Merge milestone/v0.5-bearers-runtime into main (v0.5 Bearers Runtime feature milestone release)

v0.5 Bearers Runtime — 7 runtime REQs (REQ-033..039) shipped as feature.
8 modules promoted to runtime (MsgServer + simtest). cosmos-sdk v0.50.8 +
ibc-go v8.2.1 added (G-006 controlled exception). G-003 + locked-const
firewalls intact. 8 keeper packages ≥80% coverage. 5 GRILL decisions
ratified; 8 binding fixes landed; 5 P1+ flagged for v0.6+.

---ci---
project: oy
phase: 8
milestone: v0.5
status: complete
requirements:
  covered: [REQ-033, REQ-034, REQ-035, REQ-036, REQ-037, REQ-038, REQ-039]
  partial: []
---/ci---

x/partner/types/anchor_credential.go

@@ -0,0 +1,107 @@
+package types
+
+// anchor_credential.go holds the v0.5 runtime Anchor credential lifecycle
+// types (P3-01-01, REQ-035). v0.3 typed the AnchorCredential struct
+// (types.go); v0.5 promotes it to runtime by adding the lifecycle Status
+// field + the AnchorCredentialStatus enum (the lifecycle Pending →
+// Onboarded → Suspended → Revoked per RESEARCH v0.5 / REQ-035).
+//
+// The four Msg* types (MsgIssueAnchorCredential, MsgOnboardAnchor,
+// MsgSuspendAnchorCredential, MsgRevokeAnchorCredential) live in
+// msg_anchor.go (sdk.Msg impls). The expected-keeper interfaces
+// (WatcherKeeper, HubKeeper) live in expected_keepers.go (G-003 shims).
+//
+// Lifecycle (REQ-035, vision §13):
+//
+//   IssueAnchorCredential    → Pending  (Watcher-authorized issuance)
+//   OnboardAnchor            → Pending → Onboarded  (asserts custody-provider-id
+//                              via the HubKeeper shim — P4 wires the real hub
+//                              keeper; P3 uses a stub in simtest per the G-003
+//                              test exemption)
+//   SuspendAnchorCredential  → Onboarded → Suspended
+//   RevokeAnchorCredential   → any → Revoked  (Watcher 6-of-9 quorum authz per
+//                              REQ-004)
+//
+// Invalid transitions are REJECTED by the handler (the simtest covers each
+// invalid transition). Revoked is terminal (no transition out of Revoked).
+// The lexicon-clean holder identifier is "reach-id" (NOT a banned financial
+// term; use Holder/Reach).
+
+// AnchorCredentialStatus enumerates the Anchor credential lifecycle states
+// (REQ-035). The lifecycle is Pending → Onboarded → Suspended → Revoked
+// (Suspended is a temporary halt; Revoked is terminal). "Onboarded" is the
+// vision-§13 lexicon-clean term for an institutional Anchor that has
+// completed onboarding (NOT a banned term).
+type AnchorCredentialStatus string
+
+const (
+	// AnchorPending is the initial state after IssueAnchorCredential
+	// (Watcher-authorized issuance). The Anchor is registered but has
+	// not yet completed onboarding.
+	AnchorPending AnchorCredentialStatus = "Pending"
