fix: consolidated V10 API hardening + finality principle (supersedes #105, #106, #107)

packages/adapter-openclaw/src/DkgNodePlugin.ts

@@ -372,9 +372,9 @@ export class DkgNodePlugin {
         name: 'dkg_publish',
         description:
           'Publish knowledge to a DKG context graph as an array of quads (subject/predicate/object). ' +
+          'Data is first written to Shared Working Memory, then published to Verified Memory on-chain. ' +
           'Object values that look like URIs (http://, https://, urn:, did:) are treated as URIs; ' +
-          'all other values become string literals automatically. ' +
-          'By default, published data is private (ownerOnly). Set access_policy to "public" to make it readable by anyone.',
+          'all other values become string literals automatically.',
         parameters: {
           type: 'object',
           properties: {
@@ -395,19 +395,6 @@ export class DkgNodePlugin {
                 'Array of quads to publish. Each quad has subject (URI), predicate (URI), and object (URI or literal string). ' +
                 'URIs are auto-detected by prefix (http://, https://, urn:, did:); everything else becomes a literal.',
             },
-            access_policy: {
-              type: 'string',
-              enum: ['public', 'ownerOnly', 'allowList'],
-              description:
-                'Access control: "ownerOnly" (only you can read — the default), ' +
-                '"public" (anyone can read), or "allowList" (only listed peers).',
-            },
-            allowed_peers: {
-              type: 'string',
-              description:
-                'Comma-separated peer IDs allowed to read the data. ' +
-                'Required when access_policy is "allowList". Must not be set for other policies.',
-            },
           },
           required: ['context_graph_id', 'quads'],
         },
@@ -566,43 +553,8 @@ export class DkgNodePlugin {
         };
       });
 
-      // Access policy: default to ownerOnly (private) when not specified
-      const VALID_POLICIES = new Set(['public', 'ownerOnly', 'allowList']);
-      const accessPolicy = args.access_policy
-        ? String(args.access_policy).trim()
-        : 'ownerOnly';
-
-      if (!VALID_POLICIES.has(accessPolicy)) {
-        return this.error(
-          `Invalid access_policy "${accessPolicy}". Must be one of: ${[...VALID_POLICIES].join(', ')}.`,
-        );
-      }
-
-      // Parse allowed_peers from comma-separated string
-      let allowedPeers: string[] | undefined;
-      if (args.allowed_peers) {
-        allowedPeers = String(args.allowed_peers)
-          .split(',')
-          .map(p => p.trim())
-          .filter(p => p.length > 0);
-      }
-
-      if (accessPolicy === 'allowList' && (!allowedPeers || allowedPeers.length === 0)) {
-        return this.error(
-          '"allowList" access_policy requires non-empty "allowed_peers" (comma-separated peer IDs).',
-        );
-      }
-      if (accessPolicy !== 'allowList' && allowedPeers && allowedPeers.length > 0) {
-        return this.error(
-          '"allowed_peers" is only valid when access_policy is "allowList".',
-        );
-      }
-
-      const result = await this.client.publish(contextGraphId, quads, undefined, {
-        accessPolicy: accessPolicy as 'public' | 'ownerOnly' | 'allowList',
-        allowedPeers,
-      });
-      return this.json({ kcId: result.kcId, kaCount: result.kas?.length ?? 0, quadsPublished: quads.length, accessPolicy });
+      const result = await this.client.publish(contextGraphId, quads);
+      return this.json({ kcId: result.kcId, kaCount: result.kas?.length ?? 0, quadsPublished: quads.length });
     } catch (err: any) {
       return this.daemonError(err);
     }

packages/adapter-openclaw/src/dkg-client.ts

@@ -188,12 +188,16 @@ export class DkgDaemonClient {
     privateQuads?: Array<{ subject: string; predicate: string; object: string; graph?: string }>,
     opts?: { accessPolicy?: 'public' | 'ownerOnly' | 'allowList'; allowedPeers?: string[] },
   ): Promise<any> {
-    return this.post('/api/publish', {
-      contextGraphId,
-      quads,
-      privateQuads,
-      accessPolicy: opts?.accessPolicy,
-      allowedPeers: opts?.allowedPeers,
+    if (privateQuads?.length || opts?.accessPolicy || opts?.allowedPeers?.length) {
+      throw new Error(
+        'privateQuads, accessPolicy, and allowedPeers are not supported in V10 SWM-first publish',
+      );
+    }
+    await this.post('/api/shared-memory/write', { paranetId: contextGraphId, quads });
+    return this.post('/api/shared-memory/publish', {
+      paranetId: contextGraphId,
+      selection: 'all',
+      clearAfter: true,
     });
   }
 

packages/adapter-openclaw/test/dkg-client.test.ts

@@ -287,50 +287,47 @@ describe('DkgDaemonClient', () => {
   // Publish
   // ---------------------------------------------------------------------------
 
