neuron-tai/.scratch/node-capability-admission/issues/03-fail-closed-startup-admission.md

Status: ready-for-agent

03 — Fail-closed startup admission lifecycle

What to build

Gate run_startup on a fresh, matching successful capability report before routable Tracker registration. A Node selected for a Model Preset/shard must fail closed if its recipe cannot perform the doctor forward: no ready/registered endpoint and no paid request acceptance.

Keep local diagnostic behavior useful: a failed report may be persisted/exposed locally, but the Node must not advertise the failed model/shard as ready. Define a bounded freshness/match rule so a report cannot be reused for a different model revision, shard, recipe, or backend identity.

Code refs:

• packages/node/meshnet_node/startup.py — download/load/start/register sequence
• packages/node/meshnet_node/cli.py — start and default startup error paths
• packages/node/meshnet_node/torch_server.py — server lifecycle
• tests/test_node_startup.py — fake startup and registration capture patterns

Test-first

1. Red: backend validation failure still causes /v1/nodes/register to be called.
2. Red: a success report for one arbitrary model/shard is reused for another.
3. Green: matching successful validation reaches registration; failed/stale/mismatched validation exits before registration.

Acceptance criteria

• Explicit selected model/shard fails closed before routable registration when validation fails
• Startup sends only a matching successful capability report with its registration payload
• Failed, stale, model-mismatched, shard-mismatched, recipe-mismatched, and backend-mismatched reports are rejected locally
• Existing stub/test startup remains usable through an explicit test-safe capability path, not a production bypass
• Tests prove the tracker receives no registration on a failed validation

Blocked by

01-generic-capability-report.md, 02-doctor-real-forward.md.