Harden dual-chain accounting, signed voting and deployment boundaries

PlasticDigits commented

2026-10-14 06:33:49 +00:00

Owner

Dual-chain snapshot voting could replay balances, freeze stale power, open unreviewed revisions, and expose unsafe browser/API boundaries. This change validates complete chain observations and coherent registration boundaries, makes accounting and signed actions transactional, certifies freeze readiness, supervises independent workers, and secures SQL, rendering, CORS and protocol contracts.

It adds forward migrations preserving frozen/history records, immutable independently verifiable v2 receipts, generated OpenAPI/TypeScript contracts, stored-weight UI controls, and explicit operational recovery. Existing hash-only receipts and uncertified legacy polls retain documented verification limits; legacy mutation signatures require v2 re-signing. Governance remains advisory and separate per address/chain; Legal and the existing wallet ports remain in place.

Validation on Rust1.88.0: 71 Rust unit/supervisor tests, 79 integration tests, 225 OpenAPI response validations, 146 frontend tests, production build, 11 Chromium regressions, real second-origin signed amend/retry, 4 optimized timestamp regressions, nginx smoke checks and Gitleaks passed. Followup application coverage passes8 tests, including configured threshold, forbidden headers, and16 genuine signed development-domain/version rejections. Verification uses dedicated marked disposable PostgreSQL with no production URL fallback.

Implementation, invariants, commands and evidence limits crosslinks the ops and third-party agent runbooks. Coolify/live verification follows merge; issues36–43 are not automatically closed. Final issue comments will identify completed criteria and remaining exhaustive fault-matrix checks.

Related: #36 #37 #38 #39 #40 #41 #42 #43.

Dual-chain snapshot voting could replay balances, freeze stale power, open unreviewed revisions, and expose unsafe browser/API boundaries. This change validates complete chain observations and coherent registration boundaries, makes accounting and signed actions transactional, certifies freeze readiness, supervises independent workers, and secures SQL, rendering, CORS and protocol contracts. It adds forward migrations preserving frozen/history records, immutable independently verifiable v2 receipts, generated OpenAPI/TypeScript contracts, stored-weight UI controls, and explicit operational recovery. Existing hash-only receipts and uncertified legacy polls retain documented verification limits; legacy mutation signatures require v2 re-signing. Governance remains advisory and separate per address/chain; Legal and the existing wallet ports remain in place. Validation on Rust1.88.0: 71 Rust unit/supervisor tests, 79 integration tests, 225 OpenAPI response validations, 146 frontend tests, production build, 11 Chromium regressions, real second-origin signed amend/retry, 4 optimized timestamp regressions, nginx smoke checks and Gitleaks passed. Followup application coverage passes8 tests, including configured threshold, forbidden headers, and16 genuine signed development-domain/version rejections. Verification uses dedicated marked disposable PostgreSQL with no production URL fallback. [Implementation, invariants, commands and evidence limits](docs/verification/2026-10-14-issues-36-43.md) crosslinks the ops and third-party agent runbooks. Coolify/live verification follows merge; issues36–43 are not automatically closed. Final issue comments will identify completed criteria and remaining exhaustive fault-matrix checks. Related: #36 #37 #38 #39 #40 #41 #42 #43.

PlasticDigits added 19 commits

2026-10-14 06:33:49 +00:00

test: isolate release verification and document hardening rollout 3078fe5fcb

test: add live release probes and memory-backed isolated database 59c1704e32

build: pin release Rust toolchain and locked dependency resolution 188b6f8ee7

test: require a marked disposable integration database 67b7c1e701

fix(voting): transact revision approvals and immutable action receipts c2580589b8

Require versioned nonce actions, complete revision approval, atomic signature and state persistence, safe retries and race-safe quotas. Secure balance definers and explicit API grants, validate effective production privileges, and guard destructive test databases before migrations. Document receipt verification and legacy evidence limits.

fix(protocol): secure API middleware and canonical signing contracts 9768907117

Cover PUT with exact CORS, trusted proxy peers, bounded mutation quotas and safe correlated errors. Keep display sanitation separate from server canonical signing and bind frontend actions to v2 revisions. Generate typed API contracts and document protocol invariants for issues 41 and 43.

Verify middleware, shared vectors, browser amendment, production build boundaries and frontend workflows.

ops: wire generated protocol document and scoped release controls 7ffc86e740

fix(voting): verify admission and acceptance across process restarts a25098b8c0

Enforce shared authenticated action quotas and final acceptance timestamps. Bind receipt sections, rendered content and identifiers to signed history. Audit effective column privileges and writer-owned registration metadata, expose finalized admission and stored poll weights, and exercise crash recovery through the production application stack.

fix(voting): bind vote controls to certified snapshots and stored power 1991a2bda2

Keep unauthenticated mutation limits scoped to peer IP and reserve wallet quotas for the authenticated database action service. Refuse forwarded identity without an actual peer and retain safe correlated 429 responses.

Expose typed future registration admission and immutable per-poll weight contracts. Explain confirmation and invalid snapshot states, block signing without positive stored power, refresh eligibility and discard stale account responses. Capture canonical metadata responses for schema validation.

test: verify runtime API schemas and apply wallet patches explicitly 5bfe5f7551

fix(voting): align wire order and seal worker readiness and role boundaries d90dde94f6

Require a fresh successful intent pass before opening, reject role escape and definer ownership, and preserve complete proposal identity and opened content. Match client canonical field ordering, reject blank titles and foreign Terra prefixes, and verify duplicate ballot conflicts and restricted registration operations.

test: add explicit live registration and receipt probe for both chains 85c8440496

fix(protocol): verify shared v2 wire and suppress duplicate vote signing 8e1c16d690

Add exact Terra and BSC register, amend and open JSON vectors with Unicode titles, revision ordering, EIP-191 digest and ADR-36 sign-document checks.

Load immutable recorded votes before signing and recover response loss through the same nonce and persisted state. Keep wallet and proposal contexts separate. Validate title UTF8 limits and allow valid Unicode summaries without a UTF16 textarea cap.

ops: record private ingress peer for exact proxy enrollment 8708953db7

fix(ledger): harden dual-chain accounting and readiness 7f057ea478

Validate physical Terra executions and coherent native balance observations before atomic source accounting. Preserve canonical continuity, registration boundaries and immutable frozen power across replay, concurrent writers and explicit recovery epochs.

Supervise independent chain workers and bounded fair intent processing with fresh readiness evidence. Add deterministic HTTP, Postgres, fork, concurrency, migration and process restart regressions, plus invariant and maintenance documentation.

style: format integrated code with pinned Rust toolchain bd2f79958b

test: record integrated verification and reject forbidden CORS headers 3b4d453789

test(api): cover configured threshold and signed production boundaries 4155c15b3a

ops: use deployed Coolify environment field names

ci/woodpecker/pr/woodpecker Pipeline was successful

Details

c59c9fe188

PlasticDigits merged commit cd07f00f32 into main

2026-10-14 06:34:37 +00:00

PlasticDigits referenced this pull request

2026-10-14 07:09:17 +00:00

fix(ledger): validate complete Terra execution responses and BSC provider events #36