fix: harden DGR-003 identity trust boundary

.scratch/distributed-gguf-runtime/evidence/DGR-003/README.md

@@ -3,10 +3,15 @@
 Evidence class: deterministic offline/unit. No model payload, GPU, external API,
 network node, or API credit is required or claimed.
 
-## Result
+## Result — delayed-review repair, 2026-07-14
 
-DGR-003 defines an exact, model-agnostic compatibility identity and connects it
-to both DGR-002's gRPC `Fingerprint` and tracker capability admission.
+DGR-003 defines and tests an exact, model-agnostic compatibility identity and
+connects it to DGR-002's gRPC `Fingerprint` plus tracker parsing, admission,
+route partitioning, and certification. It is **not complete**: the existing
+production doctor/backend path still emits the legacy capability report without
+constructing a `ShardIdentity` from authoritative loaded artifact/runtime state.
+No exact recipe is therefore claimed live or routable from that path; supplied
+exact identities remain dark until tracker-owned certification.
 
 A matching digest proves canonical consistency, **not node authenticity or real
 execution**. Tracker-owned certification of a fingerprint by a non-synthetic,
@@ -29,8 +34,9 @@ complete, multi-node distributed forward is the execution trust boundary.
   - boundary and protocol schema versions;
   - recipe ID/version and catalogue version.
 - `CompatibilityFingerprint` populates the existing DGR-002 Protobuf
-  `Fingerprint`; `check_handshake()` returns DGR-002's structured fingerprint
-  mismatch error.
+  `Fingerprint`; `check_session_open()` fails closed on schema, fingerprint,
+  advertised/effective range, non-empty route session, positive route epoch,
+  and (when supplied) exact tracker route-session/epoch assignment.
 - Node and tracker implementations independently canonicalize the declaration.
   This is intentional: the tracker must not trust a digest copied from a node,
   and future native/C++ workers also need an independent implementation. Their
@@ -38,9 +44,11 @@ complete, multi-node distributed forward is the execution trust boundary.
 - Tracker admission cross-checks the exact identity against the capability
   proof's model, range, recipe labels, backend, and weight quantization. Any
   disagreement fails closed.
-- `TrackerServer` owns one certification ledger and passes it through direct and
-  replicated registration paths. A known exact recipe is `uncertified` and dark
-  for user traffic until the same exact fingerprint is certified.
+- `TrackerServer` owns the sole live certification ledger and passes it through
+  direct and replicated registration paths. A known exact recipe is
+  `uncertified` and dark for user traffic until the same exact fingerprint is
+  certified. Restart fails closed; durable/cluster-wide certification events
+  require the later real-forward control path and are not claimed here.
 - Certification evidence is bound to the promoted fingerprint, requires at
   least two distinct nodes, complete layer coverage, generated tokens, and
   `synthetic=false`. Unknown or mismatched fingerprints cannot be promoted.
@@ -48,7 +56,6 @@ complete, multi-node distributed forward is the execution trust boundary.
 ## Files changed
 
 - `packages/node/meshnet_node/runtime_recipe.py`
-- `packages/node/meshnet_node/capability.py`
 - `packages/tracker/meshnet_tracker/recipe.py`
 - `packages/tracker/meshnet_tracker/capability.py`
 - `packages/tracker/meshnet_tracker/server.py`
@@ -57,7 +64,7 @@ complete, multi-node distributed forward is the execution trust boundary.
 - this evidence directory, issue state, and DGR-003 PRD state
 
 A late review of dependency DGR-017 also found and fixed two genuine contract
-continuity defects before DGR-003 was accepted: v1 now has an independently
+continuity defects during delayed DGR-003 review: v1 now has an independently
 trusted digest and recursively immutable parsed state. Those changes and tests
 are recorded in DGR-017 evidence rather than claimed as DGR-003 functionality.
 
@@ -67,9 +74,14 @@ Exact commands and outcomes are in `commands.txt`.
 
