fix(gossip): RejectV1 default for modern-only support (ADR-014)

[dirvine]

Summary

• Installs saorsa_gossip_pubsub::SignaturePolicy::RejectV1 in PubSubManager::new_with_oracle (covers new / new_with_oracle / new_with_participation) and fails closed with NetworkError::NodeCreation if the policy does not stick.
• Exposes read-only outer_signature_policy (reject_v1 / accept_v1) and cumulative outer_v1_receipts through Agent + GET /diagnostics/gossip.
• Adds focused regression tests for constructors, valid outer V1 refuse+receipt, outer V2 positive + tampered negative, publish_with_fanout with SigningContext sealing V2, Leaf/Full refuse without grant API, and diagnostics route contract.
• Package version stays 0.41.3; no Cargo.toml dependency bump; no AcceptV1 restore path; no migration grant enablement; no docs/ADR/receipt template in this PR.

Authority / separation

• ADR-014 Accepted (saorsa-gossip): docs(adr): Accept ADR-014 modern-only release support saorsa-gossip#52
• x0x modern-only convergence receipt template (Architect-owned): docs(release): modern-only convergence receipt template (ADR-014) #545 (docs/release/modern-only-convergence-receipt.template.md)
• Separate from release: x0x 0.41.4 (#504 leaf ceiling + gossip 0.5.76 / ant-quic 0.27.50) #544 (do not conflate).
• release blocker: current gossip v2 breaks legacy historical KV recovery in both mixed-version gates #517 and run 34058040463 stay FAIL as stock-compat evidence; this PR does not flip just convergence-release.

Test plan

• cargo fmt --all
• cargo clippy --all-features --all-targets -- -D warnings
• cargo clippy --all-features --lib --bins -- -D warnings -D clippy::panic -D clippy::unwrap_used -D clippy::expect_used
• cargo check --workspace --all-targets
• Focused nextest: adr014_* + gossip_route_reports_reject_v1_and_receipt_increment (6 passed)

Greptile Summary

The PR installs the modern-only RejectV1 outer gossip signature policy, exposes its state and V1 receipt count through diagnostics, and adds focused constructor, receive, publish, participation, and route tests.

• Rejects outer V1 frames while retaining valid sealed V2 handling.
• Adds operational policy and receipt diagnostics.
• Adds test-only outbound PubSub frame capture for V2 sealing assertions.
• The production oracle-enabled constructor path lacks direct invariant coverage, and the receipt metric excludes V1 traffic refused by the earlier Leaf admission gate.

Confidence Score: 4/5

The PR appears safe to merge after non-blocking improvements to production-path policy coverage and the accuracy of the V1 receipt diagnostic contract.

RejectV1 is installed and the primary receive behavior is tested, but the final oracle-enabled object is not directly verified and the advertised cumulative receipt metric omits V1 frames rejected by the earlier Leaf admission gate.

Files Needing Attention: src/gossip/pubsub.rs

Important Files Changed

Filename	Overview
src/gossip/pubsub.rs	Installs and reports RejectV1, delegates receipt accounting, and adds ADR-014 tests; the oracle-enabled production branch is not directly covered and the receipt contract overstates what is counted.
src/lib.rs	Adds read-only Agent accessors for the policy and receipt counter plus a test-only incoming-frame hook.
src/network.rs	Adds test-only capture of PubSub frames handed to the transport for outbound encoding assertions.
src/server/routes/network.rs	Extends gossip diagnostics with stable policy and receipt fields and tests their values, while the asserted receipt path requires a subscription.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Incoming outer gossip frame] --> B{Leaf and unsubscribed passthrough?}
    B -->|Yes| C[Refuse before PlumTree handling]
    C --> D[V1 receipt counter unchanged]
    B -->|No| E[PlumTree handle_message]
    E --> F{Outer signature version}
    F -->|V1| G[RejectV1 refusal]
    G --> H[Increment V1 receipt counter]
    F -->|Valid sealed V2| I[Continue delivery]

Loading

Prompt To Fix All With AI

### Issue 1
src/gossip/pubsub.rs:491-495
**Post-oracle policy unchecked**

The mandatory policy check runs before `with_health_oracle`, but production constructs this manager with `Some(oracle)` and the new constructor test only covers `None`. If applying the oracle changes the policy, the final object can lose `RejectV1` without detection. Verify the final post-oracle object and cover the production branch so this invariant remains protected.

### Issue 2
src/gossip/pubsub.rs:543-550
**Receipt counter undercounts traffic**

This diagnostic is described as cumulative outer-V1 receipts since startup, but a Leaf node returns before `PlumtreePubSub::handle_message` for V1 frames on unsubscribed topics. Those received frames never reach `v1_receipt_count`, so the metric can understate contact with V1 peers and provide misleading convergence evidence. Count at the earlier admission boundary or narrow the field's documented meaning and name.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: 0e4ffd0 | Re-trigger Greptile}

Greptile also left 2 inline comments on this PR.

[greptile-apps]

Post-oracle policy unchecked

The mandatory policy check runs before with_health_oracle, but production constructs this manager with Some(oracle) and the new constructor test only covers None. If applying the oracle changes the policy, the final object can lose RejectV1 without detection. Verify the final post-oracle object and cover the production branch so this invariant remains protected.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/gossip/pubsub.rs
Line: 491-495

Comment:
**Post-oracle policy unchecked**

The mandatory policy check runs before `with_health_oracle`, but production constructs this manager with `Some(oracle)` and the new constructor test only covers `None`. If applying the oracle changes the policy, the final object can lose `RejectV1` without detection. Verify the final post-oracle object and cover the production branch so this invariant remains protected.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Receipt counter undercounts traffic

This diagnostic is described as cumulative outer-V1 receipts since startup, but a Leaf node returns before PlumtreePubSub::handle_message for V1 frames on unsubscribed topics. Those received frames never reach v1_receipt_count, so the metric can understate contact with V1 peers and provide misleading convergence evidence. Count at the earlier admission boundary or narrow the field's documented meaning and name.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/gossip/pubsub.rs
Line: 543-550

Comment:
**Receipt counter undercounts traffic**

This diagnostic is described as cumulative outer-V1 receipts since startup, but a Leaf node returns before `PlumtreePubSub::handle_message` for V1 frames on unsubscribed topics. Those received frames never reach `v1_receipt_count`, so the metric can understate contact with V1 peers and provide misleading convergence evidence. Count at the earlier admission boundary or narrow the field's documented meaning and name.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.