NC-12: the sole-owner sweep walks dig-wallet ONLY — dig-node-core is unguarded

[MichaelTaylor3d]

Task

Extend the NC-12 sole-owner sweep to cover dig-node-core. It currently walks dig-wallet/src only —
its own doc says so at sources.rs:580: "It walks dig-wallet/src ONLY."

Why

https://github.com/DIG-Network/dig_ecosystem/issues/2790's clause 2 requires that no path constructs its
own peer fabric outside the registry. Measured against origin/main 4efa57fc, that holds in
production within dig-wallet — the only non-test ChiaQuery::new is in sources.rs; fallback.rs:636
and service.rs:561 are both #[cfg(test)] (gate at service.rs:550).

Nothing covers dig-node-core. No live violation there today — its chia-peer light client was
removed (seams/chia_peer/mod.rs:13-23) — but it does hold an unregistered chain source, and
chain.rs:111 with_sources is dead, pub, and constructs peer_reads: None, i.e. an oracle-first
peak_height (#360).

A guard whose scope is narrower than the property it claims is the false-satisfaction class #2790 was
opened to end. Right now the clause reads as enforced ecosystem-wide and is enforced in one crate.

What "extend" must mean here

The sweep is a line classifier over Rust source, and it took five gate rounds to make honest
within one crate (dig-node PR#354). Widening its haystack widens its blind spots. So:

• Do not widen the heuristic. The durable artifact from those five rounds is the fail-closed flag
  (Swept { sites, ended_inside_a_test_item } — a return type that can say "I could not tell") plus an
  explicitly open enumeration of mis-read shapes. Preserve both when the scope grows.
• Re-run the known-silent shapes against the new haystack: a column-0 #[cfg(test)] as string
  content, and a trailing comment on a column-0 terminator (} // done). rustfmt preserves both
  byte-for-byte, so cargo fmt --check suppresses neither. Confirm whether either occurs in
  dig-node-core — if one does, the guard is silent there on day one.
• The doc must state the new scope truthfully. sources.rs:580 currently names its bound correctly;
  after this change it must name the new one just as precisely.

Also in scope

Decide chain.rs:111 with_sources alongside this — a dead but pub constructor that yields a
single-source transport is exactly what the sweep should refuse, and deleting it may be cheaper than
teaching the sweep to allow it. Coordinate with dig-node#360 rather than duplicating it.

Done condition

The sweep covers dig-node-core as well as dig-wallet, its doc states the new scope exactly, the
fail-closed flag still refuses on an unreadable file, and a deliberately-introduced second fabric in
dig-node-core makes it fail — demonstrated, not asserted.

Context

• Parent: https://github.com/DIG-Network/dig_ecosystem/issues/2790 · epic
  https://github.com/DIG-Network/dig_ecosystem/issues/2760
• The five-round history and the two known-silent shapes: dig-node PR#354
• Sibling: test(dig-wallet): make the sweep guard's worked examples doctests — a backwards example survived four gate rounds #363 (make the sweep's worked examples doctests —
  a backwards example survived four adversarial rounds)

Effort

Medium — the widening is small; keeping the guard honest across a second crate is the work.

[MichaelTaylor3d]

Owned by a loop lane. Branch loop/365-366-nc12-anchored-root, draft PR #369, worktree worktrees/dn-365-366. Both taken in ONE branch/PR. Coordinating with the #360/#361/#363/#364/#367 lane: dig-wallet/src/sage/chain.rs belongs to that lane and is NOT touched here.

[MichaelTaylor3d]

Progress — branch loop/365-366-nc12-anchored-root @ a8a482d, PR #369 (DRAFT).

Re-measured against a fresh origin/main @ 4efa57f: sources.rs:580 still says "It walks
dig-wallet/src ONLY", and it was still true. Scope claim confirmed before changing anything.

The sweep now walks dig-wallet/src AND dig-node-core/src. The heuristic is UNCHANGED —
sweep, ends_a_column_0_item, the Swept { sites, ended_inside_a_test_item } fail-closed flag and
the explicitly-open enumeration of mis-read shapes are all byte-for-byte as they were. What changed is
the haystack, plus the two things a wider haystack breaks:

1. Sites are now CRATE-QUALIFIED (dig-wallet/sources.rs:NNN) and OWNER with them. File names
   repeat across a workspace — both swept crates already contain a chain.rs — so the unqualified
   "sources.rs" owner would have accepted a second fabric built in a sources.rs in ANY swept
   crate. The guard would have widened its scope and lost its property in the same change.
2. The haystack test asserts a FILE COUNT PER ROOT, not just a global needle total. dig-node-core
   contains zero ChiaQuery::new(, so a total across both roots stays positive from dig-wallet
   alone: a typo in the second path would leave the new scope reading nothing while the guard still
   reported a real haystack. Per-root counting separates "this crate is clean" from "this crate was
   never opened" — the same distinction the fail-closed flag draws within a file.

