From 3c6bff4076bfbc77ac1b5a4e2da8ff970faab4e5 Mon Sep 17 00:00:00 2001
From: Antigravity <antigravity@gemini.local>
Date: Wed, 16 Sep 2026 07:19:21 +0800
Subject: [PATCH] fix: refresh Nexus Gateway recovery trust anchors

---
 src/durable-operations.test.ts | 12 ++++++++++++
 src/durable-operations.ts      |  6 ++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/durable-operations.test.ts b/src/durable-operations.test.ts
index 83e939cfa..216b42d94 100644
--- a/src/durable-operations.test.ts
+++ b/src/durable-operations.test.ts
@@ -16,6 +16,7 @@ import {
   DurableOperationError,
   DurableOperationManager,
   DurableOperationStore,
+  NEXUS_GATEWAY_ACCEPTED_CONTRACT_SHA256,
   NEXUS_GATEWAY_ACCEPTED_MANAGER_SHA256,
   NEXUS_GATEWAY_RECOVERY_BRIDGE_CODE,
   NEXUS_GATEWAY_RECOVERY_PREFLIGHT_BRIDGE_CODE,
@@ -618,6 +619,17 @@ test("nexus_gateway_recover malformed manager output fails closed as uncertain",
   }
 });
 
+test("Nexus Gateway recovery trust roots track the accepted #526 r10 lineage", () => {
+  assert.equal(
+    NEXUS_GATEWAY_ACCEPTED_MANAGER_SHA256,
+    "6873dde17e08d4020620c2408e414327b176be723f5f23f01bee754b2627502c",
+  );
+  assert.equal(
+    NEXUS_GATEWAY_ACCEPTED_CONTRACT_SHA256,
+    "3cd032639f69349bd44e61dec41551957e9034157febfff83e7fb3c89b5ef798",
+  );
+});
+
 test("fixed Nexus bridge rejects manager hash mismatch before importing manager code", { skip: process.platform !== "darwin" }, async () => {
   const home = await mkdtemp(join(tmpdir(), "devspace-nexus-bridge-hash-"));
   try {
diff --git a/src/durable-operations.ts b/src/durable-operations.ts
index 04037302e..3b127503e 100644
--- a/src/durable-operations.ts
+++ b/src/durable-operations.ts
@@ -59,8 +59,10 @@ const HEX64 = /^[0-9a-f]{64}$/;
 const NEXUS_DEPLOYMENT_ID = /^r1-[0-9a-f]{40}$/;
 export const NEXUS_GATEWAY_RECOVERY_SCHEMA = "nexus.gateway.durable_recovery_request.v2" as const;
 export const NEXUS_GATEWAY_INTERPRETER = "/Users/jameschen/Workspace/Nexus-new/.venv/bin/python";
-export const NEXUS_GATEWAY_ACCEPTED_MANAGER_SHA256 = "7af3760bd2b6729654a89d7b07fa4c43bb9b323e8e0006a08aa5e485d78562ac";
-export const NEXUS_GATEWAY_ACCEPTED_CONTRACT_SHA256 = "be6918bc5b328dfbf8c50387e88f983ce33f0096542cc22109f75fbe6250ab5e";
+// Nexus-new #526 successor-manager / r10 recovery lineage. The exact accepted
+// bytes are unchanged from accepted source 6d1e3221 through current 40ad671e.
+export const NEXUS_GATEWAY_ACCEPTED_MANAGER_SHA256 = "6873dde17e08d4020620c2408e414327b176be723f5f23f01bee754b2627502c";
+export const NEXUS_GATEWAY_ACCEPTED_CONTRACT_SHA256 = "3cd032639f69349bd44e61dec41551957e9034157febfff83e7fb3c89b5ef798";
 export const NEXUS_GATEWAY_STATE_ROOT = join(homedir(), "Library", "Application Support", "Nexus", "gateway-direct");
 
 export interface NexusGatewayRecoveryRequest {