Preserve the legacy electorate during canonical ledger migration

PlasticDigits commented

2026-10-14 09:59:42 +00:00

Owner

Production's original electorate lives in the legacy voting schema while the newly migrated public ledger tables are empty. Switching pooled search paths alone would omit all 15 registrations and 2 BSC event/balance rows. Forward migration 20261014000105 imports the original records after exact collision checks, preserves full originals and metadata in an audit archive, leaves frozen weights and the canonical migration tracker intact, and requires explicit canonical recovery.

The migration rejects nonidentical collisions atomically and is idempotent for unchanged legacy data. Existing source tables stay untouched. Startup admission allows bounded recovery while liveness remains separate from readiness.

Validation uses Rust1.88 and a fresh marked PostgreSQL16 instance with real SCRAM TCP authentication. Regression additions cover fresh/null/default password refusal and explicit restricted credentials, both-chain process crash/COMMIT/replay matrices, overlapping writers, sustained arrivals, database loss/reconnect, RPC-time SIGTERM, Terra forks, drained-holder recovery, uint256 HTTP accounting, base64/failed Terra executions, signed malleability/domain attacks, and actual Chromium hostile rendering across every entry point. The final combined release run is recorded in the linked evidence before merge.

Live inventory and invariants, verification, ops. Related #36 #37 #38 #39 #40 #41 #42 #43. Live import/recovery and exact-commit deployments follow merge; issue closure requires original acceptance criteria and all comments to pass.

Final verified release run: 73 Rust unit/supervisor tests, 113 integration tests, 245 schema-validated responses, 146 frontend tests, production build, nginx and Gitleaks passed on Rust 1.88.0 with fresh SCRAM PostgreSQL. The two exact-tip fixture races were fixed using bounded cursor barriers; accounting assertions were retained. Optimized timestamp tests and the latest live-probe build also passed.

Production's original electorate lives in the legacy voting schema while the newly migrated public ledger tables are empty. Switching pooled search paths alone would omit all 15 registrations and 2 BSC event/balance rows. Forward migration 20261014000105 imports the original records after exact collision checks, preserves full originals and metadata in an audit archive, leaves frozen weights and the canonical migration tracker intact, and requires explicit canonical recovery. The migration rejects nonidentical collisions atomically and is idempotent for unchanged legacy data. Existing source tables stay untouched. Startup admission allows bounded recovery while liveness remains separate from readiness. Validation uses Rust1.88 and a fresh marked PostgreSQL16 instance with real SCRAM TCP authentication. Regression additions cover fresh/null/default password refusal and explicit restricted credentials, both-chain process crash/COMMIT/replay matrices, overlapping writers, sustained arrivals, database loss/reconnect, RPC-time SIGTERM, Terra forks, drained-holder recovery, uint256 HTTP accounting, base64/failed Terra executions, signed malleability/domain attacks, and actual Chromium hostile rendering across every entry point. The final combined release run is recorded in the linked evidence before merge. [Live inventory and invariants](docs/verification/2026-10-14-live-storage-inventory.json), [verification](docs/verification/2026-10-14-issues-36-43.md), [ops](docs/OPS.md). Related #36 #37 #38 #39 #40 #41 #42 #43. Live import/recovery and exact-commit deployments follow merge; issue closure requires original acceptance criteria and all comments to pass. Final verified release run: 73 Rust unit/supervisor tests, 113 integration tests, 245 schema-validated responses, 146 frontend tests, production build, nginx and Gitleaks passed on Rust 1.88.0 with fresh SCRAM PostgreSQL. The two exact-tip fixture races were fixed using bounded cursor barriers; accounting assertions were retained. Optimized timestamp tests and the latest live-probe build also passed.

