OriginTrail
diff --git a/‎docs/specs/SPEC_CG_HOSTING_MEMBERSHIP.md‎
Lines changed: 12 additions & 8 deletions b/‎docs/specs/SPEC_CG_HOSTING_MEMBERSHIP.md‎
Lines changed: 12 additions & 8 deletions
diff --git a/‎packages/agent/src/dkg-agent-types.ts‎
Lines changed: 20 additions & 0 deletions b/‎packages/agent/src/dkg-agent-types.ts‎
Lines changed: 20 additions & 0 deletions
@@ -837,14 +837,18 @@ The Phase A milestones above are mostly landed. Devnet validation lives in `scri
 | LU-9: member-attestation token mint + outsider verification (with optional `membershipResolver` chain hook) | `packages/agent/src/swm/member-attestation.ts` + `POST /api/attestation/{mint,verify}` | `devnet-test-rfc38-lu9.sh` | ✅ landed |
 | LU-10: public-CG regression sweep (publish + anonymous catchup + verify-batch + attestation, all on a public CG) | reuses LU-5/7/8/9 surfaces with `accessPolicy: 0` | `devnet-test-rfc38-lu10.sh` | ✅ landed |
 | Cross-CG isolation, multi-member (3-way), scale (50 triples / 25 KAs), late-joiner (member-from-member with curator offline) | scenario coverage on top of the landed surfaces | `devnet-test-rfc38-{cross-cg,multi-member,scale,late-joiner}.sh` | ✅ landed |
-| LU-6: sharding-table-driven SWM substrate subscription on cores + pre-registration staging (TTL, byte caps, ciphertext fanout to cores) so cores can serve catchup when the curator AND all live members are offline | (deferred) | `devnet-test-rfc38-late-joiner.sh` SCENARIO C documents the gap with a passing fail-soft assertion (cores-only catchup returns 0 triples cleanly, no crash) | ⚠️ deferred (see below) |
-
-**What "deferred LU-6" means in practice on this branch:**
-
-- A new member joining when the curator OR any other current member is online → catches up the full SWM history via `POST /api/shared-memory/catchup` against that peer. ✅ works.
-- A new member joining when the curator AND all current members are offline → catchup against cores returns 0 triples. The endpoint shape is correct (`peersAttempted > 0`, `totalInsertedTriples == 0`, no crash); the data simply isn't there because today's cores don't subscribe to curated CG SWM gossip topics outside the member allowlist. ⚠️ gap.
-
-This gap is acceptable for the Phase A user-visible surface (the §1.1 bug was about *publishing*, not about a specific late-joiner pattern), but is the next thing to land for the full "scenarios 1–4 of §2.4" promise to be honest. The substrate-subscription work itself is non-trivial: it touches the `SharedMemoryHandler` apply path (currently signature-checks the publisher and applies plaintext quads; needs a parallel "store opaque ciphertext under sharding-table assignment" path) and the SWM gossip wire format (Phase B in §7.2 will move it to AEAD per §5.2; Phase A could ship a transitional "cores subscribe but only persist for members" mode if needed sooner).
+| LU-6: opaque SWM ciphertext hosting on cores + member-side host-catchup fallback (so curated CGs can be recovered by an offline-then-online member even when the curator and every other member is also offline) | `packages/agent/src/swm/host-mode-store.ts`, `packages/agent/src/swm/host-catchup-wire.ts`, `packages/agent/src/dkg-agent.ts` (host-mode reconciler, `enableSwmHostModeFor`, `catchupSwmFromConnectedHosts`, `handleSwmHostCatchup`); `packages/cli/src/daemon/routes/memory.ts` (`POST /api/shared-memory/host-mode/subscribe`, `POST /api/shared-memory/host-catchup`, `GET /api/shared-memory/host-mode/stats`, plus auto-fallback in `POST /api/shared-memory/catchup`); `packages/publisher/src/workspace-handler.ts` `trustedReplay` flag for the receiver path | `devnet-test-rfc38-late-joiner.sh` SCENARIO D (LU-6 happy path: cores host ciphertext, member with surviving chain key catches up while curator+everyone offline) + SCENARIO C (confidentiality invariant: outsider without chain key applies 0 triples even though cores serve ciphertext) | ✅ landed |
+
+**LU-6 shape (Phase A):**
+
+- **Operator-driven hosting designation.** Cores opt into a CG's encrypted SWM substrate via `POST /api/shared-memory/host-mode/subscribe { contextGraphId }`. The (future) sharding-table-driven auto-assignment from §5.1.1 plugs in as a periodic reconciler over `listContextGraphs()`; the explicit endpoint is the Phase A surface for operators (and the devnet harness) to designate hosting without waiting on the full sharding-table integration.
+- **Opaque storage.** Cores store the raw gossip envelope bytes under a per-CG append-only log (`packages/agent/src/swm/host-mode-store.ts`) with a separate TTL + per-CG byte cap for unregistered vs registered CGs (defaults: 6h / 1 MiB unregistered, 30d / 64 MiB registered — pre-registration staging per §1.2 and §5.1.1). Cores never possess the chain key and cannot decrypt; the cryptographic invariant in §5.2 holds.
+- **Member-side catchup.** `/dkg/10.0.1/swm-host-catchup` is a new libp2p request/response protocol (JSON over the universal Messenger substrate) that lets members fetch stored ciphertext envelopes by `(contextGraphId, sinceSeqno)`. Members re-feed each envelope through `SharedMemoryHandler.handle(..., { trustedReplay: true })`, which skips the two pubsub-transport-layer peer assertions (`publisherPeerId === fromPeerId`, peer-allowlist gate) while *keeping* the cryptographic chain (gossip-envelope signature + sender-key AEAD decryption) intact.
+- **Auto-fallback in catchup.** `POST /api/shared-memory/catchup` runs the standard sync path first; if that returns 0 triples (typical of the "every member is offline; only cores still hold the substrate" scenario), it transparently invokes `catchupSwmFromConnectedHosts` against the same peer set. Opt out with `{ hostCatchupFallback: false }`.
+- **What LU-6 does NOT add (deferred to later phases):**
+  - Sharding-table-driven auto-subscribe (Phase B): cores currently subscribe only via the explicit `host-mode/subscribe` endpoint or the periodic reconciler's local-CG scan. The eventual goal is "core looks up its assignment in the sharding table and subscribes accordingly" — the abstraction is in place (`enableSwmHostModeFor` is the call site that the auto-subscriber will reuse).
+  - Pre-registration staging quotas (§1.2.4): per-wallet rate limits and per-core aggregate budgets are NOT enforced yet. The TTL + per-CG byte cap is enforced; the additional rate-limit dimensions land in Phase B.
+  - On-disk replay of stored envelopes across cores: cores don't currently re-gossip the ciphertext to each other, so a fresh core joining the sharding-table assignment for an existing CG starts with an empty store. Phase B addition (would let a member catch up from ANY core in the assignment, not just one that was already subscribed when the writes happened).
 
