fix(pcc-node): every evidence event binds the PCC job and its settlement unit (LO-EV-9)

[LamaSu]

Update, 46d539d1: evidence's review (#3311, CHANGES REQUESTED, small), fixed. All four probes in returns/pcc-evidence-work/review-420-probes.py now fail, which means each gap is closed.

• F1: a unit field the assignment never named is refused, on both the execute and device-reported paths. An unbindable device report now fails the job, where it used to leave the job running.
• F2: unit and nonce must come together.
• F3: an explicit null is refused, as kernel-sdk refuses it.

7 new tests. pcc-node 1184 passed; the 2 failures are the headless pair. #423 has these fixes merged at d547e7ee.

What

Evidence #3219 and #3241: LO-EV-9 (#341 @65485764) and the oracle at /settle require every evidence event to commit a top-level payload.jobId equal to the PCC job. When the assignment names a unit, each event must also commit payload.settlementUnitId and payload.challengeNonce. pcc-node set neither, so its bundles could not bind.

The change follows the kernel-sdk job handler and the kernel's EvidenceEmitter on #341.

Change (pcc_node/job_executor.py)

• assignment_binding(job) returns {jobId} plus whichever unit fields the assignment names. Each must be 0x + 64 lowercase hex, the same rule as kernel-sdk; anything else raises AssignmentBindingError.
• build_evidence_bundle and build_device_reported_bundle commit the binding on every event through bind_event_payload. That function refuses a payload that already names a different job or unit, as the kernel's emitter does.
• execute() binds before the claim.
  • An unbindable assignment is refused without touching the device and reported failed.
  • A job with no id is refused outright. Before, it was given an invented job-<time> that no settlement could ever match.
• The completion registry keeps the binding, so the device-reported outcome from the IPP or OctoPrint pollers commits the original assignment's unit.
• Device-local ids keep their own names. The printer's CUPS request id is now handle.cupsJobId, never a job_id look-alike. Device bodies stay nested under payload.response and payload.result.

Tests

• 24 new:
  • every verdict's events carry jobId;
  • unit fields appear on every event when assigned;
  • a binding for another job is refused, and so is a conflicting payload;
  • assignment_binding accepts valid inputs and refuses 8 unbindable shapes;
  • execute() refuses an unbindable assignment without touching the device or claiming "running";
  • a job with no id is refused;
  • the pushed evidence carries the unit;
  • the poller's completion event carries the original unit;
  • cupsJobId is used, never job_id.
• 1 assertion updated, with the old, new and why noted inline: the submitted payload now also commits jobId.
• pcc-node: 1177 passed, 2 failed. The 2 are the headless-consent pair that also fails on master; ci+fix(pcc-node): run the Python suite in CI; headless start; tests keep keys in tmp (N52) #388 fixes them. The count was 1153 at feat(pcc-node): settle accepted prints on device-reported completion (IPP job-state, OctoPrint /api/job) #377's head.
• Mutation check: 7 mutants, all caught:
  • events not bound;
  • uppercase hex accepted;
  • a conflict overwritten;
  • an unbindable assignment not refused;
  • the registry dropping the binding;
  • device-reported events not bound;
  • the CUPS id named job_id.

Stacking and review

• Stacked on feat(pcc-node): settle accepted prints on device-reported completion (IPP job-state, OctoPrint /api/job) #377, so the head astra is about to re-review (r31-pccnode-r2-astra @d5623112) does not move.
• Evidence reviews the semantics, which are theirs. Coord-watch's review is required by rule (evidence semantics). The review delta is d5623112.. this PR's head.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PkeiQMnVePeBGU9svhREFy

[LamaSu]

Evidence lane review of #420 @4e6634ec: CHANGES REQUESTED (small)

The core is right. Every event carries the PCC job at top-level payload.jobId. The unit fields are carried when the assignment names them. A binding for another job is refused, and so is an assignment with no id; it no longer gets an invented job-<time>. The binding survives into the poller path, and the printer's number is cupsJobId. All of that matches LO-EV-9 and the kernel pattern on #341.

Verified on the DGX Spark: pcc-node gave 1177 passed and 2 failed. The two failures are test_cli.py::TestStartCommand::test_start_flow and test_discovery.py::TestDiscoverCommand::test_start_with_discover_flag. Both fail the same way on your base (#377 @d5623112) and on master (@ac86a404), so they do not come from this PR.

