release: RFC-64 public RC after bounded canary

.github/workflows/rfc64-inventory-windows.yml

@@ -0,0 +1,115 @@
+name: RFC-64 inventory Windows gate
+
+on:
+  push:
+    branches:
+      - integration/rfc64-devnet
+    paths:
+      - '.github/workflows/rfc64-inventory-windows.yml'
+      - 'devnet/_bootstrap/package.json'
+      - 'devnet/_bootstrap/rdf-canonize.d.ts'
+      - 'devnet/_bootstrap/rfc64-evidence*'
+      - 'devnet/_bootstrap/tsconfig.evidence.json'
+      - 'devnet/_bootstrap/vitest.evidence.config.ts'
+      - 'devnet/rfc64-persistence-lifecycle/**'
+      - 'package.json'
+      - 'packages/agent/**'
+      - 'packages/chain/**'
+      - 'packages/core/**'
+      - 'packages/publisher/**'
+      - 'packages/query/**'
+      - 'packages/random-sampling/**'
+      - 'packages/rdf-utils/**'
+      - 'packages/storage/**'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - 'tsconfig.base.json'
+  pull_request:
+    paths:
+      - '.github/workflows/rfc64-inventory-windows.yml'
+      - 'devnet/_bootstrap/package.json'
+      - 'devnet/_bootstrap/rdf-canonize.d.ts'
+      - 'devnet/_bootstrap/rfc64-evidence*'
+      - 'devnet/_bootstrap/tsconfig.evidence.json'
+      - 'devnet/_bootstrap/vitest.evidence.config.ts'
+      - 'devnet/rfc64-persistence-lifecycle/**'
+      - 'package.json'
+      - 'packages/agent/**'
+      - 'packages/chain/**'
+      - 'packages/core/**'
+      - 'packages/publisher/**'
+      - 'packages/query/**'
+      - 'packages/random-sampling/**'
+      - 'packages/rdf-utils/**'
+      - 'packages/storage/**'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - 'tsconfig.base.json'
+  workflow_dispatch:
+
+concurrency:
+  group: rfc64-inventory-windows-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  inventory-lifecycle:
+    name: SQLite lifecycle (Windows)
+    runs-on: windows-latest
+    timeout-minutes: 40
+    steps:
+      - name: Checkout candidate
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Typecheck RFC-64 evidence harness
+        run: pnpm typecheck:devnet:rfc64-evidence
+
+      - name: Test RFC-64 evidence harness
+        run: pnpm test:devnet:rfc64-evidence
+
+      - name: Build agent dependency closure
+        run: pnpm --filter @origintrail-official/dkg-agent... run build
+
+      - name: Strict-typecheck Gate 0 lifecycle harness
+        run: pnpm typecheck:gate0:rfc64-persistence-lifecycle
+
+      - name: Run Gate 0 production persistence lifecycle
+        # Nine sequential 60s process bounds plus bounded forced-close cleanup
+        # fit below 10m; reserve additional time for the build and verifier.
+        timeout-minutes: 20
+        run: pnpm test:gate0:rfc64-persistence-lifecycle
+
+      - name: Typecheck the lifecycle crash harness
+        run: >-
+          pnpm exec tsc --noEmit --target ES2022 --module NodeNext
+          --moduleResolution NodeNext --types node,vitest/globals --skipLibCheck
+          packages/agent/test/rfc64-inventory-v1-lifecycle.test.ts
+          packages/agent/test/fixtures/rfc64-inventory-v1-child.ts
+
+      - name: Run RFC-64 inventory tests
+        run: >-
+          pnpm --filter @origintrail-official/dkg-agent exec vitest run
+          --config vitest.unit.config.ts
+          test/rfc64-inventory-v1
+          test/rfc64-agent-inventory-lifecycle.test.ts
+          test/rfc64-author-catalog-producer.test.ts
+          test/rfc64-control-object-store-v1.test.ts
+          test/rfc64-control-object-store-lifecycle-v1.test.ts
+          test/rfc64-durable-file-store-v1.test.ts
+          test/rfc64-secure-filesystem-policy-v1.test.ts