 ### 7.2 Phase B — Explicit key lifecycle + monetization model β
 
 
@@ -38,6 +38,7 @@ import type { QueryAccessConfig } from '@origintrail-official/dkg-query';
 import type { SkillHandler } from './messaging.js';
 import type { CclFactResolutionMode } from './ccl-fact-resolution.js';
 import type { JsonLdContent } from './dkg-agent-utils.js';
+import type { SwmHostModeStoreLimits } from './swm/host-mode-store.js';
 import type { SyncPhase } from './sync/auth/request-build.js';
 
 // ── File-local structural types ─────────────────────────────────────
@@ -600,6 +601,25 @@ export interface DKGAgentConfig {
   syncContextGraphs?: string[];
   /** TTL for shared memory data in milliseconds. Expired operations are periodically cleaned up. Default: 48 hours. Set to 0 to disable. */
   sharedMemoryTtlMs?: number;
+  /**
+   * OT-RFC-38 LU-6 — settings for the core-side host-mode SWM store.
+   * Only honoured when `nodeRole === 'core'`. Omit on edges (the
+   * store is never initialized there).
+   *
+   * Fields:
+   *  - `enabled`: when `false`, cores skip host-mode entirely and behave like edges. Default `true` for cores.
+   *  - `unregistered`: TTL/byte-cap for CGs the core knows about but that aren't on-chain registered yet.
+   *  - `registered`: TTL/byte-cap for on-chain registered CGs (typically larger).
+   *  - `pruneIntervalMs`: how often the TTL/cap sweep runs.
+   *  - `reconcileIntervalMs`: how often the host-mode subscription reconciler ensures cores are subscribed to all known curated CGs.
+   */
+  swmHostMode?: {
+    enabled?: boolean;
+    unregistered?: SwmHostModeStoreLimits;
+    registered?: SwmHostModeStoreLimits;
+    pruneIntervalMs?: number;
+    reconcileIntervalMs?: number;
+  };
   /** Durable local store for subscribed context-graph runtime state. */
   contextGraphSubscriptionStore?: ContextGraphSubscriptionStore;
   /** Durable local cache for nodes/agents known to be members of a context graph. */