Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 cloudinit-bot
|
3e762f648d |
@@ -1,14 +1,11 @@
|
|||||||
{
|
{
|
||||||
"phase": 6,
|
"phase": 0,
|
||||||
"stage": "complete",
|
"stage": "plan",
|
||||||
"milestone": "v0.6",
|
"milestone": "v0.2",
|
||||||
"milestone_type": "feature",
|
"milestone_type": "feature",
|
||||||
"tag_base": "v0.5.x",
|
"tag_base": "v0.1.x",
|
||||||
"phase_role": "final",
|
"phase_role": "pre_execution",
|
||||||
"project": "oy",
|
"project": "oy",
|
||||||
"attempts": 0,
|
"attempts": 0,
|
||||||
"updated_at": "2026-08-18T15:00:00Z",
|
"updated_at": "2026-08-17T21:00:00Z"
|
||||||
"milestone_complete": true,
|
}
|
||||||
"milestone_release_tag": "v0.5.6",
|
|
||||||
"requirements_covered": ["REQ-040", "REQ-041", "REQ-042", "REQ-043", "REQ-044", "REQ-045"]
|
|
||||||
}
|
|
||||||
@@ -6,9 +6,9 @@
|
|||||||
}
|
}
|
||||||
],
|
],
|
||||||
"active_project": "oy",
|
"active_project": "oy",
|
||||||
"milestone": "v0.6",
|
"milestone": "v0.2",
|
||||||
"milestone_type": "feature",
|
"milestone_type": "feature",
|
||||||
"tag_base": "v0.5.x",
|
"tag_base": "v0.1.x",
|
||||||
"autonomy": {
|
"autonomy": {
|
||||||
"level": "full",
|
"level": "full",
|
||||||
"escalation_hooks": ["deploy", "delete_data", "merge_to_main"],
|
"escalation_hooks": ["deploy", "delete_data", "merge_to_main"],
|
||||||
|
|||||||
+1
-455
@@ -57,458 +57,4 @@ Fee Covenant (13) blocks {Pacts (8), Orgs (10), Partners (11), Bearers (12)}
|
|||||||
## Phase 0 Architecture Deliverables
|
## Phase 0 Architecture Deliverables
|
||||||
- This index file
|
- This index file
|
||||||
- Persona assessment (created during RESEARCH stage)
|
- Persona assessment (created during RESEARCH stage)
|
||||||
- Phase plans (created during PLAN stage)
|
- Phase plans (created during PLAN stage)
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## v0.3 Architecture (Bearers & Documentation)
|
|
||||||
|
|
||||||
This section appends the v0.3 component map to the v0.1/v0.2 index above. It does
|
|
||||||
NOT rewrite or supersede the earlier content; the Phase 1/2/3 columns in the
|
|
||||||
component index above describe the *full* runtime target, while the v0.3 columns
|
|
||||||
below describe the *v0.3 skeleton+tests* deliverable (D-020 pattern continued,
|
|
||||||
D-035) plus the documentation deliverable (D-042).
|
|
||||||
|
|
||||||
### v0.3 Component Index (new + extended modules)
|
|
||||||
|
|
||||||
| # | Component | Vision § | v0.3 Module | New/Ext | Phase | v0.3 Skeleton Depth |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| 2 | Cross-Chain & Exit (Layer 3) — DEX swaps | §7 | `x/exit` | New | P4 | ExitRoute + DEXSwap types, ExitStatus enum |
|
|
||||||
| 2 | Cross-Chain & Exit (Layer 3) — L2↔L1 bridges | §7 | `x/bridge` | New | P4 | BridgeRoute + BridgeStatus enum; references x/satellite L2Chain by ID (G-003) |
|
|
||||||
| 12 | Bearers expansion (OY-SAT + OY-QR) | §14 | `x/bearers` | Extended | P4 | OYSATLink + OYQRCode transport types (BearerTransport impls); BearerType enum already complete from v0.2 |
|
|
||||||
| 11 | Anchors (institutional Partner tier) | §13 | `x/partner` | Extended | P4 | AnchorCredential struct fields on the Anchor tier (REQ-018 enum unchanged); ListByTier(Anchor) round-trip |
|
|
||||||
| 8 | Hub API (Pact #6 expanded) | §13, §16 | `x/hub` | New | P5 | HubService enum (Custody/LendingPrimitive/Compliance) + per-service struct stubs + keeper stub |
|
|
||||||
| — | Services (Care/SIM/Vault/Mail) | §13 | `x/services` | New | P5 | ServiceKind enum (4) + per-service struct stubs + keeper stub |
|
|
||||||
| 8 | Bond market depth (Growth Bonds + secondary) | §17 | `x/bond` | Extended | P5 | GrowthBond struct + SecondaryOrder types; 8%/0% consts (D-028) unchanged; Clamp reused |
|
|
||||||
|
|
||||||
> The Hub API is Pact #6 (Hub-API) per REQ-020/D-027. v0.2 stubbed it as a PactType
|
|
||||||
> enum value inside `x/pact`; v0.3 promotes it to its own `x/hub` module for the
|
|
||||||
> B2B type scaffold (D-039). The `x/pact` HubAPI enum value stays as a
|
|
||||||
> cross-reference; `x/hub` owns the service-shape types.
|
|
||||||
|
|
||||||
### v0.3 Cross-Component Dependencies (within v0.3)
|
|
||||||
|
|
||||||
Per the v0.2 G-003 invariant (by-ID-string inter-module references; no struct
|
|
||||||
imports across `x/<module>/types`), v0.3 components reference each other and the
|
|
||||||
v0.2 baseline by ID string only. The dependency edges that affect v0.3 phase
|
|
||||||
ordering:
|
|
||||||
|
|
||||||
```
|
|
||||||
x/bridge ──(L2Chain by id)──► x/satellite (v0.2 baseline; ref only, no struct import)
|
|
||||||
x/exit ──(BridgeRoute by id)──► x/bridge (P4: exit references bridge routes)
|
|
||||||
x/hub ──(Anchor by id)──► x/partner (P5: Hub custody/compliance references Anchor partners)
|
|
||||||
x/bond ──(Stand by id)──► x/stand (v0.2 baseline; GrowthBond issuer-stand-id, unchanged)
|
|
||||||
x/services ──(Window by id)──► x/window (v0.2 baseline; service-grant references a Window)
|
|
||||||
x/bearers ──(BearerTransport)──► (none; OY-SAT/OY-QR are transport stubs, no new deps)
|
|
||||||
```
|
|
||||||
|
|
||||||
**Phase-ordering implication (informs D-044):** `x/exit` references `x/bridge`
|
|
||||||
routes, so both must land in the same phase (P4) and `x/bridge` types must exist
|
|
||||||
before `x/exit` tests that reference a BridgeRoute. `x/hub` references Anchor
|
|
||||||
partner-ids, so `x/partner` Anchor extension (P4) must precede `x/hub` (P5). This
|
|
||||||
confirms the D-044 P4→P5 split: P4 = exit/bridge/bearers/partner-Anchor,
|
|
||||||
P5 = hub/services/bond. Reversing P4/P5 would force `x/hub` to reference an Anchor
|
|
||||||
tier that does not yet exist.
|
|
||||||
|
|
||||||
### v0.3 Interface Contracts (6 cross-component — unchanged from v0.2)
|
|
||||||
|
|
||||||
The six cross-component interfaces (Standing API, Forge/Fold, Watcher Attestation,
|
|
||||||
Window Lifecycle, Fee Covenant, Voice/Council) are NOT extended in v0.3 — v0.3
|
|
||||||
adds *type scaffolds* that will *consume* them at runtime in v0.4+:
|
|
||||||
|
|
||||||
- **Window Lifecycle Interface** — `x/services` service-grants reference a Window
|
|
||||||
by ID (the service opens a Window on the holder's behalf). Skeleton only.
|
|
||||||
- **Fee Covenant Interface** — `x/bridge`/`x/exit` exit routes carry an
|
|
||||||
`exit-fee-bps` field clamped by the Fee Covenant ceiling/floor (the field is
|
|
||||||
typed in v0.3; the Clamp is NOT invoked in the skeleton — deferred to v0.4
|
|
||||||
runtime to avoid cross-module calls in the skeleton layer).
|
|
||||||
- **Standing API** — `x/hub` compliance service stub references a partner's
|
|
||||||
Standing by reach-id (skeleton: by-ID-string field, no query).
|
|
||||||
- **Watcher Attestation** — `x/bridge` BridgeStatus has an `Attested` state; the
|
|
||||||
attestation itself is not modeled in v0.3 (Watchers are v0.1 baseline; the
|
|
||||||
bridge references a Watcher quorum by ID at runtime, deferred to v0.4).
|
|
||||||
|
|
||||||
### Documentation Architecture (v0.3 deliverable B)
|
|
||||||
|
|
||||||
v0.3 introduces a documentation deliverable alongside the Bearers skeleton. This
|
|
||||||
is a NEW architecture surface (no docs site existed in v0.1/v0.2).
|
|
||||||
|
|
||||||
**Layout:**
|
|
||||||
```
|
|
||||||
oy/
|
|
||||||
├── README.md # repo-root project overview (lexicon-clean)
|
|
||||||
├── mkdocs.yml # MkDocs Material config (site_name, nav, theme)
|
|
||||||
└── docs/
|
|
||||||
├── nomads/ # audience: nomads (Reach path, Stash, bearers, Maps/Pay, Pacts, standing basics)
|
|
||||||
├── freeholders/ # audience: freeholders (4 signals, Bayesian Standing, Stands/Guilds, Councils/Voice, Bonds, Partner spectrum)
|
|
||||||
├── shared/ # cross-audience (Six Principles, Bread Scale, Storage pools, Watchers/Mirror, Lexicon glossary, Vision overview)
|
|
||||||
└── reference/ # architecture index + component map
|
|
||||||
```
|
|
||||||
|
|
||||||
**mkdocs.yml (minimal config):** `site_name: OpenYield`, `theme: readthedocs` or
|
|
||||||
`theme: material` (D-042 chose Material), `nav:` with the four audience
|
|
||||||
sections, `markdown_extensions: [admonition, toc, pymdownx.superfences]`. Build-
|
|
||||||
only Python dep (`mkdocs` + `mkdocs-material`); `go.mod` stays zero-dep (G-006 —
|
|
||||||
the docs toolchain is NOT a Go dependency). No publishing CI in v0.3 (D-046);
|
|
||||||
README documents `mkdocs serve` / `mkdocs build`.
|
|
||||||
|
|
||||||
**Audience-organized nav (D-042, D-045):** nomads 5-8 pages, freeholders 5-8
|
|
||||||
pages, shared 5-6 pages, reference 2 pages (~20-25 total). Pages map to REQs:
|
|
||||||
nomads cover REQ-007/013/014/015/019/020; freeholders cover REQ-005/006/016/017/
|
|
||||||
011/021/018; shared covers REQ-001/003/004/012; reference covers the architecture
|
|
||||||
index.
|
|
||||||
|
|
||||||
**Lexicon-clean by construction (REQ-012 extension, D-043):** docs are user-
|
|
||||||
facing and must be lexicon-clean. The highest-risk banned term in docs is
|
|
||||||
"yield" (PROJECT.md uses "real yield" but docs must say "real production" / "real
|
|
||||||
return" — the word-boundary regex in `lexicon.FindBannedTerm` bans standalone
|
|
||||||
"yield" while allowing "OpenYield"). Other high-risk terms in docs: "account"
|
|
||||||
(use "Holder"/"Reach"), "bank"/"deposit"/"savings" (use "Stash"/"Vault"/
|
|
||||||
"Root-Pool"). The firewall lands in P1 BEFORE content (P2/P3) so docs are checked
|
|
||||||
as authored (D-044 firewall-first ordering).
|
|
||||||
|
|
||||||
**Firewall extension (D-043):** a NEW sibling test `lexicon_meta_docs_test.go`
|
|
||||||
(package `lexicon_meta_docs`) mirrors `lexicon_meta_test.go` (package
|
|
||||||
`lexicon_meta`) exactly — same `lexicon.FindBannedTerm`, same word-boundary
|
|
||||||
regex, same fragment-assembled self-test table, same self-exclusion of the meta-
|
|
||||||
test file — but scans `README.md` + `docs/**/*.md` instead of `x/**/*.go`. The
|
|
||||||
existing `lexicon_meta_test.go` is NOT modified (preserves v0.2 coverage). The
|
|
||||||
new meta-test walks the repo root for `README.md` + the `docs/` tree, excludes
|
|
||||||
`.ciagent/` and `.git/` (firewall meta-files are not user-facing docs), and
|
|
||||||
excludes itself. Per-package lexicon assertions in the new `x/*` modules follow
|
|
||||||
the v0.2 pattern (`TestLexiconNoBannedTermsIn<Module>Package` scanning the
|
|
||||||
module's production `.go` files).
|
|
||||||
|
|
||||||
> The `.ciagent/` directory holds firewall META-files (PROJECT.md, RESEARCH.md,
|
|
||||||
> this file) that discuss the banned terms by name for governance reasons — they
|
|
||||||
> are NOT user-facing docs and are explicitly excluded from the docs firewall
|
|
||||||
> scan. This mirrors how `lexicon_meta_test.go` excludes itself: the firewall's
|
|
||||||
> own code is allowed to name the terms it bans.
|
|
||||||
|
|
||||||
## v0.4 Architecture (Refinement — NFR)
|
|
||||||
|
|
||||||
v0.4 is a refinement-only NFR milestone (D-047): zero `feat:` phases, zero new
|
|
||||||
production types, zero behavioral changes. It lands durability fixes sourced
|
|
||||||
from v0.3 forward-references. Tags run on the `v0.3.x` patch line.
|
|
||||||
|
|
||||||
### v0.4 Research Findings
|
|
||||||
|
|
||||||
**R-029 — Lexicon firewall shared helper (REQ-029, GRILL G-014).**
|
|
||||||
|
|
||||||
Verified during v0.4 RESEARCH: `lexicon_meta_test.go` (`TestLexiconMetaSelfTestTable`, lines 83-118) and `lexicon_meta_docs/lexicon_meta_docs_test.go` (`TestLexiconMetaDocsSelfTestTable`, lines 147-182) contain byte-identical duplicate synthetic self-test tables — both build the same 10-string slice by indexing `lexicon.BannedTerms()`. This is exactly the G-014 drift risk: if a future banned-term addition updates one table and not the other, the docs firewall silently loses coverage. The fix is a new `lexicon.SyntheticBannedStrings() []string` helper in `lexicon/lexicon.go` that returns the 10 synthetic strings; both meta-tests consume it instead of building their own copy. The helper's source uses `lexicon.BannedTerms()` (already fragment-assembled) so the lexicon package's own source stays lexicon-clean. Both meta-tests already assert `len(terms) == 10` from `lexicon.BannedTerms()` (the G-014 minimum); the helper closes the drift fully. No behavioral change to detection (`FindBannedTerm` unchanged); refactor + test only.
|
|
||||||
|
|
||||||
**R-030 — Cross-package const-equality test (REQ-030, REVIEW P2 / A-304).**
|
|
||||||
|
|
||||||
Verified during v0.4 RESEARCH: `x/hub/types/types.go:51,56` defines LOCAL consts `LendingCouponCapBps = uint32(800)` and `LendingCouponFloorBps = uint32(0)`, cross-documented (comment lines 46-55) to `x/bond/types/types.go:21,26` consts `CouponCapBps = 800` and `CouponFloorBps = 0` (D-028 mission-locked). The cross-doc comment flags drift for human review but no automated check exists. The fix is a new test file `x/hub/types/cross_const_test.go` (package `types`) that imports `github.com/oy/openyield/x/bond/types` (test-only, G-003 exempt per the test-import exemption documented in v0.2 GRILL G-003) and asserts `hub.LendingCouponCapBps == bond.CouponCapBps` and `hub.LendingCouponFloorBps == bond.CouponFloorBps`. The test fails closed if either const drifts. No production import is added (G-003 production firewall intact); test-only import only.
|
|
||||||
|
|
||||||
**R-031 — Lifecycle type shape-divergence review (REQ-031, AUDIT §193).**
|
|
||||||
|
|
||||||
Verified during v0.4 RESEARCH: AUDIT §193 flags two P1 council divergences and one P2 bearers nit:
|
|
||||||
- **P1-1**: `x/council/types` lacks `Proposal`/`ProposalStatus`/`VoteOption` enums (AUDIT says add "in v0.3 when wiring the council keeper to a live governance runtime"). Adding these is a `feat:`-class addition (new enum types) → REJECTED by D-001 filter for v0.4. Deferred to v0.5+ governance runtime.
|
|
||||||
- **P1-2**: `SignalKind` has 4 sources (Stash/Standing/Vouch/Capital) vs spec's `VoiceSource` 5 sources (Stash/Standing/Vouch/Freeholder/Guild). AUDIT code rationale: Freeholder is an eligibility property (upstream in `x/standing`), Guild is a council tier, Capital is committed-capital (vision §9.1) — defensible refinement. Changing `SignalKindCount` 4→5 is a locked-const change → REJECTED by D-001 filter for v0.4.
|
|
||||||
- **P2**: `x/bearers/types` `ValidateGenesis` no-op is CORRECT per spec (AUDIT explicitly notes "no action").
|
|
||||||
|
|
||||||
v0.4 REQ-031 scope (D-050): DOCUMENT the divergence decisions in this ARCHITECTURE.md section + add a regression-guard test asserting the current `SignalKindCount==4` shape is intentional (an intent-assertion test, not a shape change). No enum additions, no locked-const changes. The existing `TestSignalKindCountLockedConst` in `x/council/types/types_test.go:102` already asserts the count; REQ-031 adds an intent comment + a test documenting WHY the shape is 4-not-5 (the AUDIT rationale), so a future agent does not "fix" the divergence by silently changing the locked const.
|
|
||||||
|
|
||||||
**R-032 — Docs build CI (REQ-032, D-046).**
|
|
||||||
|
|
||||||
Verified during v0.4 RESEARCH: no `.github/workflows/` directory exists; Gitea Actions uses `.gitea/workflows/`. `mkdocs.yml` is present at repo root (buildable locally via `mkdocs build`). v0.4 REQ-032 ships a `.gitea/workflows/docs-build.yml` workflow that: (1) runs `go test ./...` (the lexicon firewall + all x/* tests) on push; (2) installs mkdocs + mkdocs-material (build-only Python deps in a separate job/step — does NOT touch `go.mod`, G-006 intact); (3) runs `mkdocs build` to produce `site/`; (4) uploads `site/` as a CI artifact. Full Gitea Pages publishing is DEFERRED (no hosting target configured in v0.4 per D-051). The workflow file is `chore` (CI config), not `feat:` — passes the D-001 filter. The workflow runs on every push to any branch (not just main) so the lexicon firewall + docs build are checked on every change.
|
|
||||||
|
|
||||||
### v0.4 Component Map (no new modules)
|
|
||||||
|
|
||||||
v0.4 touches NO new `x/*` modules. The touched files are:
|
|
||||||
- `lexicon/lexicon.go` (add `SyntheticBannedStrings()`) — REQ-029
|
|
||||||
- `lexicon_meta_test.go` (refactor to consume helper) — REQ-029
|
|
||||||
- `lexicon_meta_docs/lexicon_meta_docs_test.go` (refactor to consume helper) — REQ-029
|
|
||||||
- `x/hub/types/cross_const_test.go` (NEW test file) — REQ-030
|
|
||||||
- `x/council/types/types_test.go` (add intent-assertion test + comment) — REQ-031
|
|
||||||
- `.ciagent/oy/ARCHITECTURE.md` (this section) — REQ-031
|
|
||||||
- `.gitea/workflows/docs-build.yml` (NEW CI workflow) — REQ-032
|
|
||||||
|
|
||||||
### v0.4 Interface Contracts (unchanged from v0.3)
|
|
||||||
|
|
||||||
v0.4 does not change any cross-component interface. The 6 cross-component interfaces (Standing, Forge/Fold, Mirror, Window, Fee Covenant, Voice/Council) are unchanged. REQ-031 documents a divergence in the Voice/Council interface surface (SignalKind shape) but does not change it.
|
|
||||||
|
|
||||||
### Council Voice/Council Interface — Lifecycle Type Divergence Decisions (v0.4, REQ-031)
|
|
||||||
|
|
||||||
This section documents the lifecycle type shape-divergences flagged by AUDIT.md §193 for the Council/Voice interface surface. v0.4 is a refinement-only NFR milestone (D-047): the D-001 filter REJECTS `feat:`-class enum additions and locked-const shape changes, so these divergences are DOCUMENTED here, not fixed in code. A regression-guard test (`TestSignalKindShapeIntentional` in `x/council/types/types_test.go`) locks the current shape so a future agent does not silently "fix" a divergence by changing a locked const.
|
|
||||||
|
|
||||||
**Divergence P1-1 (AUDIT §193): `Proposal`/`ProposalStatus`/`VoteOption` enums absent from `x/council/types`.**
|
|
||||||
|
|
||||||
- **Spec source**: P3-01-01 deliverable recommended `Proposal`, `ProposalStatus` (5 states), `VoteOption` (3 options) enums mirroring OZ Governor / `x/gov`.
|
|
||||||
- **Implemented**: `Council`, `CouncilMember`, `Voice`, `SignalKind`, `TallyResult` — no `Proposal`/`ProposalStatus`/`VoteOption` lifecycle types.
|
|
||||||
- **Must-have impact**: NONE. The v0.2 P3 must-haves (3 councils, Mission Lock, `TallyResult` x/gov shape, no veto) are all met without the Proposal lifecycle.
|
|
||||||
- **Decision (v0.4, D-050)**: ADDING `Proposal`/`ProposalStatus`/`VoteOption` is a `feat:`-class addition (new enum types). REJECTED by the D-001 refinement-only filter. **Deferred to v0.5+** when the council keeper is wired to a live governance runtime (the AUDIT's own recommendation: "add in v0.3 when wiring the council keeper to a live governance runtime"). The skeleton council keeper in v0.2 does not consume a Proposal lifecycle; adding the types without the runtime would be dead code.
|
|
||||||
- **Severity (AUDIT)**: P1 (spec drift from deliverable text, not a must-have, not blocking).
|
|
||||||
- **v0.4 action**: DOCUMENT only (this section). No code change.
|
|
||||||
|
|
||||||
**Divergence P1-2 (AUDIT §193): `SignalKind` 4 sources vs spec `VoiceSource` 5 sources.**
|
|
||||||
|
|
||||||
- **Spec source**: P3-01-01 deliverable specified `VoiceSource` with 5 sources (Stash/Standing/Vouch/Freeholder/Guild).
|
|
||||||
- **Implemented**: `SignalKind` with 4 sources: `SignalStash`, `SignalStanding`, `SignalVouch`, `SignalCapital` (`SignalKindCount = 4`, locked const).
|
|
||||||
- **Code rationale (AUDIT §193 P1-2)**: the 4-source shape is a defensible design refinement, not a defect:
|
|
||||||
- `Freeholder` is an ELIGIBILITY property (upstream in `x/standing`), not a voice signal. A Freeholder-eligible Reach is a precondition for voting, not a signal that feeds a vote's weight.
|
|
||||||
- `Guild` is a COUNCIL TIER (one of the three councils is the Guild Council), not a voice signal. Including Guild as a signal kind would conflate the council tier with the signal source.
|
|
||||||
- `Capital` is committed-capital (vision §9.1, one of the four Freeholder signals), which the spec's `VoiceSource` list omitted. Adding `Capital` corrects the spec list to match vision §9.1's four-signal definition (REQ-005: "Four Freeholder signals locked").
|
|
||||||
- **Must-have impact**: NONE. The v0.2 P3 must-haves did not enumerate `VoiceSource` coverage; the 4-signal shape matches REQ-005's "Four Freeholder signals locked" exactly.
|
|
||||||
- **Decision (v0.4, D-050)**: changing `SignalKindCount` 4→5 (to restore the spec's 5-source `VoiceSource`) is a LOCKED-CONST CHANGE. REJECTED by the D-001 refinement-only filter (changing a locked const is a behavioral change, not a refinement). The 4-source shape is the CORRECT shape per vision §9.1 and REQ-005; the spec deliverable text was wrong, not the implementation.
|
|
||||||
- **Severity (AUDIT)**: P1 (design-choice divergence, tested and self-consistent, not blocking).
|
|
||||||
- **v0.4 action**: DOCUMENT the rationale here + add `TestSignalKindShapeIntentional` (regression guard) so a future agent changing `SignalKindCount` from 4 to 5 must also update the intent-assertion test, surfacing the AUDIT rationale for review. No locked-const change.
|
|
||||||
|
|
||||||
**Divergence P2 (AUDIT §193): `x/bearers/types` `ValidateGenesis` no-op.**
|
|
||||||
|
|
||||||
- **Spec source**: P4-02-01 said "DefaultParams/GenesisState unchanged" (bearers is an EXTENSION in v0.2, not a new module; the A-212 `ValidateGenesis` upgrade was scoped to NEW modules only).
|
|
||||||
- **Implemented**: `ValidateGenesis` remains a no-op (`x/bearers/types/types.go:108` returns `nil` unconditionally).
|
|
||||||
- **Decision (v0.4)**: CORRECT per spec — no action (AUDIT explicitly notes "no action"). The A-212 upgrade applies to NEW modules (v0.2's `x/window`, `x/stand`, etc.), not to EXTENDED modules like `x/bearers`. Listed here for completeness; no code change, no test change.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## v0.5 Runtime Architecture (Bearers Runtime)
|
|
||||||
|
|
||||||
This section appends the v0.5 runtime architecture to the v0.1/v0.2/v0.3/v0.4
|
|
||||||
content above. It does NOT rewrite or supersede earlier sections. v0.5 is the
|
|
||||||
first **feature** milestone to ship executable behavior: the v0.3 Bearers
|
|
||||||
skeletons are promoted from types + in-memory keeper stubs + invariant tests
|
|
||||||
to **live keeper MsgServer message handlers + simtest-grade end-to-end flows**
|
|
||||||
(D-054). This is NOT mainnet — D-020 continues to govern network deployment;
|
|
||||||
runtime = simtest-grade handlers, not live chain. Tags run on the `v0.4.x`
|
|
||||||
patch line (config.json `tag_base`).
