fix(transport): UTC-stable hash + derive hop reset (live round-trip proof)

[cryptoxdog]

Summary

• Fix transport_hash host-dependence: datetime canonicalize always uses UTC/Z (was local TZ → macOS EDT ≠ Docker UTC → CEG/EIE 400 transport_hash does not match packet).
• Fix derive() to reset hop_trace (parent hops keep parent packet_id; lineage owns parentage). Unblocks GateClient inbound hop validation after real worker responses.
• Document LIVE_TRANSPORT_ROUNDTRIP_PASS evidence (no stubs): Gate :9000 → CEG :8000 (ceg-real) → EIE :8001 (enrichment-engine).

Proof

• Harness: PLASTICOS_GATE_LIVE_URL=http://127.0.0.1:9000 → pytest tests/integration/test_gate_external_authority_e2e.py → 3 passed
• Evidence: reports/TASK-046-live-transport-roundtrip.md + .json
• Digest: sha256:819de0dde2e1ad66ef0fa0f00a48350f7d8351c405def83c50aa093cde730235
• Registry: only real workers; stub ports 9101/9102 free
• Response sources: ceg-real / enrichment-engine

Honest non-claims

• Not full semantic LIVE_INTEGRATION_PASS / PROMOTION_APPROVED
• Match handler returned ValidationError (sparse graph / no candidate); converge returned ValueError — transport + hop integrity still valid

Repo boundary

• Only Gate_SDK — Constellation.Gate / CEG / EIE trees unchanged (runtime overrides were local /tmp only)

Gate A

cd "$HOME/.cursor-governance"
env -u VIRTUAL_ENV UV_NO_SYNC=1 make pr WS=/tmp/gate-sdk-pr-gate PR_BASE=origin/main
→ RESULT: PASS — local PR gate clean (changed files only)
→ 236 passed

Test plan

• pytest tests/transport/test_hashing.py tests/transport/test_lineage.py tests/runtime/test_execution.py
• Cursor-Governance make pr PASS on clean worktree
• Live e2e 3/3 against real :8000/:8001 (documented in reports/)
• CI green on this PR

Made with Cursor

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR updates the Constellation Node SDK’s transport contract implementation to eliminate host-dependent transport_hash differences caused by timezone handling, and to align derive() semantics with hop-trace validation rules by ensuring derived packets do not inherit parent hop observations.

Changes:

• Canonicalize all datetime hash material to UTC (...Z), treating naive datetimes as UTC to keep transport_hash host-invariant.
• Change TransportPacket.derive() to reset hop_trace (only optionally including a single new hop), relying on lineage to represent parentage.
• Add/adjust unit tests and contract/spec documentation, plus include a live round-trip evidence report.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests/transport/test_lineage.py	Adds coverage ensuring derive() resets hop_trace and the child remains hop-trace-valid.
tests/transport/test_hashing.py	Adds coverage for UTC-stable datetime canonicalization and packet round-trip integrity.
tests/runtime/test_execution.py	Updates expectations to match new derive() hop-trace reset behavior in runtime execution flow.
src/constellation_node_sdk/transport/packet.py	Implements derive() behavior change to reset hop_trace on child packets.
src/constellation_node_sdk/transport/hashing.py	Makes datetime canonicalization always UTC and host-invariant for hashing.
reports/TASK-046-live-transport-roundtrip.md	Adds human-readable live round-trip evidence and explanation of defects addressed.
reports/TASK-046-live-transport-roundtrip.json	Adds machine-readable evidence artifact for the live round-trip proof.
contracts/TRANSPORT_PACKET_SPEC.md	Documents UTC datetime hashing rule and derive() hop-trace reset semantics.
.gitignore	Ignores /WIP/ directory for local work-in-progress artifacts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.