feat(dig-node): serve getProof/getMetadata/getPublicManifest/getCapsule locally

[MichaelTaylor3d]

Task

Serve the read methods dig-node classified as "passthrough aliases" — relayed to an upstream, and
therefore -32601 on any node that has none. rpc.dig.net is meant to be an ordinary node (#1997),
so it has none, and every client calling these got method-not-found from a node that held the bytes.

Second half of DIG-Network/dig_ecosystem#2071. #177 is merged (95141b7) and this is now rebased
directly onto main — no longer stacked.

Scope note, since this was briefly mis-sequenced: #177 is what restores *.on.dig.net. This PR
does not, and never could — the deployed resolver's only RPC call is dig.getContent
(grep -o 'rpcCall("[^"]*"' sw.js dig-embed.js returns exactly that one). This PR matters because
rpc.dig.net is an ordinary node and OTHER clients — the hub, the extension, the CLI — do call these.

Methods now served locally

method	result
dig.getProof	{ inclusion_proof, root, chunk_lens, program_hash, execution_proof: null, execution_proof_status: "unavailable" }
dig.getMetadata	{ manifest | null, program_hash, root } — publisher metadata, data-section id 6
dig.getPublicManifest	{ manifest | null, root } — the enveloped form of dig.getManifest
dig.getCapsule / dig.getModule	one window of the whole .dig module, in the getContent envelope

dig.getProof is served genuinely, not stubbed

The constraint on #2071 is explicit: a proof that does not verify is worse than -32601,
because the client would then decrypt unverified bytes with no error raised anywhere.

So dig.getProof does not derive a proof of its own. It runs the ordinary dig.getContent read
— same mandatory anchored-root pin (§14.4), same local-first → peer → upstream ladder — and discards
the ciphertext. That makes the proof it returns provably the proof a content read of the same
resource would have verified against; a second derivation could pin a different generation and no
client could tell. The proof itself is computed by the module's own guest wasm inside serve_blind.

When no proof can be produced, the underlying read's error is returned verbatim — never a
proof-shaped result with an empty inclusion_proof.

The test decodes the returned proof and checks it, rather than asserting it is non-empty:

assert!(proof.verify(), "the merkle path resolves to its declared root");
assert_eq!(proof.root.to_hex(), root.to_hex(),
    "the proof is rooted at the CHAIN-anchored root, not some other generation");

The old guard was rewritten, not deleted

get_proof_is_not_served_as_a_verified_proof_by_the_node asserted dig.getProof must be -32601.
"Never fabricate a proof" was always the invariant; "never implement the method" was only the
cheapest way to hold it, and it cost every client the ability to re-verify bytes it already held.
The guard now asserts the invariant directly: an unobtainable proof is an error, never a blank
that looks like a proof. No execution attestation is fabricated — execution_proof: null with
execution_proof_status: "unavailable" (#126/#134, SECURITY.md residual #3).

Security property found while reviewing this, now recorded in the code

dig.getPublicManifest is dispatched by NAME (it is not yet a dig_rpc_protocol::Method variant).
That absence from the catalogue is what keeps it off the permissionless peer surface —
is_peer_reachable_method ends in Method::from_name(m).is_some_and(|m| m.is_peer_reachable()), so
an unknown name is filtered before the peer surface reaches this dispatch. It therefore serves the
loopback / in-process / gateway surface only.

Promoting the method into dig-rpc-protocol later MUST make a deliberate is_peer_reachable()
decision rather than inherit one, or a gateway-only public read silently widens to the whole peer
network. That reasoning is in dispatch.rs, not just here.

Anti-rollback applies to capsule-scoped reads too

root may be omitted or "latest", which every client uses to mean "whatever the chain says" — the
node resolves the tip itself rather than making the caller walk the singleton. An explicitly
requested root MUST equal the anchored tip or the read fails closed with -32005, with the same
#747/#841 bounded-verify tolerance the content read has. Tested across all three capsule-scoped
methods.

Still NOT served, deliberately

• dig.listCapsules — needs a chain generation walk this node does not perform.
• dig.getProofStatus — polls an execution-proof JOB this node does not run; inventing a status
  would be the fabrication above.

Both stay -32601 and the passthrough guard now pins exactly those two, with the reasoning recorded
in the test.

Bump

0.93.9 → 0.94.0 (minor — new served capability on the public read tier); dig-node-core
0.41.1 → 0.42.0.