 Observed final results:
 
-- DGR-003 identity + node/tracker capability suites: **99 passed**.
+- DGR-003 identity + node/tracker capability suites: **126 passed**.
 - DGR-017 focused dependency repair suite: **99 passed**.
-- Full deterministic suite: **872 passed, 13 skipped**.
+- Tracker routing suite: **93 passed**.
+- First delayed-review integrated run: **898 passed, 13 skipped, 1 failed** on
+  the pre-existing tracker-cancellation race.
+- Final delayed-review integrated rerun: **899 passed, 13 skipped** in
+  **253.64s**; Hermes controller acceptance rerun: **899 passed, 13 skipped**
+  in **252.66s**.
 - `python -m compileall -q packages tests`: pass.
 - `git diff --check`: pass.
 - Ruff on the changed identity, capability, contract, and test modules: pass.
@@ -80,8 +92,11 @@ The first integrated full-suite run produced **871 passed, 13 skipped, 1 failed*
 on the known unrelated
 `test_tracker_dashboard_can_cancel_inflight_proxy` timing race. Its fixture
 completed after three seconds just before cancellation, so the cancel endpoint
-returned 404. The same test then passed **5/5 in isolation**, and the complete
-integrated rerun passed **872/872** tests. No cancellation-test code was changed.
+returned 404. In this delayed repair it again produced a 404 after the stream
+finished (first integrated run: **898 passed, 13 skipped, 1 failed**); three
+immediate isolated repeats passed before a fourth reproduced the same race.
+No cancellation-test code was changed. The final complete integrated rerun
+passed **899/899** tests.
 
 ## Limitations
 
@@ -90,10 +105,16 @@ integrated rerun passed **872/872** tests. No cancellation-test code was changed
   persistence belongs with the later real distributed-forward control path.
   Restart or failover therefore returns exact recipes to the safe dark state;
   it never makes an unsupported recipe routable.
-- The node module still contains a local registry helper from the interrupted
-  partial implementation. It has no call sites and is not used by admission;
-  tracker remains the live certification authority. Removing that unpushed
-  helper is safe cleanup, not an acceptance dependency.
+- The node module has no certification ledger or admission policy; it holds only
+  identity construction and handshake validation. The Tracker is the sole
+  promotion authority.
+- **Completion blocker:** `doctor._validate_recipe()` calls
+  `build_capability_report()` without `identity=`, because the legacy
+  Transformers backend does not expose an immutable artifact-content pin and
+  full runtime recipe axes authoritative enough to build one. Adding a guessed
+  identity would weaken this contract. Production emission must be added with
+  the authoritative native worker/backend loading seam; until then the issue and
+  PRD deliberately remain incomplete.
 - This story proves identity and admission behavior with deterministic fixtures.
   It does not claim a real GLM forward or hardware certification.
 

.scratch/distributed-gguf-runtime/evidence/DGR-003/commands.txt

@@ -32,3 +32,56 @@ git show e7c780a:packages/tracker/meshnet_tracker/server.py > /tmp/dgr003-server
 ruff check /tmp/dgr003-server-base.py
 ruff check packages/tracker/meshnet_tracker/server.py
 # result: both baseline and current server.py report the same 8 pre-existing findings
+
+# ---------------------------------------------------------------------------
+# Delayed-review repair continuation — 2026-07-14
+# No model payload, GPU, external API, or real inference was run.
+# ---------------------------------------------------------------------------
+
+PYTHONPATH=packages/node:packages/tracker:packages/contracts /run/media/popov/d/DEV/repos/d-popov.com/AI/.venv/bin/python -m pytest -q tests/test_runtime_recipe_identity.py tests/test_node_capability.py tests/test_tracker_capability_admission.py
+# result: 126 passed in 4.77s
+# includes adversarial certification binding, unknown participant, mutation-atomicity,
+# report/identity revision+config, route partition, golden-vector, and SessionOpen tests
+
+PYTHONPATH=packages/node:packages/tracker /run/media/popov/d/DEV/repos/d-popov.com/AI/.venv/bin/python scripts/gen_recipe_fingerprint_vectors.py --check
+# result: tests/data/recipe_fingerprint_vectors.json matches the identity implementation
+
+PYTHONPATH=packages/node /run/media/popov/d/DEV/repos/d-popov.com/AI/.venv/bin/python -m pytest -q tests/test_glm_alpha_target.py
+# result: 99 passed in 0.11s
+
+/run/media/popov/d/DEV/repos/d-popov.com/AI/.venv/bin/python -m pytest -q tests/test_tracker_routing.py
+# result: 93 passed in 46.83s
+# there is no separate tests/test_tracker_server.py in this repository
+
+/run/media/popov/d/DEV/repos/d-popov.com/AI/.venv/bin/python -m compileall -q packages tests
+# result: pass
+
+ruff check packages/node/meshnet_node/runtime_recipe.py packages/tracker/meshnet_tracker/recipe.py packages/tracker/meshnet_tracker/capability.py tests/test_runtime_recipe_identity.py scripts/gen_recipe_fingerprint_vectors.py
+# result: All checks passed!
+
+git show e7c780a:packages/tracker/meshnet_tracker/server.py > /tmp/dgr003-server-base.py
+ruff check /tmp/dgr003-server-base.py
+ruff check packages/tracker/meshnet_tracker/server.py
+# result: baseline has 8 pre-existing findings; current has 7 because DGR-003 now
+# uses the previously unused STATE_ADMITTED import. No new server.py finding.
+
+git diff --check
+# result: pass
+
+/run/media/popov/d/DEV/repos/d-popov.com/AI/.venv/bin/python -m pytest -q
+# result: 898 passed, 13 skipped, 1 failed in 255.43s
+# sole failure: tests/test_tracker_routing.py::test_tracker_dashboard_can_cancel_inflight_proxy
+# the fixture completed its three-second stream before the cancel request, so cancel returned 404
+
+for i in 1 2 3 4 5; do
+  /run/media/popov/d/DEV/repos/d-popov.com/AI/.venv/bin/python -m pytest -q tests/test_tracker_routing.py::test_tracker_dashboard_can_cancel_inflight_proxy || exit 1
+done
+# result: first 3 passed (1.16s, 1.65s, 1.64s); attempt 4 reproduced the same 404 race.
+# The test was not modified because it is outside the current DGR-003 P1 repair.
+
+/run/media/popov/d/DEV/repos/d-popov.com/AI/.venv/bin/python -m pytest -q
+# result: 899 passed, 13 skipped in 253.64s (0:04:13)
+
+# Hermes controller acceptance rerun after agent completion
+/run/media/popov/d/DEV/repos/d-popov.com/AI/.venv/bin/python -m pytest -q
+# result: 899 passed, 13 skipped in 252.66s (0:04:12)

