Nothing verifies a mirror-coin claim against chain — the collateral economy is unenforced

[MichaelTaylor3d]

Task

Nothing anywhere verifies a mirror-coin claim against chain. Build the consumer.

Measured 2026-08-31 across all of modules/: MirrorCoin::advertises has eight call sites, and every one is inside dig-mirror-coin itself — two crate-internal (census.rs:723, query.rs:373) and six in its own tests. Zero consumers. No node, no peer, no DHT reader, no download path calls it.

So the economic guarantee of the whole mirror-coin system is unenforced end to end. Coins are created, listed, and reclaimed correctly; a peer's claim that it holds content backed by collateral is never checked by anybody.

Why this is the load-bearing gap, not one of several

Everything else in the family works or is close. The flywheel's premise is that a holder's advertisement is backed — that is what makes the collateral mean anything and what a bad actor would attack. Without a verifier, unverified_mirror_coin_id is a field that travels the wire and is read by nothing, and a peer can claim any bond it likes at zero cost.

The name of the wire field says this outright: unverified_. It is an attacker-supplied shortcut, correctly named, and the verification it is a shortcut to does not exist.

The contract already exists — implement against it, do not invent one

SYSTEM.md's mirror-coin row is normative and states the whole algorithm. Consult it first; the summary:

1. Fetch the coin and verify it sits at dig_mirror_coin::mirror_coin_puzzle_hash().
2. Verify it is $DIG, with the asset id re-derived from the creating spend.
3. Verify it carries the full collateral.
4. Call MirrorCoin::advertises(store_launcher_id, root_hash, epoch) — exact equality on the coin's memo-declared triple, plus the hint recomputed with the owner taken from the coin's own lineage proof, never from a memo.

Steps 1-3 alone prove only that a valid mirror coin exists somewhere. Step 4 is what binds it to the claim.

Verification MUST NOT be an arithmetic recompute of the morph alone. mirror_hint sums four terms, one an unbounded freely-chosen epoch, so a coin's author can solve for a value placing their advertisement on any other's hint — the crate asserts this itself in namespace.rs (a_freely_chosen_epoch_solves_onto_any_other_advertisements_hint).

The three failure directions that must be right

• Absence of unverified_mirror_coin_id is NORMAL and must never read as "uncollateralised". A publisher that has not created its coin, an older publisher, and one mid-epoch-rollover all legitimately omit it. Fall back to the hint scan (discover/list) — slower, not weaker.
• A wrong pointer costs the publisher, not the verifier. One chain read, no retry loop; a miss falls straight back to the scan. It MUST NOT blocklist or penalise the publisher — a stale pointer is indistinguishable from an epoch rollover.
• A chain that cannot answer is not a failed verification. Keep "unverified" and "verified absent" distinct, the same three-state discipline absence_established uses on the wire. Collapsing them is how a partitioned node starts rejecting honest peers.

Settle the shape first (§1.10)

Who verifies, and when? Candidates, each with a different cost profile: the download path before accepting a holder; the DHT reader on ingesting a provider record; a background sweep over known holders. Verifying on every provider record is a chain read per record and will not scale; verifying never is where we are now.

And what does a failed verification DO? Deprioritise the holder, refuse it, or merely record it? A verifier whose result nothing acts on reproduces today's situation with more code. State the answer before building.

Scope

The deliverable is a verifier that is actually called on a production path, plus what acts on its result. A crate-internal helper with no consumer is exactly the state this ticket exists to end — the acceptance is a call site, not a function.

Out of scope: changing dig-mirror-coin's verification primitive, which is sound and exercised by its own tests.

Evidence

Sweep of all modules/ on 2026-08-31, both origin/main and origin/loop/batch-mirror. Also note dig-node's only use of the crate's verifying surface is collateral_census.rs:42, which prices this node's own requirement network-wide — not a check of any peer's claim.

Acceptance

A peer advertising a bond it does not hold is detected on a production path, proven by a test with a coin that does not advertise the claimed triple — plus the three controls: a valid bond verifies, an absent pointer falls back to the scan rather than failing, and an unreachable chain yields "unverified" rather than "absent".

Parent

Epic https://github.com/DIG-Network/dig_ecosystem/issues/3166 · lifecycle #412 · pointer supply #435

[MichaelTaylor3d]

Lane claimed by the loop.

