[Soushi888]

SoushAI analysis. Drafted by Soushi's AI assistant, reviewed and posted by @Soushi888.

Summary

Brings the general backend work from Tibi's commitment-pool-experiment branch onto dev, so the v0.1 line and the Grassroots Economics MVP share one backend. Quantities become a ValueFlows Measure, each NDO indexes its commitments (with hash-paired reads a UI can act on), commitment fulfillment closes atomically with a real counterparty countersignature, and ResourceSpecification gains the optional Layer 1 foreshadow fields. The commitment pool itself (CommitmentAnchor on the Group DNA, admit, withdraw and pool UI) stays on the experiment branch.

Tibi's commits keep his authorship. On top: two small ports to Holochain 0.7.1, and fixes from an independent review of the fulfillment closure (its receipts failed the PPR signature check, the counterparty signed whatever hash it was handed, and a commitment could be fulfilled repeatedly), each its own commit with Sweettests.

Consent rule (new, please check). The party who did not author a commitment initiates its fulfillment, and the author countersigns. Writing the commitment is the author's consent, initiating is the other party's. A commitment naming an agent who never wrote it can no longer collect that agent's signature.

Intent

Tibi's branch forked from dev at 7faf650 and several of its commits are protocol-general rather than pool-specific (his own split, shared with Soushi on 2026-11-10). Landing them now keeps the two lines from drifting apart, and gives the v0.1 UI work the Measure shape and commitment reads it will build on.

Changes

• Measure (dcbc019, 0fc0ab3): nondominium_shared::types::Measure { numerical_value, has_unit } with one validate(), replacing quantity: f64 plus unit: String on commitments, economic events and economic resources; the TypeScript mirror in packages/shared-types and the NDO forms (commitment with an explicit receiver, economic event) follow.
• Commitments per NDO (f7e06a2): NdoToCommitments link type, written by propose_commitment, read by get_commitments_for_ndo.
• Hash-paired reads (backend slice of 033a63a): CommitmentRecord { action_hash, commitment } from get_commitments_for_ndo_detailed and get_all_commitments_detailed, plus its TS type. The admit, fulfill and pool modals of that commit are not included.
• Atomic fulfillment (11085b5, 09c86a1): fulfillment.rs with fulfill_commitment_closure, which logs the fulfilling event, writes the Claim with the correct fulfilled_by, and issues both parties' participation receipts, the counterparty countersigning through call_remote on an unrestricted countersign_fulfillment grant created in init (the function itself checks the caller is the counterparty). Sweettest coverage included.
• Review fixes (c58860d, 2c1b730): the initiator signs signed_data_hash like the counterparty, so both receipts pass validate_participation_claim_signature; countersign_fulfillment rebuilds the payload from the commitment, the observed quantity and the event time and signs its own hash; only the non-author initiates; a commitment with a CommitmentToClaim link is refused on both sides; the commitment form's numeric inputs no longer call .trim() on a number, and a Measure of 0 stays 0 in the event form.
• Layer 1 foreshadow (backend, shared-types and docs slice of 3156120): InventoryIntent, IdentificationPattern, DigitalLocatorKind and the optional fields on ResourceSpecification, validated in validate_spec_foreshadow, with Sweettests. The UI redesign that rode on that commit (GovernanceTab, ResourcesTab, AgentPubkeyField and others) is left for the v0.1 UI pass.
• Holochain 0.7.1 ports: the fulfillment test uses await_consistency_s(20, …); the countersign grant uses the 0.7 CapGrant { constraint: GrantConstraint::Unrestricted, capability: Capability::ZomeCall(..) }.

Decisions

Option	Rejected because
Cherry-pick 033a63a and 3156120 whole	Both mix the backend change with pool modals or a UI redesign that belongs to the v0.1 UI review, not to a backend sync
Merge the experiment branch	It carries the pool product (CommitmentAnchor, pool UI, the MVP shell remix) that stays experimental
Gate countersign_fulfillment with a cap token	Authorisation stays semantic: the function re-fetches the commitment, refuses a caller who is not its counterparty, signs only if it authored the commitment, and signs its own rebuilt hash. The unrestricted grant still lets any agent make the author's conductor run a get
A pending-approval step before countersigning	Heavier than v0.1 needs; authorship is the author's consent. Open to revisit for the pool
Let either party initiate	Then a commitment written by one party, naming the other, would collect the other's signature without any act of theirs

How to test

nix develop
bun run build:happ
CARGO_TARGET_DIR=target/native-tests cargo test --package nondominium_sweettest
cd packages/shared-types && bun run build && cd ../../ui && bun run check

Follow-ups (non-blocking, from the review)

• Whether the same-cell update_operational_state call rolls back with the closure when a later step fails (not verified).
• Integrity has no Measure check on EconomicResource updates and no validation on Claim entries (authorship, fulfilled_by).
• determine_claim_types_for_action duplicates the mapping in ppr.rs.
• Comments still name the Commitment Pool and CommitmentAnchor, which are not on dev.
• Two concurrent closures on one commitment can still race before the first claim link propagates.
• The deprecated Tryorama suite in tests/ still uses the old quantity shapes.

Documentation

CHANGELOG.md (0.1.0, Added, including the network reset: the nondominium DNA hash changes), documentation/IMPLEMENTATION_STATUS.md and documentation/requirements/resources.md (foreshadow fields, from 3156120).

Related

• Refs Implement bi-directional receipt generation system #14 (fulfillment closure; the issue is already closed)
• Source branch: commitment-pool-experiment (stays open for the pool MVP)