.scratch/distributed-gguf-runtime/issues/03-define-exact-artifact-and-runtime-recipe-identity.md

@@ -1,6 +1,6 @@
 # 03 — Define exact Artifact and runtime recipe identity
 
-Status: done
+Status: ready-for-agent
 
 ## Mandatory fresh-session context
 
@@ -23,7 +23,7 @@ As the Tracker, I need exact compatibility identity so that only numerically and
 
 - [x] Separate weight quantization, activation dtype, compute dtype, KV dtype/layout, tokenizer revision, architecture adapter, backend, and runtime version.
 - [x] Bind derivative or split artifacts to an exact source Model Artifact hash and Shard range.
-- [x] Produce a stable compatibility fingerprint used by capability admission and the gRPC handshake.
+- [ ] Produce a stable compatibility fingerprint used by live capability emission/admission and the gRPC handshake. The tracker parses, re-derives, admits, partitions, and certifies supplied exact identities, but the current production doctor/backend path does not yet derive one from authoritative loaded-artifact/runtime state. It must stay dark rather than be claimed complete.
 - [x] Fail closed on mismatched artifact, tokenizer, architecture, range, boundary schema, activation recipe, or cache layout.
 - [x] Keep unsupported recipes registered-but-dark until a real distributed forward certifies them.
 - [x] Targeted pytest tests pass
@@ -35,7 +35,7 @@ As the Tracker, I need exact compatibility identity so that only numerically and
 - [x] Read and verify every dependency evidence README before relying on dependency behavior
 - [x] Preserve all pre-existing working-tree changes and stage only files belonging to this story
 - [x] Write .scratch/distributed-gguf-runtime/evidence/DGR-003/README.md with files changed, exact commands and real results, limitations, compatibility notes, and dependent-story handoff
-- [x] Update only this story issue to Status: done after every acceptance criterion and quality gate passes
+- [ ] Update only this story issue to Status: done after every acceptance criterion and quality gate passes
 
 ## Dependency handoff
 

.scratch/distributed-gguf-runtime/prd.json

@@ -80,8 +80,8 @@
         "Update only this story issue to Status: done after every acceptance criterion and quality gate passes"
       ],
       "priority": 4,
-      "passes": true,
-      "notes": "Source issue: .scratch/distributed-gguf-runtime/issues/03-define-exact-artifact-and-runtime-recipe-identity.md",
+      "passes": false,
+      "notes": "Delayed-review repair: tracker-side exact identity contract is covered by deterministic tests, but live doctor/backend capability emission has no authoritative ShardIdentity construction yet. DGR-003 remains incomplete and exact recipes stay dark; see .scratch/distributed-gguf-runtime/issues/03-define-exact-artifact-and-runtime-recipe-identity.md.",
       "dependsOn": [
         "DGR-002",
         "DGR-017"