Rust/PostgreSQL wallet security service: signed identity, delayed assignments and chain reconciliation #1
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Build Rust API and PostgreSQL migrations for a public noncustodial security portal. Support multiple wallets with explicit owner/guardian/recovery/notification assignments and proof of control by each assigned wallet; distinguish UI profile membership from on-chain authority. Wallet login ADR-036 or canonical equivalent: unpredictable one-use challenge, expiration, chain/domain/audience/address binding, verified secp256k1 signature and pubkey-derived Terra address. Do not treat supplied address/social login as authority. Secure HttpOnly sessions, CSRF/origin checks and least-privilege role checks. No private signing keys server-side. Delayed assignment additions/removals/role changes (24h default minimum, snapshot old delay; replacing restarts) and cancellation/replay/race handling; blockchain authoritative for token settings. Provide typed OpenAPI/types for frontend.
Index finalized timer-start/settings/recovery events with durable checkpoint, dedup IDs, bounded reorg/restart handling and transactional outbox; verify contract/chain allowlist rather than arbitrary URL/SSRF. No off-chain timer can unlock on-chain assets. PostgreSQL exact integers/string base units and UTC; sensitive contact encryption/retention/deletion policy. Unavailable contracts shown honestly. Publish focused auth, assignment and outbox tests.
Dependency: establish API/types early; backend scaffolding can run parallel with contracts/research and UI. Coordinate exact token ABI when available.
Working rules
User authorizes implementation and worker coordination. Trusted CL8Y governance is an explicit trust assumption; separate containment, unpause, recovery authorization, execution and key rotation. No social account alone establishes asset ownership. Never publish PII, secrets or private incident operations. Work in small reviewable increments, with bounded focused security tests; no broad soak runs or very long scripts. Publish commits/PRs and factual evidence. Keep acceptance open until actually met; source success does not establish live deployment. No automatic closing keywords in PR descriptions before full acceptance.
Implementation assigned to BB worker
thr_wur9hgwhec, coordinated bythr_4rw76j9kerin security epic.Dependency/order: Independent foundation now; publish API types early. Integrate actual contract ABI once stable.
Worker is active in an isolated worktree. It owns implementation and truthful acceptance evidence, with independent review before production completion. Initial orchestration does not establish code/deployment acceptance.
Implementation is published in PR #5. The API is a working Rust/PostgreSQL service with ADR-036 wallet authentication, exact-origin/CSRF sessions, independent wallet proofs and delayed dual-consent profile assignments; these are explicitly distinct from chain authority. The accessible TypeScript frontend is integrated, and its exact ABI continuation is in progress against independently reviewed token/controller schema pin
2d70d43c651ecd4491c0736c89ae2975ee825686.Finalized receipt ingestion, checkpoint/replay/divergence handling, transactional warning outbox, bounded controller fanout, encrypted double-opt-in email/Telegram pairing, retry and visible delivery uncertainty are implemented. Nine focused backend checks passed against owned disposable PostgreSQL, including an owned loopback receipt fixture. UI checks use owned API/provider doubles; there have been no real-recipient test sends or chain transactions.
Independent auth/security/deployment review identified and drove fixes for proxy admission, connection starvation, lease/retry ambiguity, worker session-forgery privileges, activation filtering, cross-profile email floods and untrusted-event checkpoint poisoning. Final source/UI/live review remains in progress. Coolify's dedicated portal PostgreSQL resource is now running; API/static/worker release and exact live migration/source/worker/backup receipts remain pending. No feature or production acceptance is inferred from source or database startup.
No deployed security-v1 token/controller identities exist per the contract lead, so live chain coverage and signing remain unavailable until verified deployment configuration is supplied. Notification provider credentials are absent, gating those channels only. Issues #1–#4 stay open for their unverified acceptance. Research followups #6/#7 are separate future scope.
Verified scoped deployment is live at https://security.cl8y.com. Source PR #5 and deployment-recipe/receipt PR #8 are merged to main; checkout
/home/answorld/repos/cl8y-wallet-securitywas fast-forwarded without overwriting changes.Actual workload source:
e44569e45b15dbee4b0347dff742f92bd85bedb2. Immutable OCI manifest:sha256:07b476118ac7ca8a8af9653471026d02c0e615ace174231bd50aea06392b607e; tested config digest:sha256:556024673401ce7337c00ab54a40230abc6e1ffe45d03a41af27eb1ea7c772d9. Separately reviewed runtime hook:b8aa303154b25d3017816c258b0daeb8954b7b26; it selects the deployment's unique private PostgreSQL hostname and preserves credentials, volumes and trust. Immutable tags preserve both source references. Current main also contains post-release operator recipe/receipts; the running artifact remains pinned.Actual evidence: TLS health 200 with matching source and migration 5; advancing matching worker; all 16 live owned-wallet checks passed (signed login, one-use replay rejection, independent second wallet, dual-consent >=24h assignment, cancellation, secure cookie/logout); all 13 exact-image persistence/privilege/owned-restore checks passed. Independent reviewer verified source, HTTPS/redirect/security headers, one authorized invalid forwarded-header negative probe, source/migration/heartbeat, runtime UID/credential/DDL boundaries, private networking and backup/restore. No real-recipient messages or chain transactions were sent.
Public receipts: live, storage.
Full production acceptance remains OPEN; issues #1–#4 are not closed by source merge or this deployment:
thr_n4vtxxfcb7/coordinatorthr_4rw76j9kerown that dependency; UI ownerthr_yc2yevrgcwowns subsequent real-chain/wallet acceptance. Live defaults are never invented.thr_ywz2dcyd3p, provider PR #9. Authorized scoped Mailu enrollment was found and completed in disabled/test-restricted state, so email is pending adapter/gateway/review/owned proof rather than falsely called unavailable. Fresh review is on hold for durable retry-window aging across pending/blocked states; fixing before activation. Independent Telegram bot registration/token capability remains to be established; unrelated polling bots are not reused. Current delivery readiness is false and no real sends are claimed.thr_tj2burwn8bis continuing authorized scoped enrollment/inventory/restore proof. Live local backup/scratch restore passed; off-host recovery has not been invented.Independent reviewer
thr_rbd98geiraremains assigned for fresh provider/deployment increments. No human approval, reading, monitoring or credential handoff is requested; all remaining technical work has explicit active agent ownership.