A deliberately-introduced second fabric in the new root FAILS — demonstrated, not asserted.
a_second_fabric_in_the_new_root_is_seen_and_judged_a_stray drives the same
production_call_sites_in over a temporary root whose only content is the violation, named
sources.rs precisely because that is the name the unqualified owner check would have waved through,
and asserts both halves: the site is SEEN, and it is judged a STRAY.

THE TWO KNOWN-SILENT SHAPES, RE-RUN AGAINST THE NEW HAYSTACK — one occurs.

• Column-0 #[cfg(test)] as string content: ABSENT from both crates. Every occurrence of that
  text inside a literal is INDENTED, and indentation is what the latch requires.
• Terminator carrying trailing content: PRESENT ONCE, at dig-node-core/src/lib.rs:195 —
  const DEFAULT_CACHE_CAP: u64 = 1024 * 1024 * 1024; // 1 GiB. The guard is NOT silent there
  today, and the reason is worth stating precisely rather than trusting: the shape only bites when
  the latch is already SET, and no column-0 #[cfg(test)] precedes it in that file. I verified this
  by replaying the classifier over both crates — no file reaches a trailing-comment terminator with
  the latch set, and no file ends inside a test item (so the fail-closed refusal fires nowhere). That
  is a property of where the line SITS, not of the line; move it below a column-0 #[cfg(test)] and
  it goes silent with nothing reporting it. Recorded in the sweep doc-comment and in
  DEVELOPMENT_LOG.md.

Doc states the new scope exactly, and names what is still invisible: the other workspace crates
(dig-node-service, dig-runtime, dig-chat-protocol), every tests//benches//examples/ target
including those of the two swept crates, and anything a dependency builds.

chain.rs:111 with_sources NOT touched — that is dig-node#360 and belongs to the
#360/#361/#363/#364/#367 lane. Coordinated, not duplicated.

Revert-proof: reverting OWNER + the site format to their unqualified forms fails the new
demonstration test and leaves every other test in the module green — which is exactly why the
demonstration was needed rather than the real assertion alone. Pointing a root at an existing but
Rust-free directory fires the per-root count assertion by name.

Gates: cargo fmt --check exit 0, cargo clippy -D warnings exit 0; sole_owner_tests 7/7.

[MichaelTaylor3d]

Complete on loop/365-366-nc12-anchored-root @ 2b551b9, PR #369 (DRAFT, awaiting the gate).

Verified against freshly-fetched origin/main @ 4efa57fc, where sources.rs:580 still said "It walks dig-wallet/src ONLY" — and it was still true.

Done condition, item by item

• The sweep covers dig-node-core as well as dig-wallet.
• The doc states the new scope exactly — and names what stays invisible: the other workspace crates (dig-node-service, dig-runtime, dig-chat-protocol), every tests//benches//examples/ target including those of the two swept crates, and anything a dependency builds.
• The fail-closed flag still refuses on an unreadable file. Swept { sites, ended_inside_a_test_item } and the explicitly-open enumeration are preserved byte-for-byte. The heuristic was NOT widened.
• A deliberately-introduced second fabric in dig-node-core makes it fail — demonstrated, not asserted, driven through the same production_call_sites_in over a stand-in root whose only content is the violation.

What widening the haystack actually broke — two things, both fixed

1. File names repeat across a workspace. Both swept crates already contain a chain.rs, so the unqualified OWNER = "sources.rs" would have accepted a second fabric built in a sources.rs in any swept crate — the guard widening its scope and losing its property in the same change. Sites are now crate-qualified (dig-wallet/sources.rs:NNN). The demonstration fixture is named sources.rs precisely because that is the name the old check would have waved through.
2. A crate with none of the needle cannot tell you it was read. dig-node-core holds zero ChiaQuery::new(, so a global needle total stays positive from dig-wallet alone: a typo in the second path would leave the new scope reading zero files while the guard still reported a real haystack. The haystack test now asserts a file count per root — the same distinction the fail-closed flag draws within a file, applied across roots.

THE TWO KNOWN-SILENT SHAPES, RE-RUN AGAINST THE NEW HAYSTACK — one occurs

• Column-0 #[cfg(test)] as string content — ABSENT from both crates. Every occurrence of that text inside a literal here is INDENTED, and indentation is what the latch requires.

• Terminator carrying trailing content — PRESENT ONCE, at dig-node-core/src/lib.rs:195:
  const DEFAULT_CACHE_CAP: u64 = 1024 * 1024 * 1024; // 1 GiB

  The guard is NOT silent there today, and the reason is measured rather than trusted: the shape only bites when the latch is already SET, and no column-0 #[cfg(test)] precedes it in that file. I replayed the classifier over every file in both crates — no file reaches a trailing-comment terminator with the latch set, and no file ends inside a test item, so the fail-closed refusal fires nowhere and these two shapes are the whole of the residual risk.

  That is a property of where the line sits, not of the line. Move it below a column-0 #[cfg(test)] and it goes silent with nothing reporting it. Recorded in the sweep doc-comment and DEVELOPMENT_LOG.md.

rustfmt preserves both shapes byte-for-byte, so cargo fmt --check suppresses neither — confirmed, fmt --check exits 0 with the one occurrence present.

chain.rs:111 with_sources — NOT touched

That is #360, owned by PR #368. Coordinated, not duplicated.

