v10.0.16

DKG v10.0.16

A default-responsibility RFC-64 release. For persistent nodes, when RFC-64 controls are omitted, the root Shared Memory scope of every Context Graph the node is already responsible for uses signed catalogs as its sole discovery and recovery authority: Core nodes host their public CGs, Edge nodes follow only their public subscriptions, and private CGs follow current verified membership. Registered CG authority is rebuilt from finalized chain state; unregistered CGs use owner-signed local authority. Ordinary root-scope SHARE/update operations advance the durable author catalog, restart reconciliation restores it, and receivers recover by catalog pull without static provider lists. Agents intentionally created without dataDir retain the functioning in-memory legacy root lane; an explicit catalog request without persistence is rejected before startup. Named subgraphs retain a non-overlapping legacy SWM compatibility lane for live delivery and recovery until RFC-64 catalogs support non-null subGraphName; that lane does not accept root traffic. Finalized Verifiable Memory remains independently chain-authoritative. No smart-contract changes or deployments are required.

npm: @origintrail-official/dkg@10.0.16 — dist-tags latest, testnet, mainnet

Upgrading from 10.0.15

Change	Impact	Action
RFC-64 root catalog recovery is the omitted-configuration default	A node selects root-scope catalog authority from its existing Core hosting, Edge subscription, or verified private-membership responsibility; this does not auto-subscribe an Edge to additional CGs	Remove compatibility activation manifests after confirming the default status for each intended CG. Keep Edge subscriptions scoped to the CGs the node should maintain
Catalog mode requires persistent node state	An agent created without dataDir cannot provide durable catalog recovery, so omitted RFC-64 controls preserve its in-memory legacy root replication lane; explicitly requesting catalog mode without persistence fails before startup	Configure dataDir for production/default catalog operation. Use no-dataDir agents only when intentionally accepting ephemeral legacy behavior
Named subgraphs retain a non-overlapping legacy compatibility lane	The current RFC-64 catalog authoring path supports only the root scope (subGraphName=null). Valid named-subgraph live delivery and recovery therefore stay on the legacy lane, while root aggregate, metadata, and data graphs remain excluded from that lane	No activation action is required. Verify named-subgraph live delivery and restart recovery when upgrading nodes that use subgraphs; do not treat this compatibility lane as root RFC-64 completion
Historical root SWM is excluded from default catalog recovery	Pre-10.0.16 root SWM heads remain readable but are reported as a known-incomplete boundary until an ordinary root SHARE/update republishes them into a current catalog	Republish any legacy-only root asset that must participate in complete default recovery; monitor legacyReadOnlyCount and the per-CG operational phase
Authority resolution is fail closed and freshness-bearing	A responsible CG cannot serve, receive, or claim root completion while its registered chain snapshot, owner authority, private roster, or freshness is unresolved	Investigate resolving-authority, blocked, known-incomplete, or unknown-freshness status before promotion
Rollback controls remain explicit	Per-CG shadow and legacy overrides and the process kill switch remain available; using them is visible in startup warnings and status evidence	Use only as bounded rollback controls. The release harness rejects injected controls and root legacy fallback as default-release evidence

Added

• Responsibility-derived default selection: one live registry derives root catalog work from public Core hosting, public Edge subscriptions, and current private membership without expanding subscription scope.
• Release-native authority bootstrap: registered CGs compose policy from finalized chain snapshots; unregistered CGs compose owner-signed policy and private member rosters from ordinary node state.
• Default root catalog lifecycle: ordinary durable root-scope SWM promotions author and announce signed catalogs, receivers discover current providers from catalog evidence, and restart reconciliation repairs durable heads without static peer configuration.
• Named-subgraph compatibility: catalog selection preserves the member transport and scope-filtered legacy recovery required by valid named subgraphs while rejecting root SWM traffic from that lane.
• Upgrade-boundary accounting: historical root SWM heads are captured durably, exposed as legacyReadOnlyCount, retained read-only, and retired only after a normal current-catalog publication.
• Release observability: /api/status exposes privacy-safe configuration evidence, responsibility, authority/freshness, parity digests and counts, provider health, stable reason, and the phases inactive, resolving-authority, bootstrapping, applying, blocked, known-incomplete, unknown-freshness, and complete.