PlasticDigits added 11 commits

2026-10-14 09:59:42 +00:00

test(ledger): cover Terra forks and drained-holder recovery a7f86e8756

Exercise indexed Terra one-block and multi-block fork rewind/replay plus an actual retained-horizon overflow and canonical hash failure recovery. Verify unavailable Terra and BSC intervals block freeze until explicit current-balance reconciliation; new epochs exclude spent power while old frozen weights remain immutable. BSC recovery waits for fifteen confirmations.

test(frontend): exercise hostile HTML across Chromium display boundaries 2200a05532

Preserve historical ledger namespace during canonical storage upgrade 2dbfdf8e8f

Archive original rows and metadata, import matching ledger history atomically, and require explicit reconciliation before resumed voting. Reject conflicting canonical data without overwrites and preserve existing frozen proposal snapshots.

Test real restricted login and permanent storage shadows 53b7c6a34e

Exercise fresh null-password and historical default refusal over TCP, ephemeral SCRAM provisioning, actual restricted startup privileges, and permanent table/function shadow attacks across pooled connections.

test(ledger): verify ingest cancellation and overlapping writers 5cb2d27236

Pause real Terra and BSC ingest at event insertion, balance update, and deferred COMMIT using isolated SQL advisory barriers. Verify rolled-back statements and completed but canceled COMMIT calls preserve atomic state and retry exactly once. Exercise concurrent partial overlap and reordered new blocks through HTTP into Postgres.

test(ledger): exercise arrivals shutdown and database reconnect 7229309eef

Keep both core chains progressing while healthy intents arrive behind a timed-out early registration. Send SIGTERM during a real pending BSC log request and verify funded accounting resumes exactly once after restart. Disconnect only tagged child sessions from the guarded test database, restore connection admission, and verify liveness, readiness and unchanged eligibility epochs.

test(ledger): verify process crashes and Terra RPC shutdown 5166ddfaf5

SIGKILL funded ledger child processes after event insertion, balance update, and deferred COMMIT on both chains. Assert atomic durable accounting, restart recovery and replay without double application. Block a real Terra execution request, observe continued BSC progress, then verify SIGTERM and one-time funded delta recovery after restart.

Test malleable signatures and signed domain attacks through middleware 447a94d81b

Reject a genuine high-s counterpart, cross-scheme signing, wrong network, wrong purpose, and a different proposal target with normalized authentication errors and no persisted action records.

test(ledger): verify HTTP execution and integer boundary cases 0504bc4df8

Persist and replay the maximum uint256 BSC transfer through the real HTTP adapter and Postgres without rounding or duplicate deltas. Exercise distinct same-block logs returned in reverse order with credit-before-debit required for valid accounting. Bind a Terra physical block containing a failed execution and base64 WASM attributes, applying only the successful execution.

docs: preserve live storage provenance and require real test authentication 35a90fbb46

ops: allow bounded baseline recovery before startup health admission

ci/woodpecker/pr/woodpecker Pipeline was successful

Details

5e23ff9d89

PlasticDigits added 3 commits

2026-10-14 10:18:45 +00:00

Verify secure restricted-role credential rotation over TCP 773dd4f794

Rotate an already usable ephemeral SCRAM credential, reject the previous secret with authentication failure, and establish a fresh restricted login that passes the effective privilege matrix.

test(ledger): wait for exact cursors before process faults e59a52ef5b

Separate bounded-lag readiness from fully caught-up fixture state. Wait for both exact fixed tips before fault baselines and after restart, preserving all balance, cursor, event, hash and epoch assertions. Verify the process suite on Rust 1.88 with freshly reset SCRAM-authenticated PostgreSQL.

docs: record complete preservation release verification

ci/woodpecker/pr/woodpecker Pipeline was successful

Details

c22f97b0ae

PlasticDigits merged commit 6a1755a674 into main

2026-10-14 10:22:19 +00:00

PlasticDigits referenced this pull request

2026-10-14 14:19:41 +00:00

fix(ledger): validate complete Terra execution responses and BSC provider events #36

PlasticDigits referenced this pull request

2026-10-14 14:19:47 +00:00

fix(ledger): make transfer accounting exactly once across registration and concurrent writers #37