|
|
||||||
|
|
||||||
### v0.5 Skeleton→Runtime Promotion Pattern
|
|
||||||
|
|
||||||
The promotion is uniform across all 8 target modules. The v0.3 skeleton
|
|
||||||
baseline (verified against the current tree): each module has only a `types/`
|
|
||||||
subdir with `types.go` (pure-Go structs + locked consts + enums),
|
|
||||||
`genesis.go` (`ValidateGenesis`), and `*_test.go` (invariant + lexicon
|
|
||||||
tests). The in-memory `Keeper` stub lives INSIDE `types/types.go` (e.g.,
|
|
||||||
`x/partner/types/types.go:101 type Keeper struct{...}`, `NewKeeper()` returns
|
|
||||||
`&Keeper{partners: make(map[string]Partner)}`). There is NO `keeper/` subdir,
|
|
||||||
NO `msg_server.go`, NO `types.Msg*`, NO `sdk.Context`, and NO cosmos-sdk
|
|
||||||
import anywhere in `x/` (grep for `cosmos-sdk` / `sdk.Context` /
|
|
||||||
`cosmos/cosmos` returns zero matches — verified at v0.5 P0).
|
|
||||||
|
|
||||||
v0.5 promotes each module per the Cosmos-SDK `MsgServer` convention:
|
|
||||||
|
|
||||||
| Layer | v0.3 skeleton | v0.5 runtime addition |
|
|
||||||
|---|---|---|
|
|
||||||
| Keeper | in-memory `map[string]T` in `types/types.go` | `keeper/keeper.go` (store-backed, wraps `sdk.KVStore`); the v0.3 stub is retired or wrapped as a test helper |
|
|
||||||
| Messages | none | `types/msg_*.go` with `Msg*` structs implementing `sdk.Msg` (`ValidateBasic`, `GetSigners`) |
|
|
||||||
| Handlers | none | `keeper/msg_server.go` with `MsgServer` + one `*Response, error` method per `Msg*` |
|
|
||||||
| Module wiring | none | `module.go` (`AppModule` with `RegisterServices` registering the `MsgServer`); simtest may use a lighter `ModuleManager` shim |
|
|
||||||
| End-to-end test | invariant tests only | `simtest/` (or `keeper/msg_server_simtest_test.go`) exercising each handler against an in-memory `sdk.Context` |
|
|
||||||
| Cross-module deps | by-ID-string only (G-003) | by-ID-string preserved at the type level; keeper-to-keeper calls via `expected_keepers.go` interface shims (ibc-go convention) |
|
|
||||||
|
|
||||||
The existing `types/` locked consts, enums, and structs are NOT amended —
|
|
||||||
the runtime layer adds behavior on top, not changes to the contract. The
|
|
||||||
locked-const firewall (8%/0% bond cap, 6 bearers, 4 Partner tiers, Mission
|
|
||||||
Lock non-amendable, etc.) stays green.
|
|
||||||
|
|
||||||
### v0.5 Per-Module Runtime Surface
|
|
||||||
|
|
||||||
| Module | REQ | Phase | Runtime surface (MsgServer handlers) | Key types added/extended |
|
|
||||||
|---|---|---|---|---|
|
|
||||||
| `x/exit` | REQ-033 | P1 | `MsgSubmitExitRoute`, `MsgExecuteDEXSwap`, `MsgRefundExit` driving the v0.3 `ExitStatus` lifecycle (Proposed→InProgress→Settled/Failed/Refunded) | `Msg*` types; cross-chain exit invokes `x/bridge` via `BridgeKeeper` expected-keeper shim |
|
|
||||||
| `x/bridge` | REQ-033 | P1 | `MsgAttestBridgeRoute` (Pending→Attested via Watcher quorum), `MsgActivateBridge`, `MsgCloseBridge`, `OnRecvPacket`, `OnAcknowledgementPacket`, `OnTimeoutPacket` (ibc-go `IBCModule` contract) | `Msg*` types; ICS-20 v1 payload parser; Solana via wormhole-adapter verification branch (D-059) |
|
|
||||||
| `x/bearers` | REQ-034 | P2 | `MsgSendOYSATFrame`, `MsgReceiveOYSATFrame`, `MsgIssueOYQR`, `MsgConsumeOYQR` (one-shot) + session lifecycle (Open/Active/Closed/Revoked) | `Session` struct; store-backed `BearerTransport` impl (keeper as transport in simtest); `consumed` flag is the OY-QR replay firewall |
|
|
||||||
| `x/partner` | REQ-035 | P3 | `MsgIssueAnchorCredential`, `MsgOnboardAnchor` (Pending→Onboarded), `MsgSuspendAnchorCredential`, `MsgRevokeAnchorCredential` (Watcher-quorum authz) | `Msg*` types; `expected_keepers.go` shims for `x/watcher` (revocation authz) and `x/hub` (custody-provider-id validity, P4-wired) |
|
|
||||||
| `x/hub` | REQ-036 | P4 | `MsgRegisterCustodyService` (operator must be Onboarded Anchor), `MsgCustodyReceiveAsset`, `MsgCustodyReleaseAsset` (compliance-before-debit), `MsgRecordLendingPrimitive` (coupon clamp [0,800]), `MsgRecordComplianceAttestation` | `CustodyKeyring` interface + `memKeyring` in-memory test impl (D-058); `Msg*` names avoid banned "deposit" (lexicon) |
|
|
||||||
| `x/services` | REQ-037 | P5 | `MsgRegisterService` (window-grant check), `MsgActivateService`, `MsgSuspendService`, `MsgRevokeService`; per-kind: `MsgIssueCareGrant`, `MsgActivateSIM`, `MsgProvisionVault`, `MsgBindMailbox` | Per-kind `Msg*` (typed dispatch, not generic); `window-id` grant checked on EVERY op (revoked Window invalidates) |
|
|
||||||
| `x/bond` | REQ-038 | P6 | `MsgIssueBond`, `MsgIssueGrowthBond` (`Clamp` + `ClampGrowth`), `MsgTickGrowthBond`, `MsgPlaceSecondaryOrder`, `MsgCancelSecondaryOrder`, `MsgMatchSecondaryOrder` (CLOB, price-time priority, per-match clamp) | CLOB matching engine; per-match coupon clamp to [0, 800] bps via v0.3 `Clamp` (D-057/D-028); match above 800 REJECTED (fails closed, A-562) |
|
|
||||||
| `x/council` | REQ-039 | P7 | `MsgSubmitProposal` (MissionLockAmendment kind rejected at `ValidateBasic`), `MsgVote` (Veto is Watcher-only, quorum-based), `MsgTallyProposal` | `Proposal` struct + `ProposalKind` enum (4, incl. rejected MissionLockAmendment) + `ProposalStatus` enum (5) + `VoteOption` enum (4) — AUDIT §193 P1-1 promotion; `SignalKind` stays 4 (P1-2 defensible); Mission Lock const firewall intact |
|
|
||||||
|
|
||||||
### v0.5 Custody Keyring Interface Boundary (D-058)
|
|
||||||
|
|
||||||
`x/hub/types/keyring.go` defines the `CustodyKeyring` Go interface — the
|
|
||||||
custody key-share abstraction (MPC-via-interface, not a concrete HSM/MPC
|
|
||||||
vendor):
|
|
||||||
|
|
||||||
```
|
|
||||||
type CustodyKeyring interface {
|
|
||||||
Sign(ctx context.Context, assetID string, payload []byte) (sig []byte, err error)
|
|
||||||
Derive(ctx context.Context, assetID string) (pub PubKey, err error)
|
|
||||||
Status(ctx context.Context, assetID string) (KeyringStatus, error)
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
- v0.5 ships an in-memory test-only `memKeyring` impl (`x/hub/keeper/
|
|
||||||
keyring_mem.go` or `x/hub/types/keyring_mem_test.go`) that signs with a
|
|
||||||
throwaway ed25519 key. Real MPC/HSM backing is deferred (operational,
|
|
||||||
Year 3+).
|
|
||||||
- The interface supports key rotation: `Status` reports the active key
|
|
||||||
version; the handler consults the keyring per operation (no caching
|
|
||||||
across blocks — a cached pubkey breaks rotation).
|
|
||||||
- The boundary keeps v0.5 dep-neutral w.r.t. custody vendors while landing
|
|
||||||
the handler surface. GRILL reviews the interface boundary.
|
|
||||||
|
|
||||||
### v0.5 CLOB Matching Engine Invariants (D-057)
|
|
||||||
|
|
||||||
`x/bond` secondary-market matching is a **central-limit order book (CLOB)**
|
|
||||||
(not an AMM — D-057 rejects AMM as a Year-4 concern). The invariants:
|
|
||||||
|
|
||||||
1. **Price-time priority** — at the same price, the earlier resting order
|
|
||||||
fills first (by sequence). This is REQ-007 FCFS at the same price.
|
|
||||||
2. **Per-tx matching** — the handler matches a new order against the resting
|
|
||||||
book in the same tx (dYdX-v4-shaped); no asynchronous / end-of-block
|
|
||||||
batch matching in v0.5 simtest.
|
|
||||||
3. **Per-match coupon clamp** — every match's resulting coupon is clamped to
|
|
||||||
`[CouponFloorBps=0, CouponCapBps=800]` (D-028, locked since v0.2) via the
|
|
||||||
v0.3 `Clamp` helper. A match whose implied coupon exceeds 800 bps is
|
|
||||||
**REJECTED** (fails closed — A-562, the mission-lock-true choice; D-057
|
|
||||||
says "clamp", the runtime interpretation is reject-above-cap. Planner
|
|
||||||
confirms before P6).
|
|
||||||
4. **Mission-lock const firewall** — the handler references the consts
|
|
||||||
directly (not a local copy); the REQ-030 cross-const test (hub lending
|
|
||||||
consts == bond consts) stays green.
|
|
||||||
5. **No front-running safety claim** — per-tx matching in a single-
|
|
||||||
validator simtest has no MEV; the handler is documented as NOT
|
|
||||||
front-running-safe for mainnet (a Year-3+ concern). Simtest does not
|
|
||||||
assert front-running safety (out of scope for simtest-grade runtime,
|
|
||||||
D-054).
|
|
||||||
|
|
||||||
### v0.5 IBC Packet Handler Scope (D-059)
|
|
||||||
|
|
||||||
`x/bridge` IBC packet handlers cover the **5 locked L2 chains** already in
|
|
||||||
the v0.2 `x/satellite` skeleton (Polygon, Base, Arbitrum, Optimism, Solana
|
|
||||||
per REQ-009). No new L2 chains in v0.5. The handler shape:
|
|
||||||
|
|
||||||
- **4 EVM chains (Polygon/Base/Arbitrum/Optimism):** standard IBC
|
|
||||||
recv/ack/timeout on the ICS-20 v1 payload (the v0.2 satellite packet
|
|
||||||
shape). Timestamp-only timeouts (IBC Eureka model, ibc-go v10) avoid the
|
|
||||||
EVM height-timeout ambiguity.
|
|
||||||
- **Solana:** via the wormhole-style bridge adapter (D-021 stub promoted
|
|
||||||
to runtime). Solana packets arrive as wormhole VAAs (Verified Action
|
|
||||||
Approvals); the `x/bridge` handler verifies the guardian signature set
|
|
||||||
(a 2-of-N quorum, N = the wormhole guardian set) before transitioning the
|
|
||||||
route. The guardian set is read from state (not hardcoded); simtest uses
|
|
||||||
a frozen stub guardian set. Live wormhole integration deferred (D-054).
|
|
||||||
- **Replay protection:** mirrors ibc-go — delete the in-flight record on
|
|
||||||
first ack; reject on second; `OnTimeoutPacket` refunds the source-chain
|
|
||||||
escrow exactly once. Simtest covers both replay and timeout-refund cases
|
|
||||||
(the CVE-class ibc-go pitfall).
|
|
||||||
|
|
||||||
### v0.5 Council Governance Enum Additions (D-060)
|
|
||||||
|
|
||||||
`x/council/types` gains the AUDIT §193 P1-1 enums deferred from v0.4
|
|
||||||
(D-050/D-001 rejected them as `feat:` for the NFR milestone; v0.5 promotes
|
|
||||||
them as the feature milestone's P7):
|
|
||||||
|
|
||||||
| New type | Values | Locked count | Notes |
|
|
||||||
|---|---|---|---|
|
|
||||||
| `Proposal` struct | (id, council-id, kind, proposer-reach, submit-time, voting-deadline, status, tally) | — | Mirrors OZ Governor / `x/gov` proposal shape |
|
|
||||||
| `ProposalKind` enum | `Stand`, `Guild`, `Mesh`, `MissionLockAmendment-Rejected` | `ProposalKindCount = 4` | The 4th value exists but the handler rejects it — documents the non-amendability in code |
|
|
||||||
| `ProposalStatus` enum | `Pending`, `Active`, `Succeeded`, `Failed`, `Executed` | `ProposalStatusCount = 5` | Mirrors OZ Governor / `x/gov` lifecycle |
|
|
||||||
| `VoteOption` enum | `Yes`, `No`, `Abstain`, `Veto` | `VoteOptionCount = 4` | `Veto` is Watcher-only; quorum-based (default `WatcherVetoQuorum = 6` per REQ-004 6-of-9); a single Veto does NOT block (anti-greed, vision §19) |
|
|
||||||
|
|
||||||
**Mission Lock const firewall intact (G-003):**
|
|
||||||
- `MissionLockAmendable = false` (v0.2 locked const) is UNCHANGED. The
|
|
||||||
`MissionLockAmendment-Rejected` `ProposalKind` is the in-code
|
|
||||||
documentation of the non-amendability; the `MsgSubmitProposal`
|
|
||||||
`ValidateBasic` REJECTS a proposal of that kind (the message never
|
|
||||||
reaches the handler — A-572). The const is the firewall; the
|
|
||||||
`ValidateBasic` is the gate. The v0.2 `TestMissionLockAmendableFalse`
|
|
||||||
regression test stays green.
|
|
||||||
- `SignalKind` stays at 4 sources (P1-2 defensible per AUDIT; the v0.4
|
|
||||||
`TestSignalKindShapeIntentional` regression-guard test stays green).
|
|
||||||
Expansion to 5 is a locked-const change deferred to v0.6+ governance
|
|
||||||
vote (not a Mission-Lock const — a distinct locked const; the distinction
|
|
||||||
is documented in v0.4 ARCHITECTURE.md).
|
|
||||||
- Proposal execution (auto-executing a passed proposal) is NOT in v0.5;
|
|
||||||
the handler records the tally result but does not auto-execute (a v0.6+
|
|
||||||
concern).
|
|
||||||
|
|
||||||
### v0.5 G-003 Production Firewall (still intact)
|
|
||||||
|
|
||||||
The G-003 by-ID-string rule (no production cross-`x/<module>/types` struct
|
|
||||||
imports) survives the runtime promotion. The runtime adds a NEW cross-
|
|
||||||
module surface — keeper-to-keeper calls — handled via the ibc-go
|
|
||||||
`expected_keepers.go` convention:
|
|
||||||
|
|
||||||
- Each module's `types/expected_keepers.go` defines Go INTERFACES for the
|
|
||||||
keepers it depends on (e.g., `x/exit/types/expected_keepers.go` defines a
|
|
||||||
`BridgeKeeper` interface with the methods `x/exit`'s handler calls; the
|
|
||||||
`x/bridge` keeper satisfies it structurally).
|
|
||||||
- The handler depends on the INTERFACE, not the concrete keeper struct.
|
|
||||||
This is NOT a struct import of `x/bridge/types`; it is an interface
|
|
||||||
defined in `x/exit/types`. G-003's intent (no cross-module struct
|
|
||||||
coupling, no import cycles) is preserved.
|
|
||||||
- Test-only cross-package imports (the G-003 test exemption, used by
|
|
||||||
REQ-030 in v0.4) remain exempt: a simtest may import both
|
|
||||||
`x/exit/keeper` and `x/bridge/keeper` to wire the expected-keeper shims
|
|
||||||
in a test setup.
|
|
||||||
|
|
||||||
### v0.5 G-006 Controlled Exception (cosmos-sdk dep, D-055)
|
|
||||||
|
|
||||||
`go.mod` gains `github.com/cosmos/cosmos-sdk` (+ transitive deps) as the
|
|
||||||
runtime substrate. This is a GRILL-approved controlled exception to G-006
|
|
||||||
(zero-dep go.mod), scoped to the runtime promotion phases:
|
|
||||||
|
|
||||||
- **Runtime phases (P1..P7):** `keeper/`, `msg_server.go`, `module.go`,
|
|
||||||
`simtest/` import cosmos-sdk. The dep is load-bearing.
|
|
||||||
- **P0 (pre-execution) + P8 (final):** stay dep-neutral where possible
|
|
||||||
(RESEARCH.md, PERSONAS.md, PLAN — no Go code).
|
|
||||||
- **`types/` packages:** the v0.3 `types/` packages were pure stdlib
|
|
||||||
(`encoding/json`); v0.5 ADDS `types.Msg*` structs implementing `sdk.Msg`,
|
|
||||||
so the `types/` package gains a cosmos-sdk import. The invariant tests
|
|
||||||
(locked-const, lexicon) stay stdlib-only and green. The `Msg*` types are
|
|
||||||
isolated in `types/msg_*.go` files for clarity.
|
|
||||||
- **Version pin (A-504, planner/GRILL confirms):** cosmos-sdk v0.50.x
|
|
||||||
(LTS, go 1.22-compatible) + ibc-go v8.x (for cosmos-sdk v0.50) for the
|
|
||||||
IBC packet handler interfaces. ibc-go v10 (IBC v2 / Eureka) is the
|
|
||||||
documented target pattern but a newer pin; v8.x is the stable choice.
|
|
||||||
The exception is GRILL-ratified per D-055.
|
|
||||||
|
|
||||||
### v0.5 Cross-Component Dependencies (within v0.5, by-ID-string + expected-keeper shims)
|
|
||||||
|
|
||||||
Per the v0.2-v0.4 G-003 invariant, v0.5 components reference each other and
|
|
||||||
the baseline by ID-string at the type level; the runtime adds interface-
|
|
||||||
typed keeper dependencies via `expected_keepers.go` shims. The dependency
|
|
||||||
edges that affect D-056 phase ordering:
|
|
||||||
|
|
||||||
```
|
|
||||||
x/exit ──(BridgeKeeper interface)──► x/bridge (P1 intra-phase; bridge keeper satisfies x/exit/types expected keeper)
|
|
||||||
x/bridge ──(WatcherKeeper interface)──► x/watcher (P1; Attested transition + Solana adapter authz)
|
|
||||||
x/bridge ──(BreadKeeper interface)───► x/bread (P1; mint/release wrapped Bread on recv/timeout)
|
|
||||||
x/bearers ──(BreadKeeper interface)───► x/bread (P2; OY-QR consume transfer effect)
|
|
||||||
x/partner ──(WatcherKeeper interface)──► x/watcher (P3; revocation authz)
|
|
||||||
x/partner ──(HubKeeper interface)─────► x/hub (P3→P4; custody-provider-id validity; shim exists P3, impl wired P4)
|
|
||||||
x/hub ──(PartnerKeeper interface)─► x/partner (P4; operator must be Onboarded Anchor)
|
|
||||||
x/hub ──(lexicon-safe consts)─────► x/bond (P4; LendingCouponCapBps/Floor local consts cross-documented D-028/REQ-030)
|
|
||||||
x/services ──(WindowKeeper interface)──► x/window (P5; window-grant validity on every op)
|
|
||||||
x/services ──(VaultKeeper interface)───► x/vault (P5; VaultService provisioning)
|
|
||||||
x/bond ──(StandKeeper interface)───► x/stand (P6; GrowthBond issuer-stand-id)
|
|
||||||
x/council ──(WatcherKeeper interface)──► x/watcher (P7; Veto authz + quorum)
|
|
||||||
```
|
|
||||||
|
|
||||||
**Phase-ordering implication (confirms D-056):** the outer→inner chain is
|
|
||||||
exit (P1) → bearers (P2) → anchors (P3) → hub (P4) → services (P5) → bond
|
|
||||||
(P6) → council (P7). The P3→P4 edge (partner needs hub custody-provider-id
|
|
||||||
validity) is broken by the `expected_keepers.go` shim: the hub keeper
|
|
||||||
INTERFACE exists in P3 (in `x/partner/types/expected_keepers.go`); the real
|
|
||||||
hub keeper impl is wired in P4. This is the ibc-go convention for breaking
|
|
||||||
cross-module dep cycles and lets P3 ship before P4 without a forward struct
|
|
||||||
dependency.
|
|
||||||
|
|
||||||
### v0.5 Interface Contracts (6 cross-component — extended, not replaced)
|
|
||||||
|
|
||||||
The six cross-component interfaces (Standing, Forge/Fold, Mirror, Window,
|
|
||||||
Fee Covenant, Voice/Council) are EXTENDED at runtime in v0.5 (they were
|
|
||||||
skeleton-only in v0.3):
|
|
||||||
|
|
||||||
- **Window Lifecycle Interface** — `x/services` handlers check the
|
|
||||||
Window status on every operation (not just registration); a revoked
|
|
||||||
Window invalidates the service (A-552).
|
|
||||||
- **Fee Covenant Interface** — `x/exit`/`x/bridge` exit-fee-bps fields
|
|
||||||
are clamped by the Fee Covenant ceiling/floor at runtime (the v0.3
|
|
||||||
field was typed but the Clamp was not invoked; v0.5 invokes it).
|
|
||||||
- **Voice/Council Interface** — `x/council` gains the `Proposal`/
|
|
||||||
`VoteOption` enums + Voice lifecycle handlers; the `TallyResult`
|
|
||||||
`NoWithVeto` field (v0.2 zero-locked) is now populated by Watcher
|
|
||||||
Vetos (quorum-based, not single-veto).
|
|
||||||
- **Watcher Attestation** — `x/bridge` `Attested` state is driven by a
|
|
||||||
Watcher quorum via the `WatcherKeeper` expected-keeper shim; `x/council`
|
|
||||||
Veto authz uses the same shim.
|
|
||||||
- **Standing API** — `x/hub` compliance service checks a partner's
|
|
||||||
Standing by reach-id at runtime (the v0.3 by-ID-string field becomes a
|
|
||||||
query).
|
|
||||||
- **Forge/Fold** — unchanged in v0.5 (no forge/fold runtime promotion this
|
|
||||||
milestone).
|
|
||||||
@@ -1,34 +0,0 @@
|
|||||||
# v0.6 Audit (Nomad Web UI)
|
|
||||||
|
|
||||||
## Reconstruction test
|
|
||||||
- git log ↔ .ciagent/ files: each REQ-040..REQ-045 maps to a shipped UI screen / firewall.
|
|
||||||
- REQ-040 → P1 (web/handlers/reach.go + 3 Reach templates + POST /reach atomic create)
|
|
||||||
- REQ-041 → P2 (web/handlers/stash.go + stash.html + Bread-scale conversion)
|
|
||||||
- REQ-042 → P3 (web/handlers/window.go + 3 Window templates + lifecycle)
|
|
||||||
- REQ-043 → P4 (web/handlers/standing.go + standing.html + Freeholder signals)
|
|
||||||
- REQ-044 → P5 (web/handlers/bloom.go + bloom.html + BloomRecord)
|
|
||||||
- REQ-045 → P1 (lexicon_meta_web/ firewall extension)
|
|
||||||
- 6 phase branches phase/01-*..phase/06-* created, merged, 5 deleted (06 pending).
|
|
||||||
- 6 patch tags v0.5.0..v0.5.5 created (v0.5.6 pending = milestone release).
|
|
||||||
- D-072 ordering respected: firewall-first P1 (REQ-045) before content P2..P5.
|
|
||||||
|
|
||||||
## Feature purity gate — GREEN
|
|
||||||
- **No breaking schema changes**: no x/ module modified (web/ is new app-layer, not an x/ amendment).
|
|
||||||
- **Locked-const firewall intact**: all v0.1..v0.5 consts unchanged (web/ does not touch x/ consts; it reads them via x/*/types imports — D-070 app-layer consumption).
|
|
||||||
- **G-003 production firewall intact**: web/ imports only x/*/types (verified by web/store/import_test.go / G-025; no x/*/keeper, no x/*/module imports).
|
|
||||||
- **G-006 go.mod unchanged**: git diff v0.5.0..HEAD -- go.mod go.sum is EMPTY (G-028 baseline diff). HTMX is a vendored static asset, NOT a Go dep.
|
|
||||||
|
|
||||||
## Coverage
|
|
||||||
- web/store: 98.1% (≥80% target met).
|
|
||||||
- web/handlers: 89.2% (≥80% target met).
|
|
||||||
- lexicon_meta_web: 100% (test-only firewall).
|
|
||||||
|
|
||||||
## Lexicon firewalls — all 3 GREEN
|
|
||||||
- lexicon_meta_test.go (v0.2, x/*.go) — green (no regression).
|
|
||||||
- lexicon_meta_docs_test.go (v0.3, README + docs/**) — green.
|
|
||||||
- lexicon_meta_web/ (v0.6, web/**/*.{html,js,go}) — green.
|
|
||||||
|
|
||||||
## Manual browser check (dynamic port)
|
|
||||||
- go run ./web on a dynamically-allocated port; all 5 screens reachable; happy path works end-to-end (Create a Reach → Stash dashboard → Open a Window → Standing progress → Bloom accrual). Smoke-tested on ports 47077 (P1) and 53907 (P5).
|
|
||||||
|
|
||||||
## Verdict: AUDIT PASS. Feature purity gate GREEN. Milestone ready to ship.
|
|
||||||
+1
-1350
File diff suppressed because it is too large
Load Diff
@@ -1,71 +0,0 @@
|
|||||||
# P1 — Orgs + Window Foundation — Ship Verification
|
|
||||||
|
|
||||||
Phase 1 of v0.2 (The Mesh). Branch: `oy/phase/01-orgs-window-foundation`.
|
|
||||||
|
|
||||||
This file is the lead-developer's P1-04-01 ship-verification report. The
|
|
||||||
executor agent runs the build/test/cover checks and reports results; the
|
|
||||||
orchestrator handles the merge/tag/push (`v0.1.1`).
