feat(gateway): wire device-signed (#236) evidence through #52 verifier to settlement — ready but gated (SEAM-2)

[LamaSu]

SEAM-2 — wire device-signed (#236) evidence into settlement. Ready but GATED.

The operator node already produces real Ed25519-signed evidence, but two gateway paths threw that signature away and anchored settlement on a fabricated gateway placeholder. This builds the mechanism to anchor on the device's own key, and leaves it OFF behind the still-stubbed #52 verifier — the money path is unchanged today.

The two inert paths (before)

1. operator-relay.ts POST /api/operator/evidence stored the node's bundle inert: assuranceTier:0, a fabricated bundleHash = \sha256-${bundleId}`, and kernelSignature.value:"operator-relay-auto"— the real Ed25519 signature inreq.body.evidence` was discarded.
2. paid-job-flow.ts /complete rebuilt the bundle and signed it with the ZERO address 0x0000…0000 / "gateway-auto-sign", then fed that to driveSettlement.

The wiring built (packages/gateway/src/services/device-evidence-settlement.ts, unit-tested)

• Path 1: capture the node's real device Ed25519 signature + real bundleHash when the pushed evidence carries a signed bundle (extractNodeSignedBundle); fall back to the placeholder for old / non-bundle nodes. The stored assuranceTier stays 0 on purpose — an unverified bundle "actually supports" only the tier-0 floor, and resume-settlement's ?? latestBundle.assuranceTier fallback must not escalate the release tier from an unverified claim (fails closed).
• Path 2: resolveSettlementEvidence chooses the settlement anchor. When a captured device bundle's signature verifies against the kernel's registered signer (normalizeRegisteredSigner chore: impl-alfa-2 post-cascade lockfile + release-please health audit #47 → tweetnacl Ed25519), settlement anchors on the device's hash + signature; otherwise it falls back to the gateway anchor. Threaded through the stored bundle, the IPFS archive, the oracle verify hash, and driveSettlement.

WHAT STAYED GATED (the safety gate — verified, not flipped)

• packages/spec/ is UNTOUCHED — git diff --stat shows zero spec changes. machine.execution_log (feat: PLR adapter Phase 1 — @pcc/adapter-pylabrobot + Python sidecar + OT-2 profile (impl-uniform) #52) and feat: 4-level federation Phase 1 — @pcc/dht-core + @pcc/federation + CRDTs (impl-fed) #53–feat: PLR backend-author registry + EIP-712 signing client + kill-switch (impl-zulu) #55 remain verifierStatus:"stub"; the oracle binding still fails closed (met:false). spec: [GATED DRAFT] flip #47/#52 verifierStatus stub->live (machine-log settlement) #233 is not flipped.
• The gate is CLOSED by construction: deviceEvidenceSettlementEnabled() = machineLogVerifierLive() (reads the real feat: PLR adapter Phase 1 — @pcc/adapter-pylabrobot + Python sidecar + OT-2 profile (impl-uniform) #52 verifierStatus, currently "stub" → false) AND SEAM2_DEVICE_EVIDENCE_SETTLEMENT flag (default unset). Both default false, so resolveSettlementEvidence always returns the gateway fallback today — /complete behavior is byte-identical. A unit test asserts the gate stays closed even with the flag set, because feat: PLR adapter Phase 1 — @pcc/adapter-pylabrobot + Python sidecar + OT-2 profile (impl-uniform) #52 is stubbed.
• Money path fails closed: any verify failure → gateway fallback; unverified device evidence sits in the DB with its real signature but cannot clear settlement until feat: PLR adapter Phase 1 — @pcc/adapter-pylabrobot + Python sidecar + OT-2 profile (impl-uniform) #52 goes live on deployed infra.

SEAM-2 is ready-but-gated pending a real device on deployed infra. The post-deploy live proof is the harness rehearse-loop.mjs A6 rehearsal — that flips the gate once a real device clears #52. No code change needed to turn it on.

Tests

• device-evidence-settlement.test.ts (23): gate holds (real stubbed feat: PLR adapter Phase 1 — @pcc/adapter-pylabrobot + Python sidecar + OT-2 profile (impl-uniform) #52 + flag set → still closed; valid device bundle → gateway fallback), gate untouched (feat: PLR adapter Phase 1 — @pcc/adapter-pylabrobot + Python sidecar + OT-2 profile (impl-uniform) #52–feat: PLR backend-author registry + EIP-712 signing client + kill-switch (impl-zulu) #55 verifierStatus stub), wiring correct (device sig → device anchor, mocked verifier and real tweetnacl Ed25519 roundtrip), fails closed (wrong key / tampered hash / unregistered / non-ed25519 signer), path-1 parser, registeredSignerInputFromColumns.
• operator-relay.test.ts (+5): the route captures the real device signature end-to-end (deviceSigned:true, stored value ≠ placeholder, tier stays 0), placeholder fallback for non-bundle evidence.

Verification (own worktree)

• pnpm --filter @pcc/gateway test: 2063 passed, 6 skipped. The 1 failing test + 2 failing suites are pre-existing, environment-only (a Windows C:\C:\…status.ts double-drive path bug that passes on Linux CI; unbuilt @pcc/verifier/dist/capture/* subpaths) — none touch evidence/settlement.
• pnpm --filter @pcc/gateway typecheck: exit 0, 0 errors (deps built).

🤖 Generated with Claude Code