Add node registration claim transport

product-source/guanghu-knowledge-base/server/domain-access-orchestrator.test.ts

@@ -191,11 +191,15 @@ test('projects both trust-source states without asking for claims or handoff bef
 });
 
 test('a signed node registration without a handoff remains identity-only', async () => {
+  let observedEndpointId = '';
   const orchestrator = new DomainAccessOrchestrator(
     signerLoader(),
     registrationLoader(),
     loggedInIdentity,
-    validRegistrationSource,
+    { async read(request) {
+      observedEndpointId = request.endpoint.endpointId;
+      return validRegistrationClaim();
+    } },
     { async read() { return null; } },
   );
 
@@ -203,6 +207,7 @@ test('a signed node registration without a handoff remains identity-only', async
 
   assert.equal(status.stage, 'identity-verified');
   assert.equal(status.runtimeReady, false);
+  assert.equal(observedEndpointId, 'GH-NODE-REG-001');
   assert.equal(status.blockers.includes('verified_node_registration_missing'), false);
   assert.ok(status.blockers.includes('verified_domain_manifest_missing'));
 });
@@ -246,13 +251,14 @@ test('current registries, signed node claim and verified handoff project runtime
 });
 
 test('source failures are reduced to safe status without raw details', async () => {
+  let claimReads = 0;
   const unavailableSigner = new TrustedSignerSnapshotLoader({ async fetchJson() { throw new Error('secret signer detail'); } });
   const unavailableRegistration = new NodeRegistrationSnapshotLoader({ async fetchJson() { throw new Error('secret registration detail'); } });
   const orchestrator = new DomainAccessOrchestrator(
     unavailableSigner,
     unavailableRegistration,
     loggedInIdentity,
-    { async read() { throw new Error('secret claim detail'); } },
+    { async read() { claimReads += 1; throw new Error('secret claim detail'); } },
     { async read() { throw new Error('secret handoff detail'); } },
   );
 
@@ -262,6 +268,7 @@ test('source failures are reduced to safe status without raw details', async ()
   assert.equal(status.runtimeReady, false);
   assert.equal(status.nodeRegistrationSource.status, 'UNAVAILABLE');
   assert.equal(status.trustSource.status, 'UNAVAILABLE');
+  assert.equal(claimReads, 0);
   assert.equal(JSON.stringify(status).includes('secret'), false);
 });