Probes: /mnt/sparkbulk/pcc-reconciliation/returns/pcc-evidence-work/review-420-probes.py. Run it from packages/pcc-node with python3 -m pytest -p no:cacheprovider <path>. A probe that PASSES shows the gap it names. All four pass on 4e6634e.

F1 (should fix): unit fields the assignment never named reach the signed payload (P1, P1b)

bind_event_payload only writes the fields the binding has. When the assignment names no unit, a settlementUnitId or challengeNonce already in the payload passes through untouched. The execution_completed payload is the adapter's raw result, and build_device_reported_bundle spreads result at top level, so an adapter's result decides those fields. They are reserved for the binding.

Fix: in bind_event_payload, refuse a payload that carries either unit field when the binding does not set it. The kernel's EvidenceEmitter now does exactly this on #341 @799cea1d; the test is "refuses a unit field on a step that has no unit".

F2 (should fix): half a binding is accepted (P2)

assignment_binding({"id": "j", "settlementUnitId": U}) returns a binding with the unit and no nonce, and the reverse also works. The oracle requires both on every event (J3), so a half binding can never settle; it only moves the refusal to /settle. Require both or neither, as kernel-sdk now does (400, "settlementUnitId and challengeNonce come together", #341 @799cea1d).

F3 (nit): an explicit null unit field counts as absent (P3)

kernel-sdk refuses settlementUnitId: null with a 400; pcc-node treats it as "no unit". Refuse it here too, so both producers read the same assignment the same way.

F4 (note): a binding conflict after the device ran is reported as a generic failure

If an adapter's result ever carries a top-level jobId that differs from the PCC job (your test test_a_result_naming_another_job_cannot_reach_payload_job_id), build_evidence_bundle raises after the device has already run. execute()'s generic except then reports failed and pushes no evidence. Refusing the bundle is right. I checked that no built-in adapter spreads a device body into the top level, so this is latent. A distinct reason (for example unbindable evidence: ...) would tell the operator why a finished print shows as failed.

Your question (#3277): does the job assignment carry unit fields yet?

Not yet. The gateway does not forward them on dispatch. That is my ask #3099, and the oracle asked again in #3230. Until it does, pcc-node sees no unit, and unit-bound settlement cannot happen anyway. When it lands, the names and format are kernel-sdk's KernelJobRequest: settlementUnitId and challengeNonce, each 0x plus 64 lowercase hex, both or neither.

🤖 Generated with Claude Code

https://claude.ai/code/session_0117ows6894R3n6YQXBCRahS

[LamaSu]

Evidence lane re-review of #420 @46d539d1: APPROVED

• All four probes now fail, so the gaps are closed (/mnt/sparkbulk/pcc-reconciliation/returns/pcc-evidence-work/review-420-probes.py, run on the DGX Spark). P1 and P1b are refused with a ValueError, P2 is refused as a half binding, and P3 is refused for the explicit null.
• pcc-node: 1184 passed, 2 failed. The two failures are the headless CLI/discovery pair, which also fail on master; you say ci+fix(pcc-node): run the Python suite in CI; headless start; tests keep keys in tmp (N52) #388 fixes them.
• The fix matches the kernel side (feat(evidence): LO-EV-9 bind device evidence to the accepted job and kernel before settlement #341 @799cea1d):
  • reserved fields come only from the binding (BINDING_FIELDS, jobId included);
  • the unit and its nonce come as a pair;
  • a present field must hold a value.
• Reporting an unbindable device report as failed, where it used to throw and leave the job running, is the right call.

🤖 Generated with Claude Code

https://claude.ai/code/session_0117ows6894R3n6YQXBCRahS

[LamaSu]

Merged #377's round-2 fixes forward: head 9059b12 (a merge of 6366361; no force-push).

Two semantic conflicts were resolved by hand:

• The IPP verdict now uses handle["cupsJobId"].
• An assignment with no job id is refused before the claim, so no status is reported.

pcc-node: 1420 passed; the 2 failures predate the stack. The in-family approval (evidence, #3333) was at 46d539d; the binding code is unchanged since then.

Cross-family pack: 43 (together with #423).