feat(e2ee): build a deployment-test Node daemon that trusts the hosted witness

[Lokesh7025]

Summary

#435 is merged and this branch is rebased on RC. It has two commits: feat(e2ee): build a deployment-test Node daemon that trusts the hosted witness, and chore(e2ee): license the deployment-test loader additions, which annotates the appended loader file in REUSE.toml (a header inside it would change the byte-exact loader).

A daemon cannot pair through the hosted deployment-test stack today:

• the production Node binding names no replica trust
• no supported key store exists on hosts such as WSL
• the configured endpoints added for tests keep their keys in memory, so a restart loses the paired session

build.mjs deployment-test (with AXL_E2EE_DEPLOYMENT_TEST_TRUST_FILE) builds dist/deployment-test. It is the production binding plus exactly one export, deploymentTestDaemonEndpoint(root, account, installation, session).

• Trust is pinned at build time. build.rs copies the named file into OUT_DIR, and the endpoint decodes it with ReplicaTrustSet::decode_config. Without a file (unit tests, lint) the pinned trust is empty and endpoints fail closed with rollback_anchor_unavailable.
• Keys persist in one owner-only file under root/keys. Each change is written to a sibling file, synced, and renamed into place before it becomes visible. A damaged file fails closed. This is not a secure store, and it ships in no production artifact.
• Loader: the production loader plus one appended export.
• Checks: check-abi forbids every deployment-test name in production. It also verifies that the deployment-test binary carries no test identifiers and that its loader is exactly production plus the appended export. artifact-policy treats deployment-test items as neither production nor test, so deployment_test_daemon_endpoint can't hide the test-only test_daemon_endpoint it contains.
• CI: runs the key store tests and clippy with the deployment-test feature.

Test plan

• cargo fmt --check; clippy -D warnings for the Node crate with deployment-test, test-fixtures, and default features
• cargo test -p axl-e2ee-node --features deployment-test deployment_store: 2 passed (persistence across reopen, store contract, owner-only mode, damaged file fails closed)
• Node production, test, and deployment-test builds; Node and browser check-abi
• pnpm --filter @axl/e2ee-node test: 16 passed, 1 skipped (Windows DPAPI on Linux)
• Live against the AWS deployment-test stack (feat(hosted): serve the rollback witness from the deployment-test control plane #434 deployed), with the trust from witness-trust.sh:
  • the endpoint registered through the hosted witness and read ready
  • it reopened from its file keys and completed the recover_accepted exchange
  • it returned the same invitation

Next: the daemon remote host and /remote (invitation link, claim and Welcome rendezvous, pair_activation over the relay).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: eed89ac5-5065-49fb-88a0-4c5a9b6219f8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None