refactor(drive)!: route ranked and having-range proofs through grovedb's unified PathQuery surface

[QuantumExplorer]

What

Switches the four remaining direct indexed-axis call sites onto grovedb's unified PathQuery surface — prove_query / verify_path_query over PathQuery::new_axis_top_k / new_axis_bounded:

call site	before	after
execute_top_k_with_proof	prove_indexed_axis_top_k_paginated	prove_query(new_axis_top_k)
verify_ranked_top_k_proof/v0	verify_indexed_axis_top_k_paginated	verify_path_query → VerifiedPathQuery::AxisEntries
execute_range_with_proof	prove_indexed_{count,sum,avg}_query	prove_query(new_axis_bounded)
verify_having_range_proof/v0	verify_indexed_{count,sum,avg}_query	verify_path_query → VerifiedPathQuery::AxisEntries

Why

grovedb is retiring the standalone indexed-axis provers/verifiers from its public API (dashpay/grovedb#839) so their standalone envelope wire format never becomes consensus-frozen — only the GroveDBProof V1 axis-descent format ships with GROVE_V4. This PR is the platform half of that retirement; grovedb pinned the byte-level relationship between the two envelope families first (dashpay/grovedb#837: the semantic core — secondary proof bytes, target chains, root bindings — is byte-identical; only the outer envelope differs), so this is a proven envelope swap, not a behavioral leap.

The change compiles against the current grovedb pin (the unified surface already exists there), so this PR does not require a grovedb bump — but the next grovedb bump past dashpay/grovedb#839 requires this PR.

Wire format changes (unreleased surface)

The proof bytes for ranked/having responses change from the standalone envelopes to GroveDBProof::V1. Both surfaces exist only on this feature branch (#3740, unreleased), and prover + verifier switch together in this commit.

Behavioral deltas, pinned by updated tests

• AxisRangeBounds::merk_query is retired. The prover/verifier agreement artifact is now grovedb's own bounded-axis lowering, shared by both proof sides inside grovedb; platform feeds it AxisRangeBounds::i128_bounds (lossless widening). The two repos can no longer drift on the bounds→keyspace translation.
• Having-range over a completely empty secondary now proves instead of erroring (the unified prover carries the same empty-secondary convention the ranked paginated prover already had). an_empty_match_set_reads_empty_and_proves_empty flipped to the round-trip its own comment promised; drive-abci's empty_ranking_proof_rejection stays as the backstop it was already documented to be.
• Query-as-input instead of echo checks. The unified verifier holds "a proof can never make the client believe a wrong answer to the client's own query", not "a proof only verifies under the exact request it was built for". Answer-changing tampers (bounds, direction) still fail closed; the limit-tamper arm of a_proof_does_not_verify_under_different_bounds now pins that the same bytes verify under an answer-equivalent limit — to that query's own correct answer, capped by the verifier's ≤-limit shape check.
• prove_query proves committed state (no transaction parameter). The executors keep their TransactionArg for signature stability; the query dispatch passes None on this surface anyway.

Trusted-read call sites (indexed_*_top_k_paginated_keys, indexed_*_range_keys) are untouched — grovedb's trusted-read surface remains public.

Trusted reads (second commit)

The no-proof executors and the platform tests calling grovedb trusted reads directly now also route through the unified surface — grovedb is retiring those wrappers to crate-internal engine status (second commit on dashpay/grovedb#839):

• execute_top_k_no_proof: indexed_*_top_k_paginated_keys → run_path_query(PathQuery::new_axis(AxisQuery::top_k(..).keys_only())), destructuring PathQueryRun::AxisKeys { keys, skipped }.
• execute_range_no_proof: indexed_*_range_keys → the bounded equivalent.
• The keys-only projection preserves the old read cost: ranking pairs come straight off the pinned secondary view, no primary values resolved.
• One request shape now serves reads, proving, and verification.

This needs the attested-skip field on PathQueryRun (grovedb #836), so the grovedb pin moves 753a11f1 → 6b34ea81 (current grovedb develop, merged commits only), and rs-drive gains a direct grovedb-query dep at the same rev for the AxisQuery builder. Bump fallout: grovedb #833 made transaction commit/rollback/savepoint return grovedb_storage::Error directly, so drive-abci's three RocksDBError(e) re-wraps become StorageError(e).

Tests

• drive ranked: 72 passed (incl. prove+verify round trips, empty-index proving, tamper rejection)
• drive having: 38 passed
• drive-abci document_query: 108 passed
• dash-platform-queries: 37 passed
• drive builds clean under server,verify and verify-only feature cuts

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 251cbc3d-4cd6-4ed5-a50e-f177ba2a1fa4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

ℹ️ Review skipped (commit a2faef1)
Last checked: 2026-08-26 17:00 UTC