feat(dig-node): peer provider-snapshot mTLS RPC + concrete NeighbourhoodProbe

[MichaelTaylor3d]

Part of DIG-Network/dig_ecosystem#1989 — child 4/7 of epic #1934, PR 4a of 2 (4b = the governed prefetch loop, a separate later PR). SECURITY-CRITICAL: the anti-Sybil identity-binding layer.

What changed

Provides the concrete NeighbourhoodProbe (child 2 left it a mocked trait seam) + the node↔node RPC it needs to obtain other peers' provider snapshots.

• Server dig.getProviderSnapshot peer RPC — answers with the node's LOCAL DhtService::provider_snapshot(max_keys), reusing the RLY-009 DhtRecordsAnswer wire shape verbatim (counts-only, no provider identities). max_keys clamped to MAX_PROVIDER_SNAPSHOT_KEYS = 512 (bounded by the 64 KiB read_framed frame ceiling). Answered at the NodeResponder level (it needs self.dht, which the FFI-safe handle_rpc lacks), async-awaited (no block_in_place — that's only needed for RLY-009's sync callback and would panic under the current-thread test runtime).
• Client + concrete DhtNeighbourhoodProbe::observe_near(point) — find_node(point) → for each Contact, mTLS-dial + call the RPC → one PeerObservation per responding peer.
• Allowlist:dig-rpc-protocol is a crates.io 0.6 pin (can't extend), so this is a dig-node-local method — an explicit, documented exception in is_peer_reachable_method with a regression test asserting it's the ONE deliberate local addition (the shared peer_reachable_names() set is unchanged).

Security properties (the point)

• Anti-Sybil identity (load-bearing):PeerObservation.peer_id is set ONLY from the verified session SPKI (PeerConnection.peer_id = SHA-256(SPKI DER), checked by dig-tls) — NEVER Contact.peer_id, NEVER any payload field (the answer is deliberately identity-free). Proven by a unit test (Contact claims 0xAA…, session verifies 0xBB… → observation attributed to 0xBB…) + a real-wire two-node test asserting peer_id == the responding server's SPKI. This is what makes child 2's quorum "one peer = one vote" hold.
• Caps before reconcile():MAX_HOLDINGS_PER_PEER = 512, MAX_OBS_PER_ROUND = 4096 — truncated so a lying peer can't OOM the reconciler.
• Silent/unreachable/mis-identified peer → nothing, never an error (matches the trait contract).

How verified

• cargo fmt --all -- --check → 0; cargo clippy -p dig-node-core --all-targets --all-features -- -D warnings → 0; cargo build -p dig-node-core → 0.
• New neighbourhood_probe module: 11/11 pass (server clamp + empty-DHT, parse good/malformed, identity binding, silent peer, per-peer cap at/over bound, round cap, malformed-key drop, the two-node real-wire test); peer allowlist tests 4/4. The 7 broader peer::tests failures are the known sandbox socket-bind limit (pass on real runners), none touch this code. Coverage deferred to CI's ≥80% gate (local llvm-cov >2min timeout).

Version

dig-node-core 0.31.0 → 0.32.0; root [workspace.package].version 0.80.0 → 0.81.0; Cargo.lock updated. SPEC.md (+ dig-node-core SPEC) document the method + bounds + the verified-identity contract.

Follow-ups (orchestrator-owned / cross-repo)

• SYSTEM.md gets dig.getProviderSnapshot as a node↔node peer RPC reusing RLY-009's DhtRecordsAnswer shape (I'll add it).
• A release-first ticket to promote the method into the shared dig-rpc-protocol allowlist so the local exception can be removed.

---

Generated by Claude Code