[Med] Parity Gate only actually validates the matcher — prog/stake/nft cannot build their fixture bin

[dcccrypto]

The Parity Gate workflow has failed on main every day since at least 2026-08-23. Three of its four targets never run:

[percolator-prog]  cargo run failed:  error: failed to get `percolator` as a dependency of package `percolator-prog`
[percolator-stake] cargo run failed
[percolator-nft]   cargo run failed
[percolator-match] parity OK

percolator-prog, percolator-stake and percolator-nft have no src/bin/sdk_parity_fixtures.rs (and prog additionally cannot resolve its percolator engine dependency in that job, since the engine is not checked out).

Why it matters

The gate is permanently red, so its signal is being ignored — and it was hiding a real finding. The matcher spec had genuinely drifted after the 585f492 → d4d4f1c redeploy: new BatchMatcherCall tag 3, new batch size constants, and insurance_fee_remainder_e6 shifting _reserved from 168 to 176. That is exactly what this check exists for, and it took reading the log line by line to notice, because the job is red every day regardless.

Fixed in #374. But the structural problem stands: ABI drift in prog, stake or nft would not be detected at all.

Options

1. Add sdk_parity_fixtures to the three repos and check out the engine in the prog job — makes the gate mean what its name says.
2. Scope the gate to the matcher explicitly and rename it, so a red run is a real signal rather than background noise.

Either is fine. A permanently-red gate nobody reads is the one option that helps nobody — the same failure mode as percolator's required checks that could never report (dcccrypto/percolator#151).

🤖 Generated with Claude Code

https://claude.ai/code/session_01NgoNgagkvw7i5SSRC3FJ8D

[dcccrypto]

CONFIRMED, and this is the most consequential issue in the SDK queue — not for what it broke, but for what it cannot see. Left open.

Verified the claim: percolator-prog, percolator-stake and percolator-nft have no src/bin/sdk_parity_fixtures.rs, and prog additionally cannot resolve its percolator engine dependency in that job because the engine is not checked out. Three of four targets never run. Only the matcher is actually gated.

The finding inside the finding

The gate is permanently red, so its signal is being ignored — and it was hiding a real finding.

That is exactly what happened, and the drift it hid was not cosmetic: a new BatchMatcherCall tag 3, new batch size constants, and insurance_fee_remainder_e6 shifting _reserved from 168 to 176 after the 585f492 → d4d4f1c redeploy. A check that is red every day is indistinguishable from a check that is red for a reason, so the one signal it did produce cost a line-by-line log read to recover.

This is the same class as #379 — where EXPECTED_SLAB_VERSION = 16 against a deployed 17 survived because the SDK's tests build their own fixtures at version 16 and assert they parse. A suite that constructs its own inputs cannot detect a constant that disagrees with production. The parity gate is the one mechanism designed to catch that class, and for prog, stake and nft it has never run.

So the standing conclusion is worth stating plainly: we currently have no automated detection for ABI drift in prog, stake or nft. Every drift issue in this repo right now was found by hand.

Why it stays open

The remedy is three new sdk_parity_fixtures.rs binaries plus a CI job that checks out the engine for the prog build. That is real work in three other repositories, and it should be done properly rather than stubbed — a fixture binary that emits an incomplete struct would make the gate green while checking less than it appears to.

#374 fixed the matcher drift this exposed. The structural gap is what this issue tracks, and it should stay open until all four targets actually execute.

[dcccrypto]

One of the three broken targets is FIXED — and it found a drift on its first run. Keeping open for the other two.

percolator-nft: now runs and passes ✅

percolator-nft#188 adds src/bin/sdk_parity_fixtures.rs, and #386 corrects the spec it revealed was stale. Verified by running the binary and diffing: MATCH.

The binary emits live offset_of! values, not a copied table — deliberately, because a hand-written offset list would restate the numbers the spec already holds and the check would compare a copy against a copy.

What it caught immediately

The spec called the field at offset 167 reserved. percolator-nft#138 renamed _reserved → last_holder in place — same offset, same 199-byte total. Nothing broke (the SDK reads by offset) and nothing flagged it (the target could not execute).

And the test guarding the spec had the same stale name. parity-fixtures.test.ts asserted fixture.offsets.reserved === 167, so the spec and its test agreed with each other while the program said something else, and the suite was green. That is the same shape as nft#160's const_assert!s and the stale CYCLE_CAP copy found in percolator-keeper today: two artifacts validating each other. It took a binary reading the real struct to break the agreement.

Every other offset matched exactly, so the mirror is correct — this was a naming drift only. Benign, and a good demonstration of what the gate is for.

percolator-prog: still broken ⏸️

Needs a fixture binary and a workflow change: the job checks out prog, stake, nft and match, but not percolator (the engine), which the wrapper depends on by path (percolator = { path = "../percolator" }). That is why the log says it "cannot resolve percolator as a dependency" — a missing checkout, not a missing file.

percolator-stake: still broken, and NOT a copy of the nft approach ⏸️

Worth being explicit about why this one is more than an afternoon.

Most of its spec offsets are positions inside a _reserved array, and the map exists only in a comment:

//   [9]      = market_resolved
//   [10..32] = reserved for PERC-313 HWM
//   [32]     = tranche_enabled
//   [33..41] = junior_balance: u64 (LE)

There are no named constants — the indices are literals inside accessor methods. A fixture that restated them would be exactly the copy-vs-copy check the nft binary avoids.

Doing it properly means deriving the map from the accessors' behaviour: zero a StakePool, call each setter with a distinctive value, record which bytes moved. That is more work, and it is also strictly more valuable here, because it would detect an aliasing collision — two setters writing the same bytes. This program has already had one: the cooldown timelock aliased the PERC-313 HWM range, silently disabling the floor and bypassing the timelock.

So the stake fixture is not just parity coverage; it is the detector for a defect class this program has demonstrated. It should be built that way or not at all.

Standing conclusion, updated

The gate now validates 2 of 4 targets (matcher, nft) rather than 1. Until prog and stake land, ABI drift in those two still has no automated detection — and every drift defect found in this repo recently was found by hand.