Governance + L2PS — May 2026 PR batch

[linear]

Umbrella issue tracking 4 open PRs across the SDK, node, and agent-commerce-demo repos that came out of the governance / L2PS investigation in May 2026.

PR map

#	Repo	PR	Title	Status
1	kynesyslabs/sdks	#90	test(denomination): networkUpgrade/networkUpgradeVote roundTripHash fixtures	Ready to merge
2	kynesyslabs/node	#876	diag(governance): dev-node battery + isCoherent mismatch dump + analysis	Ready to merge
3	kynesyslabs/sdks	#87	fix(l2ps): per-call AES-GCM nonce in encryptTx (was reusing static IV)	3 unresolved security findings
4	kynesyslabs/agent-commerce-demo	#11	feat(ui): visible L2PS encrypted-on-chain badge in NEGOTIATE header	Awaiting human review

Context

• The governance hash-mismatch surfaced on dev.node2 while running scripts/dev-node-battery.ts. Native pay / stake / unstake confirm cleanly; DemosTransactions.proposeNetworkUpgrade hits [Tx Validation] [SIGNATURE ERROR] Transaction hash mismatch. Root cause not yet pinned (deployed binary is dirty=true, no log access) — sub-issue Splitting transactions from blocks #2 ships the diagnostic infrastructure to capture it on next repro.
• Sub-issue Fees development #1 closes the SDK-side coverage gap that let the divergence slip through — every governance test bypasses the SDK builder, so the SDK had no canonical guard against drift in the byte shape it ships.
• Sub-issue refactoring (please read the description) + initial POST support #3 is unrelated to governance but came from the same investigation arc — Greptile + CodeRabbit flagged 3 security concerns (AAD binding, decryption AAD, nonce validation) on the L2PS nonce fix that need to land before that PR can merge.
• Sub-issue Unified tx #4 is the UX badge that proves L2PS is active to the user — pure UI, no AI feedback, just needs a human review pass.

Merge order

1. SDK Rewrite demos.ts to work with HTTP #90 first (test fixtures, zero risk, locks the contract)
2. SDK Implement HTTP logic in SDK #87 after addressing security findings (carries the actual encryption change)
3. Node diag(governance): dev-node battery + isCoherent mismatch dump + hash-mismatch analysis #876 (depends on SDK being on a clean v4 — current is fine)
4. Demo (UI revamp) txeditor/xm #11 anytime (orthogonal)

Linked sub-issues

See sub-issues below for per-PR status, action items, and AI feedback summary.