[do not merge] Infra/mainnet network configuration prep.

.github/workflows/npm-publish.yml

@@ -354,6 +354,78 @@ jobs:
           echo "EXTRA_TAGS=${EXTRA_TAGS}" >> "$GITHUB_OUTPUT"
           echo "Resolved dist-tags: ${NPM_TAG} ${EXTRA_TAGS:++ $EXTRA_TAGS} for ${TAG}"
 
+      - name: Generate build-info.json for published packages (RFC-41 §4.9)
+        # CI writes `build-info.json` into each public package root
+        # before `pnpm pack` runs, so the tarball — and therefore
+        # the installed npm package — carries the build's commit
+        # SHA + ISO timestamp + dist-tag + CI run id.
+        #
+        # The daemon's `loadBuildInfo()` (packages/cli/src/daemon/manifest.ts)
+        # reads this file at startup. `/api/status` exposes it as
+        # `{commit, commitShort, buildTime, distTag}`. `dkg doctor`'s
+        # §4.7.0 state summary surfaces it alongside the rest of the
+        # install context. Pre-release dist-tag testing becomes
+        # auditable: operators see exactly which commit they're
+        # running, not just a semver tag that may have multiple
+        # sequential builds.
+        #
+        # `files` field on each package.json must include
+        # `build-info.json` for it to be picked up by pnpm pack
+        # (cli has been updated; other public packages will be
+        # added on a follow-up if they also serve build-info via
+        # an HTTP route).
+        env:
+          GITHUB_SHA: ${{ github.sha }}
+          GITHUB_RUN_ID: ${{ github.run_id }}
+          NPM_TAG: ${{ steps.dist-tag.outputs.NPM_TAG }}
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          VER="${TAG_NAME#v}"
+          COMMIT="${GITHUB_SHA}"
+          COMMIT_SHORT="${COMMIT:0:8}"
+          BUILD_TIME="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
+          CI_RUN="${GITHUB_RUN_ID}"
+          DIST_TAG="${NPM_TAG}"
+          echo "build-info.json fields:"
+          echo "  version    = ${VER}"
+          echo "  commit     = ${COMMIT}"
+          echo "  commitShort= ${COMMIT_SHORT}"
+          echo "  buildTime  = ${BUILD_TIME}"
+          echo "  distTag    = ${DIST_TAG}"
+          echo "  ciRun      = ${CI_RUN}"
+          node -e "
+            const fs = require('fs');
+            const path = require('path');
+            const payload = {
+              version: '${VER}',
+              commit: '${COMMIT}',
+              commitShort: '${COMMIT_SHORT}',
+              buildTime: '${BUILD_TIME}',
+              distTag: '${DIST_TAG}',
+              ciRun: '${CI_RUN}',
+            };
+            const pkgsDir = path.join(process.cwd(), 'packages');
+            for (const dir of fs.readdirSync(pkgsDir)) {
+              const pkgPath = path.join(pkgsDir, dir, 'package.json');
+              if (!fs.existsSync(pkgPath)) continue;
+              const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+              if (pkg.private) continue;
+              // Only write build-info.json into packages whose 'files'
+              // field explicitly includes it. Other packages would
+              // accept the file on disk during pack-time but the
+              // tarball pruning step (npm's standard files-list
+              // behaviour) would silently drop it. Explicit gating
+              // keeps the file's presence on a published tarball
+              // a deterministic per-package choice.
+              const files = Array.isArray(pkg.files) ? pkg.files : null;
+              if (files && !files.includes('build-info.json')) continue;
+              const outPath = path.join(pkgsDir, dir, 'build-info.json');
+              fs.writeFileSync(outPath, JSON.stringify(payload, null, 2) + '\n');
+              console.log('  wrote ' + outPath);
+            }
+          "
+
       - name: Pack public packages into tarballs
         # `pnpm pack` runs the same prepack/prepare lifecycle hooks
         # `pnpm publish` would, but EMITS A TARBALL instead of pushing

CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to the DKG V9 node are documented here. The format is based
 
 ## [Unreleased]
 
+### Changed — V10 EVM module hardening pass
+
+Consistency and defense-in-depth refinements across the V10 EVM-module contracts. No behaviour change for valid callers.
+
+- **CEI ordering on `DKGStakingConvictionNFT.withdraw`.** The receipt NFT is now burned before `StakingV10.withdraw` drives the CSS teardown + TRAC payout. `StakingV10.withdraw` gates on the CSS position (`pos.identityId == 0`), not NFT existence, so the CSS teardown is unaffected.
+- **`nonReentrant` perimeter on KAV10 entrypoints.** `publish` / `update` / `extendKnowledgeCollectionLifetime` now carry OZ `ReentrancyGuard.nonReentrant` as a defense-in-depth perimeter against the ERC-1155 receiver-hook callback path. ~50 gas/call overhead. KAV10 version: `10.1.0` → `10.1.1`.
+- **Strict-positive `tokenAmount` floor in KAV10 `_validateTokenAmount` AND post-discount floor in `PublishingConviction.coverPublishingCost`.** Both branches of the publish flow now charge a non-zero economic cost regardless of input rounding: direct-spend reverts `InvalidTokenAmount(1, 0)` on `tokenAmount == 0`; the conviction (PCA) branch inflates a truncated `discountedCost == 0` to `1` wei TRAC when `baseCost > 0` so the active-sink reward distribution + `windowSpent` accounting always fire. **BREAKING for any caller that previously relied on dust-CG zero-amount publishes** — the on-chain revert is the floor of truth; off-chain callers must encode `tokenAmount >= 1`. PublishingConviction version: `1.0.0` → `1.0.1`.
+- **Single source of truth for op-wallet validation in `Identity.addOperationalWallets`.** Same-identity collisions (primary added by `createIdentity` OR intra-array duplicate within the same call) surface as `OperationalWalletDuplicate(wallet)`; cross-identity collisions still fire `OperationalKeyTaken(key)`; admin/operational wallet overlap surfaces as the existing `KeyAlreadyAttached(key)`. `Profile.createProfile`'s pre-flight validation loop is removed — atomic-revert semantics make the prior "fail-fast at the entrypoint" rationale moot, and the relocation removes the duplicate validation pass on the happy path. Identity version: `1.0.0` → `1.1.0`; Profile version: `1.3.0` → `1.4.2`.
+- **`Profile.recreateProfile` signature refinement.** Drops the `uint16 initialOperatorFee` argument; the recovered profile is seeded at fee = 0 and the admin sets the real value via the cooldown-gated `updateOperatorFee` path. Keeps the recovery and steady-state surfaces symmetric on the operator-fee dimension. ADR `docs/adr/0001-recreate-profile-admin-only.md` updated.
+- **Chain-package ABI sync.** `packages/chain/abi/KnowledgeAssetsV10.json` and `packages/chain/abi/Profile.json` re-exported from the freshly regenerated `evm-module/abi/` copies so the chain adapter's error decoder (which prefers its local override over the published artifact) resolves `ReentrancyGuardReentrantCall`, `InvalidTokenAmount`, and the new Profile error surface as structured errors instead of opaque reverts.
+- **Regression coverage.** New unit tests pin every new revert surface: `publish` + `extendKnowledgeCollectionLifetime` revert `InvalidTokenAmount(1, 0)` on `tokenAmount == 0`; `publish` reverts `ReentrancyGuardReentrantCall()` when re-entered from the ERC-1155 mint acceptance callback (via the new `MockReentrantPublisher` test harness); `PublishingConviction.coverPublishingCost(baseCost=1, ...)` floors `discountedCost` at 1 and propagates that floor through the active-sink reward distribution + `windowSpent` accounting; `Identity.addOperationalWallets` per-class disambiguation; `Profile.createProfile` per-class diagnostics.
+
+Compatibility: `recreateProfile`'s signature is a BREAKING change for the recovery script. The `tokenAmount > 0` floor is a BREAKING change for any zero-cost publish flows. Off-chain consumers pinned to `KnowledgeAssetsV10@10.1.0` or `Profile@1.3.0` need a version bump. No storage-layout changes — KAV10's added `ReentrancyGuard` storage slot lands at the end of the inheritance chain, and V10's redeploy-and-reinit pattern doesn't preserve storage across upgrades anyway.
+
 ## [10.0.0-rc.11] - 2026-05-26
 
