native private metadata
+        // proves curation. A name commitment alone does not prove access policy.
         const curated = await this.isCuratedForHostMode(contextGraphId);
-        if (!curated || !session.active || this.gossipSession !== session)
+        if (!curated || !session.active || this.gossipSession !== session
+            || !this.automaticSwmHostModeAdmissionAllowed(contextGraphId)
+            || this.swmHostModeAccessPolicy(contextGraphId) === 0)
             return;
         // OT-RFC-49 WS-A — the private-ciphertext strip. With `stripCiphertext`
         // ON (default), a core declines ALL host-mode custody for a curated CG:
@@ -409,7 +417,13 @@ export class SwmHostModeMethods extends DKGAgentBase {
         }
         this.wireSwmHostModeHandler(contextGraphId, source, true);
         await this.awaitHostModePersistence(contextGraphId);
+        if (!session.active || this.gossipSession !== session
+            || !this.automaticSwmHostModeAdmissionAllowed(contextGraphId))
+            return;
         await this.maybeMarkRegisteredForHostMode(contextGraphId);
+        if (!session.active || this.gossipSession !== session
+            || !this.automaticSwmHostModeAdmissionAllowed(contextGraphId))
+            return;
         this.log.info(createOperationContext('system'), `SWM host-mode subscription enabled for "${contextGraphId}" (role=core)`);
     }
     /**
@@ -422,36 +436,76 @@ export class SwmHostModeMethods extends DKGAgentBase {
     swmHostModeStripCiphertext() {
         return this.config.swmHostMode?.stripCiphertext ?? true;
     }
-    /**
-     * OT-RFC-38 / LU-6 Phase B — the three-source curation probe used to decide
-     * whether a CG warrants host-mode custody, in cheapest-first order:
-     *
-     *   (a) `subscribedContextGraphs[id].onChainHash` — set ONLY by paths that
-     *       already proved curation (chain-event handler with accessPolicy==1,
-     *       beacon handler with BEACON_ACCESS_POLICY_CURATED, curator-side
-     *       register of a curated CG);
-     *   (b) `onChainId` + `onChainAccessPolicyCache===1` — populated by the
-     *       chain-event poller, keyed by numeric on-chain id;
-     *   (c) `isPrivateContextGraph` — the local `_meta` accessPolicy/allowlist
-     *       read (the original gate; the only one a host-only core CANNOT
-     *       satisfy, since it never holds the cleartext `_meta`).
-     *
-     * Any positive ⇒ curated. A probe throw is treated as NOT curated (the same
-     * bail-out `reconcileSwmHostModeSubscription` had inline). Extracted so the
-     * OT-RFC-49 WS-A operator-hatch close in {@link enableSwmHostModeFor} sees
-     * the EXACT same curation answer as the auto-host path — without this, a
-     * host-only core (no local `_meta`) would fail an `isPrivateContextGraph`-only
-     * check, leaving the operator override open for precisely the case WS-A
-     * exists to close.
-     */
-    async isCuratedForHostMode(contextGraphId) {
-        const sub = this.subscribedContextGraphs.get(contextGraphId);
-        if (sub?.onChainHash)
+    /** Exact local identity wins; absent raw wire requests use native routing. */
+    swmHostModeLocalId(contextGraphId) {
+        if (this.subscribedContextGraphs.has(contextGraphId)
+            || this.contextGraphSubscriptionDormancyById.has(contextGraphId))
+            return contextGraphId;
+        const wireId = normalizeContextGraphNameHash(contextGraphId);
+        if (wireId === null)
+            return contextGraphId;
+        if (this.subscribedContextGraphs.has(wireId)
+            || this.contextGraphSubscriptionDormancyById.has(wireId))
+            return wireId;
+        return this.resolveContextGraphIdAlias(wireId) ?? wireId;
+    }
+    /** Automatic hosting cannot activate saved intent that admission left dormant. */
+    automaticSwmHostModeAdmissionAllowed(contextGraphId) {
+        const localId = this.swmHostModeLocalId(contextGraphId);
+        if (!this.contextGraphSubscriptionDormancyById.has(localId)
+            || isAdmittedContextGraphSubscription(this.subscribedContextGraphs.get(localId)))
             return true;
-        if (sub?.onChainId && this.onChainAccessPolicyCache.get(sub.onChainId) === 1)
+        const hostKey = this.canonicalSwmHostModeKey(contextGraphId);
+        // Refusal of A cannot retire an operator handler or another slot's owner B.