devnet/_bootstrap/RFC64_EVIDENCE.md

@@ -0,0 +1,99 @@
+# RFC-64 deterministic devnet evidence
+
+`rfc64-evidence.ts` is a protocol-independent evidence layer for RFC-64 Gate 0+
+devnet harnesses. It does not discover peers, transfer data, retry operations,
+or modify runtime sync behavior. A harness supplies the expected and observed
+Knowledge Asset datasets after its own operation completes.
+
+## Deterministic snapshot rules
+
+1. UALs are parsed with `parseDeterministicKnowledgeAssetUal`, converted to the
+   canonical protocol spelling, rejected on duplicate canonical identity, and
+   sorted lexically.
+2. Received N-Quads are parsed row-by-row and projected to S/P/O before hashing;
+   physical graph placement is never part of semantic equality. Any duplicate
+   S/P/O row after projection is rejected instead of silently deduplicated.
+3. The placement-neutral dataset is canonicalized with RDFC-1.0, sorted
+   lexically, joined with LF, and terminated by one LF when non-empty.
+4. `ualsSha256` is SHA-256 over the sorted UAL list (`UAL + LF` per entry).
+5. Each `semanticNQuadsSha256` is SHA-256 over that KA's exact canonical
+   N-Quads UTF-8 bytes.
+6. The snapshot-level semantic digest is SHA-256 over the domain string
+   `rfc64-semantic-nquads-manifest/v1\n` followed by stable JSON containing the
+   sorted `(UAL, quadCount, per-KA digest)` manifest.
+7. Stable JSON recursively sorts object keys and rejects sparse/custom arrays,
+   accessors, symbols, hidden properties, custom prototypes, lossy values, and
+   non-finite numbers. An own `__proto__` key remains ordinary JSON data.
+
+Snapshots contain KA and quad counts plus exact digests, without embedding the
+potentially large N-Quads payload. Validation recomputes every redundant count
+and manifest digest before comparison. Duplicate UALs, malformed snapshots,
+missing KAs, unexpected KAs, count differences, and digest differences cannot
+produce a passing comparison.
+
+Created and validated snapshots are defensively copied and deeply frozen. Run
+evidence closes over its own frozen expected/observed copies, so later caller
+mutation cannot change a previously derived `passed` result. Public constructors
+capture caller-owned records and arrays exactly once through data descriptors;
+proxies, accessors, sparse/custom arrays, and custom containers are rejected
+before caller code can affect validation. String timestamps must carry `Z` or an
+explicit UTC offset, contain a real Gregorian calendar instant, and use at most
+millisecond fractional precision. Timestamp inputs are exactly primitive strings
+or genuine non-proxy `Date` objects. Dates are read through the intrinsic
+`Date.prototype.getTime` and normalized through a fresh `Date`; durations must be
+non-negative safe integers. Emitted timestamps use canonical UTC form.
+
+The run artifact adds the stable gate/observer label, selected source peer,
+canonical ISO timing and duration, attempt/retry/failure details, expected and
+observed snapshots, and the derived comparison. `passed` is derived from the
+comparison and terminal failure; a caller cannot manually force it to `true`.
+Artifact publication uses a same-directory exclusive temporary file, fsyncs
+its contents, atomically renames it, and verifies the published bytes. POSIX
+publication enforces mode 0600 and fsyncs the containing directory. Every
+directory created for a nested artifact path is made durable through a
+parent-directory fsync before it is used. The caller must provide a trusted,
+static parent-directory topology for the full call. Node has no portable
+directory-handle-relative `openat`/`renameat` surface, so path checks cannot
+prevent a cooperating process from changing a parent between validation and
+rename. Initial checks reject existing symlinks and post-operation checks provide
+best-effort detection, but an error raised after rename can leave publication
+side effects in the changed topology. On Windows, Node cannot fsync a directory
+through its ordinary filesystem API and POSIX mode bits do not prove ACL
+isolation, so the returned publication metadata explicitly reports
+`file-flush-rename-no-directory-flush` and `windows-inherited-acl` instead of
+claiming the stronger POSIX policies.
+
+## Harness use
+
+```ts
+import {
+  createRfc64DevnetEvidence,
+  createRfc64SemanticSnapshot,
+  writeStableJsonArtifact,
+} from '@origintrail-official/dkg-devnet-harness/rfc64-evidence';
+
+const expected = await createRfc64SemanticSnapshot(expectedAssets);
+const observed = await createRfc64SemanticSnapshot(observedAssets);
+const evidence = createRfc64DevnetEvidence({
+  gate: 'gate-1-semantic-recovery',
+  observer: 'receiver-node-2',
+  sourcePeerId,
+  startedAt,
+  completedAt: new Date(),
+  attemptCount,
+  retryFailures,
+  terminalFailure: null,
+  expected,
+  observed,
+});
+
+writeStableJsonArtifact(artifactPath, evidence);
+if (!evidence.passed) throw new Error('RFC-64 evidence gate failed');
+```
+
+Run the focused no-devnet verification with:
+
+```sh
+pnpm test:devnet:rfc64-evidence
+pnpm typecheck:devnet:rfc64-evidence
+```

devnet/_bootstrap/package.json

@@ -4,13 +4,17 @@
   "private": true,
   "type": "module",
   "exports": {
-    ".": "./harness.ts"
+    ".": "./harness.ts",
+    "./rfc64-evidence": "./rfc64-evidence.ts"
   },
   "scripts": {
-    "test:smoke": "vitest run --config vitest.config.ts"
+    "test:smoke": "vitest run --config vitest.config.ts",
+    "test:rfc64-evidence": "vitest run --config vitest.evidence.config.ts",
+    "typecheck:rfc64-evidence": "tsc --project tsconfig.evidence.json"
   },
   "dependencies": {
-    "ethers": "^6.16.0"
+    "ethers": "^6.16.0",
+    "rdf-canonize": "^5.0.0"
   },
   "devDependencies": {
     "vitest": "^4.0.18"

devnet/_bootstrap/rdf-canonize.d.ts

@@ -0,0 +1,33 @@
+declare module 'rdf-canonize' {
+  interface RdfTerm {
+    termType: 'NamedNode' | 'BlankNode' | 'Literal' | 'DefaultGraph';
+    value: string;
+    datatype?: RdfTerm;
+    language?: string;
+  }
+
+  interface RdfQuad {
+    subject: RdfTerm;
+    predicate: RdfTerm;
+    object: RdfTerm;
+    graph: RdfTerm;
+  }
+
+  interface CanonizeOptions {
+    algorithm: 'RDFC-1.0' | 'URDNA2015';
+    inputFormat?: 'application/n-quads';
+    format?: 'application/n-quads';
+    maxWorkFactor?: number;
+  }
+
+  interface RdfCanonize {
+    canonize(input: string, options: CanonizeOptions): Promise<string>;
+    NQuads: {
+      parse(nquads: string): RdfQuad[];
+      serialize(dataset: readonly RdfQuad[]): string;
+    };
+  }
+
+  const rdfCanonize: RdfCanonize;
+  export default rdfCanonize;
+}