 ### Added — Node release visible on the libp2p wire

README.md

@@ -143,6 +143,34 @@ TOKEN=$(dkg auth show)
 curl -H "Authorization: Bearer $TOKEN" http://127.0.0.1:9200/api/agents
 ```
 
+### Updating your node
+
+To update DKG, run one command:
+
+```bash
+dkg update                  # pull the latest release from npm and restart
+dkg update --check          # check what's available without applying
+dkg update --allow-prerelease   # follow the `next` dist-tag for pre-release builds
+dkg rollback                # revert to the previous version
+```
+
+Do **not** `git pull` or clone the repository to update — `dkg update` is the canonical verb. If anything looks off (multiple repositories on disk, served UI doesn't match version, version skew between daemon and CLI), run `dkg doctor` for a structured diagnostic of the install state. See [`OT-RFC-41`](https://github.com/OriginTrail/dkgv10-spec/blob/main/rfcs/OT-RFC-41-edge-node-npm-only-install-and-update.md) for the design rationale.
+
+### Contributors / monorepo development
+
+Hacking on DKG itself? Don't go through `npm install -g`. Clone, install, and run from the workspace:
+
+```bash
+git clone https://github.com/OriginTrail/dkg.git
+cd dkg
+pnpm install
+pnpm dkg start             # or `pnpm dkg <any subcommand>`
+```
+
+Contributor state lives under `~/.dkg-dev/` (separated from `~/.dkg/` so a contributor's dev work doesn't stomp on their own Edge install). `dkg update` is intentionally disabled in monorepo-checkout mode — use `git pull && pnpm install && pnpm build` instead.
+
+The legacy `install.sh` git-checkout installer was removed in rc.12 (OT-RFC-41 §5 PR 6). If you have an existing `install.sh`-style install, run `npm install -g @origintrail-official/dkg` to take over the install; the daemon will detect the legacy `~/.dkg/releases/` tree on first start, record the active slot version into `~/.dkg/previous-version` (rollback target), and resume from the npm-global install. `dkg doctor` flags any leftover cleanable state. See [`docs/archive/MIGRATE_TO_NPM.md`](docs/archive/MIGRATE_TO_NPM.md) for historical context on the pre-rc.12 procedure.
+
 ---
 
 ## Community integrations
@@ -236,9 +264,10 @@ dkg integration list [--tier community]  # default tier filter is `verified`+
 dkg integration info <slug>              # show details for one entry
 dkg integration install <slug>           # install cli/mcp kind; --allow-community for community-tier entries
 
-# Update / rollback
-dkg update [--check] [--allow-prerelease]  # update node software
+# Update / rollback / diagnose
+dkg update [--check] [--allow-prerelease]  # update node software via npm registry
 dkg rollback                               # roll back to previous version
+dkg doctor [--json]                        # diagnostic report: install layout, version skew, orphan clones, UI mismatch, plugin root, config sanity
 ```
 
 Run `dkg <command> --help` for per-command options.
@@ -311,6 +340,109 @@ analysis reports are under `bench/results/profiles/`, including
 
