spec(network): the network job as a Queen job card -- receipts verified by Ed25519 in generated code, quorum, settle() and a pending-then-final test credit #8790

Problem

The network MVP chain (see #8613, #8685) has no live step b: no Queen job dispatches a real commit to the labs, and the decisions after the receipts (is it authentic, do the labs agree, how many independent votes, what settle() pays, when a credit is final) exist only in simulations. mvp.t27 and mvp_v2.t27 model a signature as an input bool.

Requirements

• FR-1: specs/jobs/network_job.t27, a card in the jobs.t27 shape: one parameter (a commit sha); steps CHECK job-commit, EFFECT lab-challenge, WAIT lab-receipts, CHECK receipts-verified, CHECK quorum, EFFECT settle-credit, WAIT challenge-window; the labs, their request paths (t27b-lab-2 has none: GAP), the registered keys and their operator.
• FR-2: specs/network/job_rules.t27, compiled to wasm for the Queen: receipt_auth judges a receipt's real bytes (corpus_receipt.t27 message, commit = job, signed_receipt.t27 order, tri/crypto/ed25519.t27 verify, nonce = challenge when challenged); results_agree; independent_votes (dedupe by key id, then operator); quorum_verdict against the trusted N/F/M (TEMP copy of mvp_v2's 4/1/3 until the hardening lane fixes them in one place); settle_outcome / settle_credit_mtri through trinet/ledger.t27 settle(), including a replay; credit_state PENDING -> FINAL after the window.
• FR-3: at least one test runs Ed25519 verify on a real lab receipt; tampered result, borrowed key, unregistered key, replay against a challenge and wrong commit each fail by name.

Acceptance criteria

• t27c test-report of both specs: 0 FAIL; the rules' tests are not vacuous.
• Seals saved; both specs listed in docs/reports/t27b_expectations.json.
• The runtime half (trios, branch mvp-live-dispatch) loads the card and calls the wasm; no rule is restated in TS.

Honest limits

Both labs and every registered key belong to one operator, so every job is ONE independent vote: QV_BELOW_QUORUM under N4/F1/M3, which may earn a test credit and nothing more. Test credits are not money.

🤖 Generated with Claude Code

User Scenarios

• Given a commit SHA is dispatched as a network job, When the Queen loads specs/jobs/network_job.t27 and calls the compiled specs/network/job_rules.wasm, Then the job steps execute CHECK job-commit, EFFECT lab-challenge, WAIT lab-receipts, CHECK receipts-verified, CHECK quorum, EFFECT settle-credit, WAIT challenge-window in order.
• Given a lab receipt with a valid Ed25519 signature over the correct challenge nonce and commit, When receipt_auth verifies the receipt bytes using tri/crypto/ed25519.t27, Then the check passes and the receipt is counted toward quorum.
• Given a tampered receipt, a borrowed key, an unregistered key, or a replay against a different challenge or commit, When receipt_auth runs, Then each case fails by its distinct error name.

Requirements

• FR-001: specs/jobs/network_job.t27 MUST define a Queen job card in the jobs.t27 shape with one parameter (commit sha) and steps: CHECK job-commit, EFFECT lab-challenge, WAIT lab-receipts, CHECK receipts-verified, CHECK quorum, EFFECT settle-credit, WAIT challenge-window; it MUST declare the labs, their request paths (noting t27b-lab-2 has none), the registered keys, and their operator.
• FR-002: specs/network/job_rules.t27 MUST compile to wasm for the Queen and implement: receipt_auth verifying real receipt bytes (corpus_receipt.t27 message, commit = job, signed_receipt.t27 order, tri/crypto/ed25519.t27 verify, nonce = challenge when challenged); results_agree; independent_votes (dedupe by key id, then operator); quorum_verdict against trusted N/F/M (TEMP copy of mvp_v2's 4/1/3); settle_outcome / settle_credit_mtri through trinet/ledger.t27 settle() including a replay; credit_state PENDING -> FINAL after the window.
• FR-003: The test suite MUST include at least one test that runs Ed25519 verify on a real lab receipt, and MUST have distinct failing tests for tampered result, borrowed key, unregistered key, replay against a challenge, and wrong commit.

Success Criteria

• t27c test-report specs/jobs/network_job.t27 specs/network/job_rules.t27 exits 0 with 0 FAIL; the rules' tests are not vacuous.
• Seals are saved; both specs/jobs/network_job.t27 and specs/network/job_rules.t27 are listed in docs/reports/t27b_expectations.json.
• 5 tests in specs/network/job_rules.t27 cover the named failure modes (tampered, borrowed key, unregistered key, replay wrong challenge, wrong commit) and pass.

Boundary

• specs/jobs/network_job.t27
• specs/network/job_rules.t27
• docs/reports/t27b_expectations.json
• specs/tri/crypto/ed25519.t27
• specs/hosting/credit.t27
• specs/tools/trinity/tri/test.t27