|
|
||||||
|
|
||||||
## Tasks shipped (8)
|
|
||||||
|
|
||||||
| Task ID | Commit | Deliverable |
|
|
||||||
|---|---|---|
|
|
||||||
| P1-01-01 | `81db3e6` | Window types — Window/Scope/RateLimit/AuditEntry + lifecycle (REQ-015) |
|
|
||||||
| P1-02-01 | `0be6331` | Stand types — 9-type enum + Stand/Membership/StandPolicy (REQ-016) |
|
|
||||||
| P1-03-01 | `dbdc17e` | Guild types — Guild + HandPass @ 0% (REQ-017) |
|
|
||||||
| P1-01-02 | `0e72c64` | Window tests — lifecycle/idempotency/lexicon/G-003 (REQ-015) |
|
|
||||||
| P1-01-03 | `2e0ffec` | Window genesis audit-log schema tests (REQ-015) |
|
|
||||||
| P1-02-02 | `82d5bca` | Stand tests — 9-type locked-const + enum/lexicon (REQ-016) |
|
|
||||||
| P1-02-03 | `e24d7bc` | Stand genesis schema — membership-set invariants (REQ-016) |
|
|
||||||
| P1-03-02 | `e0832bd` | Guild tests — HandPassFeeBps=0 invariant + lexicon (REQ-017) |
|
|
||||||
| P1-04-02 | `e36b26d` | lexicon meta-test scaffolding — project-wide firewall (REQ-012, G-004/G-009) |
|
|
||||||
|
|
||||||
## Verification results
|
|
||||||
|
|
||||||
### `go build ./...`
|
|
||||||
GREEN. All 19 packages (15 v0.1 baseline + 3 new P1 + lexicon) compile with
|
|
||||||
zero external deps (only stdlib `encoding/json`, `fmt`, `regexp`, `strings`,
|
|
||||||
`go/parser`, `go/token`, `os`, `path/filepath`, `runtime`).
|
|
||||||
|
|
||||||
### `go test ./...`
|
|
||||||
GREEN. 143 tests across the repo; v0.1 baseline (53 tests) unchanged — no
|
|
||||||
regression. New: window (41 tests), stand (28), guild (17), lexicon meta (4).
|
|
||||||
|
|
||||||
### Coverage (`go test -cover`)
|
|
||||||
| Package | Coverage | Target |
|
|
||||||
|---|---|---|
|
|
||||||
| `x/window/types` | 100.0% | ≥80% |
|
|
||||||
| `x/stand/types` | 100.0% | ≥80% |
|
|
||||||
| `x/guild/types` | 100.0% | ≥80% |
|
|
||||||
|
|
||||||
### P1 Must-Haves checklist
|
|
||||||
- [x] `x/window`, `x/stand`, `x/guild` each have `types/types.go` + `types_test.go` (v0.1 pattern, package `types`, zero external deps).
|
|
||||||
- [x] `go build ./...` and `go test ./...` green across the whole repo.
|
|
||||||
- [x] ≥80% coverage on `x/window/types`, `x/stand/types`, `x/guild/types` (all 100%).
|
|
||||||
- [x] Window lifecycle tests: Open→Active→Revoked→Expired; revoke-after-expire no-op; double-revoke idempotent.
|
|
||||||
- [x] Stand locked-const: exactly 9 types with vision §11 names.
|
|
||||||
- [x] Guild `HandPassFeeBps == 0` invariant test.
|
|
||||||
- [x] Lexicon assertion in all 3 new test files.
|
|
||||||
- [x] `ValidateGenesis` performs ID-uniqueness checks (A-212 upgrade from v0.1 no-op).
|
|
||||||
- [x] Project-wide lexicon meta-test (G-004) scans all `x/**/*.go`; self-test table (G-009) detects all 10 banned terms.
|
|
||||||
- [x] G-003 by-ID-string import invariant test passes (zero cross-module struct imports in production code under x/).
|
|
||||||
- [ ] Git tag `v0.1.1` — NOT created by executor; orchestrator ships the phase.
|
|
||||||
|
|
||||||
## Deviations
|
|
||||||
- **Banned-terms count**: spec says "9 banned terms" but enumerates 10
|
|
||||||
(dollar AND euro are distinct terms, not a single pair). Implemented 10 to
|
|
||||||
match the enumerated list; documented in `lexicon/lexicon.go` and the
|
|
||||||
meta-test. The firewall scope is the enumerated list, not the count label.
|
|
||||||
- **genesis.go placement**: P1-01-03's `genesis.go` (ValidateAuditLogs) was
|
|
||||||
authored in P1-01-01 so `types.go` compiles (types.go references
|
|
||||||
ValidateAuditLogs). P1-01-03 adds `genesis_test.go` (the security-engineer's
|
|
||||||
assertions, G-008 split). Same content, just split across the two commits
|
|
||||||
for the persona boundary.
|
|
||||||
- **Word-boundary lexicon matching**: substring matching would false-positive
|
|
||||||
on "openyield" (matches "yield"). Implemented word-boundary regex matching
|
|
||||||
in `lexicon.FindBannedTerm`; documented and tested with a
|
|
||||||
no-false-positive test.
|
|
||||||
|
|
||||||
## Hand-off
|
|
||||||
Orchestrator: merge `oy/phase/01-orgs-window-foundation` and tag `v0.1.1`.
|
|
||||||
Executor did not merge/tag/push per instructions.
|
|
||||||
@@ -1,124 +0,0 @@
|
|||||||
# P2 Ship Verification — v0.2 Phase 2 (Pacts + Partners)
|
|
||||||
|
|
||||||
**Branch**: `oy/phase/02-pacts-partners`
|
|
||||||
**Phase**: P2 — Pacts + Partners (REQ-020, REQ-018)
|
|
||||||
**Tag target**: `v0.1.2` (orchestrator ships; executor does NOT merge/tag/push)
|
|
||||||
**Date**: 2026-08-17
|
|
||||||
|
|
||||||
## Summary
|
|
||||||
|
|
||||||
Phase 2 ships two new Mesh modules — `x/pact` (6-Pact enum with Mission-Lock
|
|
||||||
invariant) and `x/partner` (4-tier Partner Spectrum with registry keeper stub)
|
|
||||||
— both consuming Window + Stand refs from P1 by-ID-string (G-003). All five
|
|
||||||
P2 tasks executed atomically with per-task commits. Build green, tests green,
|
|
||||||
coverage ≥80% on both new packages, lexicon firewall green.
|
|
||||||
|
|
||||||
## Must-Haves (from PLANS.md P2 Must-Haves)
|
|
||||||
|
|
||||||
| Must-Have | Status | Evidence |
|
|
||||||
|---|---|---|
|
|
||||||
| `x/pact`, `x/partner` each have `types/types.go` + `types/types_test.go` | ✅ | 4 files created (pact: types.go+types_test.go+genesis.go; partner: types.go+types_test.go) |
|
|
||||||
| `go build ./...` and `go test ./...` green | ✅ | `go build ./...` → build OK; `go test ./...` → all ok (20 packages with tests) |
|
|
||||||
| ≥80% coverage on `x/pact/types`, `x/partner/types` | ✅ | pact 95.9%, partner 100.0% |
|
|
||||||
| Pact locked-const: exactly 6 types (vision §16 names) | ✅ | `PactTypeCount == 6`, `AllPactTypes()` returns Pause/Ground/Stance/Cover/StandRegistry/HubAPI; `TestPactTypeCountLockedConst` + `TestAllPactTypesNames` |
|
|
||||||
| Partner locked-const: exactly 4 tiers (Op, MasterOp, Pier, Anchor) | ✅ | `PartnerTierCount == 4`, `AllPartnerTiers()`; `TestPartnerTierCountLockedConst` + `TestAllPartnerTiersNames` |
|
|
||||||
| Mission-Lock invariant: Pause/Ground/Stance core terms non-amendable | ✅ | `MissionLockAmendable == false` const + per-type `AmendableCoreTermsPause/Ground/Stance == false` consts; `TestMissionLockAmendableConstFalse` + `TestMissionLockCoreTermsNonAmendable` (highest-severity regression firewall) |
|
|
||||||
| Lexicon assertion in both new test files | ✅ | `TestLexiconNoBannedTermsInPactPackage` + `TestLexiconNoBannedTermsInPactTestFile`; `TestLexiconNoBannedTermsInPartnerPackage` + `TestLexiconNoBannedTermsInPartnerTestFile` |
|
|
||||||
| `ValidateGenesis` ID-uniqueness checks | ✅ | pact rejects dup/empty pact-ids + unknown types; partner rejects dup/empty partner-ids (A-212 upgrade) |
|
|
||||||
| Git tag `v0.1.2` | ⏸ DEFERRED | Orchestrator ships (executor does NOT tag/merge/push per instructions) |
|
|
||||||
|
|
||||||
## Tasks Committed (5)
|
|
||||||
|
|
||||||
| Task | Commit | Description |
|
|
||||||
|---|---|---|
|
|
||||||
| P2-01-01 | `d00d51d` | pact types — 6 PactType enum, Mission-Lock invariant, execute stubs |
|
|
||||||
| P2-02-01 | `f74e4ae` | partner types — 4-tier Partner Spectrum, registry keeper stub |
|
|
||||||
| P2-01-02 | `c050e52` | pact types tests — locked-const, Mission-Lock, execute stubs, lexicon |
|
|
||||||
| P2-01-03 | `76d5f5d` | pact genesis schema — ValidatePacts rejects dup ids, Mission-Lock check |
|
|
||||||
| P2-02-02 | `363b367` | partner types tests — locked-const, registry, ListByTier, lexicon |
|
|
||||||
|
|
||||||
## Build / Test / Coverage Results
|
|
||||||
|
|
||||||
### `go build ./...`
|
|
||||||
```
|
|
||||||
build OK
|
|
||||||
```
|
|
||||||
|
|
||||||
### `go test ./... -count=1`
|
|
||||||
- 20 packages with tests, all `ok` (no FAILs)
|
|
||||||
- Total test count: **207** (up from 143 baseline → +64 new tests across pact + partner)
|
|
||||||
- Packages with no test files: lexicon, x/identity/types, x/processing/types, x/rootpool/types, x/vault/types (unchanged from baseline)
|
|
||||||
|
|
||||||
### `go test -cover ./x/pact/types/... ./x/partner/types/...`
|
|
||||||
| Package | Coverage | Target | Pass |
|
|
||||||
|---|---|---|---|
|
|
||||||
| `x/pact/types` | **95.9%** | ≥80% | ✅ |
|
|
||||||
| `x/partner/types` | **100.0%** | ≥80% | ✅ |
|
|
||||||
|
|
||||||
### Lexicon meta-test (`go test -run TestLexiconMeta .`)
|
|
||||||
- `TestLexiconMetaNoBannedTermsInX` — PASS (scans all `x/**/*.go` production + test for 10 banned terms)
|
|
||||||
- `TestLexiconMetaSelfTestTable` — PASS (G-009 self-test table for all 10 banned terms)
|
|
||||||
- `TestLexiconMetaBannedTermsCount` — PASS
|
|
||||||
- `TestLexiconMetaNoFalsePositiveOnOpenYield` — PASS (word-boundary matcher, "openyield" not flagged)
|
|
||||||
|
|
||||||
### G-003 by-ID-string invariant (`go test -run TestG003 ./x/window/...`)
|
|
||||||
- `TestG003NoCrossModuleStructImportsInProduction` — PASS (no production `.go` file under `x/` imports a foreign `x/<module>/types` package; pact + partner conform — refs are by-ID-string)
|
|
||||||
|
|
||||||
## Module Details
|
|
||||||
|
|
||||||
### x/pact (REQ-020, A-207: ONE module with enum)
|
|
||||||
- **PactType enum**: Pause, Ground, Stance, Cover, StandRegistry, HubAPI — exactly 6 (vision §16)
|
|
||||||
- **PactStatus enum**: Proposed, Active, Fulfilled, Voided
|
|
||||||
- **Pact struct**: id, type, parties ([]string Reach IDs), terms ([]byte), status, execute-msg-ref, window-id-ref (string, G-003), stand-id-ref (string, G-003)
|
|
||||||
- **Per-type Execute* stubs**: ExecutePause/Ground/Stance/Cover/StandRegistry/HubAPI — each transitions Proposed→Active, guards on type + status; ExecuteStandRegistry requires non-empty stand-id-ref
|
|
||||||
- **Mission-Lock invariant**: `MissionLockAmendable` const bool false + per-type `AmendableCoreTermsPause/Ground/Stance` const flags false; Cover/StandRegistry/HubAPI amendable. `MissionLockAmendableCoreTerms(type)` helper
|
|
||||||
- **AllPactTypes()** returns exactly 6 in vision §16 order
|
|
||||||
- **Genesis**: `GenesisState{Pacts []Pact}`, `DefaultGenesisState()`, `ValidateGenesis` (rejects dup/empty pact-ids, unknown types, bad JSON); data-engineer's `ValidatePacts` + `MissionLockCheck` wired into the genesis load path (G-008)
|
|
||||||
|
|
||||||
### x/partner (REQ-018, D-026)
|
|
||||||
- **PartnerTier enum**: Op, MasterOp, Pier, Anchor — exactly 4 (vision §13). "Op" not "operator" — lexicon-clean per RESEARCH §1.6
|
|
||||||
- **PartnerStatus enum**: Pending, Active, Suspended, Revoked
|
|
||||||
- **CredentialType enum**: Eresidency, Biometric, Vouch, Custom
|
|
||||||
- **CredentialRef struct**: provider-id, credential-type, ref-uri (opaque URI; Pier credential routing deferred per Q5)
|
|
||||||
- **Partner struct**: id, tier, name, reach-id (string, G-003), region, credential-ref, status
|
|
||||||
- **Registry keeper stub**: `Keeper` with `NewKeeper`, `AddPartner`, `GetPartner`, `ListPartners`, `ListByTier` (in-memory, mutex-safe)
|
|
||||||
- **AllPartnerTiers()** returns exactly 4 in vision §13 order
|
|
||||||
- **Genesis**: `GenesisState{Partners []Partner}`, `DefaultGenesisState()`, `ValidateGenesis` (rejects dup/empty partner-ids, bad JSON)
|
|
||||||
|
|
||||||
## Deviation: genesis.go created in P2-01-01 alongside types.go
|
|
||||||
|
|
||||||
The plan ordered genesis.go as task P2-01-03 (after the test task P2-01-02),
|
|
||||||
but `types.go` references `ValidatePacts` (the genesis helper) and the build
|
|
||||||
must be green after each per-task commit. I therefore created `genesis.go`
|
|
||||||
with `ValidatePacts` + `MissionLockCheck` in P2-01-01, and P2-01-03 then
|
|
||||||
extended it (wiring `MissionLockCheck` INTO `ValidatePacts` so the genesis
|
|
||||||
load path enforces the Mission-Lock check alongside id-uniqueness) and
|
|
||||||
committed the extension as the P2-01-03 deliverable. Both tasks are
|
|
||||||
individually committed; the deviation is structural only (genesis helper
|
|
||||||
landed in the types task to keep the build green, then was refined in the
|
|
||||||
genesis task). No semantic change to the plan's deliverables.
|
|
||||||
|
|
||||||
## Lexicon Compliance Notes
|
|
||||||
|
|
||||||
- **No banned literals** in any new `x/**/*.go` file (production or test). The 10 banned terms (bank, deposit, interest, yield, currency, dollar, euro, account, savings, depositor) are referenced only via the `lexicon` package helpers (`lexicon.FindBannedTerm`, `lexicon.BannedTerms`) in test files.
|
|
||||||
- **Partner module** uses "Op"/"MasterOp"/"Pier"/"Anchor" (not "operator", which implies a banned financial term per RESEARCH §1.6). Verified lexicon-clean.
|
|
||||||
- **Pact module** avoids "account" — uses "Holder"/"Reach" conventions. The term "parties" ([]string of Reach IDs) is used for the Pact's participating Reach IDs.
|
|
||||||
- **Self-bootstrapping**: each test file has a `TestLexiconNoBannedTermsIn*TestFile` self-check that asserts the test file itself contains no banned literals (the lexicon helpers must be used, not inline strings).
|
|
||||||
- **Project-wide meta-test** (`lexicon_meta_test.go`) scans ALL `x/**/*.go` including the new pact + partner files — PASS.
|
|
||||||
|
|
||||||
## Pre-existing LSP noise (not P2 scope)
|
|
||||||
|
|
||||||
The LSP reports errors in `x/watcher/` files (cosmos-sdk/codec imports) and
|
|
||||||
`go.mod` (version "v2.0.1" invalid). These are **pre-existing** and **not in
|
|
||||||
P2 scope** — `x/watcher` is a v0.1 module with stale cosmos-sdk references
|
|
||||||
that are not part of the v0.2 skeleton (the v0.2 skeleton is zero-deps;
|
|
||||||
`go build ./...` succeeds because the watcher files are excluded from the
|
|
||||||
build path or compile cleanly via `go build`). `go build ./...` and
|
|
||||||
`go test ./...` both PASS, confirming the LSP noise does not affect the
|
|
||||||
build.
|
|
||||||
|
|
||||||
## Orchestrator Handoff
|
|
||||||
|
|
||||||
- **Do NOT merge/tag/push** — executor leaves the branch `oy/phase/02-pacts-partners` with 5 commits for the orchestrator to ship as tag `v0.1.2`.
|
|
||||||
- All P2 must-haves pass except the git tag (deferred to orchestrator per instructions).
|
|
||||||
- No regressions: all v0.1 baseline tests (143) + all v0.2-P1 tests + 64 new P2 tests = 207 total, all green.
|
|
||||||
@@ -1,154 +0,0 @@
|
|||||||
# P3 Ship Verification — v0.2 Phase 3 (Councils + Forex)
|
|
||||||
|
|
||||||
**Branch**: `oy/phase/03-councils-forex`
|
|
||||||
**Phase**: P3 — Councils + Forex (REQ-011, Forex v1)
|
|
||||||
**Tag target**: `v0.1.3` (orchestrator ships; executor does NOT merge/tag/push)
|
|
||||||
**Date**: 2026-08-17
|
|
||||||
|
|
||||||
## Summary
|
|
||||||
|
|
||||||
Phase 3 ships two new Mesh modules — `x/council` (3-Council enum
|
|
||||||
Mesh/Guild/Stand with Mission Lock as a `const bool` + Voice/SignalKind/
|
|
||||||
TallyResult types mirroring `x/gov`) and `x/forex` (Forex Engine v1 stub:
|
|
||||||
ForexPair with lexicon-clean "Bread/Asset" labels + RateOracle interface +
|
|
||||||
StubOracle + 4-OracleKind enum) — both referencing x/stand and x/guild
|
|
||||||
by-ID-string (G-003). All six P3 tasks executed atomically with per-task
|
|
||||||
commits. Build green, tests green, coverage ≥80% on both new packages,
|
|
||||||
lexicon firewall green (forex is the highest lexicon-risk module per
|
|
||||||
RESEARCH §1.10 — verified clean), Mission Lock invariant green.
|
|
||||||
|
|
||||||
## Must-Haves (from PLANS.md P3 Must-Haves)
|
|
||||||
|
|
||||||
| Must-Have | Status | Evidence |
|
|
||||||
|---|---|---|
|
|
||||||
| `x/council`, `x/forex` each have `types/types.go` + `types/types_test.go` | ✅ | 6 files created (council: types.go+types_test.go+genesis.go; forex: types.go+types_test.go+genesis.go) |
|
|
||||||
| `go build ./...` and `go test ./...` green | ✅ | `go build ./...` → BUILD OK; `go test ./... -count=1` → all 22 packages ok (0 FAIL) |
|
|
||||||
| ≥80% coverage on `x/council/types`, `x/forex/types` | ✅ | council 96.4%, forex 100.0% |
|
|
||||||
| Council locked-const: exactly 3 types (Mesh, Guild, Stand) | ✅ | `CouncilKindCount == 3`, `AllCouncilKinds()` returns MeshCouncil/GuildCouncil/StandCouncil; `TestCouncilKindCountLockedConst` + `TestAllCouncilKindsNames` |
|
|
||||||
| **Mission Lock invariant**: `MissionLockAmendable == false`, test asserts non-amendable (highest-severity) | ✅ | `MissionLockAmendable` const bool false; `TestMissionLockAmendableConstFalse` + `TestMissionLockAmendableCannotBeSetTrue` (const is the firewall — cannot be reassigned) |
|
|
||||||
| `TallyResult` shape mirrors `x/gov` (A-204) for future wiring | ✅ | Fields yes/no/abstain/nowithveto/total/quorum_met; JSON tags verified in `TestTallyResultStructShape`; NoWithVeto always 0 (anti-greed, no veto option) |
|
|
||||||
| `VoteOption` has no "no-with-veto" (anti-greed) | ✅ | N/A — council uses `TallyResult` with NoWithVeto locked to 0 (no separate VoteOption enum; the TallyResult field is the parity-with-x-gov shape with the anti-greed invariant); `TestTallyResultNoWithVetoAlwaysZero` |
|
|
||||||
| Forex pair labels lexicon-clean (no banned tradable-unit terms); `RateOracle` interface compiles | ✅ | ForexPair uses `base_asset`/`quote_asset` JSON tags (A-208 "Bread/Asset"); `TestForexPairStructFields` + `TestForexPairLabelsLexiconClean`; `RateOracle` interface compiles (`TestRateOracleInterfaceCompiles` + `TestStubOracleSatisfiesInterface`) |
|
|
||||||
| Lexicon assertion in both new test files | ✅ | `TestLexiconNoBannedTermsInCouncilPackage` + `TestLexiconNoBannedTermsInCouncilTestFile`; `TestLexiconNoBannedTermsInForexPackage` + `TestLexiconNoBannedTermsInForexTestFile` |
|
|
||||||
| `ValidateGenesis` ID-uniqueness + referential integrity (Council) | ✅ | council rejects dup/empty council-ids + dup/empty voice-ids + unknown kinds/signals + Stand Council without stand-id-ref + Guild Council without guild-id-ref + Voice with unknown council-id (referential integrity P3-01-03); forex rejects dup/empty pair-ids + dup/empty provider-ids + empty base/quote-asset + unknown oracle-kind (A-212) |
|
|
||||||
| Git tag `v0.1.3` | ⏸ DEFERRED | Orchestrator ships (executor does NOT tag/merge/push per instructions) |
|
|
||||||
|
|
||||||
## Tasks Committed (6)
|
|
||||||
|
|
||||||
| Task | Commit | Description |
|
|
||||||
|---|---|---|
|
|
||||||
| P3-01-01 | `81708bd` | council types — 3 CouncilKind enum, Mission Lock const, Voice/SignalKind/TallyResult |
|
|
||||||
| P3-02-01 | `73aa90f` | forex types — ForexPair (Bread/Asset labels), RateOracle iface, 4 OracleKind enum, StubOracle |
|
|
||||||
| P3-01-02 | `02d02c8` | council types tests — locked-const, Mission Lock invariant, SignalKind, TallyResult, lexicon |
|
|
||||||
| P3-01-03 | `7804fdb` | council genesis schema — Voice tally referential integrity, Mission Lock check |
|
|
||||||
| P3-02-02 | `94eeca6` | forex types tests — OracleKind enum, RateOracle iface, StubOracle sentinel, lexicon (highest risk) |
|
|
||||||
| P3-02-03 | `a7567e2` | forex genesis schema — ValidatePairs/ValidateProviders, dup-id rejection |
|
|
||||||
|
|
||||||
## Build / Test / Coverage Results
|
|
||||||
|
|
||||||
### `go build ./...`
|
|
||||||
```
|
|
||||||
BUILD OK
|
|
||||||
```
|
|
||||||
|
|
||||||
### `go test ./... -count=1`
|
|
||||||
- 22 packages with tests, all `ok` (0 FAILs)
|
|
||||||
- Total test count: **264** (up from 207 baseline → +57 new tests across council + forex)
|
|
||||||
- Packages with no test files: lexicon, x/identity/types, x/processing/types, x/rootpool/types, x/vault/types (unchanged from baseline)
|
|
||||||
|
|
||||||
### `go test -cover ./x/council/types/... ./x/forex/types/...`
|
|
||||||
| Package | Coverage | Target | Pass |
|
|
||||||
|---|---|---|---|
|
|
||||||
| `x/council/types` | **96.4%** | ≥80% | ✅ |
|
|
||||||
| `x/forex/types` | **100.0%** | ≥80% | ✅ |
|
|
||||||
|
|
||||||
### Lexicon meta-test (`go test -run TestLexiconMeta .`)
|
|
||||||
- `TestLexiconMetaNoBannedTermsInX` — PASS (scans all `x/**/*.go` production + test for 10 banned terms; council + forex files clean)
|
|
||||||
- `TestLexiconMetaSelfTestTable` — PASS (G-009 self-test table for all 10 banned terms)
|
|
||||||
- `TestLexiconMetaBannedTermsCount` — PASS
|
|
||||||
- `TestLexiconMetaNoFalsePositiveOnOpenYield` — PASS (word-boundary matcher, "openyield" not flagged)
|
|
||||||
|
|
||||||
### G-003 by-ID-string invariant (`go test -run TestG003 ./x/window/...`)
|
|
||||||
- `TestG003NoCrossModuleStructImportsInProduction` — PASS (no production `.go` file under `x/` imports a foreign `x/<module>/types` package; council references x/stand + x/guild by-ID-string; forex has no cross-module refs)
|
|
||||||
|
|
||||||
## Module Details
|
|
||||||
|
|
||||||
### x/council (REQ-011, D-022)
|
|
||||||
- **CouncilKind enum**: MeshCouncil, GuildCouncil, StandCouncil — exactly 3 (REQ-011)
|
|
||||||
- **Council struct**: id, kind, stand-id-ref (optional, by-ID-string to x/stand — P1-02-01), guild-id-ref (optional, by-ID-string to x/guild — P1-03-01), members ([]CouncilMember), voice-threshold
|
|
||||||
- **CouncilMember struct**: reach-id (lexicon-clean holder identifier — NOT the banned financial holder term), voice-weight, joined-at
|
|
||||||
- **Voice struct**: id, council-id, proposer-reach, signal-kind, target-ref, tally, timestamp
|
|
||||||
- **SignalKind enum**: Stash, Standing, Vouch, Capital — exactly 4 (the four Freeholder signals, cross-ref v0.1 REQ-005 / vision §9.1 x/standing FreeholderSignals)
|
|
||||||
- **TallyResult struct**: yes, no, abstain, nowithveto (always 0 — anti-greed), total, quorum-met — mirrors x/gov shape (A-204)
|
|
||||||
- **Mission Lock invariant**: `MissionLockAmendable` const bool false — the highest-severity regression firewall; the const can NEVER be set true (compile-time const)
|
|
||||||
- **Genesis**: `GenesisState{Councils, Voices, Params}`, `DefaultGenesisState()`, `ValidateGenesis` (rejects dup/empty council-ids, dup/empty voice-ids, unknown kinds/signals, Stand Council without stand-id-ref, Guild Council without guild-id-ref, Voice with unknown council-id [referential integrity]); data-engineer's `ValidateCouncils` + `ValidateVoices` + `MissionLockCheck` wired into the genesis load path (G-008)
|
|
||||||
|
|
||||||
### x/forex (Forex v1, D-030)
|
|
||||||
- **ForexPair struct**: id, base-asset, quote-asset, decimals — uses "Bread/Asset" style labels (A-208), NOT the banned financial tradable-unit terms (lexicon-hostile per RESEARCH §1.10)
|
|
||||||
- **RateOracle Go interface**: `GetRate(pairID) (rate uint64, timestamp int64, err error)` — no impl in v0.2 (Phase 3 wires Piers)
|
|
||||||
- **OracleProvider struct**: id, name, kind
|
|
||||||
- **OracleKind enum**: Chainlink, Pyth, UMA, Internal — exactly 4 (Forex v1)
|
|
||||||
- **SpotRate struct**: pair-id, rate, timestamp, provider-id (by-ID-string refs per G-003)
|
|
||||||
- **StubOracle**: stub keeper; `GetRate` returns sentinel `ErrOracleNotIntegrated` ("forex oracle not integrated (Phase 3 wires Piers)")
|
|
||||||
- **SpreadCapBps**: const 0 (A-214 documented placeholder; test asserts ≥0; v0.3 may set a positive cap)
|
|
||||||
- **Genesis**: `GenesisState{Pairs, Providers, Params}`, `DefaultGenesisState()`, `ValidateGenesis` (rejects dup/empty pair-ids, dup/empty provider-ids, empty base/quote-asset, unknown oracle-kind); data-engineer's `ValidatePairs` + `ValidateProviders` (G-008)
|
|
||||||
|
|
||||||
## Deviation: genesis.go created in Wave 1 alongside types.go (P3-01-01 / P3-02-01)
|
|
||||||
|
|
||||||
The plan ordered genesis.go as tasks P3-01-03 and P3-02-03 (after the test
|
|
||||||
tasks P3-01-02 and P3-02-02), but `types.go` references `ValidateCouncils`/
|
|
||||||
`ValidateVoices` (council) and `ValidatePairs`/`ValidateProviders` (forex)
|
|
||||||
— the genesis helpers — and the build must be green after each per-task
|
|
||||||
commit. I therefore created `genesis.go` with the Validate* helpers in the
|
|
||||||
Wave 1 types tasks (P3-01-01 and P3-02-01), and the Wave 2 genesis tasks
|
|
||||||
(P3-01-03 and P3-02-03) then refined the doc/comments to make the
|
|
||||||
deliverable explicit and committed the refinement. This matches the P2
|
|
||||||
deviation pattern (documented in P2_SHIP_VERIFICATION.md). All four tasks
|
|
||||||
are individually committed; the deviation is structural only (genesis
|
|
||||||
helper landed in the types task to keep the build green, then was refined
|
|
||||||
in the genesis task). No semantic change to the plan's deliverables.