 ---
 
+## Triple Store Backends
+
+A DKG node keeps every assertion in an [RDF](https://www.w3.org/RDF/) triple store. Out of the box the node runs an embedded [Oxigraph](https://github.com/oxigraph/oxigraph) instance, which is everything you need on a workstation — no extra process, no extra port, no extra config. Heavier deployments can swap in [Blazegraph](https://blazegraph.com/) (the mainnet store) or any SPARQL 1.1 server.
+
+| Backend | When to pick it |
+|---|---|
+| `oxigraph-worker` (default) | Single-operator nodes, dev, CI. No setup. File-backed, capped at process RAM. |
+| `blazegraph` | High-throughput nodes, mainnet parity, very large graphs (10M+ quads). Run as a separate daemon (Docker or `java -jar`). Shares cleanly with V6 / V8 instances — DKG scopes its writes to the `did:dkg:context-graph:` named-graph prefix. |
+| `sparql-http` | Any SPARQL 1.1 Protocol server (Fuseki, GraphDB, Stardog, Neptune…). Bring your own URL + (optional) auth header. |
+
+### Configure via `dkg init`
+
+Two paths:
+
+**1. Point at an existing Blazegraph instance:**
+
+```
+$ dkg init
+…
+Triple store backend (oxigraph / blazegraph) (oxigraph): blazegraph
+Blazegraph SPARQL endpoint URL: http://127.0.0.1:9999/bigdata/namespace/mynode/sparql
+  Store endpoint reachable: blazegraph http://127.0.0.1:9999/bigdata/namespace/mynode/sparql
+```
+
+**2. Let `dkg init` provision a Blazegraph container via Docker:**
+
+```
+$ dkg init
+…
+Triple store backend (oxigraph / blazegraph) (oxigraph): blazegraph
+Blazegraph SPARQL endpoint URL:                                    ← leave blank
+No URL provided. Provision a Blazegraph container via Docker? (y/n) (y): y
+  Starting Blazegraph in Docker (namespace: mynode)…
+  Docker available: Docker version 24.0.6, build ed223bc
+  Created container "dkg-blazegraph-mynode" on port 9999.
+  Created Blazegraph namespace "mynode".
+```
+
+The Docker provisioner pins `lyrasis/blazegraph:2.1.5` (same image and tag as mainnet and the devnet test fixture), uses `--restart unless-stopped`, auto-bumps the host port if 9999 is taken, and is idempotent — re-running `dkg init` against an already-provisioned namespace reuses the running container.
+
+The wizard validates non-Docker URLs via an `ASK { ?s ?p ?o }` probe before saving — typos or unreachable namespaces are caught at setup time, not at first boot. A 404 surfaces a specific "namespace likely doesn't exist" message rather than the generic network-failure hint.
+
+### Configure via flags (scripted setup)
+
+Every setup entry point honours `--store` / `--store-url`:
+
+```bash
+# Init only
+dkg init --store blazegraph --store-url http://127.0.0.1:9999/bigdata/namespace/mynode/sparql
+
+# Adapter setups (validated + persisted after the adapter step completes)
+dkg hermes setup    --store blazegraph --store-url http://blaze.example/sparql
+dkg openclaw setup  --store blazegraph --store-url http://blaze.example/sparql
+dkg mcp setup       --store blazegraph --store-url http://blaze.example/sparql
+```
+
+`--store oxigraph` on a previously-Blazegraph node clears the persisted block (force-fall-back to the local default).
+
+### Configure via `~/.dkg/config.json`
+
+```json
+{
+  "store": {
+    "backend": "blazegraph",
+    "options": {
+      "url": "http://127.0.0.1:9999/bigdata/namespace/mynode/sparql",
+      "managedByDkg": false
+    }
+  }
+}
+```
+
+For `sparql-http`:
+
+```json
+{
+  "store": {
+    "backend": "sparql-http",
+    "options": {
+      "queryEndpoint": "http://server.example/query",
+      "updateEndpoint": "http://server.example/update",
+      "auth": "Bearer YOUR_TOKEN"
+    }
+  }
+}
+```
+
+### What changes when you pick an external backend
+
+- **Boot-time health check**: the daemon refuses to start until the endpoint answers `ASK`. Unreachable URLs print an actionable message naming the URL — no half-broken daemon.
+- **Namespace identity tag**: on first boot the daemon writes a triple into a reserved `<urn:dkg:store-meta>` graph recording its node name. Subsequent boots verify the tag before doing any writes — two DKG nodes pointed at the same Blazegraph namespace can't silently corrupt each other any more. Mismatches print the cleanup recipe (`DELETE WHERE { ... }`).
+- **Backend-aware reset**: chain-reset (and rebooting against a different backend) scopes its `DELETE` to the `did:dkg:context-graph:` prefix, leaving any V6/V8 data on the same Blazegraph instance untouched. Docker-provisioned namespaces (`managedByDkg: true`) use the faster `DROP ALL` path.
+- **Backend-switch guard**: switching backends between boots is treated like a destructive operation. The daemon prints a multi-line warning and refuses to start unless you set `DKG_ACCEPT_STORE_RESET=1`. Reverting `store.backend` in your config recovers the previous backend's data.
+- **Metrics**: `/api/status` exposes `storeUrl` and `storeQuads` (cached for 30 s) instead of the `storeBytes` file size — quad count is what's meaningful when the store isn't a local file.
+- **Required config**: when you enable `largeLiteralStorage` or `sharedMemoryPublicSnapshotStorage` with an external backend, you must set their `directory` explicitly (no local store path to infer from). The daemon fails fast at config-load if either is missing.
+
+### Limitations
+
+- **Auth / TLS**: only the generic `sparql-http` backend accepts an `Authorization` header. For Blazegraph behind auth or HTTPS-with-custom-CA, run a reverse proxy in front of it for now.
+- **Migration tool**: there is no `dkg migrate-store` between backends. Plan a chain-reset window if you need to switch on a node that holds important non-VM state.
+
+---
+
 ## Testnet Funding
 
