feat(pouw): PoUW integration capstone — verify driver, quorum-driven disputes, declared-fault refund, demo

[febuz]

Adopts the stacked PoUW integration work onto main. Merges cleanly into current main (bb37697); merged result is 425 tests green (393 → 425, +32) and the signed-record CID gate holds.

What lands

• Quorum-driven disputes — slash on a verifier quorum, not a lone mismatch (integration feat(pouw): k-of-n verifier quorum — BFT aggregate verdict + declared-vs-detected fault asymmetry (Sprint 2) #50→feat(pouw): dispute window — settlement timing + slashing (Sprint 2) #32)
• Collateral sizing enforced in the dispute ledger (integration feat(pouw): collateral sizing — make fraud never net-positive (Sprint 2 escrow economics) #51→feat(pouw): dispute window — settlement timing + slashing (Sprint 2) #32)
• End-to-end verification driver (pouw/verify.py) — select → size → re-execute → vote
• Declared-fault refund — the third settlement outcome (completes the verdict space)
• End-to-end PoUW demo (examples/pouw_demo.py) — select → verify → quorum → settle (acceptance capstone, feat(examples): end-to-end PoUW demo — select → verify → quorum → settle (acceptance capstone) #64)

Why one PR

int/full-pouw-base is the capstone of the stack — it already contains the work of int/dispute-base (quorum-driven disputes + dispute tests) and int/verify-base (pouw/verify.py + verify test). Those two are intermediate bases, fully subsumed here, so they need no separate PRs.

Notes

• The duplicated primitive commits (feat(pouw): k-of-n verifier quorum — BFT aggregate verdict + declared-vs-detected fault asymmetry (Sprint 2) #50/feat(pouw): collateral sizing — make fraud never net-positive (Sprint 2 escrow economics) #51/feat(pouw): sample-size sizing — how many blocks a verifier must re-run (audit soundness) #55/feat(pouw): verifier committee selection — unpredictable, verifiable jury for a job #58) dedupe in the 3-way merge — that's why a stale-looking "10 behind" base still merges clean.
• Separate track, not in this PR: int/feed-safety-base (feat(p2p): policing — wire equivocation/conflict detection to reputation (integration #56+#57) #60 p2p policing) — also merges clean; can be adopted as its own PR if wanted.
• Pure feature/test additions; no signed-record byte changes.

🤖 Generated with Claude Code

[febuz]

Reviewer note — soundness fundamentals verified ✅, one adversarial question on declared-fault timing

Reviewed the consensus-critical parts statically against the diff (didn't re-run the suite; trusting the stated 425-green). The fundamentals hold up well:

Verified good:

• Quorum safety invariant is correct and enforced at runtime. default_threshold(n) = ⌊2n/3⌋+1 (BFT supermajority), max_faulty = ⌊(n-1)/3⌋, and tally() raises if 2*k <= n. So a confirm-quorum and a mismatch-quorum can never both form — the protocol can't simultaneously release and slash. This is the property that matters most here, and it's guarded, not just documented.
• Float-ban respected on the consensus path. Zero float literals in the added code; 44× fractions.Fraction instead (collateral 1.5× over-collateralization, sampling miss-probability). Exactly the right pattern for the determinism rule — the only N.N tokens are in comments.
• CID-invariant holds. No kind / to_record / signing_bytes / canonical.encode changes in the diff — consistent with "no signed-record byte changes."

One thing to confirm before merge — declared-fault as a possible slash-escape:

tally() short-circuits:

if worker_declared_fault:
    outcome = DECLARED_FAULT      # refund, no slash — "regardless of verdicts"
elif confirms >= k:  ...
elif mismatches >= k:
    outcome = DETECTED_FAULT      # slash

Refund-regardless-of-verdicts is correct only if worker_declared_fault is pinned before the committee result is knowable. If a worker can set it after seeing a mismatch-quorum forming, it's a strict downgrade of a slash to a refund: cheat → about to be caught → declare fault → stake returned, no penalty. tally() is a pure function and can't enforce that ordering itself.

test_declared_fault_refund.py covers the happy-path refund mechanics and the conservation accounting, but not the adversarial ordering — each terminal outcome is tested on a separate submission, so "declare fault on a submission a quorum already mismatched" is never exercised.

Requests:

1. Where is worker_declared_fault committed relative to sampling/verification? If it isn't already behind the commit-before-sample point (challenge.py), it should be — same guarantee the rest of the verify path leans on.
2. Add a property test: a refund_declared_fault / declared-fault tally must not resolve a submission once a mismatch-quorum exists (or once dispute() is reachable) — i.e. declared-fault can't escape a detected fault.

Not blocking the quorum/collateral/verify core, which is solid — just want the third outcome closed against the obvious griefing path before it's the acceptance capstone.