Add gn-ten node lab package

Author: nshkrdotcom

.blitz/test_state_v1/indexes/task_states.ndjson

@@ -6,6 +6,7 @@ defmodule StackLab.Build.WeldContract do
   @proof_projects [
     "support/spec_cell",
     "support/gn_ten_control_plane",
+    "support/gn_ten_node_lab",
     "support/connector_hardening_scanner",
     "support/tenant_isolation_scanner",
     "support/no_bypass_scanner",

build_support/weld.exs

@@ -5,6 +5,7 @@ defmodule StackLab.Build.WorkspaceContract do
     "support/lab_core",
     "support/spec_cell",
     "support/gn_ten_control_plane",
+    "support/gn_ten_node_lab",
     "support/connector_hardening_scanner",
     "support/tenant_isolation_scanner",
     "support/no_bypass_scanner",

build_support/workspace_contract.exs

@@ -163,11 +163,14 @@ path, and run GitHub or Linear live commands by prefixing them with
   over-cap. It does not prove EPMD startup, peer lifecycle, owner facade
   availability, distributed business semantics, monolith/distributed parity,
   or 49-node scale feasibility.
-- `gn_ten_distributed_preflight`: records the v2 Phase 2 host preflight. It
-  proves EPMD can start, a shortname StackLab controller node can come up, a
-  redacted per-run cookie can be generated, the planned distribution port range
-  validates, a temporary peer can start/respond/stop/clean up, listen-socket
-  exposure is recorded, and existing multi-node proofs remain parallel in root
+- `gn_ten_distributed_preflight`: records the v2 Phase 3 node-lab package
+  preflight. It proves `support/gn_ten_node_lab` owns reusable preflight and
+  peer lifecycle checks; EPMD can start; a shortname StackLab controller node
+  can come up; a redacted per-run cookie can be generated; the planned
+  distribution port range validates; frozen topology specs can be parsed with
+  node-cap enforcement; a temporary peer can start, sync code paths, answer
+  bounded `:erpc`, stop, and become unreachable after cleanup; listen-socket
+  exposure is recorded; and existing multi-node proofs remain parallel in root
   CI until node-lab migration. It does not prove owner facades, domain
   semantics, parity, production security, per-run cookie application to peers,
   or release boot.

docs/gn_ten_proof_matrix.md

@@ -0,0 +1,47 @@
+{
+  "cookie_posture": {
+    "byte_size": 43,
+    "distribution_security_claim": "local_dev_only",
+    "posture": "generated_redacted",
+    "production_security_proven?": false,
+    "secret_value_present?": false
+  },
+  "distribution": {
+    "node_alive?": true,
+    "node_name": "stack_lab_node_lab_controller_1@ubuntu-dev",
+    "started_by_node_lab?": true
+  },
+  "does_not_prove": [
+    "owner facade availability",
+    "domain business semantics",
+    "monolith/distributed parity",
+    "production distribution security",
+    "release artifact boot"
+  ],
+  "epmd": {
+    "command": {
+      "args": [
+        "-daemon"
+      ],
+      "command": "/home/home/.asdf/installs/erlang/28.3/erts-16.2/bin/epmd",
+      "duration_ms": 4,
+      "exit_status": 0,
+      "status": "ok"
+    },
+    "path": "/home/home/.asdf/installs/erlang/28.3/erts-16.2/bin/epmd"
+  },
+  "failures": [],
+  "finished_at": "2026-05-25T08:18:51.639875Z",
+  "peer_probe": {
+    "code_paths_synced?": true,
+    "peer_node": "stack_lab_node_lab_peer_2@ubuntu-dev",
+    "reachable_after_stop?": false,
+    "remote_call": "ok",
+    "started?": true,
+    "stopped?": true
+  },
+  "receipt_ref": "receipt://stack_lab/gn_ten_node_lab_preflight/latest",
+  "schema_version": "stack_lab.gn_ten_node_lab.preflight.v1",
+  "started_at": "2026-05-25T08:18:51.460102Z",
+  "status": "pass"
+}

docs/receipts/gn_ten_distributed/node_lab_preflight.json

@@ -0,0 +1,27 @@
+# gn-ten Node Lab Preflight Receipt
+
+Receipt ref:
+
+```text
+receipt://stack_lab/gn_ten_node_lab_preflight/latest
+```
+
+Command:
+
+```bash
+mix stack_lab.gn_ten.node_lab.preflight \
+  --receipt docs/receipts/gn_ten_distributed/node_lab_preflight.json \
+  --json
+```
+
+Status: pass.
+
+This receipt records the Phase 3 package-owned preflight for
+`support/gn_ten_node_lab`. It proves the generic support package can start
+EPMD, start a shortname controller node, generate a redacted local-dev cookie
+posture, start a peer with `:peer.start_link/1`, synchronize code paths, call
+the peer with bounded `:erpc.call/5`, stop the peer, and verify cleanup.
+
+This receipt does not prove owner facade availability, domain business
+semantics, monolith/distributed parity, production distribution security, or
+release artifact boot.