+	// AnchorOnboarded is the state after OnboardAnchor (the custody-
+	// provider-id has been validated via the HubKeeper shim). The Anchor
+	// is live and may custody assets.
+	AnchorOnboarded AnchorCredentialStatus = "Onboarded"
+	// AnchorSuspended is the temporary-halt state (SuspendAnchorCredential
+	// transitions Onboarded → Suspended). A Suspended Anchor may not
+	// custody new assets; it may be re-onboarded (Suspended → Onboarded)
+	// by a fresh OnboardAnchor in a future handler revision (v0.5 simtest
+	// scope: the handler does NOT implement Suspended → Onboarded; only
+	// the forward transitions are wired).
+	AnchorSuspended AnchorCredentialStatus = "Suspended"
+	// AnchorRevoked is the terminal state (RevokeAnchorCredential, Watcher
+	// 6-of-9 quorum authz per REQ-004). A Revoked Anchor may not transition
+	// to any other state.
+	AnchorRevoked AnchorCredentialStatus = "Revoked"
+)
+
+// AnchorCredentialStatusCount is the locked count of AnchorCredentialStatus
+// enum values (REQ-035). A regression firewall: adding/removing/renaming a
+// status breaks this const's test.
+const AnchorCredentialStatusCount = 4
+
+// AllAnchorCredentialStatuses returns all four AnchorCredentialStatus values
+// in lifecycle order (Pending, Onboarded, Suspended, Revoked). Locked-const
+// test asserts exactly 4 entries with these names (REQ-035).
+func AllAnchorCredentialStatuses() []AnchorCredentialStatus {
+	return []AnchorCredentialStatus{
+		AnchorPending,
+		AnchorOnboarded,
+		AnchorSuspended,
+		AnchorRevoked,
+	}
+}
+
+// IsTerminalAnchorStatus reports whether the Anchor credential status is
+// terminal (no further transitions permitted). Revoked is terminal.
+// Pending/Onboarded/Suspended are non-terminal.
+func IsTerminalAnchorStatus(s AnchorCredentialStatus) bool {
+	return s == AnchorRevoked
+}
+
+// ValidAnchorTransition reports whether the from → to transition is
+// permitted by the REQ-035 lifecycle:
+//   - Pending → Onboarded (OnboardAnchor)
+//   - Onboarded → Suspended (SuspendAnchorCredential)
+//   - Onboarded → Revoked (RevokeAnchorCredential)
+//   - Suspended → Revoked (RevokeAnchorCredential)
+//   - Pending → Revoked (RevokeAnchorCredential — a Pending Anchor may be
+//     revoked before onboarding completes)
+//
+// All other transitions are REJECTED. Revoked is terminal (no transition
+// out). The handler consults this helper before mutating state.
+func ValidAnchorTransition(from, to AnchorCredentialStatus) bool {
+	switch from {
+	case AnchorPending:
+		return to == AnchorOnboarded || to == AnchorRevoked
+	case AnchorOnboarded:
+		return to == AnchorSuspended || to == AnchorRevoked
+	case AnchorSuspended:
+		return to == AnchorRevoked
+	case AnchorRevoked:
+		return false // terminal
+	default:
+		return false // unknown source status
+	}
+}

