mirror funding: per-PASS authentication budget, the discarded skip count, and the rival FundingObservation

[MichaelTaylor3d]

Task

Three defense-in-depth follow-ups split out of the dig-node#469 gate round, so #469 could close on its
three gating money-honesty findings. None is user-visible today; all three are real.

Parent orchestrator epic: https://github.com/DIG-Network/dig_ecosystem/issues/3124

1. MAX_AUTHENTICATION_ATTEMPTS bounds a SELECTION, not a pass

crates/dig-node-service/src/mirror/funding.rs — the constant bounds one call to
select_operator_dig_cats, and NodeMirrorEffects::create is called once per bond
(lifecycle.rs:426-460), so a pass planning K creates costs up to K x 128 chain reads under
tokio::task::block_in_place.

The create loop breaks on the first FAILURE (runner.rs), which bounds a pass that cannot fund
itself to one selection — but not the case that matters: a stranger who plants
MAX_AUTHENTICATION_ATTEMPTS - 1 coins ranked above the honest ones leaves every create still
SUCCEEDING, so nothing breaks, while each pays the full wasted walk, on the ten-minute timer,
indefinitely, off a one-time dust spend.

#469 corrected the doc comment to state the real bound rather than change the shape. The fix is a
per-PASS budget shared across the create loop. Note the interaction that makes it more than a
counter: exhausting a shared budget part-way turns later bonds into
FundingError::CandidatesUnverifiable, which since #469 SPEAKS to the operator — so the design
question is what the operator is told when the pass ran out of budget rather than out of money.

Bounded factor (K is the node's own bond count, not an attacker's choice), which is why it is
follow-up and not gating.

2. skipped is discarded at the only production call site

funding.rs documents that "a skip is counted and reported, never swallowed". In production it is
swallowed: lifecycle.rs:454 calls select_operator_dig_cats, whose body is
.map(|selection| selection.cats), so the skipped vector reaches tests only.

The production record is the per-candidate tracing::warn! inside authenticate — up to 128 lines
per selection per create per pass, roughly 18k lines/day/create, and the volume is attacker-driven.
Either surface the count (it is now exactly the figure UnmeasuredFunding::AuthenticationTruncated
carries) or make the comment true, and rate-limit the per-candidate line.

3. Two rival FundingObservation types

crate::wallet_funded::FundingObservation (pre-existing, consumed at server.rs:2796) and
crate::mirror::funding::FundingObservation (added by #463/#469). Same name, same problem domain,
different semantics — CLAUDE.md §2.0 centralize-rivals. Name the survivor; they are not obviously
the same concept, so renaming one may be the whole fix.

Evidence

All three found by the loop-security gate on #469 and
recorded in its verdict comment. Items 2 and 3 were explicitly rated LOW / do-not-gate there.

Scope

Item 1 is a design change and should be sized first; 2 and 3 are small. They are filed together
because they all live in mirror/funding.rs and its call sites, so one lane opening that file
should take all three.

[MichaelTaylor3d]

Verification sweep verdict: NOT SATISFIED — leaving open. All THREE items not done (2026-09-01)

Verified against code on origin/main (aa9ec72). Symbols re-located by name.

Item 1 — per-PASS authentication budget: NOT DONE

• crates/dig-node-service/src/mirror/funding.rs:269 —
  pub const MAX_AUTHENTICATION_ATTEMPTS: usize = 128; still bounds one call, enforced at
  funding.rs:463 against an attempts counter initialised per call at funding.rs:456.
• The code explicitly defers to this ticket: funding.rs:248-250 — "a per-PASS budget shared
  across the create loop is filed as dig-node#481 rather than taken inside this change".
• crates/dig-node-service/src/mirror/lifecycle.rs:454 calls
  funding::select_operator_dig_cats(...) with no budget argument. NodeMirrorEffects carries
  committed_coin_ids and resolved as RefCell accumulators (~lifecycle.rs:147-169) but no
  attempts/budget field. Grep for budget|remaining_attempts|per_pass|pass_budget across mirror/
  returns only doc prose and Cell<usize> test counters.

The test that looks like the guard is not — and its own message overstates what it measures.
funding.rs:1542 authentication_is_bounded_by_a_constant_however_many_coins_a_stranger_sends asserts
a per-selection bound only: each fixture makes exactly one select_operator_dig_cats call, with
no create loop and no K bonds. Its assertion string reads "one pass must never read more than the
budget" — stronger than what it measures, and read casually it will be taken as this ticket's
bar already met.

Half of the second-order ask is pre-built by #469 and can be reused: FundingError::CandidatesUnverifiable
(funding.rs:110) → FundingObservation::Unmeasured(AuthenticationTruncated) (funding.rs:709),
with operator copy at funding.rs:863. The machinery to tell the operator exists; the shared-budget
path that would use it does not.

Item 2 — skipped discarded at the only production call site: NOT DONE

• funding.rs:347 select_operator_dig_cats's body is still funding.rs:353 —
  .map(|selection| selection.cats).
• The only production caller is lifecycle.rs:454, which calls that discarding wrapper.
  select_operator_dig_cats_detailed (funding.rs:417) is called only from tests:
  crates/dig-node-service/tests/mirror_operator_funding.rs:423 and :456 (imported at :31).
  Complete list — the grep returned 7 hits, 4 of which are doc/definition lines.
• The comment this ticket calls untrue is still present verbatim: funding.rs:382 — "A skip is
  counted and reported, never swallowed."
• Narrower than the body records, and worth noting: the count is only reachable on the ERROR path
  (CandidatesUnverifiable { skipped }, funding.rs:496). On a successful selection with skips,
  the count is dropped entirely — so "surface the count" has two cases, not one.
• Warn rate-limiting: not done. The per-candidate tracing::warn! is at funding.rs:474,
  unconditional. (Small correction to the body: it sits in select_operator_dig_cats_detailed's loop,
  not inside authenticate at funding.rs:947 — the location is off, the defect is not.) Grep
  for warn_once|rate_limit|RateLimit|log_every|throttle across mirror/ returns zero hits; no
  rate-limiting primitive exists in the module to reuse.

Tests do assert the count, but only through _detailed — i.e. below the production seam, so they
pass with the call site unchanged: tests/mirror_operator_funding.rs:415 an_unauthenticatable_candidate_is_skipped_and_the_honest_coin_still_funds_the_create asserts
selection.skipped.len() == 1; :445 many_unauthenticatable_candidates_do_not_consume_the_selections_input_budget asserts == 10.

Item 3 — two rival FundingObservation types: NOT DONE

Both still exist and both are live:

• crates/dig-node-service/src/mirror/funding.rs:633 — pub enum FundingObservation
  (Healthy / Short / Unknown / Unmeasured), consumed at mirror/runner.rs:445,452,480,494,498.
• crates/dig-node-service/src/wallet_funded.rs:21 — pub enum FundingObservation
  (Funded / ObservedEmpty / CannotSay), consumed at server.rs:2827,2834,2838.

No rename, no re-export, no survivor named. The variant sets confirm the body's read that these are
not obviously the same concept — one grades operator funding health, the other answers whether a
wallet was observed funded — so renaming one is plausibly the whole fix, as the body suggests.

Sizing note

Item 1 remains the design change and should be sized first; 2 and 3 are small. All three still live in
mirror/funding.rs and its call sites, so one lane opening that file should still take all three.