Reduce storage-commitment audit egress by verifying co-held leaves locally

[grumbach]

Summary

The storage-commitment audit (ADR-0002) round 2 has the responder serve the
sampled chunks' bytes back to the auditor, which is a large share of
steady-state replication traffic. When the auditor already holds a sampled
leaf, it can verify that leaf against its own copy instead of receiving the
bytes over the wire.

This change:

• Verifies a sampled leaf the auditor already holds against the auditor's own
  copy, with no chunk bytes on the wire. A sampled leaf the auditor does not
  hold is wire-challenged for the original bytes exactly as before. The verdict
  is the unchanged pass/fail with whole-slice credit.
• Makes the possession digest a domain-separated keyed BLAKE3 hash so the fresh
  per-audit nonce is bound into the digest over the whole content. The
  replication protocol id advances to v3 for a clean cutover.
• Returns no verdict (Idle) from the responsible-chunk audit when a challenged
  key's own local copy is unreadable, instead of a pass that reflects only the
  readable keys.

Expected impact

Expected egress for an audit is (1 - q) of round 2's chunk traffic, where q
is the fraction of the sampled leaves the auditor holds. The first-audit lane,
where the auditor holds nothing, is unchanged.

Testing

• Adds test-only observability (compiled under test/test-utils only) so an
  e2e test can confirm co-held leaves are verified locally with no byte
  challenge.
• Full lib suite, the commitment-audit PoC suites, and the real-QUIC
  subtree-audit e2e pass; cargo fmt and clippy are clean.

[Copilot]

Pull request overview

This PR reduces steady-state storage-commitment audit egress by letting an auditor verify sampled leaves it already co-holds against its own local bytes (instead of always round-2 byte-challenging the responder), while also strengthening the possession digest construction and tightening responsible-audit semantics when the auditor’s own local copies are unreadable.

Changes:

• Subtree audit round-2 now verifies co-held sampled leaves locally (zero egress) and wire-challenges only the remainder; protocol cutover is cleanly isolated via REPLICATION_PROTOCOL_ID → v3.
• Possession digest (compute_audit_digest) becomes a domain-separated keyed BLAKE3 construction that binds the per-audit nonce into the digest over the entire content.
• Responsible-chunk audit returns Idle (no verdict) when any challenged key cannot be verified due to unreadable local copies, preventing partial-read “passes”.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/poc_commitment_audit_attacks.rs	Updates PoC documentation to reflect the new local-vs-wire round-2 behavior.
tests/e2e/subtree_audit_testnet.rs	Adds an e2e regression test asserting co-held sampling yields zero byte challenges (egress-saving path).
src/replication/storage_commitment_audit.rs	Implements local co-held leaf verification, refactors wire verification into wire_verify_leaves, and adds test-only byte-challenge observability.
src/replication/recent_provers.rs	Updates documentation to match current close-group sizing assumptions.
src/replication/protocol.rs	Reworks compute_audit_digest to a domain-separated keyed BLAKE3 scheme and adds a construction-pinning unit test.
src/replication/possession.rs	Aligns documentation with the updated compute_audit_digest definition.
src/replication/mod.rs	Threads the local storage handle into subtree audits (gossip and first-audit paths).
src/replication/config.rs	Bumps replication protocol id to v3 and updates audit spotcheck documentation.
src/replication/commitment_state.rs	Adds test-only recording/querying of round-2 byte challenge keys per pinned commitment.
src/replication/audit.rs	Changes responsible-audit digest verification to return Idle when local reads prevent full verification, with supporting unit tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.