x/partner/types/expected_keepers.go

@@ -0,0 +1,77 @@
+package types
+
+// expected_keepers.go holds the Go INTERFACES for the cross-module keepers
+// x/partner depends on (G-003 firewall — ibc-go expected-keepers convention).
+//
+// The Anchor credential lifecycle (REQ-035) depends on TWO cross-module
+// keepers:
+//
+//  1. x/watcher (WatcherKeeper) — the 6-of-9 Watcher quorum (REQ-004)
+//     authorizes Anchor credential ISSUANCE (IssueAnchorCredential) and
+//     REVOCATION (RevokeAnchorCredential). The handler consults the
+//     watcher quorum by ID-string; the interface method reports whether
+//     the quorum reached its threshold on the payload.
+//
+//  2. x/hub (HubKeeper) — the custody-provider-id validity check on
+//     OnboardAnchor (Pending → Onboarded). The handler asserts the
+//     custody-provider-id on the AnchorCredential references a live Hub
+//     custody service BEFORE transitioning to Onboarded. This is the
+//     P3→P4 hub dep edge (G-003 / ARCHITECTURE.md v0.5): the hub keeper
+//     INTERFACE exists in P3 (defined HERE); the real hub keeper impl
+//     is wired in P4. In P3 simtest, the HubKeeper shim is wired to a
+//     stub (G-003 test exemption) — the simtest validates the wiring
+//     contract without a real hub keeper.
+//
+// Both dependencies are expressed as INTERFACES defined HERE (in
+// x/partner/types), NOT as struct imports of x/watcher/types or
+// x/hub/types. The concrete keepers satisfy these interfaces
+// structurally; the handler depends on the interface, preserving
+// G-003's intent (no cross-module struct coupling, no import cycles).
+//
+// Test-only cross-package imports (the G-003 test exemption) remain
+// exempt: a simtest may import both x/partner/keeper and x/hub/keeper
+// (or x/watcher/keeper) to wire the expected-keeper shims in a test
+// setup.
+
+// WatcherKeeper is the expected-keeper interface for x/watcher (G-003).
+// The partner handler calls it for:
+//   - IssueAnchorCredential: a Watcher 6-of-9 quorum must authorize the
+//     issuance (vision §7, REQ-004). The handler consults the watcher
+//     quorum by ID-string; the interface method reports whether the
+//     quorum reached its threshold on the issuance payload.
+//   - RevokeAnchorCredential: a Watcher 6-of-9 quorum must authorize the
+//     revocation (the same REQ-004 quorum, applied to revocation authz).
+//
+// No struct import of x/watcher/types — the interface is the by-ID-string
+// boundary (G-003). The WatcherQuorumID is an opaque string (the quorum
+// identifier, by-ID-string ref to x/watcher).
+type WatcherKeeper interface {
+	// IsQuorumSigned reports whether the named quorum (by-ID-string)
+	// reached its threshold signature count on the payload. Used for
+	// both IssueAnchorCredential (issuance authz) and
+	// RevokeAnchorCredential (revocation authz). Returns true if the
+	// quorum threshold is met (e.g., 6-of-9 per REQ-004); false otherwise.
+	IsQuorumSigned(quorumID string, payload []byte) bool
+}
+
+// HubKeeper is the expected-keeper interface for x/hub (G-003). The
+// partner handler calls it for:
+//   - OnboardAnchor: the handler asserts the custody-provider-id on the
+//     AnchorCredential references a LIVE Hub custody service BEFORE
+//     transitioning the credential to Onboarded. This is the P3→P4 hub
+//     dep edge (G-003 / ARCHITECTURE.md v0.5): the INTERFACE exists in
+//     P3 (defined here); the real impl is wired in P4. In P3 simtest,
+//     the HubKeeper shim is wired to a stub (G-003 test exemption).
+//
+// No struct import of x/hub/types — the interface is the by-ID-string
+// boundary (G-003). The custodyProviderID is an opaque string (the
+// custody service identifier, by-ID-string ref to x/hub CustodyService).
+type HubKeeper interface {
+	// CustodyServiceExists reports whether the named custody service
+	// (by-ID-string) exists and is live (i.e., the custody-provider-id
+	// on the AnchorCredential references a real Hub custody service).
+	// The OnboardAnchor handler consults this BEFORE transitioning the
+	// credential to Onboarded; a non-existent custody service REJECTS
+	// the onboarding (the credential stays Pending).
+	CustodyServiceExists(custodyProviderID string) bool
+}