|
|
||||||
|
|
||||||
## Lexicon Compliance Notes (Forex is highest risk per RESEARCH §1.10)
|
|
||||||
|
|
||||||
- **No banned literals** in any new `x/council/**/*.go` or `x/forex/**/*.go`
|
|
||||||
file (production or test). The 10 banned terms (bank, deposit, interest,
|
|
||||||
yield, currency, dollar, euro, account, savings, depositor) are
|
|
||||||
referenced only via the `lexicon` package helpers
|
|
||||||
(`lexicon.FindBannedTerm`, `lexicon.BannedTerms`) in test files.
|
|
||||||
- **Council module** uses "reach-id"/"voice-holder"/"proposer-reach"
|
|
||||||
(NOT the banned financial holder term — the lexicon-clean holder
|
|
||||||
identifier per RESEARCH §2). Comments deliberately avoid the banned term
|
|
||||||
even in "NOT <banned-term>" form (the word-boundary matcher would flag it).
|
|
||||||
- **Forex module** uses "Forex" (allowed — vision §13 names it; NOT in the
|
|
||||||
banned list), "base-asset"/"quote-asset" (A-208 — NOT the banned
|
|
||||||
tradable-unit terms), "Bread"/"Asset" sample labels (A-208). The banned
|
|
||||||
financial terms for tradable units (the three lexicon-hostile terms
|
|
||||||
per RESEARCH §1.10) NEVER appear in source. "fx" is borderline but
|
|
||||||
avoided (the module name is "forex" not "fx").
|
|
||||||
- **Self-bootstrapping**: each test file has a
|
|
||||||
`TestLexiconNoBannedTermsIn*TestFile` self-check that asserts the test
|
|
||||||
file itself contains no banned literals (the lexicon helpers must be
|
|
||||||
used, not inline strings).
|
|
||||||
- **Project-wide meta-test** (`lexicon_meta_test.go`) scans ALL
|
|
||||||
`x/**/*.go` including the new council + forex files — PASS.
|
|
||||||
|
|
||||||
## Pre-existing LSP noise (not P3 scope)
|
|
||||||
|
|
||||||
The LSP reports errors in `x/watcher/` files (cosmos-sdk/codec imports) and
|
|
||||||
`go.mod` (version "v2.0.1" invalid). These are **pre-existing** and **not
|
|
||||||
in P3 scope** — `x/watcher` is a v0.1 module with stale cosmos-sdk
|
|
||||||
references that are not part of the v0.2 skeleton (the v0.2 skeleton is
|
|
||||||
zero-deps; `go build ./...` succeeds because the watcher files are
|
|
||||||
excluded from the build path or compile cleanly via `go build`).
|
|
||||||
`go build ./...` and `go test ./...` both PASS, confirming the LSP noise
|
|
||||||
does not affect the build. (Same note as P1/P2 ship verification.)
|
|
||||||
|
|
||||||
## Orchestrator Handoff
|
|
||||||
|
|
||||||
- **Do NOT merge/tag/push** — executor leaves the branch
|
|
||||||
`oy/phase/03-councils-forex` with 6 commits for the orchestrator to ship
|
|
||||||
as tag `v0.1.3`.
|
|
||||||
- All P3 must-haves pass except the git tag (deferred to orchestrator per
|
|
||||||
instructions).
|
|
||||||
- No regressions: all v0.1 baseline tests + all v0.2-P1 tests + all v0.2-P2
|
|
||||||
tests + 57 new P3 tests = 264 total, all green.
|
|
||||||
@@ -1,113 +0,0 @@
|
|||||||
# Phase P4 — Bonds + Bearers + L2 — Ship Verification
|
|
||||||
|
|
||||||
> Milestone **v0.2 (The Mesh)** — Phase 4 (P4 — Bonds+Bearers+L2).
|
|
||||||
> Branch: `oy/phase/04-bonds-bearers-l2`.
|
|
||||||
> Tag: **NOT created** (per executor instructions — do NOT merge/tag/push).
|
|
||||||
|
|
||||||
## Verification Summary
|
|
||||||
|
|
||||||
| Check | Result |
|
|
||||||
|---|---|
|
|
||||||
| `go build ./...` | ✅ green |
|
|
||||||
| `go test ./...` | ✅ green (303 PASS, 0 FAIL across 21 packages with tests) |
|
|
||||||
| `go test -cover ./x/bond/types/...` | ✅ 96.8% (≥80%) |
|
|
||||||
| `go test -cover ./x/bearers/types/...` | ✅ 100.0% (≥80%) |
|
|
||||||
| `go test -cover ./x/satellite/types/...` | ✅ 100.0% (≥80%) |
|
|
||||||
| Existing v0.1 tests (no regression) | ✅ all green (15+10=25 packages incl. 4 no-test) |
|
|
||||||
| Lexicon meta-test (`TestLexiconMetaNoBannedTermsInX`) | ✅ green |
|
|
||||||
| Bond lexicon (A-210 coupon-only) | ✅ green (`TestLexiconNoBannedTermsInBondPackage`) |
|
|
||||||
| Satellite lexicon (Holder/Reach, not banned terms) | ✅ green (`TestLexiconNoBannedTermsInSatellitePackage`) |
|
|
||||||
| Bearers extension lexicon | ✅ green (`TestLexiconNoBannedTermsInBearersPackage`) |
|
|
||||||
| AllBearers() == 6 (no regression) | ✅ green (`TestBearerCount`, `TestOYLRStillInAllBearers`) |
|
|
||||||
| Git tag `v0.1.4` | ⛔ NOT created (per executor instructions — do NOT tag/push) |
|
|
||||||
|
|
||||||
## Tasks Executed (8/8 committed)
|
|
||||||
|
|
||||||
| Task | File(s) | Commit | Persona |
|
|
||||||
|---|---|---|---|
|
|
||||||
| P4-01-01 | `x/bond/types/types.go`, `x/bond/types/genesis.go` | `242ebcc` | backend-engineer |
|
|
||||||
| P4-02-01 | `x/bearers/types/types.go` (extended) | `0727219` | cosmos-engineer |
|
|
||||||
| P4-03-01 | `x/satellite/types/types.go`, `x/satellite/types/genesis.go` | `0979015` | cosmos-engineer |
|
|
||||||
| P4-01-02 | `x/bond/types/types_test.go` | `70f1ddf` | security-engineer |
|
|
||||||
| P4-01-03 | `x/bond/types/genesis_test.go` (genesis.go committed in 01-01) | `e18c323` | data-engineer |
|
|
||||||
| P4-02-02 | `x/bearers/types/types_test.go` (extended) | `faf0508` | security-engineer |
|
|
||||||
| P4-03-02 | `x/satellite/types/types_test.go` | `9ee2d11` | security-engineer |
|
|
||||||
| P4-04-01 | `.ciagent/oy/P4_SHIP_VERIFICATION.md` | (this commit) | lead-developer |
|
|
||||||
|
|
||||||
## Must-Haves (P4 checklist)
|
|
||||||
|
|
||||||
- [x] `x/bond` (new), `x/bearers` (extended), `x/satellite` (new) each have `types/types.go` + `types/types_test.go`.
|
|
||||||
- [x] `go build ./...` and `go test ./...` green — including all v0.1 baseline tests (no regression).
|
|
||||||
- [x] ≥80% coverage on `x/bond/types` (96.8%), `x/bearers/types` (100%), `x/satellite/types` (100%).
|
|
||||||
- [x] Bond clamp invariant: `CouponCapBps == 800`, `CouponFloorBps == 0`; clamp below→floor, above→cap, in-range→unchanged.
|
|
||||||
- [x] Bond lexicon: "coupon" exclusively, no banned terms (A-210).
|
|
||||||
- [x] Bearers: `BearerTransport` interface compiles; `OYLRLink` + `BeaconFrame` stubs; existing `AllBearers()` (6) unchanged.
|
|
||||||
- [x] Satellite: `L2Chain` exactly 5 (Polygon active + 4 stubs); `Packet` pinned to ICS-20 v1 shape; zero external deps.
|
|
||||||
- [x] Lexicon assertion in all 3 test files (bond, bearers-ext, satellite).
|
|
||||||
- [x] `ValidateGenesis` ID-uniqueness (all 3) + genesis clamp (Bond).
|
|
||||||
- [ ] Git tag `v0.1.4` — ⛔ NOT created (executor instructed NOT to merge/tag/push).
|
|
||||||
|
|
||||||
## Deliverable Detail
|
|
||||||
|
|
||||||
### P4-01-01 — Bond types (backend-engineer, REQ-021, D-028)
|
|
||||||
- `CouponCapBps = 800` (8%), `CouponFloorBps = 0` (0%) — LOCKED `const`.
|
|
||||||
- `Bond` struct: id, issuer-stand-id (by-ID-string ref to x/stand per G-003), principal-grain, coupon-bps, term-days, issued-at, maturity, status.
|
|
||||||
- `BondStatus` enum (5): Issued, Active, Matured, Defaulted, Repaid.
|
|
||||||
- `Issue(...)` stub: constructs Bond with coupon clamped, status BondIssued.
|
|
||||||
- `Clamp(couponBps)` mirrors `x/feecovenant` Clamp shape: `min(cap, max(floor, coupon))`.
|
|
||||||
- `AllBondStatuses()` returns 5.
|
|
||||||
- `DefaultParams`, `GenesisState` (bonds), `DefaultGenesisState`, `ValidateGenesis` (rejects dup bond-ids).
|
|
||||||
|
|
||||||
### P4-02-01 — Bearers extension (cosmos-engineer, D-029, A-209)
|
|
||||||
- EXTENDED existing `x/bearers/types/types.go` (NOT a new module).
|
|
||||||
- `BearerTransport` Go interface: `Send`, `Receive`, `Status` — no impl.
|
|
||||||
- `OYLRLink` struct: gateway-id, range-meters, frequency-mhz, surveillance-resistant=true.
|
|
||||||
- `BeaconFrame` struct: beacon-id, ephemeral-id, payload-bytes, ttl.
|
|
||||||
- PRESERVED existing `BearerType` enum + `AllBearers()` (OY-LR still in the 6).
|
|
||||||
- `DefaultParams`/`GenesisState` unchanged (no break).
|
|
||||||
|
|
||||||
### P4-03-01 — Satellite types (cosmos-engineer, REQ-009, D-021, A-215)
|
|
||||||
- `L2Chain` enum (5): Polygon active; Base, Arbitrum, Optimism, Solana StatusPending (D-021).
|
|
||||||
- `TransferChannel` struct: port-id, channel-id, counterparty, status.
|
|
||||||
- `ChannelStatus` enum (4): Init, TryOpen, Open, Closed (ICS-20 handshake).
|
|
||||||
- `WrappedBreadDenom` struct: denom, trace-path (IBC trace encoding).
|
|
||||||
- `Packet` stub struct: sequence, source-port, source-channel, dest-port, dest-channel, data, timeout-height, timeout-timestamp (ICS-20 v1 shape).
|
|
||||||
- NO ibc-go import (zero external deps — A-201).
|
|
||||||
- `AllL2Chains()` returns 5; `AllChannelStatuses()` returns 4.
|
|
||||||
- `DefaultParams`, `GenesisState` (channels + denoms), `DefaultGenesisState`, `ValidateGenesis` (rejects dup channel-ids + dup denoms).
|
|
||||||
|
|
||||||
### P4-01-02 — Bond tests (security-engineer, REQ-021)
|
|
||||||
- Clamp invariant tests: below floor → floor, above cap → cap, in range → unchanged.
|
|
||||||
- `CouponCapBps == 800` locked-const; `CouponFloorBps == 0` locked-const.
|
|
||||||
- `BondStatus` enum coverage (5); `Issue` stub callable + clamps above cap.
|
|
||||||
- `ValidateGenesis` rejects dup bond-id, unknown status, coupon above cap.
|
|
||||||
- Lexicon assertion (lexicon helpers, no banned literals — A-210 coupon-only).
|
|
||||||
|
|
||||||
### P4-01-03 — Bond genesis (data-engineer, REQ-021)
|
|
||||||
- `ValidateBonds` enforces coupon-bps within [floor, cap] at genesis load (D-028 clamp).
|
|
||||||
- `genesis_test.go`: boundary tests (at floor, at cap, just above cap, just below cap).
|
|
||||||
|
|
||||||
### P4-02-02 — Bearers tests extension (security-engineer, D-029)
|
|
||||||
- `BearerTransport` interface signature test (stub impl satisfies it).
|
|
||||||
- `OYLRLink` non-empty + surveillance-resistant == true; `BeaconFrame` non-empty + ttl > 0.
|
|
||||||
- OY-LR still in AllBearers() (REGRESSION: existing v0.1 tests pass).
|
|
||||||
- Lexicon assertion (extends existing test file).
|
|
||||||
|
|
||||||
### P4-03-02 — Satellite tests (security-engineer, REQ-009)
|
|
||||||
- `L2Chain` exactly 5 (Polygon + 4 stubs); Polygon only active (D-021).
|
|
||||||
- `ChannelStatus` coverage (4); `Packet` fields match ICS-20 v1 (JSON tags).
|
|
||||||
- `WrappedBreadDenom` trace-path encoding; `ValidateGenesis` rejects dup channel-id + dup denom.
|
|
||||||
- Lexicon assertion (no banned terms — use Holder/Reach).
|
|
||||||
|
|
||||||
### P4-04-01 — Phase ship verification (lead-developer)
|
|
||||||
- This document. Full build/test/coverage verification.
|
|
||||||
|
|
||||||
## Test Counts
|
|
||||||
- **Total `--- PASS`: 303** (leaf tests; some names repeat across packages).
|
|
||||||
- **Total `--- FAIL`: 0**.
|
|
||||||
- **Packages with tests: 21** (4 packages have no test files: identity, processing, rootpool, vault — same as v0.1 baseline).
|
|
||||||
|
|
||||||
## Notes
|
|
||||||
- The bond `genesis.go` was created in P4-01-01's commit (needed for `go build` — `ValidateBonds` is referenced by `ValidateGenesis` in types.go). P4-01-03 adds the dedicated `genesis_test.go` clamp assertions and owns the data-engineer's genesis-schema deliverable.
|
|
||||||
- Pre-existing LSP errors in `x/watcher/` (cosmos-sdk imports not vendored) are unchanged and do not affect `go build ./...` or `go test ./...` (the watcher module builds under the v0.1 baseline; these are stale LSP diagnostics, not build errors).
|
|
||||||
- No merge, no tag, no push performed (per executor instructions).
|
|
||||||
+92
-99
@@ -3,131 +3,124 @@ active_personas:
|
|||||||
- id: backend-engineer
|
- id: backend-engineer
|
||||||
active: true
|
active: true
|
||||||
phase_specific: false
|
phase_specific: false
|
||||||
reason: Owns the v0.5 runtime promotion across P1..P7 — every keeper MsgServer message handler + simtest end-to-end flow for x/exit, x/bridge, x/bearers, x/partner, x/hub, x/services, x/bond, and x/council. This is the bulk of the milestone: the v0.3 skeletons were types + in-memory keeper stubs (verified — e.g. `x/partner/types/types.go:101 type Keeper struct{...}` with `NewKeeper()` returning `&Keeper{partners: make(map[string]Partner)}`, zero cosmos-sdk imports in `x/`). v0.5 adds `keeper/keeper.go` (store-backed), `keeper/msg_server.go` (one handler per `Msg*`), `types/msg_*.go` (`sdk.Msg` impls), `module.go` (RegisterServices), and a simtest exercising each handler against an in-memory `sdk.Context`. backend-engineer is the single persona that spans all seven runtime phases (P1..P7) plus the lexicon/locked-const regression guards that carry forward from v0.4. The reactivated cosmos-engineer/security-engineer/mesh-engineer personas advise on conventions and invariants but the implementation is backend-engineer's territory.
|
reason: Go/Cosmos module skeletons for v0.2 components — owns the non-Cosmos-mirroring modules (pact, partner, bond) per G-007. Owns the bulk of bespoke-type skeleton + tests work.
|
||||||
frameworks: [Go 1.22, cosmos-sdk v0.50.x (D-055 GRILL-approved), ibc-go v8.x, Go testing, simtest, lexicon firewall, locked-const invariant tests]
|
frameworks: [Go, Cosmos SDK, IBC, CosmWasm]
|
||||||
territory: ["x/exit/**", "x/bridge/**", "x/bearers/**", "x/partner/**", "x/hub/**", "x/services/**", "x/bond/**", "x/council/**", "lexicon/**", "lexicon_meta_test.go", "lexicon_meta_docs/**"]
|
territory: ["x/pact/**", "x/partner/**", "x/bond/**", "x/**/types/**", "x/**/keeper/**", "x/**/module.go"]
|
||||||
constraints: ["G-003 production firewall intact — keeper-to-keeper cross-module calls use expected_keepers.go interface shims (ibc-go convention), NOT struct imports of x/<module>/types; by-ID-string rule preserved at the type level", "G-006 controlled exception (D-055) — go.mod gains cosmos-sdk v0.50.x + ibc-go v8.x (GRILL-ratified); types/ packages gain sdk.Msg imports for Msg* types but invariant/lexicon tests stay stdlib-only and green", "locked-const invariants unchanged — 8%/0% bond cap (D-028), 6 bearers, 4 Partner tiers, MissionLockAmendable=false, SignalKindCount=4 (P1-2 defensible), BearerTypeCount=6, BridgeStatusCount=4, ExitStatusCount=5, etc. — v0.5 ADDS ProposalKind/ProposalStatus/VoteOption enums (AUDIT §193 P1-1) but does NOT change existing locked consts", "lexicon firewall stays green on both x/ and docs/ after runtime promotion — Msg* struct names are the new lexicon surface (e.g. AVOID 'deposit' in x/hub custody message names; use MsgCustodyReceiveAsset/MsgCustodyReleaseAsset per A-542)", "simtest NOT mainnet (D-054) — handlers exercised against in-memory sdk.Context + dbm in-memory store; no real IBC light clients, no real MPC, no real bearer hardware, no real DEX venues, no real Watcher attestations (all stubbed)", "≥80% coverage on runtime packages (D-033 carries forward) — every keeper/msg_server.go + simtest must hit the bar; table-driven handler tests per Msg*", "Mission Lock const firewall intact (G-003) — MissionLockAmendment-Rejected ProposalKind is rejected at ValidateBasic (A-572); the const + the ValidateBasic gate are the dual firewall"]
|
constraints: [lexicon compliance (REQ-012), skeleton+tests pattern (D-020), ≥80% coverage on new packages (D-033), no live-chain side effects in skeleton, locked-const invariants, no fractional reserve, no leverage/futures, go.mod is read-only in v0.2 (G-006 — any change is an escalation)]
|
||||||
|
|
||||||
|
- id: data-engineer
|
||||||
|
active: true
|
||||||
|
phase_specific: false
|
||||||
|
reason: Genesis/state schema design for new modules — Window audit log, Stand membership sets, Bond issuance state, Council Voice tally state. Shapes ValidateGenesis upgrades. Owns genesis SCHEMA only (G-008); test assertions are security-engineer's.
|
||||||
|
frameworks: [Go, encoding/json, Cosmos SDK state]
|
||||||
|
territory: ["x/**/types/genesis.go", "x/**/genesis.go"]
|
||||||
|
constraints: [append-only audit logs (Window), ID-uniqueness in ValidateGenesis, lexicon compliance, no state identity beyond Reach, does NOT own *_test.go files (G-008)]
|
||||||
|
|
||||||
- id: lead-developer
|
- id: lead-developer
|
||||||
active: true
|
active: true
|
||||||
phase_specific: false
|
phase_specific: false
|
||||||
reason: Coordinates v0.5 phase decomposition (P1 exit+bridge → P2 bearers → P3 anchors → P4 hub → P5 services → P6 bond → P7 council → P8 final review/audit/ship per D-056), territory enforcement (warn mode per config.json), and the final-phase feature purity gate audit (no breaking schema changes; locked-const firewall intact; G-003 production firewall intact). Owns the v0.5 ROADMAP.md / REQUIREMENTS.md status updates at milestone completion and the milestone ship. Also owns the GRILL-ratification follow-through for the cosmos-sdk version pin (A-504) and the planner-escalation items (A-562 reject-vs-clamp, A-572 reject-at-ValidateBasic, A-574 Watcher Veto quorum value) — these are escalated through the normal decision flow, not auto-decided.
|
reason: Multi-component orchestration across 10 new packages, dependency sequencing per D-031 blocker chain, vertical-slice integrity per phase.
|
||||||
frameworks: [cross-cutting, Gitea Actions, Markdown, YAML, git]
|
frameworks: [cross-cutting]
|
||||||
territory: [".ciagent/**", ".gitea/workflows/**", ".ciagent/oy/ARCHITECTURE.md", ".ciagent/oy/ROADMAP.md", ".ciagent/oy/REQUIREMENTS.md"]
|
territory: ["**"]
|
||||||
constraints: ["D-056 phase ordering (P1 exit → P2 bearers → P3 anchors → P4 hub → P5 services → P6 bond → P7 council → P8 final); each phase independently shippable (vertical slices)", "milestone versioning (v0.5 feature / tag_base v0.4.x); final-phase patch IS the milestone release (D-008)", "feature purity gate: zero breaking schema changes; zero locked-const amendments (Mission Lock non-amendable; SignalKind 4-not-5 unchanged); G-003 production firewall intact; G-006 controlled exception GRILL-ratified", "persona territory warn-mode enforcement (config.json)", "planner-escalation items (A-504 cosmos-sdk version pin, A-562 bond match reject-vs-clamp, A-572 MissionLockAmendment ValidateBasic rejection, A-574 Watcher Veto quorum) surfaced through the normal decision flow, not auto-decided"]
|
constraints: [blocked-by chain enforcement (D-031), milestone versioning (v0.2 / tag_base v0.1.x), lexicon gate on merge, persona territory warn-mode enforcement]
|
||||||
|
|
||||||
- id: security-engineer
|
|
||||||
active: true
|
|
||||||
phase_specific: false
|
|
||||||
reason: REACTIVATED for v0.5. Owns the security-critical invariant surfaces introduced by runtime promotion: (1) the CustodyKeyring interface boundary in x/hub (D-058) — the Sign/Derive/Status contract + the in-memory memKeyring test impl, with key-rotation semantics (Status reports active key version; no caching across blocks); (2) the CLOB mission-lock clamp in x/bond (D-057) — the per-match coupon clamp to [0, 800] bps via the v0.3 Clamp helper, with a match above 800 REJECTED (fails closed, A-562; planner confirms reject-vs-clamp before P6); (3) IBC packet replay protection in x/bridge — the delete-on-ack / refund-on-timeout contract mirroring ibc-go (the CVE-class pitfall); simtest must cover both replay and timeout-refund; (4) the governance Mission-Lock const firewall in x/council (G-003) — MissionLockAmendable=false unchanged, the MissionLockAmendment-Rejected ProposalKind rejected at ValidateBasic (A-572), and the Watcher Veto quorum semantics (single Veto does NOT block; quorum-based, default 6 per REQ-004 6-of-9; A-574). The v0.3/v0.4 locked-const regression tests (TestMissionLockAmendableFalse, TestSignalKindShapeIntentional, the REQ-030 cross-const test) stay green.
