NiPoPoW: align proof construction, length-prefixed parsing, and validation

[a-shannon]

Summary

• Reject non-canonical interlink runs before proof construction.
• Build and verify interlink membership against the full header extension tree and root.
• Validate proof parameters and bound declared parser resources.
• Version cached proof bytes for the root-binding cutover.
• Reject non-boolean continuous mode bytes.
• Add complete cross-runtime proof fixtures shared with sigma-rust.

Invariant

A proof is accepted only when its structural parameters are valid, its declared lengths stay within the configured resource bounds, and every disclosed interlink is authenticated by the header's full extension root.

Base and coordination

This Draft targets v6.0.5. PR #2416 carries that release branch toward master.

Companion Rust work is tracked in:

• ergo-nipopow: validate proof structure and extension-root binding sigma-rust#917 for proof validation and full-root fixtures.
• fix: guard NiPoPow scorex_parse against allocation bomb sigma-rust#855 for bounded length-prefixed parsing.

Validation

• ergoCore/test: 138 passed, 2 ignored.
• Focused NiPoPoW and serialization checks: 47/47.
• Cross-runtime interoperability fixtures: 10/10.
• UTXO and digest serializer suites: 49/49 each, with 1 existing ignored case in each suite.

Independent maintainer review and upstream CI are pending.

Additional coordinated drafts

• Dependency-line backport: mwaddip/sigma-rust#1.
• Rust node V1 capability handling: mwaddip/ergo-node-rust#16.

[a-shannon]

CI follow-up at 30501433372cce493dd6ed471357aaffdb06818e:

• The additive commit changes only three NiPoPoW test files; production behavior is unchanged.
• ergo-core passes on Scala 2.11, 2.12, and 2.13. The wallet matrix and complete node test job also pass.
• The integration job passed 12/13. UtxoStateNodesSyncSpec.scala:42 observed two height-6 heads at its convergence assertion. The same integration job passed on the immediately preceding head, ab5d3c9360bdf8a61963551389cd2b14219ba081.

An integration rerun requires upstream repository permissions.

[a-shannon]

Review acknowledgement: many thanks to Muadib for the thorough initial security review, the reproducible test cases, and the independent re-audit of this exact head (a2d30905). The re-audit reports the prior P0/P1 findings for this surface remediated and gives this revision an APPROVE (residual nit) verdict. Formal maintainer review and applicable CI remain separate gates.