Gate dAuth by registry oracles

[aledefra]

Summary

• Cache the local node DAuthOracleRegistry decision once at plugin startup.
• Use Core chore: update core #215 lifecycle hooks (should_pause, should_resume, on_pause, on_resume) instead of a manual _process gate.
• Fail closed for non-dAuth nodes and registry errors without repeated blockchain reads.
• Tear down the FastAPI request monitor, Uvicorn/start commands, queued requests, log readers, and tunnel before the plugin remains paused.
• Verify teardown and block resume after incomplete cleanup; only registry-eligible nodes may resume.
• Keep auth endpoint gating as defense in depth.
• Preserve normal supervisor secrets for protocol oracles while restricting the dAuth tunnel token to registry dAuth oracles.

Dependency

Requires the plugin pause lifecycle hooks merged in Ratio1/naeural_core#215.

Tests

• focused dAuth registry/lifecycle suite: 14 passed
• downstream Add dAuth job secret endpoints #458 combined dAuth suite after rebase: 23 passed
• Core pause lifecycle suite: 10 passed
• compileall and diff checks: passed

Residual Coverage

The focused edge tests use FastAPI lifecycle fakes. Real Uvicorn/Cloudflare pause-resume behavior is covered by the reference testbed in edge-node #470, but not repeated as a dAuth-specific Docker E2E in this PR.

[Copilot]

Pull request overview

This PR hardens the dAuth manager by failing closed unless the current node (and requesters, for secret disclosure) are registered as dAuth oracles, reducing the risk of serving auth material or supervisor/tunnel secrets from (or to) unregistered nodes.

Changes:

• Gate supervisor/tunnel secret inclusion in fill_dauth_data() on both protocol-oracle membership and dAuth-registry oracle membership (fail-closed on registry check errors).
• Add a cached dAuth-registry gate in the dAuth manager plugin to stop tunnel lifecycle work when unregistered, and fail closed at the auth endpoint with a forced fresh check.
• Add focused unit tests for secret omission and _process() gating behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
extensions/business/dauth/dauth_mixin.py	Tightens secret disclosure by requiring dAuth registry oracle status in addition to protocol oracle status.
extensions/business/dauth/dauth_manager.py	Adds runtime + endpoint gating based on dAuth registry status, including periodic re-checking and tunnel stop on disable.
extensions/business/dauth/test_dauth_registry_gating.py	Adds unit coverage for secret gating and manager _process() gating using a lightweight loader harness.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.