feat(society): N-way society-of-societies — useful cross-node work at N=3 (societies epic, increment 3)

[NickFlach]

Final increment of the N>2 field-societies epic: the useful-work path — generalizing epic #178 (society-of-societies) past two VMs. Three agentdemo societies each run a full local sub-agent society and exchange their qseed-salted aggregates over FSYP full-mesh.

Gate — scripts/test_qos_society_agents_n.py (make ci-smoke-society-agents-n-gate)

1. each VM completes AGENTD: DEMO OK (spawn society + content consensus + division of labor + qseed-salted aggregate handoff), own aggregate host-verified;
2. EXCHANGE — each node's console shows both other members' aggregates (N-1 = 2), attributed by host-recomputed value (the FSYP print carries no source; the distinct qseed-salted value is the attribution). A FIXTURE precheck requires all three expected values pairwise-distinct, and an anti-loopback assert forbids a node printing its own value as a peer's — a forged/looped-back value can't satisfy a peer check;
3. all three fields still synchronize under the demo load;
4. clean 3-way reap.

Added as a step in the society-n CI job; SOCIETY_AGENTS_N_GATE_TIMEOUT ?= 720s (three agentdemo boots — QPU + spawns + field ops each — on an oversubscribed runner).

Design notes (from the panel)

• No wire change: the FSYP frame is frozen at 16 bytes (ADR-0020 lane C). Attribution is by value, not a source field.
• FSYP frames stay source-IP-filtered/unauthenticated even in a keyed society (deferred per ADR-0019) — the host value recompute is their integrity check; a spoofed aggregate can only redden a gate, never poison a field (print-never-imprint, ADR-0014).
• boot_n gains an additive extra_tokens="" param (default empty) so society3/society4/keyauth-n stay byte-identical.

Verification (local WSL)

OK: three attested members booted with agentdemo + coupling (full 3-cycle mesh); expected aggregates ['a230f8624', 'aba418f4c', 'a8604d26c']
OK: all three societies complete; each own aggregate verified
OK: all three societies exchanged results — each holds both peers' aggregates (host-recomputed, value-attributed), none its own
OK: all three fields synchronized under agentdemo load (R_x [0.91, 0.92, 0.87])
=== SOCIETY-OF-SOCIETIES-N gate PASSED ===

2-VM agents + society3 regressions still green.

Note: a first cut called _log_text() on boot_n's status dicts instead of the QosVM handles — caught by reading the full run log rather than trusting the exit code, fixed to use soc.members.

This completes the N>2 field-societies epic (increments 1–3): the group key gates the field wire at N>2, the N=4 ceiling is proven, and N-way societies exchange real work.

🤖 Generated with Claude Code