docs/receipts/gn_ten_distributed/node_lab_preflight.md

@@ -0,0 +1,61 @@
+defmodule Mix.Tasks.StackLab.GnTen.NodeLab.Preflight do
+  @moduledoc "Runs the package-owned gn-ten node-lab preflight."
+
+  use Mix.Task
+
+  alias StackLab.GnTenNodeLab.Preflight
+
+  @shortdoc "Runs the gn-ten node-lab preflight"
+
+  @impl Mix.Task
+  def run(args) do
+    Mix.Task.run("app.start")
+
+    {opts, _argv, invalid} =
+      OptionParser.parse(args,
+        strict: [
+          receipt: :string,
+          json: :boolean
+        ]
+      )
+
+    if invalid != [] do
+      Mix.raise("invalid options: #{inspect(invalid)}")
+    end
+
+    preflight_opts = [
+      receipt_path:
+        Keyword.get(
+          opts,
+          :receipt,
+          "docs/receipts/gn_ten_distributed/node_lab_preflight.json"
+        )
+    ]
+
+    case Preflight.run(preflight_opts) do
+      {:ok, receipt} ->
+        print(receipt, Keyword.get(opts, :json, false), :info)
+
+      {:error, receipt} ->
+        print(receipt, Keyword.get(opts, :json, false), :error)
+        exit({:shutdown, 1})
+    end
+  end
+
+  defp print(receipt, true, level) do
+    encoded = Jason.encode!(receipt, pretty: true)
+    if level == :error, do: Mix.shell().error(encoded), else: Mix.shell().info(encoded)
+  end
+
+  defp print(receipt, false, :info) do
+    Mix.shell().info("stack_lab.gn_ten.node_lab.preflight passed")
+    Mix.shell().info("receipt=#{receipt["receipt_path"]}")
+    Mix.shell().info("receipt_ref=#{receipt["receipt_ref"]}")
+  end
+
+  defp print(receipt, false, :error) do
+    Mix.shell().error("stack_lab.gn_ten.node_lab.preflight failed")
+    Mix.shell().error("receipt=#{receipt["receipt_path"]}")
+    Mix.shell().error("failures=#{inspect(receipt["failures"])}")
+  end
+end

lib/mix/tasks/stack_lab.gn_ten.node_lab.preflight.ex

@@ -53,6 +53,7 @@ defmodule StackLab.Workspace.MixProject do
       {:weld, "~> 0.8.2", only: [:dev, :test], runtime: false},
       {:jason, "~> 1.4", runtime: false},
       {:stack_lab_lab_core, path: "support/lab_core"},
+      {:stack_lab_gn_ten_node_lab, path: "support/gn_ten_node_lab"},
       DependencySources.dep(:ground_plane_contracts, __DIR__),
       {:credo, "~> 1.7", only: [:dev, :test], runtime: false},
       {:dialyxir, "~> 1.4", only: [:dev, :test], runtime: false},

mix.exs

@@ -150,15 +150,17 @@ proofs:
     contract_family: "300 architecture"
     status: implemented
     profile: local_quick
-    command: mix gn_ten.distribution.preflight --json
-    fixture: lib/stack_lab/gn_ten/distribution_preflight.ex
-    receipt: receipt://stack_lab/gn_ten_distributed_preflight/latest
+    command: mix stack_lab.gn_ten.node_lab.preflight --json
+    fixture: support/gn_ten_node_lab
+    receipt: receipt://stack_lab/gn_ten_node_lab_preflight/latest
     proves:
+      - the reusable support/gn_ten_node_lab package owns preflight and peer lifecycle checks
       - EPMD can be found and started on this host
       - StackLab can start a shortname controller node
       - StackLab can generate a redacted per-run cookie value without writing it to receipts
       - the planned distribution port range is validated
-      - a temporary peer can start, answer bounded erpc, stop, and become unreachable after cleanup
+      - frozen topology specs can be parsed with node-cap enforcement
+      - a temporary peer can start, sync code paths, answer bounded erpc, stop, and become unreachable after cleanup
       - current EPMD names and listen-socket exposure are recorded
       - existing multi-node proofs remain parallel in root CI until node-lab migration
     does_not_prove:
@@ -168,10 +170,10 @@ proofs:
       - per-run cookie application to peers
       - production distribution security
       - release artifact boot
-    next_action: create support/gn_ten_node_lab and move reusable peer lifecycle APIs behind the package boundary
+    next_action: use support/gn_ten_node_lab for Phase 5 topology specs, app boot, facade readiness, and pg group checks
     trace_receipt:
       schema: aitrace.single_node_proof_trace.v1
-      ref: trace://stack_lab/gn_ten_distributed_preflight/latest
+      ref: trace://stack_lab/gn_ten_node_lab_preflight/latest
       posture:
         authoritative_audit?: false
         production_deployment_proven?: false

proof_matrix.yml

@@ -0,0 +1,3 @@
+[
+  inputs: ["{mix,.formatter}.exs", "{lib,test}/**/*.{ex,exs}"]
+]