-  it('publish should POST to /api/publish', async () => {
-    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
-      new Response(JSON.stringify({ kcId: 'kc-1' }), { status: 200 }),
-    );
+  it('publish should write to SWM then publish from SWM', async () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(new Response(JSON.stringify({ triplesWritten: 1 }), { status: 200 }))
+      .mockResolvedValueOnce(new Response(JSON.stringify({ kcId: 'kc-1' }), { status: 200 }));
 
     const quads = [{ subject: 'urn:a', predicate: 'urn:b', object: '"value"' }];
     const result = await client.publish('testing', quads);
     expect(result.kcId).toBe('kc-1');
 
-    const [url, opts] = fetchSpy.mock.calls[0];
-    expect(url).toBe('http://localhost:9200/api/publish');
-    expect(opts?.method).toBe('POST');
-    const body = JSON.parse(opts?.body as string);
-    expect(body.contextGraphId).toBe('testing');
-    expect(body.quads).toHaveLength(1);
-  });
+    expect(fetchSpy).toHaveBeenCalledTimes(2);
+    const [writeUrl, writeOpts] = fetchSpy.mock.calls[0];
+    expect(writeUrl).toBe('http://localhost:9200/api/shared-memory/write');
+    expect(writeOpts?.method).toBe('POST');
+    const writeBody = JSON.parse(writeOpts?.body as string);
+    expect(writeBody.paranetId).toBe('testing');
+    expect(writeBody.quads).toHaveLength(1);
 
-  it('publish should pass privateQuads', async () => {
-    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
-      new Response(JSON.stringify({ kcId: 'kc-2' }), { status: 200 }),
-    );
+    const [pubUrl, pubOpts] = fetchSpy.mock.calls[1];
+    expect(pubUrl).toBe('http://localhost:9200/api/shared-memory/publish');
+    expect(pubOpts?.method).toBe('POST');
+    const pubBody = JSON.parse(pubOpts?.body as string);
+    expect(pubBody.paranetId).toBe('testing');
+    expect(pubBody.selection).toBe('all');
+  });
 
+  it('publish should reject privateQuads', async () => {
     const quads = [{ subject: 'urn:a', predicate: 'urn:b', object: '"public"' }];
     const privateQuads = [{ subject: 'urn:a', predicate: 'urn:c', object: '"secret"' }];
-    await client.publish('testing', quads, privateQuads);
-
-    const body = JSON.parse(fetchSpy.mock.calls[0][1]?.body as string);
-    expect(body.privateQuads).toHaveLength(1);
-  });
-
-  it('publish should pass accessPolicy and allowedPeers', async () => {
-    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
-      new Response(JSON.stringify({ kcId: 'kc-3' }), { status: 200 }),
+    await expect(client.publish('testing', quads, privateQuads)).rejects.toThrow(
+      /not supported in V10/,
     );
+  });
 
+  it('publish should reject accessPolicy and allowedPeers', async () => {
     const quads = [{ subject: 'urn:a', predicate: 'urn:b', object: '"val"' }];
-    await client.publish('testing', quads, undefined, {
-      accessPolicy: 'allowList',
-      allowedPeers: ['12D3peer1', '12D3peer2'],
-    });
-
-    const body = JSON.parse(fetchSpy.mock.calls[0][1]?.body as string);
-    expect(body.accessPolicy).toBe('allowList');
-    expect(body.allowedPeers).toEqual(['12D3peer1', '12D3peer2']);
+    await expect(
+      client.publish('testing', quads, undefined, {
+        accessPolicy: 'allowList',
+        allowedPeers: ['12D3peer1', '12D3peer2'],
+      }),
+    ).rejects.toThrow(/not supported in V10/);
   });
 
   // ---------------------------------------------------------------------------