x/partner/types/msg_anchor.go

@@ -0,0 +1,294 @@
+package types
+
+import (
+	"fmt"
+
+	sdk "github.com/cosmos/cosmos-sdk/types"
+)
+
+// msg_anchor.go holds the partner module's Anchor-credential Msg* types
+// implementing sdk.Msg (P3-01-01, REQ-035; G-006 controlled exception:
+// types/ gains the cosmos-sdk import for sdk.Msg — D-055; the
+// invariant/lexicon tests in *_test.go stay stdlib-only per G-024,
+// isolated from this msg_*.go file). Each Msg carries a ValidateBasic
+// (stateless) and GetSigners.
+//
+// The four Anchor Msg types drive the credential lifecycle (REQ-035):
+//   - MsgIssueAnchorCredential: issue a credential (Watcher-authorized),
+//     status=Pending.
+//   - MsgOnboardAnchor: Pending → Onboarded (asserts custody-provider-id
+//     via the HubKeeper shim).
+//   - MsgSuspendAnchorCredential: Onboarded → Suspended.
+//   - MsgRevokeAnchorCredential: any → Revoked (Watcher 6-of-9 quorum
+//     authz per REQ-004).
+//
+// All cross-module refs are by-ID-string (G-003): anchor-id is this
+// credential's ID (references an Anchor-tier Partner by ID-string);
+// custody-provider-id references an x/hub custody service by ID-string;
+// watcher-quorum-id references an x/watcher quorum by ID-string.
+// GetSigners returns the signer reach-ids encoded as sdk.AccAddress
+// bytes. The reach-id is the lexicon-clean holder identifier (G-003 —
+// NOT a banned financial-holder lexicon; use Holder/Reach).
+
+// --- MsgIssueAnchorCredential ----------------------------------------------
+
+// MsgIssueAnchorCredential issues an Anchor credential (status=Pending).
+// The handler enforces Watcher 6-of-9 quorum authz (REQ-004) on the
+// issuance payload via the WatcherKeeper shim. ValidateBasic is
+// stateless: non-empty anchor-id, non-empty credential-uri, non-empty
+// watcher-quorum-id, non-empty signer.
+type MsgIssueAnchorCredential struct {
+	AnchorID        string `json:"anchor_id" yaml:"anchor_id"`
+	CredentialURI   string `json:"credential_uri" yaml:"credential_uri"`
+	WatcherQuorumID string `json:"watcher_quorum_id" yaml:"watcher_quorum_id"`
+	Issuer          string `json:"issuer" yaml:"issuer"`
+	Signer          string `json:"signer" yaml:"signer"`
+}
+
+// Reset implements proto.Message (sdk.Msg = proto.Message).
+func (m *MsgIssueAnchorCredential) Reset() { *m = MsgIssueAnchorCredential{} }
+
+// String implements proto.Message.
+func (m *MsgIssueAnchorCredential) String() string {
+	return fmt.Sprintf("MsgIssueAnchorCredential{AnchorID:%s CredentialURI:%s WatcherQuorumID:%s Issuer:%s Signer:%s}",
+		m.AnchorID, m.CredentialURI, m.WatcherQuorumID, m.Issuer, m.Signer)
+}
+
+// ProtoMessage implements proto.Message.
+func (*MsgIssueAnchorCredential) ProtoMessage() {}
+
+// ValidateBasic is the stateless validation: non-empty anchor-id,
+// non-empty credential-uri, non-empty watcher-quorum-id, non-empty
+// signer.
+func (m *MsgIssueAnchorCredential) ValidateBasic() error {
+	if m.AnchorID == "" {
+		return fmt.Errorf("partner: empty anchor-id")
+	}
+	if m.CredentialURI == "" {
+		return fmt.Errorf("partner: empty credential-uri")
+	}
+	if m.WatcherQuorumID == "" {
+		return fmt.Errorf("partner: empty watcher-quorum-id")
+	}
+	if m.Signer == "" {
+		return fmt.Errorf("partner: empty signer")
+	}
+	return nil
+}
+
+// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
+func (m *MsgIssueAnchorCredential) GetSigners() []sdk.AccAddress {
+	return []sdk.AccAddress{[]byte(m.Signer)}
+}
+
+// --- MsgOnboardAnchor --------------------------------------------------------
+
+// MsgOnboardAnchor transitions an Anchor credential Pending → Onboarded.
+// The handler asserts the custody-provider-id (set on the credential at
+// issue time or supplied here) references a LIVE Hub custody service via
+// the HubKeeper shim (the P3→P4 hub dep edge; P3 simtest uses a stub).
+// ValidateBasic is stateless: non-empty anchor-id, non-empty
