fix(dig-node): enforce chain-anchor uniformly across local, peer-serve, gateway paths (#1764, #1765)

[MichaelTaylor3d]

Closes DIG-Network/dig_ecosystem#1764. Closes DIG-Network/dig_ecosystem#1765.

Unifies chain-anchor enforcement across all three content-serve paths so "chain-anchor verified" has ONE meaning. From the #1062 live demo: the same capsule was refused over local /s (502 … pinned root unverifiable) but served happily over peer-RPC dig.fetchRange (200 x-dig-source: peer), and a reachable gateway 404'd unanchored content that a peer would serve.

Root cause (single)

The read side (/s HTTP, dig.getContent, the reader whole-resource bind) all applied the #127 fail-closed anchor pin. The serve side — the dig.fetchRange peer-serve arm — applied no anchor gate: it validated request shape then served any range that Merkle-verified against the client-named root, delegating anchor authority entirely to the reader. That violated the SPEC invariant "the node MUST NOT serve content under a root it has not confirmed on-chain," which every other path honored — so a holder served unanchored/forged-generation bytes the local path refuses.

Fix (Policy A — unify on the existing strict fail-closed invariant)

• Gate the peer-serve arm (#1764):dig.fetchRange now resolves the same anchor pin before serving. The fix(service): anchor identity + cache under the state dir, not $HOME #127 pin resolution the dig.getContent read arm used is factored into a shared resolve_enforced_pin helper and applied to both arms — one policy governs read and serve, no drift. dig.getContent behaviour is byte-identical (pure refactor there).
• Uniform refusal of unanchored content (#1765): a store with no confirmed on-chain generation (Ok(None)) is refused with -32005 ROOT_NOT_ANCHORED uniformly on /s, dig.getContent, and dig.fetchRange. This removes the peer-serve-vs-gateway-fallback mutual-exclusivity — the serve side no longer disagrees with the read side, so the outcome is identical whether the gateway is reachable or not.
• Provenance ⊥ verification:x-dig-source (local|peer|rpc) reports which tier served the bytes; it is orthogonal to x-dig-verified, which reports only whether the bytes were bound to the chain-anchored root. A peer- or gateway-served resource is still x-dig-verified: true because the reader re-binds to the anchor. x-dig-verified: false appears only under the DIG_NODE_PIN=off dev opt-out, now emitted consistently across legs.

Anti-rollback preserved (no #127/#2088 regression):Ok(Some(tip)) with a request root ≠ tip (a superseded/forged root — the real rollback attack) still hard-rejects -32005; Ok(None) cannot be a rollback; Err (chain unreachable) stays fail-closed. The serve arm gaining the gate only tightens. The generic dig-download crate is unchanged — the anchor policy lives in dig-node.

Tests (TDD)

• dig.fetchRange fails closed for an unanchored store, for an unreachable chain, and for a superseded client root (rollback code).
• Unanchored content is refused identically across dig.getContent (read) and dig.fetchRange (serve).
• Uniform anchor refusal proven across the /s HTTP tier, peer, and gateway paths (content_serve.rs) — the #1765 face, gateway reachable vs unreachable now identical.
• Existing fix(service): anchor identity + cache under the state dir, not $HOME #127/#2088 superseded-root + forged-latest_root regressions kept green.

Blast radius

crates/dig-node-core/src/seams/dig_rpc/dispatch.rs (dig.fetchRange + dig.getContent arms, the shared resolve_enforced_pin), crates/dig-node-core/src/lib.rs (pin resolution + tests), crates/dig-node-service/tests/content_serve.rs. Downstream x-dig-verified/x-dig-source consumers (extension/browser shields) read but do not set these headers — no cross-repo code change; the SPEC/docs/SYSTEM.md coherence sweep is a companion.

Version

root [workspace.package].version 0.99.3 → 0.99.4 (patch, fix: — tightens a serve path to the already-documented invariant; no wire/API/schema break; unanchored content that previously got a spurious 200 over peer-serve now correctly returns -32005). Cargo.lock regenerated. SPEC.md §4/§5 + the -32005 row + DEVELOPMENT_LOG updated.

---

Generated by Claude Code