+        if (this.swmHostModeSubscribed.get(hostKey) !== SUBSCRIPTION_SOURCES.MANUAL
+            && this.wireIdToLocalCgId.get(hostKey) === localId)
+            this.unwireSwmHostModeHandler(contextGraphId);
+        return false;
+    }
+    /** Numeric policy is authoritative over metadata and same-hash beacon hints. */
+    swmHostModeAccessPolicy(contextGraphId) {
+        let sub = this.subscribedContextGraphs.get(this.swmHostModeLocalId(contextGraphId));
+        if (!sub?.onChainId && normalizeContextGraphNameHash(contextGraphId) !== null) {
+            const owner = this.wireIdToLocalCgId.get(this.canonicalSwmHostModeKey(contextGraphId));
+            sub = owner === undefined ? undefined : this.subscribedContextGraphs.get(owner);
+        }
+        return sub?.onChainId ? this.onChainAccessPolicyCache.get(sub.onChainId) : undefined;
+    }
+    /** Manual authority uses current identity, not a retired predecessor's status. */
+    manualSwmHostModeLocalId(contextGraphId) {
+        if (this.subscribedContextGraphs.has(contextGraphId))
+            return contextGraphId;
+        const wireId = normalizeContextGraphNameHash(contextGraphId);
+        if (wireId === null)
+            return contextGraphId;
+        if (this.subscribedContextGraphs.has(wireId))
+            return wireId;
+        return this.resolveContextGraphIdAlias(wireId) ?? wireId;
+    }
+    /** Manual strip-on custody requires this exact routed slot's public proof. */
+    isExactPublicManualSwmHostMode(contextGraphId, hostKey) {
+        const localId = this.manualSwmHostModeLocalId(contextGraphId);
+        const subscription = this.subscribedContextGraphs.get(localId);
+        const onChainId = subscription?.onChainId;
+        const wireOwner = this.wireIdToLocalCgId.get(hostKey);
+        return isCanonicalAuthoritativeContextGraphId(onChainId)
+            && normalizeContextGraphNameHash(subscription?.onChainHash) === hostKey
+            && localContextGraphIdMatchesCommittedNameHash(localId, hostKey, id => this.isWireIdKeyedSubscription(id))
+            && this.canonicalSwmHostModeKey(contextGraphId) === hostKey
+            && (wireOwner === undefined || wireOwner === localId)
+            && this.onChainAccessPolicyCache.get(onChainId) === 0;
+    }
+    /** Curation requires actual policy, signed beacon verification or private metadata. */
+    async isCuratedForHostMode(contextGraphId) {
+        const policy = this.swmHostModeAccessPolicy(contextGraphId);
+        if (policy !== undefined)
+            return policy === 1;
+        if (this.beaconCuratorByWireId.has(this.canonicalSwmHostModeKey(contextGraphId)))
             return true;
         try {
-            return await this.isPrivateContextGraph(contextGraphId);
+            const privateMetadata = await this.isPrivateContextGraph(this.swmHostModeLocalId(contextGraphId));
+            const currentPolicy = this.swmHostModeAccessPolicy(contextGraphId);
+            return currentPolicy === undefined ? privateMetadata : currentPolicy === 1;
         }
         catch {
             return false;
@@ -512,6 +566,9 @@ export class SwmHostModeMethods extends DKGAgentBase {
         const live = session.live();
         if (live === null)
             return;
+        if (source !== SUBSCRIPTION_SOURCES.MANUAL
+            && !this.automaticSwmHostModeAdmissionAllowed(contextGraphId))
+            return;
         if (!this.rfc64LegacySwmGossipAllowedForContextGraph(contextGraphId)) {
             const hostKey = this.canonicalSwmHostModeKey(contextGraphId);
             const hadRuntimeHostState = session.swmHostModeHandlers.has(hostKey)
@@ -559,7 +616,17 @@ export class SwmHostModeMethods extends DKGAgentBase {
         session.swmHostModeSubscribed.set(wireCgId, source);
         session.swmHostModeCurated.set(wireCgId, curated);
         live.manager.subscribe(swmTopic);
-        const handler = createSwmHostModeHandler(this, this.log, session, contextGraphId, wireCgId);
+        const delegate = createSwmHostModeHandler(this, this.log, session, contextGraphId, wireCgId);
+        // Manual public custody must remain proven after enable returns or yields.