• branch loop/mc-verify, worktree C:/tmp/worktrees/dn-verify, base origin/main = 95c9582
• draft PR feat(mirror): verify a peer's mirror-coin bond against chain on the download path #467
• head 4ebb0bb (stub + version 0.200.0 / dig-node-core 0.66.0)

Next action: settle the shape (who verifies, when, and what a failed verification does), post the
decision here, then build to it TDD-first.

[MichaelTaylor3d]

Shape decision (§1.10) — settled before building

Blast radius

gitnexus could not answer: its dig-node index is 301 commits behind HEAD, and impact on a stale
index returns a well-formed false-safe impactedCount: 0 rather than an error. Fell back to grep +
direct read across the whole workspace, per §2.0.

Symbols touched, measured:

symbol	callers
NodeContent::new	wraps one more locator layer internally; signature unchanged
NodeContent::for_dht	2 (peer.rs:2732 production, 1 test)
NodeContent::provider_locator_chain	unchanged — 1 production + 3 test call sites left alone
serve_with_shutdown (server.rs)	one added installer call, outside spawn_mirror_passes

Everything else is additive: a new dig-node-core::mirror_bond module and a new
dig-node-service::mirror::bond_verify module. No existing behaviour is removed. Risk: LOW.

Fork 1 — who verifies, and when

Chosen: the download/redirect path, as an outermost ProviderLocator layer, on each locate.

NodeContent's locator chain is the one place every production consumer of a provider record passes
through — the multi-source download, the redirect-on-miss hint, and the capsule warm all draw from it.
Adding a fourth layer above CapsuleFallbackLocator puts the verdict exactly where the holder set is
chosen, and provider_locator_chain is already documented as the seam a test must drive to witness
the real stack.

Cost: at most one coin_record_by_id + one puzzle_and_solution read per distinct claimed coin id,
memoised behind a bounded TTL cache, and only on a cache-miss locate for content this node is
actually fetching. A record carrying no pointer costs zero chain reads.

Rejected:

• Verify on DHT provider-record ingest. A chain read per record, on a path whose input volume is
  chosen by strangers — the ticket names this and it is right. It also pays for records nobody ever
  downloads from.
• A background sweep over known holders. The verdict arrives after the decision it was meant to
  inform, and it re-reads coins for content that is never requested.

Fork 2 — what a failed verification DOES

Chosen: it REORDERS the holder set. Bonded first, Unverified next, Unbonded last. Nothing is ever
dropped, refused, or blocklisted.

Three states, kept apart the way absence_established keeps a failed walk apart from an empty one:

verdict	meaning	effect
Bonded	chain answered; the coin binds this exact (store, root, epoch)	ranked first
Unverified	no pointer, chain unreachable, or the collateral requirement is not censused	ranked as today
Unbonded	chain answered and the claim is false	ranked last, still offered

Rejected:

• Refuse an Unbonded holder. A partitioned node, an epoch rollover, and a stale republished
  pointer are all indistinguishable from a lie at the moment of reading, so refusal turns a chain
  outage into a node that rejects honest peers. Absence of a pointer is the majority case today.
• Record the verdict and act on nothing. The ticket names this too: it reproduces the current
  situation with more code.

Ranking is the smallest action that is genuinely an action — a lying publisher is served last on
every read, at no cost to an honest one that cannot prove itself.

One thing the ticket asks for that is not reachable, stated rather than faked

The ticket says an absent pointer should fall back to the hint scan (discover/list).
dig_mirror_coin::discover takes owner_puzzle_hash as a parameter, because the hint is morphed from
it, and a ProviderRecord carries no owner puzzle hash — only a peer_id, addresses, and the
optional coin id. There is no peer_id → owner mapping in this repo. So from a provider record alone
the scan cannot be initiated at all.

The behaviour delivered is therefore the effect the fallback exists to guarantee: an absent pointer
yields Unverified and the record keeps exactly its present position, so discovery is not degraded.
The trait signature can express a scan (it takes Option<coin_id>, not a required one), so an
implementation that learns an owner later needs no seam change. Filing the owner-supply gap
separately rather than pretending the scan happened.

Algorithm, as SYSTEM.md states it — not invented

1. coin_record_by_id(claimed); its puzzle_hash must equal mirror_coin_puzzle_hash().
   2/3. MirrorCoin::from_creating_spend(parent_spend, coin_id) — asset id, amount and owner all
   re-derived from executed on-chain code. Ok(None) is Unbonded.
2. MirrorCoin::advertises(store, root, &epoch) — exact equality on the declared triple and the
   hint recomputed with the owner from the coin's own lineage proof. Never a morph recompute alone.