Refs DIG-Network/dig_ecosystem#2071

[MichaelTaylor3d]

VERDICT: CHANGES-REQUIRED (recorded as a comment review — this token shares the PR author identity, so REQUEST_CHANGES is a self-review 422; the blocking findings are the open inline threads below.)

CHANGES-REQUIRED — reviewed at 1212c92e5cecda9d0dbe6ad2405a7e9908db4b09

Independent correctness gate. Own worktree (C:\tmp\worktrees\dn179g, private CARGO_TARGET_DIR); the shared primary checkout was not touched. Full suite green at head: 676 passed / 0 failed (cargo test -p dig-node-core --lib, 253s). All 15 required checks green.

The implementation is good and the PR body is honest — it explicitly disclaims the *.on.dig.net justification, which I independently agree with. Three things block.

Blocking

1. lib.rs:2299 — the anti-fabrication guard has no test. Mutating if proof.is_empty() to if false leaves the entire 676-test suite green. The named guard get_proof_errors_rather_than_fabricating_a_proof_it_cannot_produce never reaches it (guard-not-exercised).
2. SPEC.md:887-888 — untouched, and now normatively wrong. Still classifies dig.getCapsule and dig.getProof as passthrough; dig.getMetadata / dig.getPublicManifest are absent from the catalogue entirely. SPEC.md is the contract an independent reimplementation is built from (§4.2), so it is a contract split, not a doc nit.
3. lib.rs:2467 / meta.rs:88 — doc asserts a shape the code does not produce. Both say a capsule window carries no inclusion_proof; it always carries "", and the PR's own test asserts exactly that.

Non-blocking (posted inline, resolved by me)

4. peer.rs:1156 — the load-bearing peer-reachability reasoning has no assertion.
5. lib.rs:9357 — the anti-rollback test does not discriminate the arm it names.

Confirmed sound — do not re-litigate

• dig.getProof is client-verifiable. Probe against a 3-file fixture: proof.leaf == SHA-256(reassembled ciphertext) (eadd3580a2cb…), path.len() == 2 (non-trivial path), proof.verify() true, proof.root == the chain-anchored root. A DigstoreProofVerifier client can verify what this returns against a chain-anchored root.
• Both three-window fixtures survived the rebases (lib.rs:8603, lib.rs:8701, both 2 * WINDOW + 500, middle window asserted). Mutating content_window_envelope's clamp to if start == 0 { (start + WINDOW).min(total) } else { total } fails a_client_can_reassemble_a_multi_window_resource_from_the_envelope_alone.
• The two-window fixture at lib.rs:8569 is fine — keep it. Ruling on the judgement call you surfaced: your reasoning holds. The middle-window placement property is discriminated by the reassembly test above (windows_seen == 3), proven by that same mutation, so uniformity buys nothing here.
• dispatch.rs:88-89 reasoning verified in the tree, not taken on trust: peer.rs:1156 does terminate in Method::from_name(m).is_some_and(|m| m.is_peer_reachable()), and dig-rpc-protocol 0.6.0 method.rs:218-233 excludes GetProof/GetMetadata/GetCapsule/GetModule. No peer-surface widening by any of the five new methods.
• Redirects are handled correctly. A redirect is an error.data.redirect envelope, so it takes get_proof's passthrough branch as the rustdoc claims — it is not silently flattened to -32004 with the provider list discarded.
• Two further mutations killed by their own named assertions: pinning offset = 0 in get_capsule fails at lib.rs:9309 ("a window must be served at the offset requested"); reverting start == 0 && !chunk_lens.is_null() to start == 0 fails at lib.rs:9302 (the chunk_lens-omitted assertion). Every mutation was md5-verified as a real on-disk byte change before its run.
• Advertised-vs-implemented now matches for all five new names; dig.getProofStatus is correctly absent from the catalogue and dig.listCapsules correctly passthrough.

dig-constants check (mandatory, both directions)

Nothing in this diff belongs in dig-constants, and nothing here should be consuming it. The values introduced are JSON-RPC method-name strings and error codes already sourced from dig_rpc_protocol::Method and the crate's existing ROOT_NOT_ANCHORED / download::RESOURCE_UNAVAILABLE constants — no new cross-repo literal, address, port, asset id, or version pin is defined locally. WINDOW is pre-existing and out of scope.