fix: harden DGR-003 identity trust boundary

.scratch/distributed-gguf-runtime/evidence/DGR-003/README.md

@@ -3,10 +3,15 @@
 Evidence class: deterministic offline/unit. No model payload, GPU, external API,
 network node, or API credit is required or claimed.
 
-## Result
+## Result — delayed-review repair, 2026-07-14
 
-DGR-003 defines an exact, model-agnostic compatibility identity and connects it
-to both DGR-002's gRPC `Fingerprint` and tracker capability admission.
+DGR-003 defines and tests an exact, model-agnostic compatibility identity and
+connects it to DGR-002's gRPC `Fingerprint` plus tracker parsing, admission,
+route partitioning, and certification. It is **not complete**: the existing
+production doctor/backend path still emits the legacy capability report without
+constructing a `ShardIdentity` from authoritative loaded artifact/runtime state.
+No exact recipe is therefore claimed live or routable from that path; supplied
+exact identities remain dark until tracker-owned certification.
 
 A matching digest proves canonical consistency, **not node authenticity or real
 execution**. Tracker-owned certification of a fingerprint by a non-synthetic,
@@ -29,8 +34,9 @@ complete, multi-node distributed forward is the execution trust boundary.
   - boundary and protocol schema versions;
   - recipe ID/version and catalogue version.
 - `CompatibilityFingerprint` populates the existing DGR-002 Protobuf
-  `Fingerprint`; `check_handshake()` returns DGR-002's structured fingerprint
-  mismatch error.
+  `Fingerprint`; `check_session_open()` fails closed on schema, fingerprint,
+  advertised/effective range, non-empty route session, positive route epoch,
+  and (when supplied) exact tracker route-session/epoch assignment.
 - Node and tracker implementations independently canonicalize the declaration.
   This is intentional: the tracker must not trust a digest copied from a node,
   and future native/C++ workers also need an independent implementation. Their
@@ -38,9 +44,11 @@ complete, multi-node distributed forward is the execution trust boundary.
 - Tracker admission cross-checks the exact identity against the capability
   proof's model, range, recipe labels, backend, and weight quantization. Any
   disagreement fails closed.
-- `TrackerServer` owns one certification ledger and passes it through direct and
-  replicated registration paths. A known exact recipe is `uncertified` and dark
-  for user traffic until the same exact fingerprint is certified.
+- `TrackerServer` owns the sole live certification ledger and passes it through
+  direct and replicated registration paths. A known exact recipe is
+  `uncertified` and dark for user traffic until the same exact fingerprint is
+  certified. Restart fails closed; durable/cluster-wide certification events
+  require the later real-forward control path and are not claimed here.
 - Certification evidence is bound to the promoted fingerprint, requires at
   least two distinct nodes, complete layer coverage, generated tokens, and
   `synthetic=false`. Unknown or mismatched fingerprints cannot be promoted.
@@ -48,7 +56,6 @@ complete, multi-node distributed forward is the execution trust boundary.
 ## Files changed
 
 - `packages/node/meshnet_node/runtime_recipe.py`
-- `packages/node/meshnet_node/capability.py`
 - `packages/tracker/meshnet_tracker/recipe.py`
 - `packages/tracker/meshnet_tracker/capability.py`
 - `packages/tracker/meshnet_tracker/server.py`
@@ -57,7 +64,7 @@ complete, multi-node distributed forward is the execution trust boundary.
 - this evidence directory, issue state, and DGR-003 PRD state
 
 A late review of dependency DGR-017 also found and fixed two genuine contract
-continuity defects before DGR-003 was accepted: v1 now has an independently
+continuity defects during delayed DGR-003 review: v1 now has an independently
 trusted digest and recursively immutable parsed state. Those changes and tests
 are recorded in DGR-017 evidence rather than claimed as DGR-003 functionality.
 
@@ -67,9 +74,14 @@ Exact commands and outcomes are in `commands.txt`.
 
 Observed final results:
 
-- DGR-003 identity + node/tracker capability suites: **99 passed**.
+- DGR-003 identity + node/tracker capability suites: **126 passed**.
 - DGR-017 focused dependency repair suite: **99 passed**.
-- Full deterministic suite: **872 passed, 13 skipped**.
+- Tracker routing suite: **93 passed**.
+- First delayed-review integrated run: **898 passed, 13 skipped, 1 failed** on
+  the pre-existing tracker-cancellation race.
+- Final delayed-review integrated rerun: **899 passed, 13 skipped** in
+  **253.64s**; Hermes controller acceptance rerun: **899 passed, 13 skipped**
+  in **252.66s**.
 - `python -m compileall -q packages tests`: pass.
 - `git diff --check`: pass.
 - Ruff on the changed identity, capability, contract, and test modules: pass.
@@ -80,8 +92,11 @@ The first integrated full-suite run produced **871 passed, 13 skipped, 1 failed*
 on the known unrelated
 `test_tracker_dashboard_can_cancel_inflight_proxy` timing race. Its fixture
 completed after three seconds just before cancellation, so the cancel endpoint
-returned 404. The same test then passed **5/5 in isolation**, and the complete
-integrated rerun passed **872/872** tests. No cancellation-test code was changed.
+returned 404. In this delayed repair it again produced a 404 after the stream
+finished (first integrated run: **898 passed, 13 skipped, 1 failed**); three
+immediate isolated repeats passed before a fourth reproduced the same race.
+No cancellation-test code was changed. The final complete integrated rerun
+passed **899/899** tests.
 
 ## Limitations
 
@@ -90,10 +105,16 @@ integrated rerun passed **872/872** tests. No cancellation-test code was changed
   persistence belongs with the later real distributed-forward control path.
   Restart or failover therefore returns exact recipes to the safe dark state;
   it never makes an unsupported recipe routable.
-- The node module still contains a local registry helper from the interrupted
-  partial implementation. It has no call sites and is not used by admission;
-  tracker remains the live certification authority. Removing that unpushed
-  helper is safe cleanup, not an acceptance dependency.
+- The node module has no certification ledger or admission policy; it holds only
+  identity construction and handshake validation. The Tracker is the sole
+  promotion authority.
+- **Completion blocker:** `doctor._validate_recipe()` calls
+  `build_capability_report()` without `identity=`, because the legacy
+  Transformers backend does not expose an immutable artifact-content pin and
+  full runtime recipe axes authoritative enough to build one. Adding a guessed
+  identity would weaken this contract. Production emission must be added with
+  the authoritative native worker/backend loading seam; until then the issue and
+  PRD deliberately remain incomplete.
 - This story proves identity and admission behavior with deterministic fixtures.
   It does not claim a real GLM forward or hardware certification.