[gfyrag]

Summary

• add backward-readable capability policy and replay-floor fields to the replicated cluster policy
• declare stable required capability IDs on final Raft proposals and reject mismatched declarations before rawNode.Propose
• add deterministic membership/policy evaluation for voters and learners, plus rollout and recovery documentation

Validation

• bash scripts/agent-check
• go test ./internal/infra/capabilities ./internal/infra/node ./internal/application/admission

Release sequencing

• Target delivery is v3.0.0-rc.3: this PR is the backward-readable capability-barrier foundation needed before the incompatible protocol cutover.
• The rc.2 → rc.3 upgrade remains rolling, so the RefreshMembership compatibility retry for older peers is intentionally retained.
• The rc.3 → rc.4 protocol cutover is the coordinated stop-and-restart boundary; future incompatible behavior must be activated only after every node runs the barrier-aware binary.
• Coordinate the release-boundary documentation and integration coverage with refactor(raft): use proposal payloads after a full-stop upgrade #2404, fix(ledger): guard mirror promotion until catch-up #2376, and fix(ledger): restore exact id filters for logs and transactions #2425; those changes must not assume an rc.2 → rc.3 full-stop path.

Relates to EN-3046. This PR is intentionally scoped to Ledger; the coordinated operator upgrade in EN-3047 is out of scope.

[gfyrag]

The Dirty check failed in run 39279211208 because just pre-commit rewrote six tracked files on the CI toolchain, then the final git diff check failed. The first mismatch was generated-source/toolchain drift (protoc v7.34.2 / protoc-gen-go-vtproto (devel) in CI), plus the nlreturn formatter changes in the capability files. I regenerated and formatted those exact outputs, verified the worktree is clean after just pre-commit up to the long-running lint stage, and pushed fix commit 9d595ca05 (chore(ledger): sync generated capability sources).

[shipfox-ai]

Shipfox review

2 P2

The PR adds replicated capability-policy and proposal declaration fields plus pure validation helpers, then adds a pre-Raft declaration check. The admission barrier and replay floor are not fully enforced or preserved across normal policy updates and recovery.

_{Reviewed 34ab25b830cf3fb9c83ddc9662accd1b075b3248...cf3473a1ee663ce1ff6e2c5c914c4eb3902aaed0.}

[shipfox-ai]

Shipfox review

New since cf3473a: 6 P1 · 1 P2

Resolved 2 earlier findings.

_{Reviewed the changes since cf3473a1ee663ce1ff6e2c5c914c4eb3902aaed0 in 9c57884775ae39fcff972e6af112fd1f197d61a6...32821622bc385bbb83539b7307a82bdc975bc84b.}

[gfyrag]

Fixed in commit 6d76261.

The failing Tests-E2E-Business, Tests-E2E-Cluster, Tests-Model, and Tests-Antithesis-Workload jobs all exposed the same regression: Admission.Barrier serialized a semantic proposal without declaring its required capabilities, so the final proposal validator rejected it. Barrier now stamps the semantic capability field before marshaling and copies the derived declaration to the Raft proposal. Added a regression test that validates the final wire declaration.

[gfyrag]

Fixed in commit e9899e8.

The Dirty job was caused by seven protobuf artifacts generated with a local protoc/vtproto toolchain different from CI. These artifacts were regenerated with nix develop .#ci and the diff is limited to the CI-compatible generated output.

[gfyrag]

Fixed in commit c3a8fd9.

The Dirty job also reported lint --fix drift in eight Go files. The CI lint formatting/import changes are now committed; just pre-commit completes cleanly with 0 issues.

[shipfox-ai]

Shipfox review

New since 3282162: 1 P2

7 earlier findings are still open.

_{Reviewed the changes since 32821622bc385bbb83539b7307a82bdc975bc84b in 9c57884775ae39fcff972e6af112fd1f197d61a6...c3a8fd915a66caf89f1a4733c2f69fdb38b6af9a.}

[shipfox-ai]

Shipfox review

No new issues in 1 file changed since c3a8fd9.

8 earlier findings are still open.

_{Reviewed the changes since c3a8fd915a66caf89f1a4733c2f69fdb38b6af9a in f42c74fe6c770d907fe10bf6de7ecdc5c6220a2a...1e1fe85246fd7390b2b65fa40ea673fd44840320.}

[shipfox-ai]

Shipfox review

New since 1e1fe85: 1 P1 · 1 P2

Resolved 1 earlier finding. 7 earlier findings are still open.

_{Reviewed the changes since 1e1fe85246fd7390b2b65fa40ea673fd44840320 in 3d73377506b392655c48f898cf87c93fec86cceb...c8ad6f7899ad9106d93cbdd266abbdda0182067c.}

[shipfox-ai]

Shipfox review

New since c8ad6f7: 1 P1

Resolved 1 earlier finding. 8 earlier findings are still open.