+// custody-provider-id, non-empty signer.
+type MsgOnboardAnchor struct {
+	AnchorID          string `json:"anchor_id" yaml:"anchor_id"`
+	CustodyProviderID string `json:"custody_provider_id" yaml:"custody_provider_id"`
+	Signer            string `json:"signer" yaml:"signer"`
+}
+
+// Reset implements proto.Message.
+func (m *MsgOnboardAnchor) Reset() { *m = MsgOnboardAnchor{} }
+
+// String implements proto.Message.
+func (m *MsgOnboardAnchor) String() string {
+	return fmt.Sprintf("MsgOnboardAnchor{AnchorID:%s CustodyProviderID:%s Signer:%s}",
+		m.AnchorID, m.CustodyProviderID, m.Signer)
+}
+
+// ProtoMessage implements proto.Message.
+func (*MsgOnboardAnchor) ProtoMessage() {}
+
+// ValidateBasic is the stateless validation: non-empty anchor-id,
+// non-empty custody-provider-id, non-empty signer. The handler enforces
+// the stateful source-status check (must be Pending) and the
+// custody-service-exists check via the HubKeeper shim.
+func (m *MsgOnboardAnchor) ValidateBasic() error {
+	if m.AnchorID == "" {
+		return fmt.Errorf("partner: empty anchor-id")
+	}
+	if m.CustodyProviderID == "" {
+		return fmt.Errorf("partner: empty custody-provider-id")
+	}
+	if m.Signer == "" {
+		return fmt.Errorf("partner: empty signer")
+	}
+	return nil
+}
+
+// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
+func (m *MsgOnboardAnchor) GetSigners() []sdk.AccAddress {
+	return []sdk.AccAddress{[]byte(m.Signer)}
+}
+
+// --- MsgSuspendAnchorCredential ---------------------------------------------
+
+// MsgSuspendAnchorCredential transitions an Anchor credential
+// Onboarded → Suspended. ValidateBasic is stateless: non-empty
+// anchor-id, non-empty signer.
+type MsgSuspendAnchorCredential struct {
+	AnchorID string `json:"anchor_id" yaml:"anchor_id"`
+	Signer   string `json:"signer" yaml:"signer"`
+}
+
+// Reset implements proto.Message.
+func (m *MsgSuspendAnchorCredential) Reset() { *m = MsgSuspendAnchorCredential{} }
+
+// String implements proto.Message.
+func (m *MsgSuspendAnchorCredential) String() string {
+	return fmt.Sprintf("MsgSuspendAnchorCredential{AnchorID:%s Signer:%s}",
+		m.AnchorID, m.Signer)
+}
+
+// ProtoMessage implements proto.Message.
+func (*MsgSuspendAnchorCredential) ProtoMessage() {}
+
+// ValidateBasic is the stateless validation: non-empty anchor-id,
+// non-empty signer. The handler enforces the stateful source-status
+// check (must be Onboarded).
+func (m *MsgSuspendAnchorCredential) ValidateBasic() error {
+	if m.AnchorID == "" {
+		return fmt.Errorf("partner: empty anchor-id")
+	}
+	if m.Signer == "" {
+		return fmt.Errorf("partner: empty signer")
+	}
+	return nil
+}
+
+// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
+func (m *MsgSuspendAnchorCredential) GetSigners() []sdk.AccAddress {
+	return []sdk.AccAddress{[]byte(m.Signer)}
+}
+
+// --- MsgRevokeAnchorCredential ----------------------------------------------
+
+// MsgRevokeAnchorCredential transitions an Anchor credential to Revoked
+// (terminal). The handler enforces Watcher 6-of-9 quorum authz (REQ-004)
+// on the revocation payload via the WatcherKeeper shim. ValidateBasic is
+// stateless: non-empty anchor-id, non-empty watcher-quorum-id,
+// non-empty signer.
+type MsgRevokeAnchorCredential struct {
+	AnchorID        string `json:"anchor_id" yaml:"anchor_id"`
+	WatcherQuorumID string `json:"watcher_quorum_id" yaml:"watcher_quorum_id"`
+	Signer          string `json:"signer" yaml:"signer"`
+}
+
+// Reset implements proto.Message.
+func (m *MsgRevokeAnchorCredential) Reset() { *m = MsgRevokeAnchorCredential{} }
+
+// String implements proto.Message.
+func (m *MsgRevokeAnchorCredential) String() string {
+	return fmt.Sprintf("MsgRevokeAnchorCredential{AnchorID:%s WatcherQuorumID:%s Signer:%s}",
+		m.AnchorID, m.WatcherQuorumID, m.Signer)
+}
+
+// ProtoMessage implements proto.Message.
+func (*MsgRevokeAnchorCredential) ProtoMessage() {}