 A DKG testnet node needs Base Sepolia ETH (to pay gas for on-chain operations) and test TRAC (for staking and publishing). The Origin Trail testnet faucet hands out both in a single API call, so first-setup paths auto-fund the generated admin wallet plus the three operational wallets when a faucet is configured in the network config.

devnet/agent-provenance/README.md

@@ -14,7 +14,7 @@ prefer running them before falling back to the manual recipes below.
 | Suite | Scope | Runtime | Command |
 | --- | --- | --- | --- |
 | Hardhat e2e | All 10 sequence diagrams from `RFC-001-implementation-walkthrough.md` (incl. Phase 4 author override + pre-signed AuthorAttestation), run against an in-process Hardhat EVM. Covers contract correctness + publisher integration in a single process. | ~30s | `pnpm test:e2e:agent-provenance` |
-| 5-node devnet | All 4 modes (a/b/c/d) + negative case from §4 + §9.5, run against `./scripts/devnet.sh start 5`. Mode (b) registers a custodial agent on core 2 and validates `KC.author = agent.wallet` while `publisherNodeIdentityId = core2.id`. | ~35s after devnet is up | `pnpm test:devnet:agent-provenance` |
+| 5-node devnet | All 4 modes (a/b/c/d) + negative case from §4 + §9.5, run against `./scripts/devnet.sh start 5`. Mode (b) registers a custodial agent on core 2 and validates `KC.author = agent.wallet` while `publisherNodeIdentityId = core2.id`. Includes a `mode (a) strict` variant that drains edge op-wallets' TRAC to literal zero via `hardhat_setStorageAt` and asserts the publish still succeeds via the PCA — pinning the "publisher EOA holds only gas tokens, spends TRAC from PCA" operator scenario. | ~35s after devnet is up | `pnpm test:devnet:agent-provenance` |
 
 Phase 4 author override (RFC §4(b)) is now wired end-to-end via the
 agent-keystore: end-user agents register on a daemon (`POST