fix(dig-node): resolve reads to the generation that holds the file (#2088)

[MichaelTaylor3d]

Closes dig_ecosystem#2088 (P0). A store with more than one generation was unreadable for every file not changed in its latest commit — every store broke on its second commit for files that commit didn't touch.

Root cause

decrypt_local (content_serve.rs) rejected any local capsule whose roothash != pinned tip. A file unchanged since an earlier commit lives in an older capsule (roothash == latest_root ≠ tip) → dropped as a miss → tiers 2/3 serve at the tip, where the ciphertext isn't present → blind-serve decoy (proof folds to tip but leaf ≠ the resource leaf → verify_and_decrypt fails, or the AES-GCM-SIV tag fails). Reading at the older root was refused by the #127 anti-rollback pin (-32005). Both directions failed.

Fix

After the #127 pin resolves the chain-anchored tip (pin logic untouched), the serve reads the tip capsule'sPublicManifest (data-section §13, already parsed today for X-Dig-Generation) via resource_manifest_entry, gets the requested path's latest_root + sha256_latest + generation_index, and computes serve_root (the tip, or the older capsule that holds the path) + expected_leaf. These thread through all three tiers (local / peer / RPC).

The security crux — verify_and_decrypt:trusted_root is now serve_root (so the proof still folds to the capsule it belongs to), plus a new binding — proof.leaf == expected_leaf where expected_leaf = entry.sha256_latest comes only from the chain-anchored tip manifest, never the request, never the older capsule. That leaf-binding is what ties older-generation bytes to the chain-anchored tip even though the proof folds to latest_root.

Anti-rollback invariant (preserved)

The node serves only against the chain-anchored tip or an older latest_root taken from that tip's own manifest, with served bytes pinned to the tip manifest's sha256_latest; a client-supplied root is still rejected with -32005 unless it equals the tip.

• The client-root pin (-32005 ROOT_NOT_ANCHORED) is untouched — a regression test proves a client-supplied superseded root still fails.
• serve_root is never client-derivable; older-capsule redirection happens solely via the node's own trusted tip manifest.
• expected_leaf == None (legacy/private/absent-path manifest) ⇒ byte-identical to pre-fix behaviour (tip serve + constant-time decoy for genuine misses).
• X-Dig-Root continues to report the chain-anchored tip (never the older root); X-Dig-Generation discloses the actual generation index.

Residual (tracked, not blocking)

PublicManifest (§13) is not committed into current_root, and an older capsule's own root isn't chain-anchored. This fix adds no new trust boundary — it binds older-gen bytes to the tip via sha256_latest read from the tip capsule the chain already vouches for (the node already serves every current file + reads this same manifest today). Full closure = dig_ecosystem#2203 (digstore: commit the manifest into the on-chain root, release-first). Recorded in DEVELOPMENT_LOG.md.

How verified (TDD, regression-first)

• serve_content_plaintext_resolves_reads_to_the_generation_that_holds_the_file_2088 — a real two-generation store (gen0 {index.html:A, asset.js:B}, gen1 touches only index.html:A', tip=gen1): GET /asset.js → 200 + real plaintext B + X-Dig-Generation: 0; GET /index.html → A' + gen 1. Pre-fix-fails proof: reverting the fix makes this test fail (pinned to tip, local decoy dropped, falls through to unroutable upstream).
• serve_content_plaintext_still_refuses_a_client_supplied_superseded_root_2088 — client supplies gen0 root → -32005.
• Unit: verify_and_decrypt_serves_older_gen_root_when_leaf_matches + verify_and_decrypt_rejects_leaf_mismatch_against_tip_manifest (fail-closed on a tampered older capsule).
• cargo test -p dig-node-core --lib → 770 passed, 0 failed; cargo test -p dig-node-service --test content_serve → 13 passed (all prior single-gen regressions green). fmt + clippy -D warnings clean; both crates build.

Blast radius

verify_and_decrypt/decrypt_local/peer_serve_plaintext are private to content_serve.rs (all callers in-file). serve_content_plaintext (public) + the ContentServer trait keep identical signatures — no wire/trait change. resource_generation signature unchanged (delegates to resource_manifest_entry). SPEC.md §4.2 updated with the invariant + §4.2.1.

Version

root [workspace.package].version 0.99.0 → 0.99.1 (patch, fix:); Cargo.lock regenerated.

---

Generated by Claude Code

[MichaelTaylor3d]

🔴 Dual gate: reviewer PASS, security CHANGES-REQUIRED — fix in progress, do not merge yet.

• loop-reviewer (correctness): PASS (7/7 — resolution rule, verify-chain shape, tier threading, fix(service): anchor identity + cache under the state dir, not $HOME #127 pin untouched, headers, non-vacuous tests, hygiene).
• loop-security: CHANGES-REQUIRED (HIGH, live). The fix reads BOTH serve_root (entry.latest_root) and expected_leaf (entry.sha256_latest) from the PublicManifest (§13), which is NOT committed into current_root and is not checked by the capsule anchor gate. For a redirected read the verify chain becomes proof.root == serve_root (attacker-named) + proof.leaf == expected_leaf (attacker-named) — the chain root drops out of byte-authenticity. A malicious holder/upstream can serve a genuine tip capsule with a forged §13 and substitute arbitrary content on any multi-generation public store, stamped X-Dig-Verified: true. The sha256_latest binding is circular because its source is attacker-controlled. This re-opens the fix(service): anchor identity + cache under the state dir, not $HOME #127 invariant.

Fix being added to this branch: before honoring a redirect, chain-authenticate serve_root against the store's on-chain lineage / root_history (the lineage the #127 pin already walks via anchored_state). Only redirect to a latest_root that is a genuine historical root of this store; otherwise fail closed (tip serve / miss). That restores the chain-root-in-the-authenticity-path property; expected_leaf becomes defense-in-depth. Regression test: a forged-§13 tip capsule pointing latest_root at a non-lineage root must be refused. (#2203 — binding §13 into current_root — remains the full closure; this cross-check makes the redirect safe without it.)

Re-running loop-security on the updated head before merge.

---

Generated by Claude Code