+
+// ValidateBasic is the stateless validation: non-empty anchor-id,
+// non-empty watcher-quorum-id, non-empty signer. The handler enforces
+// the stateful Watcher quorum authz + the source-status check (must not
+// already be Revoked — idempotent reject, NOT double-effect).
+func (m *MsgRevokeAnchorCredential) ValidateBasic() error {
+	if m.AnchorID == "" {
+		return fmt.Errorf("partner: empty anchor-id")
+	}
+	if m.WatcherQuorumID == "" {
+		return fmt.Errorf("partner: empty watcher-quorum-id")
+	}
+	if m.Signer == "" {
+		return fmt.Errorf("partner: empty signer")
+	}
+	return nil
+}
+
+// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
+func (m *MsgRevokeAnchorCredential) GetSigners() []sdk.AccAddress {
+	return []sdk.AccAddress{[]byte(m.Signer)}
+}
+
+// --- MsgServer interface + Response types -----------------------------------
+
+// MsgServer is the partner module's message server interface (one method
+// per Msg*). The keeper's msg_server.go implements this; module.go's
+// RegisterServices wires the implementation. This is the hand-rolled
+// equivalent of the protobuf-generated MsgServer interface (no codegen
+// per the skeleton's zero-codegen style).
+type MsgServer interface {
+	IssueAnchorCredential(ctx interface{}, msg *MsgIssueAnchorCredential) (*MsgIssueAnchorCredentialResponse, error)
+	OnboardAnchor(ctx interface{}, msg *MsgOnboardAnchor) (*MsgOnboardAnchorResponse, error)
+	SuspendAnchorCredential(ctx interface{}, msg *MsgSuspendAnchorCredential) (*MsgSuspendAnchorCredentialResponse, error)
+	RevokeAnchorCredential(ctx interface{}, msg *MsgRevokeAnchorCredential) (*MsgRevokeAnchorCredentialResponse, error)
+}
+
+// Response types (hand-rolled equivalents of the protobuf-generated
+// response wrappers; empty bodies — the response is the state mutation +
+// event).
+
+// MsgIssueAnchorCredentialResponse is the response to
+// MsgIssueAnchorCredential.
+type MsgIssueAnchorCredentialResponse struct{}
+
+// Reset implements proto.Message.
+func (m *MsgIssueAnchorCredentialResponse) Reset() { *m = MsgIssueAnchorCredentialResponse{} }
+
+// String implements proto.Message.
+func (m *MsgIssueAnchorCredentialResponse) String() string {
+	return "MsgIssueAnchorCredentialResponse{}"
+}
+
+// ProtoMessage implements proto.Message.
+func (*MsgIssueAnchorCredentialResponse) ProtoMessage() {}
+
+// MsgOnboardAnchorResponse is the response to MsgOnboardAnchor.
+type MsgOnboardAnchorResponse struct{}
+
+// Reset implements proto.Message.
+func (m *MsgOnboardAnchorResponse) Reset() { *m = MsgOnboardAnchorResponse{} }
+
+// String implements proto.Message.
+func (m *MsgOnboardAnchorResponse) String() string { return "MsgOnboardAnchorResponse{}" }
+
+// ProtoMessage implements proto.Message.
+func (*MsgOnboardAnchorResponse) ProtoMessage() {}
+
+// MsgSuspendAnchorCredentialResponse is the response to
+// MsgSuspendAnchorCredential.
+type MsgSuspendAnchorCredentialResponse struct{}
+
+// Reset implements proto.Message.
+func (m *MsgSuspendAnchorCredentialResponse) Reset() {
+	*m = MsgSuspendAnchorCredentialResponse{}
+}
+
+// String implements proto.Message.
+func (m *MsgSuspendAnchorCredentialResponse) String() string {
+	return "MsgSuspendAnchorCredentialResponse{}"
+}
+
+// ProtoMessage implements proto.Message.
+func (*MsgSuspendAnchorCredentialResponse) ProtoMessage() {}
+
+// MsgRevokeAnchorCredentialResponse is the response to
+// MsgRevokeAnchorCredential.
+type MsgRevokeAnchorCredentialResponse struct{}
+
+// Reset implements proto.Message.
+func (m *MsgRevokeAnchorCredentialResponse) Reset() { *m = MsgRevokeAnchorCredentialResponse{} }
+
+// String implements proto.Message.
+func (m *MsgRevokeAnchorCredentialResponse) String() string {
+	return "MsgRevokeAnchorCredentialResponse{}"
+}
+
+// ProtoMessage implements proto.Message.
+func (*MsgRevokeAnchorCredentialResponse) ProtoMessage() {}