+        // Automatic callbacks retain their existing positive-private admission.
+        const handler = source === SUBSCRIPTION_SOURCES.MANUAL
+            ? (topic, data, from) => {
+                if (this.swmHostModeStripCiphertext()
+                    && !this.isExactPublicManualSwmHostMode(contextGraphId, wireCgId))
+                    return;
+                delegate(topic, data, from);
+            }
+            : delegate;
         session.swmHostModeHandlers.set(wireCgId, handler);
         live.manager.onMessage(swmTopic, handler);
         // B3: persist the host-mode designation so a restart re-engages
@@ -2069,9 +2136,11 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 }
             }
             const existing = this.subscribedContextGraphs.get(localCgId);
-            if (existing === undefined) {
-                return this.contextGraphSubscriptionDormancyById.has(localCgId) ? 'dormant' : undefined;
-            }
+            if (this.contextGraphSubscriptionDormancyById.has(localCgId)
+                && !isAdmittedContextGraphSubscription(existing))
+                return 'dormant';
+            if (existing === undefined)
+                return undefined;
             if (!existing.subscribed)
                 return undefined;
             if (existing.onChainId === undefined) {
@@ -6695,8 +6764,39 @@ export class SwmHostModeMethods extends DKGAgentBase {
             return { subscribed: false, alreadySubscribed: false, hostingEnabled: true, memberMode: true };
         }
         const hostKey = this.canonicalSwmHostModeKey(contextGraphId);
+        const localId = this.manualSwmHostModeLocalId(contextGraphId);
+        const subscription = this.subscribedContextGraphs.get(localId);
+        const onChainId = subscription?.onChainId;
+        const onChainHash = subscription?.onChainHash;
+        const generation = this.contextGraphBindingState.capture(localId);
+        const handler = session.swmHostModeHandlers.get(hostKey);
+        const source = session.swmHostModeSubscribed.get(hostKey);
+        const wireOwner = this.wireIdToLocalCgId.get(hostKey);
+        const requestIsCurrent = () => session.active && this.gossipSession === session
+            && this.manualSwmHostModeLocalId(contextGraphId) === localId
+            && this.subscribedContextGraphs.get(localId) === subscription
+            && subscription?.onChainId === onChainId && subscription?.onChainHash === onChainHash
+            && this.contextGraphBindingState.isGenerationCurrent(localId, generation)
+            && this.canonicalSwmHostModeKey(contextGraphId) === hostKey
+            && this.wireIdToLocalCgId.get(hostKey) === wireOwner;
         const curated = await this.isCuratedForHostMode(contextGraphId);
-        if (!session.active || this.gossipSession !== session) {
+        if (!requestIsCurrent()
+            || session.swmHostModeHandlers.get(hostKey) !== handler
+            || session.swmHostModeSubscribed.get(hostKey) !== source) {
+            return { subscribed: false, alreadySubscribed: false, hostingEnabled: true };
+        }
+        const strip = this.swmHostModeStripCiphertext();
+        const publicPolicy = this.isExactPublicManualSwmHostMode(contextGraphId, hostKey);
+        const ownsHandler = handler !== undefined && wireOwner === localId;
+        // Absence of private evidence is not public proof. Close only this owner's
+        // existing dispatch; retain its operator provenance and durable marker.
+        if (strip && !publicPolicy) {
+            if (ownsHandler)
+                session.swmHostModeCurated.set(hostKey, true);
+            this.log.info(createOperationContext('system'), `SWM host-mode subscribe REFUSED for "${contextGraphId}": private-ciphertext strip requires exact public access policy`);
+            return { subscribed: false, alreadySubscribed: false, hostingEnabled: true };
+        }
+        if (strip && (handler !== undefined || source !== undefined) && !ownsHandler) {
             return { subscribed: false, alreadySubscribed: false, hostingEnabled: true };
         }
         if (this.swmHostModeSubscribed.has(hostKey)) {
@@ -6713,31 +6813,27 @@ export class SwmHostModeMethods extends DKGAgentBase {
             // this canonicalisation the second subscribe would wire a
             // duplicate gossip handler on the same topic and double every
             // host-mode ingest/persistence.