|
|
||||||
frameworks: [Go 1.22, cosmos-sdk v0.50.x, ibc-go v8.x, Go testing, simtest, locked-const invariant tests, lexicon firewall]
|
|
||||||
territory: ["x/hub/types/keyring.go", "x/hub/keeper/keyring_mem*.go", "x/bond/types/types.go", "x/bond/keeper/**", "x/bridge/keeper/**", "x/council/types/types.go", "x/council/keeper/**", "lexicon/**"]
|
|
||||||
constraints: ["CustodyKeyring interface supports key rotation (Status reports active key version; handler consults keyring per operation, no cross-block caching)", "CLOB per-match coupon clamp to [0, 800] bps (D-028/D-057); match above 800 REJECTED (fails closed, A-562) — planner confirms reject-vs-clamp before P6", "IBC ack/timeout replay protection mirrors ibc-go (delete-on-ack, refund-on-timeout); simtest MUST cover both replay and timeout-refund cases (CVE-class pitfall)", "Mission Lock const firewall intact (G-003): MissionLockAmendable=false unchanged; MissionLockAmendment-Rejected ProposalKind rejected at ValidateBasic (A-572); Watcher Veto quorum-based (default 6, REQ-004 6-of-9), single Veto does NOT block (anti-greed, vision §19)", "locked-const regression tests stay green: TestMissionLockAmendableFalse, TestSignalKindShapeIntentional, the REQ-030 cross-const test (hub.LendingCouponCapBps==bond.CouponCapBps)", "compliance-before-custody ordering enforced in x/hub (withdrawal checks compliance status before the custody debit, A-544)", "lexicon firewall stays green — Msg* names avoid banned terms (e.g. 'deposit' banned; use MsgCustodyReceiveAsset/MsgCustodyReleaseAsset)"]
|
|
||||||
|
|
||||||
- id: cosmos-engineer
|
- id: cosmos-engineer
|
||||||
active: true
|
active: true
|
||||||
phase_specific: false
|
phase_specific: true
|
||||||
reason: REACTIVATED for v0.5. cosmos-sdk is now a load-bearing dependency (D-055 GRILL-approved controlled exception to G-006), so Cosmos-SDK convention alignment is owned rather than advisory. Owns: (1) the MsgServer promotion pattern across all 8 target modules — keeper/keeper.go (store-backed, wraps sdk.KVStore), types/msg_*.go (sdk.Msg: ValidateBasic + GetSigners), keeper/msg_server.go (one *Response,error method per Msg*), module.go (AppModule + RegisterServices), simtest exercising each handler against an in-memory sdk.Context; (2) the IBC v2 / IBC Eureka patterns in x/bridge (OnRecvPacket/OnAcknowledgementPacket/OnTimeoutPacket, timestamp-only timeouts for EVM chains, the ICS-20 v1 payload parser); (3) the expected_keepers.go shim convention (ibc-go standard for breaking cross-module keeper dep cycles — e.g. x/exit/types/expected_keepers.go defines a BridgeKeeper interface that the x/bridge keeper satisfies structurally; preserves G-003 by-ID-string rule at the type level); (4) the simtest scaffolding (in-memory store, sdk.Context construction, event emission assertions). The v0.3 in-memory Keeper stubs (in types/types.go) are retired or wrapped as test helpers — the types/ public API is not broken.
|
reason: v0.2 introduces IBC (satellite), governance (council), capability (window), group (stand/guild), oracle (forex) patterns that map directly to Cosmos SDK modules (x/gov, x/group, x/authz, x/feegrant, x/capability, x/ibc-transfer). Phase-specific to v0.2 execution phases where Cosmos-convention alignment matters for future wiring.
|
||||||
frameworks: [Go 1.22, cosmos-sdk v0.50.x (D-055), ibc-go v8.x, cometbft (simtest in-memory store only), Go testing, simtest]
|
frameworks: [cosmos-sdk, ibc-go, CosmWasm, CometBFT]
|
||||||
territory: ["x/exit/keeper/**", "x/exit/types/msg_*.go", "x/exit/types/expected_keepers.go", "x/exit/module.go", "x/bridge/keeper/**", "x/bridge/types/msg_*.go", "x/bridge/types/expected_keepers.go", "x/bridge/module.go", "x/bearers/keeper/**", "x/bearers/types/msg_*.go", "x/bearers/module.go", "x/partner/keeper/**", "x/partner/types/msg_*.go", "x/partner/types/expected_keepers.go", "x/partner/module.go", "x/hub/keeper/**", "x/hub/types/msg_*.go", "x/hub/types/expected_keepers.go", "x/hub/module.go", "x/services/keeper/**", "x/services/types/msg_*.go", "x/services/types/expected_keepers.go", "x/services/module.go", "x/bond/keeper/**", "x/bond/types/msg_*.go", "x/bond/types/expected_keepers.go", "x/bond/module.go", "x/council/keeper/**", "x/council/types/msg_*.go", "x/council/types/expected_keepers.go", "x/council/module.go"]
|
territory: ["x/satellite/**", "x/council/**", "x/window/**", "x/stand/**", "x/guild/**", "x/forex/**", "x/bearers/**"]
|
||||||
constraints: ["MsgServer convention (cosmos-sdk v0.40+ Stargate): MsgServer struct wraps the module Keeper; one method per Msg* returning (*Response, error); routed by base app MsgServiceRouter", "sdk.Msg contract: ValidateBasic (stateless gate, runs before handler), GetSigners (authz), ProtoMessage/JSONCodec registration", "handler state-machine ordering: (1) ValidateBasic (in msg), (2) keeper authz check, (3) state mutation under store, (4) ctx.EventManager().EmitEvent — reordering causes double-spend/replay", "expected_keepers.go convention: cross-module keeper deps are INTERFACES defined in the consuming module's types/ (e.g. x/exit/types/expected_keepers.go BridgeKeeper); the concrete keeper satisfies it structurally; NOT a struct import of x/bridge/types — G-003 preserved", "IBC handlers implement the ibc-go IBCModule / PacketExecutor contract (OnRecvPacket/OnAcknowledgementPacket/OnTimeoutPacket); ICS-20 v1 payload pinned to the v0.2 satellite packet shape", "simtest uses SDK in-memory store (dbm in-memory backend) + sdk.NewContext; no live CometBFT node, no real IBC light clients (D-054)", "version pin (A-504, planner/GRILL confirms): cosmos-sdk v0.50.x LTS + ibc-go v8.x (stable); ibc-go v10 IBC-v2/Eureka is the documented pattern but a newer pin"]
|
constraints: [lexicon compliance (REQ-012), no live-chain side effects in skeleton, mirror x/gov TallyResult / x/group DecisionPolicy / x/authz Grant shapes for future wiring, zero external deps in v0.2 skeleton, by-ID-string inter-module references to avoid import cycles (G-003 tested invariant), go.mod is read-only in v0.2 (G-006)]
|
||||||
|
|
||||||
- id: mesh-engineer
|
- id: security-engineer
|
||||||
active: true
|
active: true
|
||||||
phase_specific: true
|
phase_specific: true
|
||||||
reason: REACTIVATED for the bearer transport runtime in P2 (REQ-034). Owns the OY-SAT + OY-QR message handlers in x/bearers: MsgSendOYSATFrame, MsgReceiveOYSATFrame, MsgIssueOYQR, MsgConsumeOYQR, and the session lifecycle (Open/Active/Closed/Revoked). The v0.3 OYSATLink (surveillance-resistant=true locked) and OYQRCode (one-shot consumed flag) become the handler state objects. Key mesh-specific invariants: (1) OY-QR is one-shot — MsgConsumeOYQR flips consumed BEFORE the transfer effect (replay rejected idempotently, A-521); (2) the surveillance-resistant const is a runtime invariant — the handler must NOT emit geolocation or sender physical location (simtest asserts the event set has NO geolocation fields, a negative test); (3) the BearerTransport interface gains a store-backed impl (the keeper acts as the transport in simtest; no hardware/RF dep, D-054). Hardware integration is explicitly deferred. mesh-engineer is phase-specific (P2 only) — outside P2 the bearer transport territory reverts to backend-engineer.
|
reason: v0.2 enforces Mission Lock (council), fee/bond coupon clamps (clamp invariants), 9-stand / 4-tier / 6-pact locked-const tests, and Window revoke/expire lifecycle invariants. Phase-specific to v0.2 where invariant/locked-const test density is highest.
|
||||||
frameworks: [Go 1.22, cosmos-sdk v0.50.x, Go testing, simtest, lexicon firewall]
|
frameworks: [Go testing, table-driven tests, invariant tests]
|
||||||
territory: ["x/bearers/keeper/**", "x/bearers/types/msg_bearer*.go", "x/bearers/types/types.go", "x/bearers/module.go", "x/bearers/simtest/**"]
|
territory: ["x/**/types/**_test.go", "x/**/keeper/**_test.go", "x/**/genesis_test.go", "x/**/*_test.go"]
|
||||||
constraints: ["OY-QR one-shot: MsgConsumeOYQR flips consumed BEFORE the transfer effect (atomic per-tx; replay finds consumed==true and returns error idempotently, A-521)", "surveillance-resistant const is a runtime invariant — handler emits NO geolocation / sender physical location; simtest negative-test asserts the event set is geolocation-free", "BearerTransport interface gets a store-backed impl (keeper as transport in simtest); NO hardware/RF/LoRa/BLE/satellite Go libraries (D-054 — runtime = message-handling + session lifecycle, not hardware)", "session lifecycle mirrors the v0.2 Window lifecycle (Open/Active/Closed/Revoked) for consistency; frames received on Closed/Revoked sessions are rejected", "lexicon-safe: 'session', 'frame', 'bearer', 'QR', 'SAT' are safe; AVOID 'account'/'deposit' (use reach-id/Stash by ID)"]
|
constraints: [invariant tests for all locked constants (Mission Lock non-amendable, bond 8% cap / 0% floor, fee ceiling/floor), locked-const tests for every enum count (9 stands, 4 partner tiers, 6 pacts), lexicon assertion in every new test file (D-033), ≥80% coverage on new packages, owns ALL *_test.go files including genesis_test.go (G-008)]
|
||||||
|
|
||||||
phase_specific_personas:
|
|
||||||
- id: data-engineer
|
|
||||||
active: true
|
|
||||||
phase_specific: true
|
|
||||||
reason: REACTIVATED for P4 (Hub API runtime) ONLY — owns the hub custody state via an in-memory test store (the memKeyring + the keeper's store-backed custody asset records). The custody asset records are the closest thing to a data store in v0.5; there is NO real database and NO migration (the SDK in-memory store is the substrate). data-engineer's role is narrow: ensure the custody state shape (assetID → custody entry + sig ref + key version) is consistent with the CustodyKeyring interface and supports rotation. Removed after P4 (the hub runtime ships; later phases do not touch custody state shape). This mirrors the v0.3 data-engineer pattern (genesis schemas) but scoped to the P4 custody store.
|
|
||||||
frameworks: [Go 1.22, cosmos-sdk v0.50.x store, Go testing]
|
|
||||||
territory: ["x/hub/keeper/keyring_mem*.go", "x/hub/keeper/custody_state*.go"]
|
|
||||||
constraints: ["in-memory test store ONLY — no real database, no migration (D-054 simtest grade)", "custody state shape consistent with CustodyKeyring interface (assetID → custody entry + sig ref + key version); supports rotation", "removed after P4 (hub runtime ships; later phases do not touch custody state shape)"]
|
|
||||||
|
|
||||||
deactivated:
|
deactivated:
|
||||||
- id: frontend-engineer
|
- id: frontend-engineer
|
||||||
reason: INACTIVE for v0.5. The v0.3 docs site (docs/**, mkdocs.yml) is COMPLETE; v0.5 has no UI/docs-content work. The docs build CI (REQ-032, v0.4) already covers docs-build on every push. Reactivate in v0.6+ if docs content is restructured or i18n is added.
|
reason: No UI in v0.2 (skeleton+tests only; Mesh Experience UI is v0.1-complete and v0.3+ for new UI). Deactivate to avoid persona territory noise. Reactivate in v0.3.
|
||||||
- id: docs-writer
|
|
||||||
reason: INACTIVE for v0.5. Same reason as frontend-engineer — v0.3's docs-writer owned page content authoring; v0.5 has zero new docs pages. The only documentation work is the ARCHITECTURE.md v0.5 runtime section + this PERSONAS.md + RESEARCH.md, which is lead-developer/researcher architecture territory, not audience-content authoring. Reactivate if a future milestone adds docs pages.
|
|
||||||
- id: ci-security-auditor
|
- id: ci-security-auditor
|
||||||
reason: Default deactivated; activate in P8 (final review/audit/ship) for the v0.5 milestone audit and feature purity gate enforcement (no breaking schema changes; locked-const firewall intact; G-003 production firewall intact; G-006 controlled exception GRILL-ratified).
|
reason: Default deactivated; activate in P5 (review/ship) phase for the milestone audit. Not needed during P1-P4 skeleton authoring.
|
||||||
|
- id: mesh-engineer
|
||||||
|
reason: v0.1 listed as future; still not needed in v0.2 (Bearers OY-LR + Beacon are type stubs only, no hardware/RF). Activate in v0.3 for real bearer runtime.
|
||||||
|
|
||||||
custom_personas: []
|
custom_personas:
|
||||||
|
- id: cosmos-engineer
|
||||||
|
rationale: v0.2 components map onto specific Cosmos SDK modules (x/gov, x/group, x/authz, x/feegrant, x/capability, x/ibc-transfer). A dedicated persona ensures skeleton types mirror the eventual runtime shapes, reducing Phase 3 wiring refactor cost. Distinct from backend-engineer because it carries Cosmos-specific convention knowledge (tally shapes, decision policy, capability, ICS-20 packet shape).
|
||||||
|
- id: security-engineer
|
||||||
|
rationale: v0.2 has the highest locked-const + invariant density in the project (Mission Lock, bond cap, 6 Pact types, 9 Stand types, 4 Partner tiers, Window revoke idempotency). A dedicated persona ensures invariant tests and lexicon assertions are not an afterthought. Distinct from backend-engineer because it owns test-file territory and invariant-first design.
|
||||||
---
|
---
|
||||||
|
|
||||||
# Personas: OpenYield (oy) — v0.5 (Bearers Runtime — Feature)
|
# Personas: OpenYield (oy) — v0.2 (The Mesh)
|
||||||
|
|
||||||
> This file supersedes the v0.4 PERSONAS.md for the v0.5 milestone. v0.5 is a
|
|
||||||
> **feature** milestone (D-054): the v0.3 Bearers skeletons are promoted
|
|
||||||
> from types + in-memory keeper stubs + invariant tests to live keeper
|
|
||||||
> MsgServer message handlers + simtest-grade end-to-end flows. This is
|
|
||||||
> NOT mainnet — D-020 continues to govern network deployment; runtime =
|
|
||||||
> simtest-grade handlers, not live chain.
|
|
||||||
>
|
|
||||||
> The active roster is **backend-engineer + lead-developer + security-
|
|
||||||
> engineer (REACTIVATED) + cosmos-engineer (REACTIVATED) + mesh-engineer
|
|
||||||
> (REACTIVATED, P2 phase-specific)**. The v0.3 docs personas (frontend-
|
|
||||||
> engineer, docs-writer) are deactivated because v0.5 has no docs-content
|
|
||||||
> work (the docs site is complete from v0.3; the docs build CI is complete
|
|
||||||
> from v0.4). data-engineer is reactivated as a P4-phase-specific persona
|
|
||||||
> for the hub custody state (in-memory test store only; removed after P4).
|
|
||||||
> ci-security-auditor is default off; activate in P8 for the final audit.
|
|
||||||
>
|
|
||||||
> cosmos-sdk is now a load-bearing dependency (D-055 GRILL-approved
|
|
||||||
> controlled exception to G-006); go.mod gains cosmos-sdk v0.50.x +
|
|
||||||
> ibc-go v8.x (A-504, planner/GRILL confirms the exact pin).
|
|
||||||
|
|
||||||
## Active Roster
|
## Active Roster
|
||||||
|
|
||||||
| Persona | Active | Phase-specific | Territory |
|
### backend-engineer
|
||||||
|---------|--------|-----------------|-----------|
|
- **Domain**: Go/Cosmos module skeletons for v0.2 — owns the **non-Cosmos-mirroring** modules (pact, partner, bond) per G-007, plus shared `types/`+`keeper/`+`module.go` authoring.
|
||||||
| backend-engineer | yes | no (all runtime phases P1..P7) | `x/{exit,bridge,bearers,partner,hub,services,bond,council}/**`, `lexicon*` |
|
- **Frameworks**: Go, Cosmos SDK, IBC, CosmWasm.
|
||||||
| lead-developer | yes | no (all phases) | `.ciagent/**`, `.gitea/workflows/**` |
|
- **Territory**: `x/pact/**`, `x/partner/**`, `x/bond/**`, `x/**/types/**`, `x/**/keeper/**`, `x/**/module.go`. (`go.mod` is read-only in v0.2 per G-006.)
|
||||||
| security-engineer | yes | no (all runtime phases) | `x/hub` keyring, `x/bond` keeper, `x/bridge` keeper, `x/council` keeper, `lexicon/**` |
|
- **Constraints**: lexicon compliance (REQ-012), skeleton+tests pattern (D-020), ≥80% coverage on new packages (D-033), no live-chain side effects in skeleton, locked-const invariants, no fractional reserve, no leverage/futures.
|
||||||
| cosmos-engineer | yes | no (all runtime phases) | `keeper/**`, `types/msg_*.go`, `types/expected_keepers.go`, `module.go` across all 8 target modules |
|
|
||||||
| mesh-engineer | yes | yes (P2 only) | `x/bearers/keeper/**`, `x/bearers/types/msg_bearer*.go`, `x/bearers/simtest/**` |
|
|
||||||
| data-engineer | yes | yes (P4 only) | `x/hub/keeper/keyring_mem*.go`, `x/hub/keeper/custody_state*.go` |
|
|
||||||
|
|
||||||
## Phase-Persona Matrix
|
### data-engineer
|
||||||
|
- **Domain**: Genesis/state schema design — Window audit log, Stand membership sets, Bond issuance state, Council Voice tally state. Shapes `ValidateGenesis` upgrades (v0.1's no-op → v0.2 ID-uniqueness checks). Owns genesis **schema** only (G-008); genesis **test assertions** are security-engineer's.
|
||||||
|
- **Frameworks**: Go, `encoding/json`, Cosmos SDK state.
|
||||||
|
- **Territory**: `x/**/types/genesis.go`, `x/**/genesis.go` (excludes `*_test.go` per G-008).
|
||||||
|
- **Constraints**: append-only audit logs (Window), ID-uniqueness in `ValidateGenesis`, lexicon compliance, no state identity beyond Reach.
|
||||||
|
|
||||||
| Phase | Personas | Work |
|
### lead-developer
|
||||||
|-------|----------|------|
|
- **Domain**: Multi-component orchestration across 10 new packages, dependency sequencing per D-031 blocker chain, vertical-slice integrity per phase.
|
||||||
| P0 (pre-execution) | lead-developer (spec/clarify/research/plan/grill/mvp-ux + ship) | this file + RESEARCH.md + ARCHITECTURE.md v0.5 sections; planner-escalation items surfaced |
|
- **Frameworks**: cross-cutting.
|
||||||
| P1 (exit + bridge runtime) | backend-engineer + cosmos-engineer + security-engineer | REQ-033: `x/exit` DEX swap routing + `x/bridge` L2↔L1 IBC packet handlers (5 L2 chains, D-059); ibc-go IBCModule contract; Solana wormhole-adapter branch; replay/timeout simtest |
|
- **Territory**: `**`.
|
||||||
| P2 (bearers transport runtime) | backend-engineer + cosmos-engineer + mesh-engineer (phase-specific) | REQ-034: OY-SAT + OY-QR message handlers; session lifecycle; OY-QR one-shot consumed-before-transfer; surveillance-resistant invariant |
|
- **Constraints**: blocked-by chain enforcement (D-031), milestone versioning (v0.2 / tag_base v0.1.x), lexicon gate on merge, persona territory warn-mode enforcement.
|
||||||
| P3 (anchors onboarding runtime) | backend-engineer + cosmos-engineer + security-engineer | REQ-035: `x/partner` Anchor credential issuance + revocation handlers; Watcher-quorum authz via expected-keeper shim; P3→P4 hub dep broken by HubKeeper interface shim |
|
|
||||||
| P4 (hub API B2B runtime) | backend-engineer + cosmos-engineer + security-engineer + data-engineer (phase-specific) | REQ-036: custody/lending/compliance handlers; CustodyKeyring interface + memKeyring (D-058); lending coupon clamp [0,800]; compliance-before-custody ordering; lexicon (avoid 'deposit' in Msg names) |
|
|
||||||
| P5 (services runtime) | backend-engineer + cosmos-engineer | REQ-037: Care/SIM/Vault/Mail service lifecycle handlers; per-kind Msg* (typed dispatch); window-grant checked on every op |
|
|
||||||
| P6 (bond market runtime) | backend-engineer + cosmos-engineer + security-engineer | REQ-038: Growth Bond issuance + secondary-market CLOB matching (D-057); per-match coupon clamp [0,800] (A-562 reject-above-cap, planner confirms); price-time priority FCFS (REQ-007); no AMM |
|
|
||||||
| P7 (council governance runtime) | backend-engineer + cosmos-engineer + security-engineer | REQ-039: Proposal/VoteOption enums (AUDIT §193 P1-1); Voice lifecycle handlers; MissionLockAmendment-Rejected rejected at ValidateBasic (A-572); Watcher Veto quorum (A-574, default 6); SignalKind stays 4 |
|
|
||||||
| P8 (final review/audit/ship) | lead-developer + ci-security-auditor (activated) | feature purity gate audit; locked-const firewall verification; G-003 + G-006 (D-055 exception) verification; milestone ship |
|
|
||||||
|
|
||||||
## Constraints Carried Forward
|
### cosmos-engineer (custom, phase-specific to v0.2)
|
||||||
|
- **Domain**: v0.2 components map onto Cosmos SDK modules — `x/gov` (council tally), `x/group` (stand/guild decision policy), `x/authz`/`x/feegrant` (window), `x/capability` (window unforgeable ref), `x/ibc-transfer` ICS-20 (satellite). Ensures skeleton types mirror runtime shapes for low-friction Phase 3 wiring.
|
||||||
|
- **Frameworks**: cosmos-sdk, ibc-go, CosmWasm, CometBFT.
|
||||||
|
- **Territory**: `x/satellite/**`, `x/council/**`, `x/window/**`, `x/stand/**`, `x/guild/**`, `x/forex/**`, `x/bearers/**` (Cosmos-convention-mirroring modules per G-007; `x/pact`/`x/partner`/`x/bond` are backend-engineer's). `go.mod` read-only per G-006.
|
||||||
|
- **Constraints**: lexicon compliance (REQ-012), no live-chain side effects in skeleton, mirror `x/gov` `TallyResult` / `x/group` `DecisionPolicy` / `x/authz` `Grant` shapes, zero external deps in v0.2 skeleton, by-ID-string inter-module references (G-003 tested invariant).
|
||||||
|
|
||||||
- **G-003 production firewall intact**: keeper-to-keeper cross-module calls use `expected_keepers.go` interface shims (ibc-go convention), NOT struct imports of `x/<module>/types`. The by-ID-string rule is preserved at the type level. Test-only cross-package imports remain exempt (the G-003 test exemption, used by REQ-030 in v0.4; simtest may import multiple `x/*/keeper` packages to wire shims).
|
### security-engineer (custom, phase-specific to v0.2)
|
||||||
- **G-006 controlled exception (D-055)**: `go.mod` gains `cosmos-sdk v0.50.x` + `ibc-go v8.x` (GRILL-ratified). Scoped to runtime phases P1..P7; P0 + P8 stay dep-neutral where possible. `types/` packages gain `sdk.Msg` imports for `Msg*` types (isolated in `types/msg_*.go`); invariant/lexicon tests stay stdlib-only and green. Exact version pin is A-504 (planner/GRILL confirms).
|
- **Domain**: Invariant + locked-const test authorship. Owns **all** test-file territory across v0.2 packages (including `genesis_test.go` per G-008). Highest invariant density in the project: Mission Lock non-amendable, bond 8% cap / 0% floor clamp, fee ceiling/floor clamp, 6 Pact types, 9 Stand types, 4 Partner tiers, Window revoke/expire idempotency, lexicon assertion per module.
|
||||||
- **Locked-const invariants unchanged**: v0.5 ADDS `ProposalKind` (4) / `ProposalStatus` (5) / `VoteOption` (4) enums to `x/council/types` (AUDIT §193 P1-1 promotion, D-060) but does NOT change existing locked consts — `CouponCapBps=800` / `CouponFloorBps=0` (D-028), `BearerTypeCount=6`, `PartnerTierCount=4`, `MissionLockAmendable=false`, `SignalKindCount=4` (P1-2 defensible; v0.4 `TestSignalKindShapeIntentional` stays green), `BridgeStatusCount=4`, `ExitStatusCount=5`, `ServiceKindCount=4`, `HubServiceCount=3`, `CouncilKindCount=3`, etc. The REQ-030 cross-const test (`hub.LendingCouponCapBps==bond.CouponCapBps`) stays green.
|
- **Frameworks**: Go testing, table-driven tests, invariant tests.
|
||||||
- **Lexicon firewall stays green**: the `lexicon_meta_test.go` (x/**/*.go) + `lexicon_meta_docs_test.go` (docs) automatically cover the new `keeper/`, `msg_server.go`, `simtest/` files. The new `Msg*` struct names are the lexicon surface — AVOID "deposit" in `x/hub` custody message names (use `MsgCustodyReceiveAsset`/`MsgCustodyReleaseAsset`, A-542); "coupon" not "interest"/"yield" in `x/bond`; "session"/"frame" safe in `x/bearers`; "veto" safe in `x/council`. Per-module lexicon assertions added to each new `keeper/` package.
|
- **Territory**: `x/**/types/**_test.go`, `x/**/keeper/**_test.go`, `x/**/genesis_test.go`, `x/**/*_test.go` (all test files per G-008).
|
||||||
- **Simtest NOT mainnet (D-054)**: handlers exercised against in-memory `sdk.Context` + dbm in-memory store; no real IBC light clients, no real MPC, no real bearer hardware, no real DEX venues, no real Watcher attestations (all stubbed). The simtest does NOT assert front-running safety (out of scope for simtest-grade runtime; the CLOB handler is documented as NOT front-running-safe for mainnet, a Year-3+ concern).
|
- **Constraints**: invariant tests for all locked constants, locked-const tests for every enum count (9 stands, 4 partner tiers, 6 pacts, 3 councils), lexicon assertion in every new test file (D-033), ≥80% coverage on new packages, Window lifecycle idempotency tests (revoke-after-expire, double-revoke).
|
||||||
- **≥80% coverage on runtime packages (D-033 carries forward)**: every `keeper/msg_server.go` + simtest must hit the bar; table-driven handler tests per `Msg*`.
