docs: grant delivery plan and evidence tracker

[ribeirojose]

Tracking issue for the CoW grant completion push (see GRANT_APPLICATION.md). Full scoping was done against develop @ d8b2f2a on 2026-07-02; per-issue evidence is in comments on the linked issues.

Verified already fixed on develop - recommend closing

#39 (cow-api HTTP status - see comment), #49 (obsolete via #109). Also confirmed fixed with tests: duplicate-UID re-submit guard, app_data orderbook lookup, validTo=u32::MAX (ethflow redesign), e2e t0 bug, load-gen calibration (committed PASS reports).

Group 1 - independent, file-disjoint, starting now

• chain: add a per-request timeout to chain JSON-RPC calls #42 + chain: add an RPC method allowlist for chain requests #50 - chain per-request timeout + RPC method denylist (host/provider_pool.rs, host/impls/chain.rs)
• No HTTP timeout on the CoW orderbook client #41 - orderbook timeout on the from_config path (fix exists on default() but production path builds Client::new() bare, host/cow_orderbook.rs:76)
• runtime: support HTTP-only RPC by polling for blocks (no WebSocket required) #43 + config: redact RPC secrets for non-standard URL shapes #44 - abort boot on http-only when require_ws; robust redact_url (engine_config.rs)
• Backtest harness validates a deleted submit-based strategy #45 - backtest replays the observe+verify ethflow strategy (today every fixture fails, exit 1)
• evidence: add 7-day soak harness with periodic metric snapshots #122 - soak harness (unblocks 7-day unattended soak test not evidenced #65/evidence: add a 48-hour uptime test #66 evidence)
• EthFlow verification error-path tests incomplete #61 + chain: assert subscription topic-0 equals keccak256(event sig) #60 - ethflow error-path tests + manifest topic-0 assertions (test-only)
• MockHost fidelity gaps (namespace isolation, store limits) #59 - MockHost storage-error semantics + namespace isolation (kept small; runtime: mock backends and a MockRuntime assembly via the builder #94 refactor pending)
• docs: reconcile nexum.toml vs module.toml manifest naming #108 + Docs reference the wrong manifest filename in a diagram #62 - module.toml naming sweep + discovery-doc diagrams
• docs: stale-reference sweep (nexum-engine rename, sdk.md versioning, Dockerfile references) #123 - stale-reference docs sweep
• docs: multi-chain deployment patterns (Mainnet/Arbitrum/Base/Gnosis) #124 - multi-chain deployment guide (grant M5 deliverable)
• packaging: ghcr image name mismatch breaks fresh-server docker compose pull #125 + build: commit Cargo.lock and build with --locked #126 - ghcr image name fix; commit Cargo.lock + --locked

Group 2 - queued (shared files / dependencies)

• runtime: abort when only dead-module subscriptions remain #46 - exit when no live modules remain (before chain: backfill logs missed during WebSocket reconnect #40's event_loop changes)
• runtime: test graceful shutdown completion #58 + runtime: test event ordering guarantees #56 - shutdown-drain + stream-fairness tests, drain timeout (after runtime: abort when only dead-module subscriptions remain #46/chain: backfill logs missed during WebSocket reconnect #40)
• twap-monitor orphaned gate markers leak on decode-failure path #48 - GC unparseable watch/gate rows (after twap-monitor retries unknown revert selectors every block forever #75, same strategy.rs)
• sdk+twap: treat DuplicatedOrder as already-submitted; add errorType→retry classification #121 - DuplicatedOrder → already-submitted + retry classification (after twap-monitor orphaned gate markers leak on decode-failure path #48)
• Support ComposableCoW v2 ConditionalOrderRemoved event #54 - ConditionalOrderRemoved (after sdk+twap: treat DuplicatedOrder as already-submitted; add errorType→retry classification #121; local sol! binding, not in cow-rs)

In progress (Jean)

• chain: backfill logs missed during WebSocket reconnect #40 (WS backfill), twap-monitor retries unknown revert selectors every block forever #75 (bounded retries), modules: wire price-alert and balance-tracker lib.rs through strategy.rs #119 (+balance-tracker false alert on first block #47 same files), sdk: add #[must_use] to Option-returning public functions #120

Evidence schedule (grant success criteria)

• 48h testnet run w/ real order posting ~Jul 11-14 → closes evidence: add a 48-hour uptime test #66
• 7-day unattended soak starting Jul 15-17 (hard gate: running clean by Jul 21) → closes 7-day unattended soak test not evidenced #65; 24h M1 evidence from day one
• Latency-vs-watchtower KPI + fresh-server Docker test + deliverable/evidence matrix → Jul 24-29
• Submission Jul 31

Explicitly out of scope here

M0 architecture track (#77-#94, #103, nullislabs/nexum-runtime#15, #112-#118) - active refactor; 0.3 roadmap stubs (#52); #64 is a process/descope decision, not code.

[ribeirojose]

Upstream (post-grant) counterparts filed on cowdao-grants/cow-rs — Shepherd lands local fixes now, swaps to SDK once released: cowdao-grants/cow-rs#51 (typed errors + retry_hint, lifts #121's map), cowdao-grants/cow-rs#52 (HttpTransport over the cow-api host passthrough, ref #118), cowdao-grants/cow-rs#53 (IConditionalOrder revert decoding, ref #75), cowdao-grants/cow-rs#54 (ConditionalOrderRemoved + getTradeableOrderWithSignature builder, ref #54), cowdao-grants/cow-rs#55 (EthFlow bindings + per-chain constants, ref #124), cowdao-grants/cow-rs#56 (client-side validTo bound).

[mfw78]

Resequencing note: the intent architecture (doc 09, PR #132) now lands BEFORE grant evidence by owner decision - M0 (de-cow) and the new M1 (chassis, intent core, cow venue adapter, one-SDK migration) precede the evidence milestones, and evidence runs on the adapter-shaped runtime. Two consequences. First, schedule: a 7-day soak must start around July 24, so M0+M1 have roughly three weeks; the legacy cow path is retained as a fallback and evidence falls back to it if M1 slips past about July 20. Second, naming: the application promises a "shepherd-sdk" crate; the delivered SDK is nexum-sdk plus the cow-venue client slice (renamed during development), and the evidence write-up should state that mapping explicitly.