SR-4 / L2PS — Private Negotiation Channel for DACS-3

[linear]

Context

PATH-OS / DACS clients delivered an implementation brief on 2026-06-10 (file: docs/l2ps-sr4-implementation-brief.md) covering the three remaining 🟡 gaps in CORE §A.4 so DACS-3 negotiate-rfq and negotiate-sealed-envelope run end-to-end on a real private channel.

Goal

Close the SR-4 conformance bar (CH-1..CH-6, DACS-3 §8.3.1) — identity-keyed membership, confidentiality, authenticity, liveness, termination, per-session channelId uniqueness — at the substrate / SDK level so application code stops carrying that burden.

Status

SDK delivery shipped on feat/sr4-cci-channel-transcript (commit 09fcb7c). Branch pushed to kynesyslabs/sdks; PR pending review.

Open the PR: https://github.com/kynesyslabs/sdks/pull/new/feat/sr4-cci-channel-transcript

Sub-tickets

• SR-4 WI-0: ClaimReference type + Demos-key-as-CCI helper #930 WI-0 — ClaimReference type + signWithPrimaryClaim helper. Done.
• SR-4 WI-1: CCI-keyed L2PS membership binding via Storage Programs #931 WI-1 — L2PSMembershipBinding + SR-2 anchor + resolveMember. Done.
• SR-4 WI-2: ChannelMessage envelope API + sequence + transcript export #932 WI-2 — ChannelMessage envelope + sequence + transcript export. Done.
• SR-4 WI-3: anchorEncryptedTranscript() helper #933 WI-3 — anchorEncryptedTranscript. Done.

What landed

• 4 new SDK modules (~1080 LOC) + 98 jest unit tests, all passing.
• Two new package exports: @kynesyslabs/demosdk/identity and @kynesyslabs/demosdk/identity/cci.
• The l2ps barrel also exposes binding, channel, anchor namespaces.
• Two new primitives on the L2PS class (encryptBytes / decryptBytes) reusing the per-call-nonce + AAD pattern from encryptTx — needed by WI-3, additive-only.
• Pre-existing TS4114 in BroadcastFailedError / TransportError fixed (added override) so the build hook would let the commit through.

Invariant enforced

In-channel signer == on-chain party. Every signature path goes through the connected Demos Ed25519 key — never the RSA L2PS subnet key. All signatures are domain-separated (dacs-binding:v1:, dacs-channelmsg:v1:, dacs-transcript:v1:) over RFC 8785 JCS canonical bytes per §B.7.

Test status

• 98/98 unit tests pass; full project tsc --noEmit clean.
• Integration tests against live chain deferred — dev environment is down (Re-validate dev environment after reboot #890). Once dev nodes are back, run the WI-1 anchor + WI-3 broadcast paths end-to-end against dev.node2.demos.sh:53650.

Source

• Brief: docs/l2ps-sr4-implementation-brief.md
• Commit: kynesyslabs/sdks@09fcb7c
• Branch: feat/sr4-cci-channel-transcript