|
|
||||||
|
|
||||||
## Planner-Escalation Items (low-confidence assumptions, surfaced through the normal decision flow)
|
## Deactivated
|
||||||
|
- **frontend-engineer** — No UI in v0.2 (skeleton+tests only). Mesh Experience UI is v0.1-complete; new UI is v0.3+. Reactivate in v0.3.
|
||||||
|
- **ci-security-auditor** — Default deactivated; activate in P5 (review/ship) for milestone audit.
|
||||||
|
- **mesh-engineer** — v0.1 listed as future; still not needed in v0.2 (Bearers OY-LR + Beacon are type stubs only). Activate in v0.3 for real bearer runtime.
|
||||||
|
|
||||||
These are NOT auto-decided; the planner must resolve them before the corresponding phase lands:
|
## Custom Personas
|
||||||
|
- **cosmos-engineer** — v0.2 components map onto specific Cosmos SDK modules. Dedicated persona ensures skeleton types mirror eventual runtime shapes, reducing Phase 3 wiring refactor cost. Distinct from backend-engineer: carries Cosmos-specific convention knowledge (tally shapes, decision policy, capability, ICS-20 packet shape).
|
||||||
|
- **security-engineer** — v0.2 has the highest locked-const + invariant density in the project. Dedicated persona ensures invariant tests and lexicon assertions are not an afterthought. Distinct from backend-engineer: owns test-file territory and invariant-first design.
|
||||||
|
|
||||||
1. **A-504** — cosmos-sdk / ibc-go version pin (proposed: cosmos-sdk v0.50.x + ibc-go v8.x; alternative: ibc-go v10 IBC-v2/Eureka). GRILL review. Confidence 0.78.
|
## Framework Alignment
|
||||||
2. **A-562** — bond CLOB match above 800 bps: REJECT (fails closed, proposed) vs CLAMP-with-refund (D-057 says "clamp"). Resolve before P6. Confidence 0.70.
|
- **Go 1.22** — all personas target Go 1.22 (`go.mod`).
|
||||||
3. **A-572** — `MissionLockAmendment-Rejected` ProposalKind: reject at `ValidateBasic` (proposed, the message never reaches the handler) vs propose-then-fail (record Pending → auto-transition Failed with event). Resolve before P7. Confidence 0.80.
|
- **cosmos-sdk** — cosmos-engineer targets cosmos-sdk v0.50.x (LTS) for future wiring; NOT vendored in v0.2 skeleton.
|
||||||
4. **A-574** — Watcher Veto quorum value (proposed default: 6, matching REQ-004 6-of-9). Resolve before P7. Confidence 0.75.
|
- **ibc-go** — cosmos-engineer targets ibc-go v8/v10 for satellite module shape; NOT vendored in v0.2 skeleton.
|
||||||
|
- **CosmWasm** — cosmos-engineer targets wasmvm v1.5/v2.0 for potential Pacts-as-contracts in Phase 3; NOT vendored in v0.2.
|
||||||
|
|
||||||
## Removal Notes
|
## Territory Alignment
|
||||||
|
- Mapped to actual `x/<name>/` structure (15 v0.1 modules + 9 new v0.2 modules + 1 extended).
|
||||||
|
- backend-engineer owns `x/pact`, `x/partner`, `x/bond` (non-Cosmos-mirroring per G-007) + shared `types/`+`keeper/`+`module.go` authoring.
|
||||||
|
- data-engineer owns `genesis.go` schema only (G-008 — excludes `*_test.go`).
|
||||||
|
- cosmos-engineer owns the Cosmos-convention-mirroring modules (`x/satellite`, `x/council`, `x/window`, `x/stand`, `x/guild`, `x/forex`) + `x/bearers` extension (G-007).
|
||||||
|
- security-engineer owns **all** `*_test.go` files across the new packages (G-008 — including `genesis_test.go`).
|
||||||
|
- lead-developer owns `**` for cross-cutting coordination.
|
||||||
|
- `go.mod` is **read-only** in v0.2 (G-006) — no persona may modify it; any change is an escalation (would violate D-020/A-201 zero-dep invariant).
|
||||||
|
|
||||||
- frontend-engineer and docs-writer were deactivated in v0.4 (no docs-content phase); they remain deactivated in v0.5 for the same reason (the docs site is complete from v0.3; the docs build CI is complete from v0.4). They will reactivate in v0.6+ if docs content is restructured or i18n is added.
|
## Constraint Alignment
|
||||||
- cosmos-engineer, security-engineer, and mesh-engineer were deactivated in v0.3/v0.4 (lower Cosmos-convention / invariant density, no bearer hardware runtime); they are REACTIVATED in v0.5 because cosmos-sdk is now load-bearing (D-055), the runtime introduces new security-critical invariant surfaces (CustodyKeyring, CLOB clamp, IBC replay, Mission-Lock const firewall), and the bearer transport gets live handlers (P2).
|
- **Lexicon (REQ-012)** — every persona carries it; security-engineer asserts it per test file.
|
||||||
- data-engineer is reactivated as a P4-phase-specific persona (hub custody state, in-memory test store only) and removed after P4. This mirrors the v0.3 genesis-schema pattern but scoped narrowly to the P4 custody store.
|
- **Skeleton + tests pattern (D-020)** — backend-engineer + cosmos-engineer enforce.
|
||||||
- ci-security-auditor is default off; activate in P8 for the final audit + feature purity gate.
|
- **≥80% coverage on new packages (D-033)** — security-engineer owns the gate.
|
||||||
|
- **Blocker chain (D-031)** — lead-developer enforces phase ordering.
|
||||||
|
- **No live-chain side effects in skeleton** — cosmos-engineer + backend-engineer enforce (no relayer, no CometBFT, no live oracle).
|
||||||
|
- **Locked-const invariants** — security-engineer owns; every locked constant has a dedicated test.
|
||||||
|
|
||||||
|
## Phase-Specific Personas
|
||||||
|
- **cosmos-engineer** — phase-specific to v0.2 execution phases (P1-P4). Remove or merge back into backend-engineer after v0.2 ships (Cosmos convention alignment is most critical during the first Mesh-era skeleton).
|
||||||
|
- **security-engineer** — phase-specific to v0.2 (highest invariant density). May persist into v0.3 if invariant-test density remains high; reassess at v0.3 PLAN.
|
||||||
+1
-1816
File diff suppressed because it is too large
Load Diff
+23
-221
@@ -61,163 +61,33 @@ OpenYield (OY) is a durable, anti-greed, jurisdiction-light financial layer —
|
|||||||
- D-009: Rebased history to fix v1.0 → v0.1 in ---ci--- blocks
|
- D-009: Rebased history to fix v1.0 → v0.1 in ---ci--- blocks
|
||||||
|
|
||||||
## Milestone
|
## Milestone
|
||||||
v0.6 — Nomad Web UI (in progress; feature type; tags run on the v0.5.x patch line)
|
v0.2 — The Mesh (active milestone; feature type; tags run on the v0.1.x patch line)
|
||||||
|
|
||||||
### v0.6 Scope (Nomad Web UI MVP — generated test data, no real chain)
|
### v0.2 Scope (The Mesh — ROADMAP Phase 2)
|
||||||
|
Target: $1B annual volume, 4 service categories. Implements the pending Mesh-era requirements:
|
||||||
v0.6 is the project's first UI milestone. It delivers a working prototype Web
|
- **REQ-009** Satellite chains (Layer 2) — wrapped Bread, Pass-Act propagation on Polygon/Base/Arbitrum/Optimism/Solana [§7]
|
||||||
UI where a person can sign up to be a Nomad (create a Reach + open a Stash)
|
- **REQ-011** Three Councils (Mesh, Guild, Stand) with Mission Lock — multi-source Voice [§19]
|
||||||
and exercise basic functionality around the (Reach, Stash) components, plus
|
- **REQ-015** Window primitive — scope, duration, rate-limit, audit log, revoke [§10]
|
||||||
Window authorization, Standing progress, and Bloom accrual views. All data is
|
- **REQ-016** Nine Stand types (Household, Crew, Entity, Co-op, Circle, Trust, Foundation, Confederation, Shadow) [§11]
|
||||||
generated as test fixtures — there is no real blockchain interaction, no live
|
- **REQ-017** Guilds with Hand-Passes at 0% protocol fee [§12]
|
||||||
chain launch, no real bearer transports (D-020 continues to govern network
|
- **REQ-018** Four-tier Partner Spectrum (Op, Master Op, Pier, Anchor) [§13]
|
||||||
deployment). The UI is a greenfield Go `html/template` + HTMX layer served by a
|
- **REQ-020** Six Pacts (Pause, Ground, Stance, Cover, Stand Registry, Hub API) [§16]
|
||||||
Go mock HTTP server that instantiates the real `x/*/types` structs (Reach,
|
- **REQ-021** Mesh Bond Market with 8% upper coupon cap, 0% floor [§17]
|
||||||
Stash, Window, FreeholderSignals, BloomRecord) populated from in-memory
|
- Bearers expansion: OY-LR + Beacon v1
|
||||||
fixtures. No keeper, no Cosmos runtime, no `app.go` (none exists in the repo).
|
- Forex Engine v1
|
||||||
|
|
||||||
This milestone is the prerequisite for real-world MVP testing: it makes the
|
|
||||||
Nomad path visible and exercisable in a browser. Wiring the UI to a real `oyd`
|
|
||||||
daemon (once one exists) is deferred to v0.7+ (no `app.go`, `cmd/`, or `main.go`
|
|
||||||
exists in the repo today).
|
|
||||||
|
|
||||||
- **REQ-040** Nomad Reach signup Web UI — Go HTTP mock server (`web/`) + "Create a Reach" form + Reach list/detail; grounds the UI in `x/identity/types.Reach`. "Sign up" maps to "Create a Reach" (the word "account" is banned per REQ-012).
|
|
||||||
- **REQ-041** Stash dashboard Web UI — balance in Grain + Bread-scale conversion (using `x/bread/types.BreadScaleAll()`) + 90-day maturity progress bar (`x/stash/types.StashActivity.IsMature`).
|
|
||||||
- **REQ-042** Window authorization Web UI — form to open a Window (scope + duration + rate-limit), lifecycle view (Open→Active→Revoked/Expired via `x/window/types.Window.Activate/Revoke/Expire`), audit log.
|
|
||||||
- **REQ-043** Standing + Freeholder signals progress Web UI — computed from mock `Rating`/`Vouch`/`Slash` records using the locked constants + `GetStandingBucket`/`ComputeDiversityBonus`/`GetVoucherWeight`; 4-signal progress (`FreeholderSignals.IsFreeholderEligible`).
|
|
||||||
- **REQ-044** Bloom accrual Web UI — per-Stash `BloomRecord` view (`AccruedGrain`, `RateBasisPoints`), computed from mock data; shows the 4.5% target rate.
|
|
||||||
- **REQ-045** Extend REQ-012 lexicon firewall to scan `web/templates/**` + `web/static/**` (new `lexicon_meta_web_test.go`). Firewall-first: lands in P1 before content.
|
|
||||||
|
|
||||||
### Milestone Type
|
### Milestone Type
|
||||||
Feature (all execution phases are `feat` except REQ-045 which is `test`). Phase 0 → `v0.5.0`; execution phases `v0.5.1..v0.5.5`; final phase patch `v0.5.6` IS the v0.6 milestone release. No separate minor tag. The final-phase audit enforces the feature purity gate (no breaking schema changes; G-003 production firewall intact; G-006 go.mod unchanged unless a runtime dep is GRILL-approved — HTMX is a vendored static asset, not a Go dep).
|
Feature (at least one `feat` phase). Phase 0 → `v0.1.0`; execution phases `v0.1.1..v0.1.N`; final phase patch IS the milestone release. No separate minor tag.
|
||||||
|
|
||||||
### Out of Scope (v0.6)
|
### Out of Scope (v0.2)
|
||||||
- Real blockchain interaction / mainnet / IBC / real bearer transports (D-020 continues)
|
- Cross-chain exit / DEX integration (Phase 3 / v0.3)
|
||||||
- A real `oyd` daemon / `app.go` / `cmd/oyd` (no chain runtime exists; deferred to v0.7+)
|
- OY-SAT, OY-QR bearers (Phase 3)
|
||||||
- Real Anchors onboarding / Hub API B2B / real custody (simtest/mock only)
|
- Full Hub API B2B suite (Phase 3)
|
||||||
- Authentication / sessions / real key management (mock; a Reach is created by form submission, stored in-memory)
|
- Yield Token, Travel + 11 service categories (Phase 4)
|
||||||
- Persistence (mock store is in-memory; resets on restart)
|
- Full Mesh Bond market depth (Phase 3+; v0.2 ships first Mesh Bonds only)
|
||||||
- i18n / multi-language UI
|
|
||||||
- Real Standing oracle / real Bloom accrual engine (computed from fixtures using locked constants)
|
|
||||||
- The 5 P1+ mainnet-readiness items deferred from v0.5 (governance spam deposit, CLOB front-running, real IBC simtest, CLOB perf, emitMatchEventHook testability) — those are v0.7+ mainnet-readiness, not UI work
|
|
||||||
|
|
||||||
### Prior Milestones
|
### Prior Milestone
|
||||||
- v0.1 — OpenYield Foundation Init (COMPLETE; pre-MVP foundation skeleton; released as v0.0.9)
|
v0.1 — OpenYield Foundation Init (COMPLETE; pre-MVP foundation skeleton; released as v0.0.9 per run.md patch-line model)
|
||||||
- v0.2 — The Mesh (COMPLETE; skeleton + tests; released as v0.1.5)
|
|
||||||
- v0.3 — Bearers & Documentation (COMPLETE; feature; released as v0.2.6)
|
|
||||||
- v0.4 — Refinement (COMPLETE; NFR; released as v0.3.4)
|
|
||||||
- v0.5 — Bearers Runtime (COMPLETE; feature; released as v0.4.8)
|
|
||||||
|
|
||||||
## Prior Milestone
|
|
||||||
v0.5 — Bearers Runtime (complete; feature type; tags ran on the v0.4.x patch line)
|
|
||||||
|
|
||||||
### v0.5 Scope (Live-runtime promotions of the v0.3 Bearers skeletons)
|
|
||||||
|
|
||||||
v0.5 promotes the v0.3 Bearers skeletons from type+keeper-stub layers to live
|
|
||||||
runtime behavior. This is the first milestone to ship executable behavior
|
|
||||||
beyond invariant tests — keepers gain message handlers, transactions, and
|
|
||||||
end-to-end flows. Sourced from the v0.3/v0.4 deferred items (D-050,
|
|
||||||
PROJECT.md v0.4 out-of-scope, ROADMAP Phase 3 "The Bearers" runtime subset).
|
|
||||||
|
|
||||||
The skeleton-first pattern (D-020) continues to govern NEW components, but
|
|
||||||
v0.3-era modules (`x/exit`, `x/bridge`, `x/bearers`, `x/partner`, `x/hub`,
|
|
||||||
`x/services`, `x/bond`) gain runtime implementations this milestone. No live
|
|
||||||
chain launch (D-020 continues to apply to network deployment); runtime here
|
|
||||||
means keeper message handlers + simtest-grade end-to-end flows, not mainnet.
|
|
||||||
|
|
||||||
- **REQ-033** Exit layer runtime — `x/exit` DEX swap routing + bridge message handlers; `x/bridge` L2↔L1 IBC packet handlers. Promotes REQ-010 from skeleton → runtime. Live DEX/IBC channels still deferred.
|
|
||||||
- **REQ-034** Bearers transport runtime — OY-SAT + OY-QR bearer transport message handlers in `x/bearers` (extends REQ-019). Hardware integration deferred; runtime = message-handling + session lifecycle in simtest.
|
|
||||||
- **REQ-035** Anchors onboarding runtime — `x/partner` Anchor tier credential issuance + revocation handlers (extends REQ-018). Real institutional onboarding deferred; runtime = credential lifecycle in simtest.
|
|
||||||
- **REQ-036** Hub API B2B runtime — `x/hub` custody, lending primitive, compliance message handlers. Real B2B suite deferred; runtime = keeper handlers + simtest.
|
|
||||||
- **REQ-037** Services runtime — `x/services` Care / SIM / Vault / Mail service lifecycle handlers. Live service integrations deferred; runtime = lifecycle handlers + simtest.
|
|
||||||
- **REQ-038** Bond market depth runtime — `x/bond` Growth Bonds + secondary-market matching handlers (extends REQ-021). Live market depth deferred; runtime = matching engine + simtest.
|
|
||||||
- **REQ-039** Council governance runtime — `x/council` Proposal/VoteOption enum types (AUDIT §193 P1-1, deferred from v0.4) + Voice lifecycle handlers. Mission Lock const firewall intact (G-003); runtime = governance message handlers + simtest.
|
|
||||||
|
|
||||||
### Milestone Type
|
|
||||||
Feature (all execution phases are `feat`). Phase 0 → `v0.4.0`; execution phases `v0.4.1..v0.4.N`; final phase patch `v0.4.(N+1)` IS the v0.5 milestone release. No separate minor tag. The final-phase audit enforces the feature purity gate (no breaking schema changes; locked-const firewall intact).
|
|
||||||
|
|
||||||
### Out of Scope (v0.5)
|
|
||||||
- Live chain launch / mainnet / real IBC channels / real bearer transports (D-020 pattern continues; runtime = simtest-grade message handlers)
|
|
||||||
- Real institutional Anchors onboarding (credential lifecycle in simtest only)
|
|
||||||
- Yield Token, Travel + 11 service categories (ROADMAP Phase 4 — Maturity)
|
|
||||||
- i18n / MkDocs internationalization
|
|
||||||
- Cover Pool seniority mechanics (still deferred per PROJECT.md Q7)
|
|
||||||
- Breaking schema changes / locked-const amendments (Mission Lock non-amendable)
|
|
||||||
- SignalKind 4→5 enum expansion (AUDIT §193 P1-2; defensible per current rationale, deferred to v0.6+ governance vote)
|
|
||||||
|
|
||||||
### Prior Milestones
|
|
||||||
- v0.1 — OpenYield Foundation Init (COMPLETE; pre-MVP foundation skeleton; released as v0.0.9)
|
|
||||||
- v0.2 — The Mesh (COMPLETE; skeleton + tests; released as v0.1.5)
|
|
||||||
- v0.3 — Bearers & Documentation (COMPLETE; feature; released as v0.2.6)
|
|
||||||
- v0.4 — Refinement (COMPLETE; NFR; released as v0.3.4)
|
|
||||||
|
|
||||||
## Prior Milestone
|
|
||||||
v0.4 — Refinement (complete; NFR type; tags ran on the v0.3.x patch line)
|
|
||||||
|
|
||||||
### v0.4 Scope (Refinement-only NFR — v0.3 post-hoc forward-references)
|
|
||||||
|
|
||||||
v0.4 is a refinement-only NFR milestone: zero `feat:` phases. It lands the
|
|
||||||
durability fixes v0.3 flagged but did not block on, sourced from REVIEW.md,
|
|
||||||
AUDIT.md §193, and GRILL.md G-014. Live-runtime promotions of the v0.3 Bearers
|
|
||||||
skeletons are out of scope (deferred to v0.5+).
|
|
||||||
|
|
||||||
- **REQ-029** Lexicon firewall shared helper (`lexicon.SyntheticBannedStrings()`) — dedupe the synthetic self-test table between `lexicon_meta_test.go` and `lexicon_meta_docs_test.go`. Both meta-tests derive count + strings from the single `lexicon` package source, so a future banned-term addition updates both firewalls from one place. (GRILL G-014)
|
|
||||||
- **REQ-030** Cross-package const-equality test — `x/hub.LendingCouponCapBps == x/bond.CouponCapBps` (and Floor). Test-only import (G-003 exempt). Catches silent mission-lock drift between hub LOCAL consts and bond D-028 consts. (REVIEW.md P2 / A-304)
|
|
||||||
- **REQ-031** x/* lifecycle type shape-divergence review + alignment fixes — audit non-must-have lifecycle types across modules flagged by AUDIT §193; align where divergent without behavioral change. (AUDIT.md §193)
|
|
||||||
- **REQ-032** Docs build CI — Gitea Actions workflow running `go test ./...` (lexicon firewall) + `mkdocs build` on every push; upload `site/` as a CI artifact. Full Gitea Pages publishing deferred if no hosting target configured. (D-046)
|
|
||||||
|
|
||||||
### Milestone Type
|
|
||||||
NFR (all phases are refactor/test/quality/chore). Phase 0 → `v0.3.0`; execution phases `v0.3.1..v0.3.3`; final phase patch `v0.3.4` IS the milestone release. No separate minor tag. The final-phase audit enforces the NFR purity gate (zero `feat:` commits).
|
|
||||||
|
|
||||||
### Out of Scope (v0.4)
|
|
||||||
- Live-runtime promotions: Exit/DEX, OY-SAT/OY-QR hardware, Hub API B2B, bond matching, L2 IBC rollout, Anchors onboarding (all `feat:`, deferred to v0.5+)
|
|
||||||
- i18n / MkDocs internationalization (`feat:`, rejected by D-001 filter)
|
|
||||||
- Yield Token, Travel + 11 service categories (ROADMAP Phase 4)
|
|
||||||
- Cover Pool seniority mechanics (still deferred per PROJECT.md Q7)
|
|
||||||
|
|
||||||
### Prior Milestones
|
|
||||||
- v0.1 — OpenYield Foundation Init (COMPLETE; pre-MVP foundation skeleton; released as v0.0.9)
|
|
||||||
- v0.2 — The Mesh (COMPLETE; skeleton + tests; released as v0.1.5)
|
|
||||||
- v0.3 — Bearers & Documentation (COMPLETE; feature; released as v0.2.6)
|
|
||||||
|
|
||||||
### v0.3 Scope (Bearers skeleton + Docs site — ROADMAP Phase 3 partial, plus a docs deliverable)
|
|
||||||
|
|
||||||
This milestone bundles two parallel work-streams under one feature milestone:
|
|
||||||
|
|
||||||
**(A) Bearers skeleton (D-020 pattern continued)** — implements the v0.1 PROJECT.md
|
|
||||||
out-of-scope items now promoted to v0.3 (ROADMAP Phase 3 "The Bearers" subset),
|
|
||||||
as skeleton + tests (Go types + keeper stubs + invariant tests; no live chain):
|
|
||||||
|
|
||||||
- **REQ-010** Exit layer (Layer 3) — DEX swaps, bridges, off-mesh services (§7). Promoted from Skeleton to a fuller skeleton: `x/exit` (exit-route types) + `x/bridge` (L2↔L1 bridge types). Live runtime deferred to v0.4.
|
|
||||||
- **Bearers expansion** — OY-SAT (satellite) + OY-QR bearer transport types, extending `x/bearers` (D-029 pattern). Hardware integration deferred.
|
|
||||||
- **Anchors** — first institutional Partner tier (`x/partner` extension: Anchor credential types). REQ-018 promoted from Skeleton → fuller skeleton.
|
|
||||||
- **Hub API** — B2B backbone: custody, lending primitive, compliance types (`x/hub`). Full B2B suite deferred to v0.4.
|
|
||||||
- **Services** — Care / SIM / Vault / Mail service types (`x/services`). Live services deferred.
|
|
||||||
- **Bond market depth** — Growth Bonds + secondary-market types, extending `x/bond` (REQ-021 promoted from Skeleton → fuller skeleton). Full market depth deferred.
|
|
||||||
|
|
||||||
**(B) Documentation deliverable** — README.md + docs site in `docs/` for nomads and freeholders:
|
|
||||||
|
|
||||||
- Repo-root `README.md` (lexicon-clean project overview).
|
|
||||||
- MkDocs Material site (`mkdocs.yml` + `docs/`), organized by audience:
|
|
||||||
- `docs/nomads/` — Reach path, Stash, bearers, Maps/Pay, six Pacts, standing basics.
|
|
||||||
- `docs/freeholders/` — Four Freeholder signals, Bayesian Standing, Stands/Guilds, Councils/Voice, Bonds, Partner spectrum.
|
|
||||||
- `docs/shared/` — Six Principles, Bread Scale, Storage pools, Watchers/Mirror, Lexicon glossary, Vision overview.
|
|
||||||
- `docs/reference/` — architecture index, component map.
|
|
||||||
- **REQ-012 firewall extension** — extend the lexicon meta-test to scan `README.md` + `docs/**/*.md` (new sibling `lexicon_meta_docs_test.go`), so the docs site is durably lexicon-clean. This is a `feat/test` phase.
|
|
||||||
|
|
||||||
### Milestone Type
|
|
||||||
Feature (Bearers phases are feat; docs phases are docs/test). Phase 0 → `v0.2.0`; execution phases `v0.2.1..v0.2.5`; final phase patch `v0.2.6` IS the milestone release. No separate minor tag.