x/partner/types/types.go

@@ -183,6 +183,16 @@ type AnchorCredential struct {
 	CustodyProviderID string `json:"custody_provider_id" yaml:"custody_provider_id"`
 	CredentialURI     string `json:"credential_uri" yaml:"credential_uri"`
 	AttestationCount  uint32 `json:"attestation_count" yaml:"attestation_count"`
+	// Status is the Anchor credential lifecycle state (REQ-035, v0.5 runtime
+	// promotion). v0.3 typed the AnchorCredential struct without a status
+	// field (the skeleton had no lifecycle); v0.5 promotes it to runtime
+	// by adding the Status field — additive (zero value "" = Pending
+	// semantically, but the handler always sets it explicitly at issue
+	// time). The existing v0.3 tests construct AnchorCredential with named
+	// fields and do not assert the absence of Status, so the additive
+	// field does not regress them (feature purity gate: additive field,
+	// not a locked-const amendment).
+	Status AnchorCredentialStatus `json:"status" yaml:"status"`
 }
 
 // NewAnchorCredential constructs an AnchorCredential for an Anchor-tier
@@ -193,12 +203,18 @@ type AnchorCredential struct {
 // attestation-count is set to 0 (no attestations in the skeleton). The
 // caller supplies the anchor-id (the Anchor Partner's ID) and the opaque
 // credential-uri.
+//
+// v0.5 runtime promotion (REQ-035): the Status field is set to
+// AnchorPending (the initial lifecycle state). v0.3 tests construct the
+// struct via named fields and assert only the four original fields, so
+// the additive Status=Pending default does not regress them.
 func NewAnchorCredential(anchorID, credentialURI string) AnchorCredential {
 	return AnchorCredential{
 		AnchorID:          anchorID,
 		CustodyProviderID: "", // empty — hub not live until P5/v0.4 (A-304)
 		CredentialURI:     credentialURI,
 		AttestationCount:  0, // no attestations in the skeleton
+		Status:            AnchorPending,
 	}
 }
 
@@ -214,6 +230,19 @@ type GenesisState struct {
 	Partners []Partner `json:"partners" yaml:"partners"`
 }
 
+// Reset implements proto.Message (codec.JSONCodec.MustMarshalJSON /
+// MustUnmarshalJSON require proto.Message; the GenesisState is the JSON
+// shape used by the v0.5 AppModule InitGenesis/ExportGenesis).
+func (m *GenesisState) Reset() { *m = GenesisState{} }
+
+// String implements proto.Message.
+func (m *GenesisState) String() string {
+	return fmt.Sprintf("GenesisState{Partners:%d}", len(m.Partners))
+}
+
+// ProtoMessage implements proto.Message.
+func (*GenesisState) ProtoMessage() {}
+
 func DefaultGenesisState() *GenesisState {
 	return &GenesisState{
 		Params:   DefaultParams(),