Order matters: the tuple binding is checked before collateral sufficiency, so a node with no
census still detects the lie. Only once the tuple binds does an unknown requirement downgrade the
verdict to Unverified rather than Bonded.

[MichaelTaylor3d]

Progress — head fe04b91 on loop/mc-verify, draft PR #467.

DONE: the decision layer and its production call site, cargo check -p dig-node-core --lib green.

• crates/dig-node-core/src/mirror_bond.rs — BondVerdict (Bonded / Unverified / Unbonded),
  the MirrorBondVerifier seam, and BondRankingLocator, with 6 tests.
• NodeContent::new wraps the locator in BondRankingLocator outside every other layer, so the
  raw discovery leg (redirect-on-miss) and the download union both inherit one ranking.
  NodeContent::set_bond_verifier installs the chain-backed implementation once.

IN PROGRESS: crates/dig-node-service/src/mirror/bond_verify.rs — the chain-reading half
(coin_record → puzzle hash → MirrorCoin::from_creating_spend → advertises → collateral), plus
its installer call in server.rs beside spawn_peer_network, and the acceptance test over
tests/support's real CAT-spend mirror coins.

BLOCKED — ENOSPC. C: reached 0 bytes free mid-build. Deleted this lane's own target/
(§1.6) which recovered only 3.4 GB, and the workspace's dependency set alone is larger than that:
a cargo test -p dig-node-service pulls chia-sdk-test + the whole chia 0.36 set and will not fit.

Resume condition: free space on C: above ~25 GB, then
cargo test -p dig-node-core --lib mirror_bond followed by the service half. Reporting rather than
raiding a sibling lane's target/ — four lanes are live in this repo and one of them is mid-compile.

[MichaelTaylor3d]

Complete and green — head 3b978d9, draft PR #467

Test evidence (counts read, not exit statuses)

run	result
cargo test -p dig-node-core --lib	1037 passed, 0 failed, incl. download::tests::the_engine_ranks_a_disproven_bond_last_on_its_own_discovery_path
cargo test -p dig-node-service --test mirror_bond_verify	9 passed, 0 failed
cargo fmt --all	clean

Revert-proofs — committed first, then the fix reverted alone

1. Collateral magnitude moved BEFORE the tuple binding (the refinement SPEC §25.6a now states):

test result: FAILED. 8 passed; 1 failed
---- an_uncensused_node_still_catches_the_lie_but_will_not_certify_the_truth
assertion failed: the binding check runs first, so the lie is caught with no census at all
  left: Unverified   right: Unbonded

Exactly one test caught it, which is the one written for it. Every other test is blind to the step
order, because on a censused node both orders give the same answer — that is precisely why the
uncensused fixture exists.

2. MirrorCoin::advertises removed entirely, leaving steps 1-3 intact:

test result: FAILED. 6 passed; 3 failed
---- a_coin_that_bonds_another_root_does_not_bond_this_one
---- a_declaration_that_disagrees_with_its_own_hint_is_unbonded
---- an_uncensused_node_still_catches_the_lie_but_will_not_certify_the_truth

The six survivors are the ones a coin fails before step 4 ever runs — no such coin, spent, not $DIG.
So the three that fell are precisely the ones that can only be caught by the binding check, and the
sharp fixture (a real, fully collateralised, honestly published coin bonding a different generation)
is among them.

Working tree restored byte-identical after both proofs.

Acceptance, restated against the ticket

• Detected on a production path — NodeContent::new installs BondRankingLocator outside every
  other locator layer, so the multi-source download, the redirect-on-miss hint and the capsule warm
  all inherit one ranking. the_engine_ranks_… drives the real constructor rather than a
  test-assembled chain, so a wiring that dropped the layer fails even with every unit test green.
• A coin that does not advertise the claimed triple — a_coin_that_bonds_another_root_does_not_bond_this_one.
• A valid bond verifies — a_valid_bond_verifies, plus the control inside the test above.
• An absent pointer does not fail — an_absent_pointer_costs_no_chain_read_and_does_not_move_the_holder
  asserts the chain-read COUNT, because order alone cannot distinguish absence from a genuine miss.
• An unreachable chain yields unverified, not absent — asserted twice, each time paired with a
  reachable control on the same coin so exactly one thing varies.

Still DRAFT

The gate round has not returned. Not marking ready until it has.