fix: harden DGR-017 contract continuity

packages/node/meshnet_node/glm_alpha/contract.py

@@ -6,16 +6,15 @@ the fact: *what would have counted as success?*
 Its thresholds are locked before the target ever runs (DGR-017), and DGR-020 reads
 them back to publish an ``alpha`` or ``stop`` verdict. The whole point is that the
 gap between those two moments is where a threshold quietly becomes "0.1 tokens/sec
-was always the goal". So the document carries ``contract_sha256`` over its own
-canonical content, and :func:`load_alpha_contract` recomputes it on every load. An
-agent that edits a threshold and forgets the digest is rejected; an agent that
-edits both has left a diff on a file whose whole purpose is to not change.
+was always the goal". So the document carries ``contract_sha256`` over its canonical content, while the
+approved v1 digest is pinned independently in code. :func:`load_alpha_contract`
+recomputes the self-digest and then requires that trusted pre-execution digest.
+Changing a threshold and re-sealing under the same identity is rejected; an
+amendment requires a new supported contract identity under human review.
 
-This is a tamper-*evidence* mechanism, not tamper-proofing. It cannot stop a
-determined rewrite of the file and the digest together — nothing in-repo can. What
-it does is remove the possibility of a silent one, which is the failure mode that
-actually happens: a number nudged mid-run, with no reviewer ever seeing that it
-moved.
+The parsed contract recursively freezes nested mappings and sequences. Thresholds
+therefore cannot change between verification and use, and :meth:`AlphaContract.to_dict`
+returns an isolated mutable copy for diagnostics and tests.
 """
 
 from __future__ import annotations
@@ -25,6 +24,7 @@ import re
 from dataclasses import dataclass
 from importlib.resources import files
 from pathlib import Path
+from types import MappingProxyType
 from typing import Any, Mapping
 
 from .manifest import (
@@ -39,6 +39,7 @@ from .manifest import (
 ALPHA_CONTRACT_SCHEMA_VERSION = 1
 ALPHA_CONTRACT_VERSION = 1
 ALPHA_CONTRACT_ID = "glm-5.2-max-alpha/v1"
+ALPHA_CONTRACT_V1_SHA256 = "aab23220280c053a3c14ff559df3cb5c9e1bf7f0f7188c6519e2e9d9ad036ed9"
 
 _CONTRACT_RESOURCE = "alpha-contract.json"
 
@@ -72,7 +73,23 @@ def contract_signing_payload(document: Mapping[str, Any]) -> dict:
 
 def compute_contract_digest(document: Mapping[str, Any]) -> str:
     """SHA-256 over the canonical contract content."""
-    return canonical_sha256(contract_signing_payload(document))
+    return canonical_sha256(contract_signing_payload(_thaw_json(document)))
+
+
+def _freeze_json(value: Any) -> Any:
+    if isinstance(value, Mapping):
+        return MappingProxyType({str(key): _freeze_json(item) for key, item in value.items()})
+    if isinstance(value, list):
+        return tuple(_freeze_json(item) for item in value)
+    return value
+
+
+def _thaw_json(value: Any) -> Any:
+    if isinstance(value, Mapping):
+        return {str(key): _thaw_json(item) for key, item in value.items()}
+    if isinstance(value, tuple):
+        return [_thaw_json(item) for item in value]
+    return value
 
 
 @dataclass(frozen=True)
@@ -107,7 +124,7 @@ class AlphaContract:
         return block[key]
 
     def to_dict(self) -> dict:
-        return dict(self.raw)
+        return _thaw_json(self.raw)
 
 
 def parse_alpha_contract(data: Any, source: str = "<memory>") -> AlphaContract:
@@ -229,18 +246,28 @@ def parse_alpha_contract(data: Any, source: str = "<memory>") -> AlphaContract:
     if not isinstance(amendment_policy, str) or not amendment_policy.strip():
         raise AlphaContractError(f"{source} must state its amendment policy")
 
+    if declared != ALPHA_CONTRACT_V1_SHA256:
+        raise AlphaContractError(
+            f"{source} is a re-sealed mutation of {ALPHA_CONTRACT_ID}: digest "
+            f"{declared} does not match the trusted pre-execution digest "
+            f"{ALPHA_CONTRACT_V1_SHA256}. An amendment requires a new supported "
+            "contract identity under human review."
+        )
+
+    frozen = _freeze_json(data)
+
     return AlphaContract(
         schema_version=schema_version,
         contract_version=contract_version,
         contract_id=contract_id,
         locked_at=str(data["locked_at"]),
         locked_by=str(data["locked_by"]),
-        target=target,
-        sections={name: data[name] for name in REQUIRED_SECTIONS},
+        target=frozen["target"],
+        sections=MappingProxyType({name: frozen[name] for name in REQUIRED_SECTIONS}),
         verdicts=tuple(verdicts),
         amendment_policy=amendment_policy,
         digest=declared,
-        raw=data,
+        raw=frozen,
         source=source,
     )