fix: harden DGR-003 identity trust boundary

packages/tracker/meshnet_tracker/capability.py

@@ -185,6 +185,10 @@ class CapabilityState:
     # Absent for a node that predates DGR-003.
     model_artifact_digest: str | None = None
     runtime_recipe_digest: str | None = None
+    shard_binding_digest: str | None = None
+    # The tracker ledger's verdict on that fingerprint at evaluation time
+    # ("dark"/"certified"), so the network map answers "why is this exact node
+    # not routing" without a second query. None when no identity was presented.
     certification: str | None = None
 
     @property
@@ -227,6 +231,7 @@ class CapabilityState:
             "diagnostics": list(self.diagnostics),
             "model_artifact_digest": self.model_artifact_digest,
             "runtime_recipe_digest": self.runtime_recipe_digest,
+            "shard_binding_digest": self.shard_binding_digest,
             "certification": self.certification,
         }
 
@@ -372,6 +377,22 @@ def evaluate_report(
                 f"identity is for artifact {identity.artifact_id!r}, but the node "
                 f"registered {advertised_model!r}",
             )
+        model_claim = report["model"]
+        if model_claim.get("revision") != identity.revision:
+            return base.with_state(
+                STATE_MODEL_MISMATCH,
+                "identity revision does not match the capability proof",
+            )
+        config_fingerprint = model_claim.get("config_fingerprint")
+        if isinstance(config_fingerprint, str) and config_fingerprint.startswith(
+            "sha256:"
+        ):
+            config_fingerprint = config_fingerprint.removeprefix("sha256:")
+        if config_fingerprint != identity.architecture_digest:
+            return base.with_state(
+                STATE_MODEL_MISMATCH,
+                "identity architecture/config digest does not match the capability proof",
+            )
         if (
             identity.recipe_id != base.recipe_id
             or identity.recipe_version != base.recipe_version
@@ -399,6 +420,7 @@ def evaluate_report(
             base,
             model_artifact_digest=identity.model_artifact_digest,
             runtime_recipe_digest=identity.runtime_recipe_digest,
+            shard_binding_digest=identity.shard_binding_digest,
         )
 
     if status != STATUS_PASSED:
@@ -425,8 +447,22 @@ def evaluate_report(
     # not authenticate a node or prove a distributed forward. Exact recipes are
     # therefore registered-but-dark until tracker-owned certification records
     # that forward.
+    #
+    # `ledger is None` means the caller owns no certification authority. It is
+    # not "certify anything" and it is not "make one up": a disposable ledger
+    # would register the recipe into state that is discarded on return, which
+    # reads like certification is wired when nothing is recording it. The only
+    # safe reading is that nothing here has certified this recipe, so it stays
+    # dark. `TrackerServer` owns the real ledger and passes it in.
     if identity is not None:
-        recipe_status = (ledger or CertificationLedger()).register(identity)
+        if ledger is None:
+            return base.with_state(
+                STATE_UNCERTIFIED,
+                "no certification ledger; an exact recipe is dark until a "
+                "tracker-owned distributed forward certifies it",
+            )
+        recipe_status = ledger.register(identity)
+        base = replace(base, certification=recipe_status.status)
         if not recipe_status.may_serve:
             return base.with_state(STATE_UNCERTIFIED, recipe_status.detail)