-            // Never downgrade a positive classification on a transient policy-read
-            // failure. A false -> true transition closes both dispatch branches.
-            this.swmHostModeCurated.set(hostKey, this.swmHostModeCurated.get(hostKey) === true || curated);
+            // Exact public policy can reopen this owner after an unknown-policy
+            // refusal. Strip-off re-entry retains positive private classification.
+            this.swmHostModeCurated.set(hostKey, strip && ownsHandler && source === SUBSCRIPTION_SOURCES.MANUAL
+                ? false : this.swmHostModeCurated.get(hostKey) === true || curated);
             await this.maybeMarkRegisteredForHostMode(contextGraphId);
+            if (!requestIsCurrent() || session.swmHostModeHandlers.get(hostKey) !== handler
+                || session.swmHostModeSubscribed.get(hostKey) !== source
+                || (strip && !this.isExactPublicManualSwmHostMode(contextGraphId, hostKey))) {
+                return { subscribed: false, alreadySubscribed: false, hostingEnabled: true };
+            }
             return { subscribed: false, alreadySubscribed: true, hostingEnabled: true };
         }
-        // OT-RFC-49 WS-A — CLOSE the operator hatch. With the private-ciphertext
-        // strip ON (default), the operator override must NOT re-introduce private
-        // custody for a CURATED CG: WS-A diverges from rung-1 (which deliberately
-        // left this manual path open) precisely here — there is no supported way
-        // back into private host-mode for a curated CG while the strip is on.
-        // Scoped to curated CGs via the SAME three-source probe the auto-host
-        // path uses ({@link isCuratedForHostMode}), NOT `isPrivateContextGraph`
-        // alone — a host-only core has no local `_meta`, so an
-        // `isPrivateContextGraph`-only check would return false and leave the
-        // hatch open for exactly the case WS-A closes. PUBLIC / bare-uncurated CGs
-        // are never affected (all three sources return not-curated → hatch stays
-        // open).
-        if (this.swmHostModeStripCiphertext() && curated) {
-            this.log.info(createOperationContext('system'), `SWM host-mode subscribe REFUSED for "${contextGraphId}": private-ciphertext strip is ON ` +
-                `(OT-RFC-49 WS-A — the operator override is closed for curated CGs; cores custody zero private SWM ciphertext)`);
-            return { subscribed: false, alreadySubscribed: false, hostingEnabled: true };
-        }
-        this.wireSwmHostModeHandler(contextGraphId, SUBSCRIPTION_SOURCES.MANUAL, curated);
+        this.wireSwmHostModeHandler(contextGraphId, SUBSCRIPTION_SOURCES.MANUAL, strip ? false : curated);
+        const createdHandler = session.swmHostModeHandlers.get(hostKey);
+        const createdIsCurrent = () => requestIsCurrent() && createdHandler !== undefined
+            && session.swmHostModeHandlers.get(hostKey) === createdHandler
+            && session.swmHostModeSubscribed.get(hostKey) === SUBSCRIPTION_SOURCES.MANUAL
+            && (!strip || this.isExactPublicManualSwmHostMode(contextGraphId, hostKey));
         await this.awaitHostModePersistence(contextGraphId);
+        if (!createdIsCurrent())
+            return { subscribed: false, alreadySubscribed: false, hostingEnabled: true };
         // Codex PR #610 R1 comment 5: a core that only knows the CG by
         // topic id (the explicit /host-mode/subscribe entrypoint) must
         // still transition the store to the registered-CG limits as
@@ -6746,6 +6842,8 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // forever and prune ciphertext from registered CGs much
         // earlier than intended.
         await this.maybeMarkRegisteredForHostMode(contextGraphId);
+        if (!createdIsCurrent())
+            return { subscribed: false, alreadySubscribed: false, hostingEnabled: true };
         this.log.info(createOperationContext('system'), `SWM host-mode subscription explicitly enabled for "${contextGraphId}" via API (role=${this.config.nodeRole ?? 'edge'})`);
         return { subscribed: true, alreadySubscribed: false, hostingEnabled: true };
     }