fix(proposals): PR #3581 fresh-review findings — authority invariants, TOCTOU summaries, strict decision routes (cave-v4ep)

[BunsDev]

Follow-up to merged PR #3581, bead cave-v4ep — implements all three fresh-review findings (TDD, verified-but-uncommitted WIP from prior sessions; committed and rebuilt onto current main this session).

What changed

• Proposal authority invariants: daemon stagedAt, vetoDeadline, and earliestClose bind by exact RFC3339 instant at nanosecond precision; earliestClose also requires matching null presence (src/lib/proposal-authority.ts, threads adapters/read).
• TOCTOU-safe proposal summaries: staged veto timing validation is deterministic and offset-aware.
• Strict decision-route note validation: shared pure parser src/lib/proposal-decision-body.ts used by approve/reject routes, with exact route-forwarding source pins; removed the false-positive 503 note-forwarding claim.
• Phase-5 daemon-summary fixtures updated to the stricter contract.

Verification (after rebuild onto main 94dbf95)

• pnpm test:app — 862 test files green
• Focused suites (threads-read, threads-adapters, proposals-flow-e2e, api-contracts) — 163/163
• pnpm typecheck clean; pnpm check:tests-wired — 1164 wired

[Copilot]

Pull request overview

This PR tightens Phase 5 proposal lifecycle handling by enforcing stricter daemon/staged authority invariants, preventing TOCTOU issues when joining staged proposals to daemon summaries, and centralizing decision-route body parsing/validation so approve/reject handlers can’t drift.

Changes:

• Enforce exact-instant (nanosecond) binding for stagedAt, vetoDeadline, and earliestClose (including null-presence requirements) when verifying daemon authority.
• Make daemon proposal summaries TOCTOU-safe by certifying a stable pending snapshot before and after the daemon summary request (fail closed if it changes).
• Introduce a shared pure request-body parser for approve/reject routes and update tests/fixtures to match stricter label + timing contracts.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/lib/threads-read.test.ts	Expands Phase 5 authority-binding tests (offset-equivalence, nanos precision, strict label/deadline contracts).
src/lib/threads-adapters.ts	Adds readPendingSnapshot hashing + stable-snapshot verification to fail closed on pending TOCTOU during summary fetch.
src/lib/threads-adapters.test.ts	Adds coverage for TOCTOU-fail-closed behavior and updates expected canonical labels.
src/lib/proposal-decision-body.ts	New shared pure parser for decision route bodies (expectedRevision + note validation).
src/lib/proposal-authority.ts	Implements instant-based binding (epoch nanos) and stricter approvalPath label/deadline validation + staged veto metadata consistency checks.
src/app/api/proposals/[id]/approve/route.ts	Switches to shared parser and forwards parsed values exactly.
src/app/api/proposals/[id]/reject/route.ts	Switches to shared parser and forwards parsed values exactly.
src/app/api/proposals-flow-e2e.test.ts	Pins route composition to shared parser and adds parser-specific + route-level note validation coverage.
src/app/api/api-contracts.test.ts	Extends “effective source” to include the shared parser when validating route contracts.
scripts/run-tests.mjs	Adds proposals-flow-e2e test to ALIAS_LOADER wiring.
fixtures/phase-5/*.daemon-summary.json	Updates Phase 5 daemon summary fixtures to canonical labels required by the stricter contract.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.