Tell the truth about CyberGym attestation and stay down on a contradiction

[wallscaler]

Summary

• Rewrite MINER_VALIDATOR.md from the shipped code. The CyberGym check is Cathedral Ed25519 over a customer receipt, not Intel DCAP. Default: record failure, pay anyway.
• Add docs/CYBERGYM_LANE.md: what the composer does, the four off switches, and the hard rule. Do not set CATHEDRAL_ALLOCATION_CONTRACT=v3 until distill refuses public-catalog task_ids.
• #114: PENDING_RECEIPT_CONTRADICTION now exits 3. The SN39 unit sets RestartPreventExitStatus=3 so systemd does not restart the writer against its own stay-stopped remediation.
• #125: public status now says an aged-out tip needs docs/PROVENANCE_CATCHUP.md. The catch-up itself is still an operator action. This PR does not re-anchor production.

Distill (note, do not flip past)

• Leak: dispatched arvo:<n> / oss-fuzz:<n> names n132/arvo:<n>-vul. Distill fix(publisher): bound the external-score epoch so one post cannot wedge a source #131. v3 stays off until that refuse ships.
• Live exposure: dispatch/artifact/submit auth defaults off. Distill ci: keep publisher compatibility advisory #33. Anyone can ask for task ids today.
• Also still open: deploy(sn39): track the epoch loop, and stop the two outages it caused #116 (trace bonus never pays), fix(sn39): bind every external score source to one audience and fence #136 (commit-then-draw decorative), #153 (nondeterministic differential).

v3 and CyberGym payout stay off. A v3 flip without a posting producer fails the whole weight vector.

Test plan

• test_recurring_loop_exits_on_post_signed_contradiction expects exit 3
• CyberGym attestation unit tests
• public status tests
• CI on the draft PR
• Deploy the unit drop-in / service file before relying on stay-down in production (cathedral-validator-passive.service on the host still needs the same RestartPreventExitStatus=3)

Made with Cursor