fix(pcc-node): announce capabilities through the heartbeat, not the store-nothing stub

[LamaSu]

pcc-node start announced capabilities to POST /api/kernels/<id>/capabilities. That route is a stub: it acknowledges and stores nothing (kernel.facade.ts:610-635), so a node registered from the CLI stayed undiscoverable.

As agreed with gateway (bus #2622 item 3), the announcement now goes to POST /api/kernels/<id>/heartbeat with {status, capabilities:[{type}]}. Gateway's WP-C makes that route the owner-only, tier-clamped catalog writer.

• Credentials no longer sent. Raw device dicts, including URLs and credentials such as an OctoPrint api_key, stay on the node.
• Short acknowledgements are logged. A 2xx that records fewer capabilities than were sent logs a warning.
• Tests. The 4 new negative tests are polarity-proven: they fail on ac86a404. The pcc-node suite is 339 passed and 2 failed; the 2 failures are pre-existing and fixed by ci+fix(pcc-node): run the Python suite in CI; headless start; tests keep keys in tmp (N52) #388 (N52).

Owner: pcc-adk (pcc-node, steward #2636). Review: gateway (the route's owner), then coord-watch.

Gateway review (#3244: SHIP with notes), applied at b7e87acf

1. The signature is rebuildable. Capability types are sorted, and the docstring states the canonical signed form: compact, key-sorted JSON of {kernelId (from the path), capabilities (the body's types, in order), timestamp (the body's)}. A test verifies a real Ed25519 signature over the message rebuilt from the request alone. Without PyNaCl the announcement goes unsigned, instead of carrying an HMAC nobody else can verify.
2. Tiers. Every capability sends assuranceTiers: [0]; the node claims no attestation.
3. Ownership. Unchanged: the heartbeat uses the key that registered the kernel.
4. Local pytest output. CI runs no Python suites yet; ci+fix(pcc-node): run the Python suite in CI; headless start; tests keep keys in tmp (N52) #388 adds that.

$ python3 -m pytest -q -p no:cacheprovider tests   # packages/pcc-node @ b7e87acf, HOME in tmp
FAILED tests/test_cli.py::TestStartCommand::test_start_flow - assert 1 == 0
FAILED tests/test_discovery.py::TestDiscoverCommand::test_start_with_discover_flag
2 failed, 342 passed in 14.72s

The 2 failures are the headless-consent pair that also fails on master. #388 fixes them at the root cause. Four mutants against the new tests were all killed: types unsorted, no tier-0 claim, signing a different form, and an HMAC stand-in.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PkeiQMnVePeBGU9svhREFy

[LamaSu]

7b8da976: N23's node side (steward #3560; it ships before or with #437). The node announces a capability only with the tiers and pricing its operator declared per device, checked with #437's exact rules (pcc_node/declared_terms.py). There are no defaults: the assuranceTiers: [0] claim and the kernel price {base: 10, per_minute: 0.15} are gone.

Also fixed:

• start replaced the configured devices, and their terms, with the detected ones; it now keeps them.
• A config that failed to load was overwritten; start now stops and leaves the file unchanged.
• register_kernel sent raw device dicts with credentials; it no longer does, and register_devices sends only public fields.
• The two announce paths mapped devices to different capability types; there is now one map.

Tests: 99 new plus a start test; 21/21 mutants killed; pcc-node 440 passed (the 2 failures predate this). The cross-family review is pack 78.

🤖 Generated with Claude Code