_{Reviewed the changes since c8ad6f7899ad9106d93cbdd266abbdda0182067c in 3d73377506b392655c48f898cf87c93fec86cceb...149dfff81c7adc894e1c73e2df38cba2af835bf3.}

[shipfox-ai]

Shipfox review

No new issues in 3 files changed since a99d84c.

_{Reviewed the changes since a99d84cc5b4e28b0e4fa200621633b6b130eb43e in 20c55fd8538630599b2dd03b3489454792263798...c27bde1e6a2a7c8a1b9a4e48a76d60ff0e30bcf2.}

[shipfox-ai]

Shipfox review

No new issues in 1 file changed since c27bde1.

_{Reviewed the changes since c27bde1e6a2a7c8a1b9a4e48a76d60ff0e30bcf2 in 20c55fd8538630599b2dd03b3489454792263798...cb1af52cfeafabc61ba909d5bd2bc118c3f014d5.}

[flemzord]

DECISION: APPROVE
Head reviewed: cb1af52
Base: 20c55fd

Incremental re-review from 3a2d277, including the rebased full PR context. The range-diff preserves the previously reviewed implementation; the functional delta fixes startup and background RPC deadline handling and narrows activation detection to the dedicated policy payload emitted by admission. The generated protobuf follow-up changes only its compiler-version header.

FIXED: the remaining bounded restart-refresh finding. Both local attempt expiry and an early remote DeadlineExceeded remain transient while the lifecycle is live. Repeated remote deadlines now retry through success; lifecycle cancellation and permanent rejection remain terminal. The background retry and comment-contract findings are also fixed. The earlier predicted-index capacity finding remains fixed. Native activation extraction, cancellation-safe membership fencing, recovered-peer refresh, and unsupported-capability recovery checks remain intact.

Validation passed in pinned Nix: agent-check; capability contract; revision-40 wire compatibility; protobuf lint; complete race suites for bootstrap, admission, capabilities, node, infrastructure/application membership, plan, state, policy processing, and reconciler. Refresh/error-classification regressions passed 30 race-enabled repetitions. Focused race checks passed for gRPC, backup policy, protobuf JSON, and validation gate selection. The evaluator benchmark and full-PR whitespace check passed. Tracked files are unchanged.

Limits: agent-check-pr gate selection was inspected with the exact base; its broad/full, E2E, and normalization gates were not executed in this read-only review. Released-binary upgrades, an activation-specific incremental-restore delta, and complete admission latency were not exercised locally. No .codegraph directory is present; source and caller inspection used Git and rg. Immediately before publication, the PR was open, non-draft, conflict-free, and unchanged at the reviewed head. Repository Invariants passed; Default and PR Images are still running.

Blocking findings: 0
Non-blocking findings: 0
Residual risk: MEDIUM

[shipfox-ai]

Shipfox review

New since cb1af52: 1 P2

_{Reviewed the changes since cb1af52cfeafabc61ba909d5bd2bc118c3f014d5 in 20c55fd8538630599b2dd03b3489454792263798...266722e8e42818bd25e44d31bb4b2b7c7c14f518.}

[shipfox-ai]

Shipfox review

No new issues in 11 files changed since 266722e.

Resolved 1 earlier finding.

_{Reviewed the changes since 266722e8e42818bd25e44d31bb4b2b7c7c14f518 in 20c55fd8538630599b2dd03b3489454792263798...190b172fc13ae92aa249820913f8af5cf7728736.}

[shipfox-ai]

Shipfox review

New since 190b172: 1 P2

_{Reviewed the changes since 190b172fc13ae92aa249820913f8af5cf7728736 in 20c55fd8538630599b2dd03b3489454792263798...72808378d58ade03ecbaf233e5b13b17f6c09564.}

[shipfox-ai]

Shipfox review

No new issues in 1 file changed since 7280837.

Resolved 1 earlier finding.

_{Reviewed the changes since 72808378d58ade03ecbaf233e5b13b17f6c09564 in 20c55fd8538630599b2dd03b3489454792263798...0e1aa37e90a262e53ecfc2b75c67eab999168e5e.}

[shipfox-ai]

Shipfox review

No new issues in 2 files changed since 0e1aa37.

_{Reviewed the changes since 0e1aa37e90a262e53ecfc2b75c67eab999168e5e in 20c55fd8538630599b2dd03b3489454792263798...6f87a0c0fe80d0678b5a134da095985fc4f37846.}

[shipfox-ai]

Shipfox review

No new issues in 1 file changed since 6f87a0c.

_{Reviewed the changes since 6f87a0c0fe80d0678b5a134da095985fc4f37846 in 20c55fd8538630599b2dd03b3489454792263798...55fd2b840b86562221b5a263c3a47bbc2471934b.}