Changed

• Omitted RFC-64 configuration on persistent nodes now resolves the root lane to catalog mode; no-dataDir agents retain ephemeral legacy root replication, and explicit catalog mode without persistence is rejected before startup. The deprecated explicit disabled override remains a compatibility rollback rather than the persistent-node default.
• Catalog mode disallows root-scope legacy SWM synchronization. Valid named subgraphs retain a scope-selected legacy compatibility lane; legacy, shadow, and kill-switch overrides remain operator-controlled and status-visible.
• Public and private root authoring share the same tier-neutral signed catalog. Private policy and roster material remain authorization-bound and are never exposed in configuration evidence.
• Catalog head application rechecks durable state inside the mutation lock, closing the scheduler-to-commit race while preserving restart repair.

Fixed

• Scoped catalog replay now acquires the relevant author mutation locks before refreshing its replay snapshot, then revalidates that snapshot before reporting completion. A catalog head that advances while replay is waiting for a lock can therefore be replayed from current durable state instead of leaving an otherwise converged receiver fenced with unavailable expected-head evidence.
• Omitted-deployment catalog authority and author inventory use the chain adapter's namespaced network identity, matching deterministic KA UALs instead of the unrelated DKG genesis hash; post-commit inventory warnings retain their bounded cause chain for operator diagnosis.
• Local devnet snapshot storage keeps capacity admission with explicit low-disk watermarks, avoiding dependence on production-scale free-space reserves during release certification.
• Subscription catch-up re-evaluates RFC-64 responsibility after authoritative metadata lands, so a cold Edge join cannot remain fully synced but absent from the default catalog status until restart.
• Late verified on-chain binding now notifies the responsibility registry, covering cold subscriptions whose numeric Context Graph ID arrives after their initial fail-closed policy check.
• A newly responsible receiver now requests a policy-authorized replay of durable catalog heads from peers that were already connected, so subscription or finalized-authority activation after publication cannot miss the current head; private replay requests remain member/provider gated.
• A cold private joiner now re-announces its persisted profile before requesting membership and carries its wallet-proven public encryption keys in a request-specific attestation. An upgraded curator can therefore verify the active encryption key without waiting for opportunistic profile gossip, while the stable v2 delegation signature remains readable by older curators.
• Operational status includes explicitly configured catalog, shadow, and legacy Context Graphs before the live responsibility registry observes them, preserving rollout and rollback evidence during bootstrap.
• Restart reconciliation retires an exact stale SWM twin even when finalized VM content and metadata already match, while preserving unrelated or non-identical SWM state.

Deployment

• No contract or deployment changes. Existing finalized Context Graph state supplies registered authority; the release changes node and harness behavior only.
• All workspace package manifests are aligned at 10.0.16.

Validation

• Focused DKG integration coverage exercises omitted configuration, all authority sources, public/private root catalog authoring, cold recovery, restart parity, provider retry/failover, legacy-boundary retirement, rollout modes, kill switch, and fail-closed unresolved authority.
• The four-cell black-box acceptance matrix is maintained separately in OriginTrail/dkg-blackbox-harness#31 and is not executed by this repository's CI. Before release, cells 00, 01, 10, and 11 must run against the exact final DKG and harness SHAs using ordinary node APIs with RFC-64 configuration omitted; acceptance requires final head/inventory/row parity, current authority, no root legacy fallback or retained root legacy boundary, and private nonmember denial where applicable.
• Omitted-configuration named-subgraph coverage must prove live delivery and restart recovery while a mutation that admits root SWM to the compatibility lane fails.

Known limitations

• RFC-64 catalog inventory, publication, replay, and recovery in 10.0.16 are root-scope only. Named subgraphs retain the non-overlapping legacy compatibility lane until catalogs support non-null subGraphName.
• RFC-64 catalogs require dataDir. Agents created without persistent state keep an explicit ephemeral legacy root lane and cannot be used as default-catalog release evidence.
• Pre-10.0.16 root SWM history is deliberately not inferred into a signed current catalog. Until an ordinary root update republishes it, status remains known-incomplete and release certification fails closed.
• Matrix evidence is valid only for the frozen DKG and harness commits under test. Distributed testnet execution remains a separately authorized promotion gate.

Full changelog: v10.0.15...v10.0.16