Coordination — a real overlap for the orchestrator to sequence

PR #368 (#360/#363) edits the same sweep doc-comment region of sources.rs that this ticket required me to update: its doctest conversion of the silent-shapes paragraph vs my re-measurement of that same paragraph against the new haystack. My other four hunks in the file do not overlap theirs. Whichever merges second must rebase and keep BOTH — their worked examples as doctests, and the dig-node-core re-measurement, which is this ticket's deliverable. Small, textually resolvable, doc-comment only.

Evidence

sole_owner_tests 7/7; dig-wallet lib 656/656; fmt 0; clippy -D warnings 0; all five required CI contexts SUCCESS asserted BY NAME, 0 unresolved threads.

Revert-proofs: reverting OWNER + the site format to their unqualified single-crate forms fails only the new demonstration test and leaves every other test in the module green — which is exactly why the demonstration was needed rather than the real assertion alone. Pointing a root at an existing but Rust-free directory fires the per-root count assertion by name; a root that does not exist panics earlier inside rust_files, so both misconfigurations are loud but through different mechanisms, and that is written into the test.

[MichaelTaylor3d]

Gate round 2 note — #366 was verified CLEAN by the gate; no changes were required here.

The gate independently re-implemented the sweep and it agreed with mine, and its terminator replay was broader than my own — all 610 candidate lines across both crates, zero reached while latched, which corroborates the lib.rs:195 finding I reported (the shape is present but not silent, because no column-0 #[cfg(test)] precedes it).

Two things changed in this round that touch this ticket only indirectly:

1. Nothing in the sweep, its scope doc, or its fixtures was modified. The round-2 work was entirely in corroborated_resolver.rs / endpoints.rs / SPEC for NC-12: the anchored root — the fact content-serve pins on — comes from ONE hardcoded HTTP third party #365.
2. Coordination reconfirmed. PR fix(node): dead transport ctor, temp-dir leak, version-gate reporting, executed sweep examples #368 still rewrites the same sources.rs doc block (~502-560). The gate notes there is no security consequence — fix(node): dead transport ctor, temp-dir leak, version-gate reporting, executed sweep examples #368 adds no production ChiaQuery::new( site, so the sole-owner sweep still finds exactly one owner — and recommends preferring fix(node): dead transport ctor, temp-dir leak, version-gate reporting, executed sweep examples #368's executed-fixture (doctest) shape when resolving. Keep the dig-node-core re-measurement paragraph, which is this ticket's deliverable.

Branch rebased onto 7ea14fe (CHANGELOG-only delta, nothing audited moved). Full --all-targets run green: dig-wallet 656/656 including sole_owner_tests 7/7.

[MichaelTaylor3d]

Rebased onto 240732e6 (PR#368 merged). Three checks the coordinator flagged, all done and all measured.

1. The sources.rs collision resolved — and it merged with NO conflict, which is exactly the case that loses a property silently. So I verified rather than trusted:

• Both rust_files(...) call sites still name BOTH crates. They are driven from swept_roots(), whose list is ["dig-wallet", "dig-node-core"]; the only CARGO_MANIFEST_DIR use left is inside swept_roots deriving the workspace dir. The NC-12: the sole-owner sweep walks dig-wallet ONLY — dig-node-core is unguarded #366 scope widening is intact.
• fix(node): dead transport ctor, temp-dir leak, version-gate reporting, executed sweep examples #368's executed-fixture shape is preserved — its 6 JSON worked-example blocks and its every_worked_example_in_the_docs_is_executed_against_the_real_classifier test.
• My dig-node-core re-measurement paragraph survived.
• sole_owner_tests is now 8/8 — my 7 plus fix(node): dead transport ctor, temp-dir leak, version-gate reporting, executed sweep examples #368's doc harness. That harness passing against the merged doc block is the strongest evidence the resolution is semantically clean: it executes the doc's own claims against the real classifier.

2. The stale [5] numbers — not present in my text. #368's rewrite removed the unwritten-fixture example and its reconstructed fixture measures [6]/[] (lines 597/614). My paragraph never quoted them, so there was nothing to correct.

3. The version trap hit exactly as warned. main had taken 0.155.0 and dig-wallet 0.36.0 — identical to mine — so the rebase dropped both bumps as "already upstream", invisible to git status, the diff, fmt, clippy and tests. Now 0.156.0 / dig-wallet 0.37.0; dig-node-core 0.59.0 was unaffected (main is 0.58.0). Cargo.lock re-resolved.

Post-rebase: fmt --check 0, clippy -D warnings 0. Full --all-targets re-running. Head 5ab2438, PR still DRAFT.

The gating finding was already fixed and pushed before this message arrived — option (a), the Verdict::{Confirmed, Rejected, Unreachable} tri-state, plus the Voice::Rejects fixture and the corrected SPEC. Detail in the PR body and the #365 comment.