|
|
||||||
|
|
||||||
### Out of Scope (v0.3)
|
|
||||||
- Live chain launch / real IBC channels / real bearer transports (D-020 pattern continues)
|
|
||||||
- DEX integration runtime, full Hub API B2B suite runtime (types only in v0.3)
|
|
||||||
- Yield Token, Travel + 11 service categories (ROADMAP Phase 4)
|
|
||||||
- i18n / versioning in MkDocs (single-language v0.3)
|
|
||||||
- Cover Pool seniority mechanics (still deferred per PROJECT.md Q7)
|
|
||||||
|
|
||||||
### Prior Milestones
|
|
||||||
- v0.1 — OpenYield Foundation Init (COMPLETE; pre-MVP foundation skeleton; released as v0.0.9)
|
|
||||||
- v0.2 — The Mesh (COMPLETE; skeleton + tests; released as v0.1.5)
|
|
||||||
|
|
||||||
## Clarification Decisions (Phase 0 — CLARIFY, autonomy=full)
|
## Clarification Decisions (Phase 0 — CLARIFY, autonomy=full)
|
||||||
|
|
||||||
@@ -238,72 +108,4 @@ Auto-decided defaults logged per clarify workflow Step 4 (full autonomy → acce
|
|||||||
| D-030 | **Forex Engine v1**: Forex pair type + rate-oracle interface + stub keeper; no live oracle integration | Live oracle integration depends on external partners (Piers), Phase 3. | 0.80 | [live oracle integration] |
|
| D-030 | **Forex Engine v1**: Forex pair type + rate-oracle interface + stub keeper; no live oracle integration | Live oracle integration depends on external partners (Piers), Phase 3. | 0.80 | [live oracle integration] |
|
||||||
| D-031 | **Phase ordering** follows ARCHITECTURE.md blocker chain: P1 Orgs+Window foundation → P2 Pacts+Partners → P3 Councils+Forex → P4 Bonds+Bearers+L2. The final phase (P5) is review/ship. | Respects dependency graph; vertical slices keep each phase independently shippable. | 0.80 | [different wave ordering] |
|
| D-031 | **Phase ordering** follows ARCHITECTURE.md blocker chain: P1 Orgs+Window foundation → P2 Pacts+Partners → P3 Councils+Forex → P4 Bonds+Bearers+L2. The final phase (P5) is review/ship. | Respects dependency graph; vertical slices keep each phase independently shippable. | 0.80 | [different wave ordering] |
|
||||||
| D-032 | **Lexicon** enforced project-wide; all new modules must pass the lexicon assertion test (no banned terms). Non-negotiable. **Note (G-002)**: lexicon assertion tests are NEW in v0.2 — v0.1 is lexicon-clean in practice but has NO lexicon test firewall. v0.2 introduces the firewall (scaffolded in P1 per G-004, extended in P5). | REQ-012 is `All` phases. | 1.00 | [—] |
|
| D-032 | **Lexicon** enforced project-wide; all new modules must pass the lexicon assertion test (no banned terms). Non-negotiable. **Note (G-002)**: lexicon assertion tests are NEW in v0.2 — v0.1 is lexicon-clean in practice but has NO lexicon test firewall. v0.2 introduces the firewall (scaffolded in P1 per G-004, extended in P5). | REQ-012 is `All` phases. | 1.00 | [—] |
|
||||||
| D-033 | **Test coverage target**: ≥80% on new keeper/type packages. v0.1 baseline = **53 tests across 11 test files** (corrected per G-001; not 48). Add lexicon assertion to each new module's test file. | Consistency with v0.1 quality bar (53 tests verified); lexicon drift is the highest-severity regression. | 0.85 | [lower coverage bar] |
|
| D-033 | **Test coverage target**: ≥80% on new keeper/type packages. v0.1 baseline = **53 tests across 11 test files** (corrected per G-001; not 48). Add lexicon assertion to each new module's test file. | Consistency with v0.1 quality bar (53 tests verified); lexicon drift is the highest-severity regression. | 0.85 | [lower coverage bar] |
|
||||||
|
|
||||||
### v0.3 Clarification Decisions (Phase 0 — CLARIFY, autonomy=full)
|
|
||||||
|
|
||||||
Auto-decided defaults logged per clarify workflow Step 4 (full autonomy → accept defaults, log decisions).
|
|
||||||
|
|
||||||
| ID | Decision | Rationale | Confidence | Alternatives |
|
|
||||||
|----|----------|-----------|------------|--------------|
|
|
||||||
| D-034 | **v0.3 milestone bundles Bearers skeleton (D-020 pattern) + docs deliverable** under one feature milestone, rather than two separate NFR+feature milestones. Bearers phases are `feat`; docs phases are `docs`/`test`. Tags run on `v0.2.x`. | User request (--ideate) is docs-only but ROADMAP Phase 3 (Bearers) is the next queued feature work; bundling keeps the milestone cadence and avoids an NFR-only milestone that would not advance the protocol. Feature type because Bearers phases are feat. | 0.82 | [separate v0.3 docs NFR + v0.4 Bearers feature; or docs as patches on v0.2 line] |
|
|
||||||
| D-035 | **Bearers skeleton continues the D-020 skeleton+tests pattern** (Go types + keeper stubs + invariant tests; no live chain, no real IBC channels, no real bearer transports). Live runtime for any Bearers component deferred to v0.4+. | v0.1/v0.2 both shipped skeleton-first; v0.3 stays consistent. Live runtime needs Watchers + Root Basket backing (Year 3 target). | 0.85 | [fuller keeper implementations in v0.3] |
|
|
||||||
| D-036 | **REQ-010 Exit layer**: skeleton = `x/exit` (ExitRoute, DEXSwap types) + `x/bridge` (L2↔L1 bridge types, BridgeStatus enum). No live DEX integration. REQ-010 promoted from v0.1 Skeleton → v0.3 fuller skeleton (two packages instead of one). | Exit runtime needs Anchor partners + L2 bridges; v0.3 lands the typed shape. | 0.80 | [single x/exit package, defer all exit to v0.4] |
|
|
||||||
| D-037 | **REQ-022 Bearers OY-SAT + OY-QR**: extend `x/bearers/types` with `OYSAT` + `OYQR` bearer transport types (BearerTransport interface already in v0.2). No hardware/RF runtime. D-029 pattern continued. | Hardware integration is not a software deliverable; v0.3 completes the 6-bearer type set (v0.2 had 4: Internet/OY-BLE/OY-WiFi-Direct + OY-LR/Beacon). | 0.82 | [real bearer runtime, defer OY-SAT/OY-QR to v0.4] |
|
|
||||||
| D-038 | **REQ-023 Anchors**: extend `x/partner/types` with `Anchor` tier credential types (REQ-018 had the 4-tier enum; v0.3 adds Anchor-specific credential fields). No live institutional onboarding. | Anchors need Watchers + Hub API backing; v0.3 lands the credential shape. | 0.78 | [separate x/anchor module, defer Anchors to v0.4] |
|
|
||||||
| D-039 | **REQ-024 Hub API**: new `x/hub` module — custody, lending-primitive, compliance type stubs (HubService enum + per-service structs). No live B2B runtime. Full Hub API B2B suite deferred to v0.4. | Hub API needs Anchors + Watchers; v0.3 lands the typed scaffold. | 0.80 | [full Hub API runtime in v0.3] |
|
|
||||||
| D-040 | **REQ-025 Services**: new `x/services` module — Care/SIM/Vault/Mail service type stubs (ServiceKind enum + per-service structs). No live services. | Services are operational, not protocol-level; v0.3 lands the typed shape. | 0.78 | [full services runtime in v0.3] |
|
|
||||||
| D-041 | **REQ-026 Bond market depth**: extend `x/bond/types` with GrowthBond type + secondary-market order types. 8% cap / 0% floor consts (D-028) unchanged. Full secondary-market matching deferred to v0.4. | v0.2 shipped first issuance; v0.3 adds depth types without a live matching engine. | 0.80 | [full bond market in v0.3] |
|
|
||||||
| D-042 | **Docs deliverable (REQ-027)**: repo-root `README.md` + MkDocs Material site (`mkdocs.yml` + `docs/`). `mkdocs.yml` at repo root; `docs/` organized by audience: `docs/nomads/`, `docs/freeholders/`, `docs/shared/`, `docs/reference/`. Build-only Python dep (mkdocs + material); `go.mod` stays zero-dep. | User chose MkDocs Material + audience organization. MkDocs is Markdown-native, lightest toolchain; build-only dep does not affect Go modules (G-006). | 0.85 | [Hugo, Docusaurus, plain Markdown no generator] |
|
|
||||||
| D-043 | **REQ-028 lexicon firewall extension**: new sibling test `lexicon_meta_docs_test.go` (package `lexicon_meta_docs`) scanning `README.md` + `docs/**/*.md` for the 10 banned terms, using the same `lexicon.FindBannedTerm` + word-boundary regex. Self-exclusion + fragment pattern preserved. `.ciagent/` files are NOT scanned (they are firewall meta-files, not user-facing docs). | REQ-012 is `All` phases and docs are user-facing; the firewall must cover docs to be durable. Extending the existing meta-test (not modifying it) preserves v0.2 coverage. | 0.88 | [single combined meta-test scanning both x/ and docs/] |
|
|
||||||
| D-044 | **Phase ordering**: P1 docs foundation + firewall extension → P2 nomads docs → P3 freeholders docs → P4 Bearers skeleton I (exit/bridge/bearers/partner) → P5 Bearers skeleton II (hub/services/bond) → P6 final review/ship. Firewall lands in P1 BEFORE content (P2/P3) so docs are checked as authored. | Firewall-first ensures docs content is lexicon-clean by construction, not by retrofit. Bearers split across P4/P5 keeps each phase independently shippable (vertical slices). | 0.82 | [Bearers first then docs, or all docs in one phase] |
|
|
||||||
| D-045 | **Docs depth per audience**: each audience section (nomads, freeholders) gets 5-8 Markdown pages covering its core REQs (nomads: Reach/Stash/bearers/Maps-Pay/Pacts/standing-basics; freeholders: 4 signals/Bayesian Standing/Stands-Guilds/Councils-Voice/Bonds/Partner spectrum). `docs/shared/` gets 5-6 concept pages. `docs/reference/` gets architecture index + component map. Total ~20-25 pages. | Enough depth to be a real docs site, not a placeholder; bounded to keep P1-P3 phases shippable. | 0.80 | [deeper (40+ pages), shallower (10 pages)] |
|
|
||||||
| D-046 | **No docs-site publishing CI in v0.3** — `mkdocs.yml` is buildable locally (`mkdocs serve` / `mkdocs build`); CI publishing to GitHub Pages/Gitea Pages is deferred to v0.4. v0.3 ships the source + a build invocation in the README. | Publishing CI needs deployment secrets + a hosting target; v0.3 lands the content. | 0.82 | [include publishing CI in v0.3] |
|
|
||||||
|
|
||||||
### Ideation outcome (Phase 0 — IDEATE stage, autonomy=full)
|
|
||||||
|
|
||||||
IDEATE stage ratified 8 ideas (IDEATE-01..IDEATE-08) at full autonomy, mapped to REQ-010/REQ-022..REQ-028. Docs deliverable (IDEATE-01/02) is the user's `--ideate` request; Bearers ideas (IDEATE-03..08) are the ROADMAP Phase 3 subset. Three ideation tiers ran (mechanical, backend-enriched, cross-project); mechanical tier found no `lessons:`/`compound:` tags in v0.1/v0.2 history (convention unused) and v0.2 closed clean (9/9 REQs, 303 tests, ≥95.9% coverage). Defaults accepted per full autonomy; traceability recorded in `.ciagent/oy/REQUIREMENTS.md` (IDEATE Traceability section).
|
|
||||||
|
|
||||||
### v0.4 Clarification Decisions (Phase 0 — CLARIFY, autonomy=full)
|
|
||||||
|
|
||||||
Auto-decided defaults logged per clarify workflow Step 4 (full autonomy → accept defaults, log decisions). v0.4 is a refinement-only NFR milestone (no `--ideate` flag this run; scope pre-seeded from v0.3 forward-references). The D-001 refinement-only filter governs scope eligibility.
|
|
||||||
|
|
||||||
| ID | Decision | Rationale | Confidence | Alternatives |
|
|
||||||
|----|----------|-----------|------------|--------------|
|
|
||||||
| D-047 | **v0.4 milestone type = NFR** (all phases refactor/test/quality/chore). Zero `feat:` phases by construction. Tags run on the `v0.3.x` patch line: P0 → `v0.3.0`, P1..P3 → `v0.3.1..v0.3.3`, final phase P4 → `v0.3.4` (milestone release). No separate minor tag. | The candidate work set (REQ-029..REQ-032) is entirely refactor/test/quality/chore. Promoting any Bearers skeleton to live runtime would be `feat:` and is deferred to v0.5+. | 0.90 | [feature milestone promoting v0.3 skeletons to live runtime] |
|
|
||||||
| D-048 | **REQ-029 lexicon shared helper**: add `lexicon.SyntheticBannedStrings() []string` to the `lexicon` package; both `lexicon_meta_test.go` and `lexicon_meta_docs_test.go` consume it instead of duplicating their own synthetic self-test tables. Both already assert `len(terms) == 10` from `lexicon.BannedTerms()` (G-014 minimum met); the helper closes the drift risk fully. | GRILL G-014 binding fix. Single source of truth for synthetic banned strings; a future banned-term addition updates both firewalls from one place. Refactor+test (NFR-eligible). | 0.88 | [cross-reference comment only (G-014 minimum)] |
|
|
||||||
| D-049 | **REQ-030 cross-package const-equality test**: new test file `x/hub/types/cross_const_test.go` (package `types`) that imports `x/bond/types` (test-only, G-003 exempt) and asserts `hub.LendingCouponCapBps == bond.CouponCapBps` and `hub.LendingCouponFloorBps == bond.CouponFloorBps`. Test-only import does not violate G-003 (production-import firewall). | REVIEW.md P2 / A-304. Catches silent mission-lock drift between hub LOCAL consts and bond D-028 consts. Test (NFR-eligible). | 0.85 | [document manual-sync requirement in ARCHITECTURE.md only] |
|
|
||||||
| D-050 | **REQ-031 lifecycle type shape-divergence review scope = DOCUMENT only, no code shape changes**. AUDIT §193 P1-1 (council Proposal/VoteOption absent) and P1-2 (SignalKind 4 vs 5 sources) are `feat:`-class additions (new enum types / locked-const shape changes) and are REJECTED by the D-001 refinement-only filter. v0.4 REQ-031 ships an ARCHITECTURE.md section documenting the divergence decisions (P1-2 defensible per AUDIT code rationale; P1-1 deferred to v0.5+ governance runtime) + a test asserting the current `SignalKindCount==4` locked-const shape is intentional (regression guard, not a shape change). | Adding Proposal/VoteOption enums is `feat:`; changing SignalKind 4→5 is a locked-const change. Both are out-of-scope for an NFR milestone. Documentation + a regression-guard test are NFR-eligible. | 0.82 | [add Proposal/VoteOption enums (feat:, deferred to v0.5+)] |
|
|
||||||
| D-051 | **REQ-032 docs build CI = Gitea Actions workflow** at `.gitea/workflows/docs-build.yml` running `go test ./...` (lexicon firewall) + `mkdocs build` on every push; upload `site/` as a CI artifact. Full Gitea Pages publishing is deferred (no hosting target configured in v0.4). The workflow file itself is a `chore` (config, not feature). | D-046 forward-reference. `.github/workflows/` does not exist; Gitea Actions uses `.gitea/workflows/`. Build+artifact CI is `chore` (NFR-eligible); full Pages publish needs a hosting target (deferred). | 0.80 | [include full Gitea Pages publish (needs hosting target + secrets)] |
|
|
||||||
| D-052 | **Phase ordering** (provisional, planner finalizes): P1 lexicon hardening (REQ-029 + REQ-030 — same `lexicon`/test territory, vertical slice) → P2 lifecycle divergence documentation + regression guard (REQ-031) → P3 docs build CI (REQ-032) → P4 final review + audit + milestone ship. Each phase independently shippable; P1 lands the firewall durability fixes first (highest-severity regression risk). | P1 bundles the two lexicon/const firewall fixes (same territory); P2 is documentation+test; P3 is CI config. Vertical slices. | 0.80 | [different wave ordering] |
|
|
||||||
| D-053 | **No IDEATE stage in v0.4** (no `--ideate` flag this run). The NFR scope was pre-seeded from v0.3 forward-references and ratified at CLARIFY. If `--ideate` is passed on a later v0.4 run, the D-001 refinement-only filter applies. | run.md §IDEATE is conditional on `--ideate`. This invocation has no `--ideate`. | 1.00 | [run IDEATE anyway] |
|
|
||||||
|
|
||||||
## Clarification Decisions (Phase 0 v0.5 — CLARIFY, autonomy=full)
|
|
||||||
|
|
||||||
Auto-decided defaults logged per clarify workflow Step 4 (full autonomy → accept defaults, log decisions). No `--ideate` flag this run; v0.5 scope is pre-seeded from PROJECT.md v0.4 out-of-scope + AUDIT §193 P1-1 + D-050 and ratified at CLARIFY.
|
|
||||||
|
|
||||||
| ID | Decision | Rationale | Confidence | Alternatives |
|
|
||||||
|----|----------|-----------|------------|--------------|
|
|
||||||
| D-054 | **"Runtime" = simtest-grade keeper message handlers + end-to-end flows, NOT mainnet.** v0.5 ships executable keeper behavior (MsgServer handlers, keeper Set/Get/Remove, simtest `simtest`-package flows) for the v0.3 Bearers modules. No live chain launch, no real IBC channels, no real bearer transports, no real institutional onboarding (D-020 pattern continues to govern network deployment). | v0.3 skeletons are types + keeper stubs + invariant tests. The next increment is message handlers + simtest, which is the Cosmos-SDK standard pre-mainnet step. Mainnet deployment is a Year-3+ operational concern (Watchers + Root Basket backing required). | 0.88 | [full mainnet launch in v0.5; types-only with no handlers (stalls progress)] |
|
|
||||||
| D-055 | **Cosmos SDK dependency is GRILL-approved for v0.5.** `go.mod` gains `github.com/cosmos/cosmos-sdk` (and transitive deps) as the runtime substrate for keeper MsgServer handlers, `types.Msg`, `sdk.Context`, store, and simtest. This is a controlled exception to G-006 (zero-dep go.mod), escalated to GRILL for binding ratification. The exception is scoped to runtime promotion phases (P1..P7); P0 and the final phase remain dep-neutral where possible. | v0.3 skeletons used stub `keeper.go` files that already import cosmos-sdk (see LSP errors on `x/watcher/keeper/keeper.go` — pre-existing imports). Promoting to runtime makes the dependency load-bearing rather than stub-only. G-006's intent (zero-dep for skeleton durability) is preserved by isolating the dep to runtime phases and keeping types/invariants dep-free. | 0.80 | [stay zero-dep, hand-roll keeper store + message types (duplicates SDK, high risk); defer all runtime to v0.6+ (stalls)] |
|
|
||||||
| D-056 | **Phase ordering** (provisional, planner finalizes): P1 Exit+Bridge runtime (REQ-033, Layer 3 — outermost edge, fewest internal deps) → P2 Bearers transport runtime (REQ-034, depends on exit for off-mesh routing) → P3 Anchors runtime (REQ-035, depends on partner + bearers) → P4 Hub API runtime (REQ-036, depends on anchors for custody backing) → P5 Services runtime (REQ-037, depends on hub) → P6 Bond market runtime (REQ-038, depends on hub lending primitive) → P7 Council governance runtime (REQ-039, cross-cutting, lands last) → P8 final review + audit + milestone ship. Each phase independently shippable; P1 lands the outermost edge first (lowest internal coupling). | The dependency chain is outer→inner: exit needs nothing internal; bearers routes through exit; anchors ride bearers; hub custody backs anchors; services sit on hub; bond matching uses hub lending; governance is cross-cutting. Vertical slices, each phase shippable. | 0.82 | [governance-first; bond-first; single mega-phase] |
|
|
||||||
| D-057 | **Bond matching engine = central-limit order book (CLOB) with the 8% cap / 0% floor consts (D-028) as hard clamp on each match.** No AMM (constant-product or otherwise) in v0.5; AMM is a Year-4 Maturity concern. The CLOB matches Growth Bond bids/offers at the locked coupon cap; secondary-market trades clear at market price but the bond's *coupon* stays within the mission-locked band. REQ-038 ships the matching handler + simtest; live market depth deferred. | CLOB is the standard secondary-market primitive; AMM is for spot/swaps (Exit layer's DEX, deferred). The mission-lock clamp (D-028) is a per-match invariant, not a market-wide cap. CLOB lets the cap be enforced per-match. | 0.80 | [AMM (wrong fit for coupon-bearing bonds); batch auction (deferred to Maturity)] |
|
|
||||||
| D-058 | **Hub custody model = key-share abstraction (MPC-via-interface, not a concrete HSM/MPC vendor).** `x/hub` custody handlers expose a `CustodyKeyring` interface with `Sign`/`Derive` methods; v0.5 ships an in-memory test-only implementation. Real MPC/HSM backing is deferred (operational, Year 3+). This keeps v0.5 dep-neutral w.r.t. custody vendors while landing the handler surface. | Custody key management is operational, not protocol-level. An interface + test impl lets runtime handlers be exercised in simtest without committing to a vendor. GRILL reviews the interface boundary. | 0.78 | [commit to a specific MPC vendor (premature); hand-roll shamir (out of scope)] |
|
|
||||||
| D-059 | **IBC packet scope = the 5 L2 chains already in the v0.2 skeleton** (Polygon, Base, Arbitrum, Optimism, Solana per REQ-009/`x/satellite`). v0.5 `x/bridge` handlers implement IBC packet recv/ack for these 5 chains' `BridgeStatus` transitions. No new L2 chains in v0.5. Solana IBC uses the wormhole-style bridge adapter (already stubbed in `x/bridge` per D-021). | The 5 L2 chains are the locked-const set (REQ-009). Adding new chains is a Year-4 concern. Solana IBC was a v0.1 deferred item (D-021) now promoted. | 0.82 | [add 3+ new L2 chains (Year 4); defer Solana IBC again (stalls)] |
|
|
||||||
| D-060 | **Council governance shape (AUDIT §193 P1-1)**: add `Proposal` and `VoteOption` enum types to `x/council/types` (currently absent per AUDIT). `ProposalKind` enum = {Stand, Guild, Mesh, MissionLockAmendment-Rejected} (Mission Lock non-amendable → the enum value exists but the handler rejects it; documents the non-amendability in code). `VoteOption` enum = {Yes, No, Abstain, Veto} (Veto = Watcher-only, quorum rule). SignalKind stays at 4 sources (P1-2 defensible per AUDIT; expansion deferred to v0.6+ governance vote). Mission Lock const firewall (G-003) intact. | AUDIT P1-1 flagged the absence as a divergence. Adding the enums is `feat:` (deferred from v0.4 by D-001). P1-2 (SignalKind 4→5) is a locked-const change rejected by the audit rationale, so it stays at 4. | 0.82 | [add SignalKind 5th source (locked-const change, rejected); defer Proposal/VoteOption again (stalls)] |
|
|
||||||
| D-061 | **No IDEATE stage in v0.5** (no `--ideate` flag this run). The feature scope was pre-seeded from PROJECT.md v0.4 out-of-scope + AUDIT §193 P1-1 + D-050 and ratified at CLARIFY. The D-001 refinement-only filter does NOT apply (v0.5 is a feature milestone, not NFR). | run.md §IDEATE is conditional on `--ideate`. This invocation has no `--ideate`. | 1.00 | [run IDEATE anyway] |
|
|
||||||
|
|
||||||
## Clarification Decisions (Phase 0 v0.6 — CLARIFY, autonomy=full)
|
|
||||||
|
|
||||||
Auto-decided defaults logged per clarify workflow Step 4 (full autonomy → accept defaults, log decisions). `--ideate` flag IS present this run; v0.6 is the project's first UI milestone. The D-001 refinement-only filter does NOT apply (v0.6 is a feature milestone). User-validated stack choices recorded via interactive questions: Go `html/template` + HTMX (frontend stack), Go mock API server (mock data layer), all 5 screens (Reach signup, Stash dashboard, Window authorization, Standing + Freeholder signals, Bloom accrual), new top-level `web/` dir (UI code location).
|
|
||||||
|
|
||||||
| ID | Decision | Rationale | Confidence | Alternatives |
|
|
||||||
|----|----------|-----------|------------|--------------|
|
|
||||||
| D-066 | **Frontend stack = Go `html/template` + HTMX.** HTMX is a single vendored JS file served as a static asset — no node toolchain, no `package.json`, no build step. Go `html/template` is stdlib. **G-006 (zero-dep) is preserved** — this is the decisive factor vs. a React/Svelte SPA. Sufficient for Reach/Stash/Window/Standing/Bloom screens (progressive enhancement over server-rendered HTML). Weakest for rich dashboards, but adequate for an MVP prototype. | User-validated. Project has a strong zero-dep ethos (G-006); v0.5 took a controlled G-006 exception for cosmos-sdk only after GRILL ratification. A node toolchain + `package.json` would be a far larger exception for a UI MVP that can be served by stdlib + one vendored JS file. | 0.88 | [React/Vite SPA (adds node toolchain, breaks Go-only convention); SvelteKit (same tradeoff); pure static HTML/CSS/vanilla JS (most fragile)] |
|
|
||||||
| D-067 | **Mock data layer = Go HTTP server in `web/` instantiating real `x/*/types` structs.** New top-level `web/` dir holds `main.go`, HTTP handlers, an in-memory mock store seeded from fixtures, and `static/` + `templates/`. The mock store imports `x/identity/types`, `x/stash/types`, `x/window/types`, `x/standing/types`, `x/bread/types`, `x/bloom/types` and populates them with test values. **No keeper, no Cosmos runtime, no `app.go`** (none exists in the repo). This grounds the UI in the actual locked data shapes (Reach, Stash, Window, FreeholderSignals, BloomRecord) — the UI does not exercise a chain but does exercise the real Go type definitions. | User-validated. The four modules the Nomad UI primarily surfaces (identity, stash, window, standing) are types-only skeletons with no keeper/MsgServer. A Go mock server reuses the type definitions as the source of truth, so the UI is grounded in the locked constants (GrainsPerBread=10000, MaturityThresholdDays=90, standing formula) rather than mirroring them in TS/JSON. | 0.85 | [frontend-only TS/JSON fixtures (UI would not exercise any Go code path); Go mock API + in-memory keepers (more code, premature)] |
|
|
||||||
| D-068 | **UI code location = new top-level `web/` dir.** Clean separation from `x/` protocol modules; does not touch the `go.mod` module path; does not pretend to be a Cosmos module. `web/` contains `main.go` (or `cmd/oyd-ui/main.go`), handlers, mock store, fixtures, `static/`, `templates/`. | User-validated. The Mesh Experience component is ROADMAP Phase 2, not a v0.6 deliverable; coupling the UI to Cosmos module conventions (a new `x/meshexperience`) is premature. A top-level `web/` dir matches the project's existing convention of non-`x/` top-level dirs (`docs/`, `lexicon/`, `lexicon_meta_docs/`). | 0.90 | [new `x/meshexperience` Cosmos module (couples UI to Cosmos conventions prematurely); `cmd/oyd-ui` + `web/` split (more files, clearer build)] |
|
|
||||||
| D-069 | **Lexicon firewall extension to `web/`.** REQ-012 currently scans `x/` + `docs/`. A new sibling meta-test `lexicon_meta_web_test.go` (package `lexicon_meta_web`) scans `web/templates/**/*.html` + `web/static/**/*.js` for the 10 banned terms, using the same `lexicon.FindBannedTerm` + word-boundary regex. Self-exclusion + fragment pattern preserved. **"Sign up" maps to "Create a Reach"** — the word "account" is banned (REQ-012). Firewall-first: lands in P1 before content (P2..P5) so UI strings are lexicon-clean by construction. | REQ-012 is `All` phases and UI strings are user-facing; the firewall must cover the UI to be durable. Extending the existing meta-test pattern (not modifying it) preserves v0.2/v0.3 coverage. Firewall-first (D-044 pattern) ensures UI content is lexicon-clean by construction, not by retrofit. | 0.88 | [skip (REQ-012 is All phases); single combined meta-test scanning x/ + docs/ + web/ (loses isolation)] |
|
|
||||||
| D-070 | **G-003 firewall scope: `web/` importing `x/*/types` is app-layer consumption, not a cross-`x/` production import.** G-003 (production import firewall) prohibits production struct imports across `x/<module>/types` packages. `web/` is not an `x/` module — it is the application layer that consumes protocol types, exactly as a future `cmd/oyd` would. The G-003 firewall stays intact: no `x/` module gains a production import of another `x/` module's types via `web/`. GRILL reviews this boundary. | G-003's intent is to prevent cross-module coupling inside the protocol layer. The application layer consuming types is the intended consumption direction. `web/` importing `x/identity/types` is no different from `cmd/oyd` importing it (when one exists). | 0.85 | [treat `web/` as an `x/` module (wrong — it is not protocol); forbid `web/` from importing `x/*/types` (would force TS/JSON fixtures, losing the grounding in locked constants)] |
|
|
||||||
| D-071 | **"Sign up" = create a Reach + open a Stash atomically.** The Nomad entry path per `docs/nomads/reach.md` is "a Nomad starts with a Reach and a Stash". The signup form creates both atomically: a `Reach` with `IsNomad=true` + a `Stash` with `HolderID` matching the Reach's `HolderID` and `BalanceGrain` seeded to a test value (e.g., 500,000 Grain = 50 Bread). No KYC, no custodian (REQ-001 self-service principle). The UI labels this "Create a Reach" (lexicon-clean; "account" is banned). | The docs define the Nomad starting state as Reach + Stash. Creating only a Reach would leave the Nomad unable to view a Stash dashboard (P2) — the atomic creation matches the docs and makes the happy path contiguous. | 0.82 | [create Reach only, defer Stash creation to a separate flow (fractures the happy path); create Reach + Stash + Window all at signup (over-scope for an MVP)] |
|
|
||||||
| D-072 | **Phase ordering** (provisional, planner finalizes): P1 Web foundation + Reach signup + lexicon firewall extension (REQ-040 + REQ-045 — same `web/` territory, vertical slice, firewall-first) → P2 Stash dashboard (REQ-041, depends on Reach existing) → P3 Window authorization (REQ-042, depends on Stash existing) → P4 Standing + Freeholder signals (REQ-043, depends on Reach existing) → P5 Bloom accrual (REQ-044, depends on Stash existing) → P6 final review + audit + milestone ship. Each phase independently shippable; P1 lands the foundation + firewall first (lexicon-clean by construction). | P1 bundles the web foundation + Reach signup + the firewall extension (same `web/` territory, vertical slice). P2..P5 each add one screen, ordered by the Nomad happy path (Reach → Stash → Window → Standing → Bloom). Vertical slices, each phase shippable. | 0.82 | [different wave ordering; bundle Stash + Window in one phase] |
|
|
||||||
| D-073 | **Bread-scale source of truth = `x/bread/types` code constants, NOT `docs/shared/bread-scale.md`.** The code constants (`GrainsPerBread=10000`, `BreadScaleAll()` table) are the locked, tested values; the docs table is aspirational/outdated (states 1,000× ratios that do not match the code). The UI uses the code constants for all Bread-scale conversions. A doc-fix for `docs/shared/bread-scale.md` is flagged as a P1+ follow-up (not a v0.6 deliverable — docs were a v0.3 deliverable; this is a doc-drift fix, not a UI feature). | The code constants are tested (`x/bread/types/types_test.go` asserts them); the docs are not. Using the code as the source of truth keeps the UI consistent with the protocol layer. | 0.90 | [use the docs table (wrong — not tested, disagrees with code); fix the docs in v0.6 (out of scope — doc-drift fix, not a UI feature)] |
|
|
||||||
+9
-165
@@ -10,164 +10,19 @@
|
|||||||
| REQ-006 | Standing anti-gaming formula | §9.2 | High | Complete | P6 |
|
| REQ-006 | Standing anti-gaming formula | §9.2 | High | Complete | P6 |
|
||||||
| REQ-007 | FCFS processing | §15 | High | Complete | P7 |
|
| REQ-007 | FCFS processing | §15 | High | Complete | P7 |
|
||||||
| REQ-008 | OY Chain (Layer 1) | §7 | High | Skeleton | P1 |
|
| REQ-008 | OY Chain (Layer 1) | §7 | High | Skeleton | P1 |
|
||||||
| REQ-009 | Satellite chains (Layer 2) | §7 | Medium | Skeleton | v0.2/P4 |
|
| REQ-009 | Satellite chains (Layer 2) | §7 | Medium | Pending | Future |
|
||||||
| REQ-010 | Exit layer (Layer 3) | §7 | Medium | Skeleton | P8 |
|
| REQ-010 | Exit layer (Layer 3) | §7 | Medium | Skeleton | P8 |
|
||||||
| REQ-011 | Three Councils with Mission Lock | §19 | High | Skeleton | v0.2/P3 |
|
| REQ-011 | Three Councils with Mission Lock | §19 | High | Pending | Future |
|
||||||
| REQ-012 | Lexicon compliance | §3 | High | Complete | All |
|
| REQ-012 | Lexicon compliance | §3 | High | Complete | All |
|
||||||
| REQ-013 | Bread unit with scale | §4 | High | Complete | P2 |
|
| REQ-013 | Bread unit with scale | §4 | High | Complete | P2 |
|
||||||
| REQ-014 | Three pools of storage | §5 | High | Complete | P3 |
|
| REQ-014 | Three pools of storage | §5 | High | Complete | P3 |
|
||||||
| REQ-015 | Window primitive | §10 | High | Skeleton | v0.2/P1 |
|
| REQ-015 | Window primitive | §10 | High | Pending | Future |
|
||||||
| REQ-016 | Nine Stand types | §11 | Medium | Skeleton | v0.2/P1 |
|
| REQ-016 | Nine Stand types | §11 | Medium | Pending | Future |
|
||||||
| REQ-017 | Guilds with free Hand-Passes | §12 | Medium | Skeleton | v0.2/P1 |
|
| REQ-017 | Guilds with free Hand-Passes | §12 | Medium | Pending | Future |
|
||||||
| REQ-018 | Four-tier Partner Spectrum | §13 | Medium | Skeleton | v0.2/P2 |
|
| REQ-018 | Four-tier Partner Spectrum | §13 | Medium | Pending | Future |
|
||||||
| REQ-019 | Six bearers via Unified Bearer Layer | §14 | Medium | Complete | P7 |
|
| REQ-019 | Six bearers via Unified Bearer Layer | §14 | Medium | Complete | P7 |
|
||||||
| REQ-020 | Six Pacts | §16 | Medium | Skeleton | v0.2/P2 |
|
| REQ-020 | Six Pacts | §16 | Medium | Pending | Future |
|
||||||
| REQ-021 | Mesh Bond Market with 8pct cap | §17 | Medium | Skeleton | v0.2/P4 |
|
| REQ-021 | Mesh Bond Market with 8pct cap | §17 | Medium | Pending | Future |
|
||||||
| Bearers OY-LR + Beacon | (vision §14) | §14 | Medium | Skeleton | v0.2/P4 |
|
|
||||||
| Forex Engine v1 | (vision §13) | §13 | Medium | Skeleton | v0.2/P3 |
|
|
||||||
|
|
||||||
## v0.3 Milestone Requirements (Bearers & Documentation)
|
|
||||||
|
|
||||||
| ID | Requirement | Vision § | Priority | Status | Phase |
|
|
||||||
|----|-------------|----------|----------|--------|-------|
|
|
||||||
| REQ-010 | Exit layer (Layer 3) — DEX swaps, bridges, off-mesh services | §7 | Medium | Skeleton | v0.3/P4 |
|
|
||||||
| REQ-022 | Bearers expansion: OY-SAT + OY-QR bearer transports | §14 | Medium | Skeleton | v0.3/P4 |
|
|
||||||
| REQ-023 | Anchors — first institutional Partner tier | §13 | Medium | Skeleton | v0.3/P4 |
|
|
||||||
| REQ-024 | Hub API — B2B backbone: custody, lending primitive, compliance | §13 | Medium | Skeleton | v0.3/P5 |
|
|
||||||
| REQ-025 | Services — Care / SIM / Vault / Mail | §13 | Medium | Skeleton | v0.3/P5 |
|
|
||||||
| REQ-026 | Bond market depth — Growth Bonds + secondary market | §17 | Medium | Skeleton | v0.3/P5 |
|
|
||||||
| REQ-027 | README.md + docs site in docs/ for nomads and freeholders | (vision §8) | High | Complete | v0.3/P1-P3 |
|
|
||||||
| REQ-028 | Extend REQ-012 lexicon firewall to scan docs/ + README.md | §3 | High | Complete | v0.3/P1 |
|
|
||||||
|
|
||||||
> REQ-022 through REQ-028 are NEW in v0.3 (ratified during Phase 0 IDEATE as
|
|
||||||
> IDEATE-01..IDEATE-07, then assigned final REQ-IDs). REQ-010 is promoted from
|
|
||||||
> v0.1 Skeleton to a fuller v0.3 skeleton.
|
|
||||||
|
|
||||||
## v0.4 Milestone Requirements (Refinement — NFR)
|
|
||||||
|
|
||||||
v0.4 is a refinement-only NFR milestone: zero `feat:` phases. Scope sourced
|
|
||||||
from v0.3 forward-references (REVIEW.md, AUDIT.md §193, GRILL.md G-014).
|
|
||||||
Live-runtime promotions are out of scope (deferred to v0.5+). The D-001
|
|
||||||
refinement-only filter applies to any IDEATE stage.
|
|
||||||
|
|
||||||
| ID | Requirement | Source | Class | Priority | Status | Phase |
|
|
||||||
|----|-------------|--------|-------|----------|--------|-------|
|
|
||||||
| REQ-029 | Lexicon firewall: shared `lexicon.SyntheticBannedStrings()` helper — dedupe the synthetic self-test table between `lexicon_meta_test.go` and `lexicon_meta_docs_test.go`; both meta-tests derive count + strings from the single source so a future banned-term addition updates both firewalls from one place | GRILL G-014 | refactor/test | High | Complete | v0.4/P1 |
|
|
||||||
| REQ-030 | Cross-package const-equality test: `x/hub.LendingCouponCapBps == x/bond.CouponCapBps` (and Floor) — test-only import (G-003 exempt), catches silent mission-lock drift between hub LOCAL consts and bond D-028 consts | REVIEW.md P2 / A-304 | test | High | Complete | v0.4/P1 |
|
|
||||||
| REQ-031 | x/* lifecycle type shape-divergence review + alignment fixes — audit non-must-have lifecycle types across modules flagged by AUDIT §193; align shapes where divergent (no behavioral change) | AUDIT.md §193 | refactor/quality | Medium | Complete | v0.4/P2 |
|
|
||||||
| REQ-032 | Docs build CI — Gitea Actions workflow that runs `go test ./...` (lexicon firewall) + `mkdocs build` on every push; upload the built `site/` as a CI artifact. Full Gitea Pages publishing deferred if no hosting target is configured (chore, not feat) | D-046 | chore/ci | Medium | Complete | v0.4/P3 |
|
|
||||||
|
|
||||||
> REQ-029..REQ-032 are NEW in v0.4. All are NFR classes (refactor/test/quality/
|
|
||||||
> chore) — zero `feat:` phases by construction. The final-phase audit enforces
|
|
||||||
> the NFR purity gate (zero `feat:` commits in the milestone).
|
|
||||||
|
|
||||||
## Milestone v0.4 Summary (Refinement — NFR) — COMPLETE
|
|
||||||
|
|
||||||
- 4 v0.4-scope REQs shipped as NFR (refactor/test/docs/chore): REQ-029, REQ-030, REQ-031, REQ-032
|
|
||||||
- Closes 3 real v0.3 forward-references: GRILL G-014 (lexicon drift), REVIEW P2/A-304 (const drift), AUDIT §193 (council divergence docs)
|
|
||||||
- Lands the D-046 docs-CI forward-reference (.gitea/workflows/docs-build.yml, build+artifact, no Pages publish per D-051)
|
|
||||||
- NFR purity gate GREEN: zero `feat:` commit subjects in the milestone (20 commits, all docs/refactor/test/chore/verify/decision/checkpoint/Merge)
|
|
||||||
- `go.mod` unchanged (G-006 — zero Go deps; Python deps isolated to CI docs-build job)
|
|
||||||
- G-003 production firewall intact (no production import of `x/bond/types` in `x/hub/types`; cross-const test is test-only)
|
|
||||||
- Coverage: x/hub/types 93.3% (v0.3 floor preserved), x/council/types 96.4% (improved); both above 80% target
|
|
||||||
- Tags: v0.3.0 (P0) -> v0.3.1 (P1) -> v0.3.2 (P2) -> v0.3.3 (P3) -> v0.3.4 (P4 = v0.4 milestone release)
|
|
||||||
- Tag-line note: v0.4 (NFR) ships on the v0.3.x patch line (config tag_base). The v0.3.4 milestone release IS the deliverable (D-008 — final phase patch IS the milestone release; no separate minor tag).
|
|
||||||
|
|
||||||
## v0.5 Milestone Requirements (Bearers Runtime — Feature)
|
|
||||||
|
|
||||||
v0.5 promotes the v0.3 Bearers skeletons from type+keeper-stub layers to
|
|
||||||
live runtime behavior (keeper message handlers + simtest-grade end-to-end
|
|
||||||
flows). No live chain launch (D-020 continues to govern network deployment);
|
|
||||||
runtime = keeper handlers + simtest, not mainnet. Sourced from the v0.3/v0.4
|
|
||||||
deferred items (D-050, PROJECT.md v0.4 out-of-scope, ROADMAP Phase 3 runtime).
|
|
||||||
|
|
||||||
| ID | Requirement | Source | Class | Priority | Status | Phase |
|
|
||||||
|----|-------------|--------|-------|----------|--------|-------|
|
|
||||||
| REQ-033 | Exit layer runtime — `x/exit` DEX swap routing + `x/bridge` L2↔L1 IBC packet handlers; promotes REQ-010 from skeleton → runtime (simtest-grade message handlers; live DEX/IBC channels deferred) | PROJECT.md v0.4 OOS / D-050 | feat | High | Complete | v0.5/P1 |
|
|
||||||
| REQ-034 | Bearers transport runtime — OY-SAT + OY-QR bearer transport message handlers in `x/bearers` (extends REQ-019/REQ-022); session lifecycle in simtest (hardware integration deferred) | PROJECT.md v0.4 OOS | feat | Medium | Complete | v0.5/P2 |
|
|
||||||
| REQ-035 | Anchors onboarding runtime — `x/partner` Anchor tier credential issuance + revocation handlers (extends REQ-018/REQ-023); credential lifecycle in simtest (real institutional onboarding deferred) | PROJECT.md v0.4 OOS | feat | Medium | Complete | v0.5/P3 |
|
|
||||||
| REQ-036 | Hub API B2B runtime — `x/hub` custody, lending primitive, compliance message handlers; keeper handlers + simtest (real B2B suite deferred) | PROJECT.md v0.4 OOS | feat | High | Complete | v0.5/P4 |
|
|
||||||
| REQ-037 | Services runtime — `x/services` Care / SIM / Vault / Mail service lifecycle handlers; runtime handlers + simtest (live service integrations deferred) | PROJECT.md v0.4 OOS | feat | Medium | Complete | v0.5/P5 |
|
|
||||||
| REQ-038 | Bond market depth runtime — `x/bond` Growth Bonds + secondary-market matching handlers (extends REQ-021/REQ-026); matching engine + simtest (live market depth deferred) | PROJECT.md v0.4 OOS | feat | High | Complete | v0.5/P6 |
|
|
||||||
| REQ-039 | Council governance runtime — `x/council` Proposal/VoteOption enum types (AUDIT §193 P1-1, deferred from v0.4) + Voice lifecycle handlers; governance message handlers + simtest (Mission Lock const firewall intact per G-003; SignalKind 4→5 expansion deferred to v0.6+) | AUDIT §193 P1-1 / D-050 | feat | Medium | Complete | v0.5/P7 |
|
|
||||||
|
|
||||||
> REQ-033..REQ-039 are NEW in v0.5. All are `feat`-class (runtime promotion
|
|
||||||
> from skeleton). No breaking schema changes; locked-const firewall intact
|
|
||||||
> (Mission Lock non-amendable). The final-phase audit enforces the feature
|
|
||||||
> purity gate (no breaking schema changes; G-003 production firewall intact;
|
|
||||||
> G-006 go.mod unchanged unless a runtime dep is GRILL-approved).
|
|
||||||
|
|
||||||
## Milestone v0.5 Summary (Bearers Runtime — Feature) — COMPLETE
|
|
||||||
|
|
||||||
- 7 v0.5-scope REQs shipped as feature (runtime promotion from skeleton): REQ-033, REQ-034, REQ-035, REQ-036, REQ-037, REQ-038, REQ-039
|
|
||||||
- 8 modules promoted to runtime (keeper MsgServer handlers + simtest-grade end-to-end flows): x/exit, x/bridge, x/bearers, x/partner, x/hub, x/services, x/bond, x/council
|
|
||||||
- cosmos-sdk v0.50.8 + ibc-go v8.2.1 added (D-055/D-062, G-006 controlled exception — scoped to runtime phases; types/ packages stay dep-free)
|
|
||||||
- G-003 production firewall intact (expected_keepers.go interfaces; no production struct imports across x/<module>/types)
|
|
||||||
- Locked-const firewall intact: all v0.1..v0.4 consts unchanged (ExitStatusCount=5, BridgeStatusCount=4, BearerTypeCount=6, OYSATLink.SurveillanceResistant=true, PartnerTierCount=4, HubServiceCount=3, LendingCouponCapBps=800, LendingCouponFloorBps=0, ServiceKindCount=4, CouponCapBps=800, CouponFloorBps=0, CouncilKindCount=3, SignalKindCount=4, MissionLockAmendable=false); v0.5 additions additive (AnchorCredentialStatusCount=4, WatcherVetoQuorum default 6 param-tunable)
|
|
||||||
- 5 GRILL decisions ratified: D-055 (cosmos-sdk dep), D-062 (version pin), D-063 (bond CLOB REJECT above 800bps), D-064 (MissionLockAmendment reject-at-ValidateBasic), D-065 (Watcher Veto quorum default 6)
|
|
||||||
- 8 binding fixes landed: G-017 (NoWithVeto test reconciled), G-018 (go 1.22 build gate), G-019 (ImpliedCoupon helper + boundary test), G-020 (WatcherVetoQuorum bounds [2,9]), G-021 (IBC replay ERROR), G-022 (baseline stubs documented), G-023 (keeper/msg_server.go ownership split), G-024 (types/ tests stdlib-only)
|
|
||||||
- Coverage ≥80% on all 8 keeper packages: x/exit/keeper 85.0%, x/bridge/keeper 82.1%, x/bearers/keeper 91.2%, x/partner/keeper 87.6%, x/hub/keeper 90.0%, x/services/keeper 91.5%, x/bond/keeper 92.5%, x/council/keeper 90.3%
|
|
||||||
- 34 packages green (no regression on v0.1..v0.4 baseline)
|
|
||||||
- Tags: v0.4.0 (P0) -> v0.4.1 (P1) -> v0.4.2 (P2) -> v0.4.3 (P3) -> v0.4.4 (P4) -> v0.4.5 (P5) -> v0.4.6 (P6) -> v0.4.7 (P7) -> v0.4.8 (P8 = v0.5 milestone release)
|
|
||||||
- Tag-line note: v0.5 (feature) ships on the v0.4.x patch line (config tag_base). The v0.4.8 milestone release IS the deliverable (D-008 — final phase patch IS the milestone release; no separate minor tag).
|
|
||||||
- 5 P1+ issues flagged for v0.6+ mainnet-readiness (governance spam deposit, CLOB front-running/batch auction, real IBC light-client simtest, CLOB prefix-key perf, emitMatchEventHook testability)
|
|
||||||
|
|
||||||
## v0.6 Milestone Requirements (Nomad Web UI — Feature)
|
|
||||||
|
|
||||||
v0.6 is the project's first UI milestone. It delivers a working prototype Web
|
|
||||||
UI where a person can sign up to be a Nomad (create a Reach + open a Stash)
|
|
||||||
and exercise basic functionality around the (Reach, Stash) components, plus
|
|
||||||
Window authorization, Standing progress, and Bloom accrual views. All data is
|
|
||||||
generated as test fixtures — no real blockchain interaction (D-020 continues).
|
|
||||||
The UI is a greenfield Go `html/template` + HTMX layer served by a Go mock HTTP
|
|
||||||
server (`web/`) that instantiates the real `x/*/types` structs from in-memory
|
|
||||||
fixtures. No keeper, no Cosmos runtime, no `app.go`.
|
|
||||||
|
|
||||||
| ID | Requirement | Source | Class | Priority | Status | Phase |
|
|
||||||
|----|-------------|--------|-------|----------|--------|-------|
|
|
||||||
| REQ-040 | Nomad Reach signup Web UI — Go HTTP mock server (`web/main.go`, Go 1.22 `net/http.ServeMux`, mock store) + "Create a Reach" form (POST) + Reach list/detail views; grounds the UI in `x/identity/types.Reach`. "Sign up" maps to "Create a Reach" (the word "account" is banned per REQ-012). Signup atomically creates a Reach (`IsNomad=true`) + a Stash (per D-071, Nomad starts with both). | user `--ideate` request + D-066/D-067/D-068/D-071 | feat | High | Complete | v0.6/P1 |
|
|
||||||
| REQ-041 | Stash dashboard Web UI — balance in Grain + Bread-scale conversion (using `x/bread/types.BreadScaleAll()` + `GrainsPerBread=10000`, per D-073 code constants are the source of truth) + 90-day maturity progress bar (`x/stash/types.StashActivity.IsMature`, `MaturityThresholdDays=90`). | user `--ideate` request + D-073 | feat | High | Complete | v0.6/P2 |
|
|
||||||
| REQ-042 | Window authorization Web UI — form to open a Window (scope + duration + rate-limit) delegating to a service, lifecycle view (Open→Active→Revoked/Expired via `x/window/types.Window.Activate/Revoke/Expire`), audit log (`AuditEntry`). | user `--ideate` request | feat | Medium | Complete | v0.6/P3 |
|
|
||||||
| REQ-043 | Standing + Freeholder signals progress Web UI — computed from mock `Rating`/`Vouch`/`Slash` records using the locked constants + `GetStandingBucket`/`ComputeDiversityBonus`/`GetVoucherWeight`; 4-signal progress (`FreeholderSignals.IsFreeholderEligible` — StashMaturity, MultiDomainStanding, CommittedCapital, CommunityEndorsement). | user `--ideate` request | feat | Medium | Complete | v0.6/P4 |
|
|
||||||
| REQ-044 | Bloom accrual Web UI — per-Stash `BloomRecord` view (`AccruedGrain`, `RateBasisPoints`, `LastAccrualBlock`), computed from mock data; shows the 4.5% target rate (`TargetBloomRateBasisPoints=450`). | user `--ideate` request | feat | Low | Complete | v0.6/P5 |
|
|
||||||
| REQ-045 | Extend REQ-012 lexicon firewall to scan `web/templates/**` + `web/static/**` + `web/**/*.go` (new `lexicon_meta_web_test.go`, package `lexicon_meta_web`, subdir `lexicon_meta_web/`). Mirrors the `lexicon_meta_docs` pattern with G-013 walk-coverage + G-009 self-test + G-014 shared `SyntheticBannedStrings()`. Firewall-first: lands in P1 before content (P2..P5). | D-069 + RESEARCH D-075 | test/quality | High | Complete | v0.6/P1 |
|
|
||||||
|
|
||||||
> REQ-040..REQ-045 are NEW in v0.6. REQ-040..REQ-044 are `feat`-class (UI
|
|
||||||
> screens); REQ-045 is `test` (lexicon firewall extension). No breaking schema
|
|
||||||
> changes; G-003 production firewall intact (`web/` is app-layer, not an `x/`
|
|
||||||
> module); G-006 go.mod unchanged (HTMX is a vendored static asset, not a Go
|
|
||||||
> dep). The final-phase audit enforces the feature purity gate.
|
|
||||||
|
|
||||||
## IDEATE Traceability (Phase 0 v0.6 — IDEATE stage, autonomy=full)
|
|
||||||
|
|
||||||
The IDEATE stage ran the three ideation tiers (mechanical, backend-enriched,
|
|
||||||
cross-project) on the v0.6 milestone scope and ratified 6 ideas (IDEATE-09..
|
|
||||||
IDEATE-14) at full autonomy. Each IDEATE-NN maps to a REQ-ID in the v0.6
|
|
||||||
requirements table above. The user pre-validated the 5 screens + stack via
|
|
||||||
interactive questions during CLARIFY (Go html/template + HTMX, Go mock API
|
|
||||||
server, new `web/` dir, all 5 screens); IDEATE ratifies that validation.
|
|
||||||
|
|
||||||
Mechanical tier: v0.5 closed clean (7/7 REQs, 8 keeper packages ≥80% coverage,
|
|
||||||
G-003/locked-const firewalls intact, 5 P1+ flagged for v0.7+ mainnet-readiness);
|
|
||||||
no `lessons:`/`compound:` tags in v0.1..v0.5 history (convention unused).
|
|
||||||
Backend-enriched tier: confirmed the mock-server-over-real-Go-types approach
|
|
||||||
grounds the UI in the locked constants (D-067/D-073). Cross-project tier: no
|
|
||||||
applicable cross-project patterns (this is the project's first UI; no prior UI
|
|
||||||
conventions to inherit). Defaults accepted per full autonomy.
|
|
||||||
|
|
||||||
| IDEATE ID | REQ-ID | Category | Source | Confidence | Phase |
|
|
||||||
|-----------|--------|----------|--------|------------|-------|
|
|
||||||
| IDEATE-09 | REQ-040 | feature/ui | user `--ideate` request + D-066/D-067/D-068/D-071 | 0.92 | v0.6/P1 |
|
|
||||||
| IDEATE-10 | REQ-041 | feature/ui | user `--ideate` request + D-073 | 0.90 | v0.6/P2 |
|
|
||||||
| IDEATE-11 | REQ-042 | feature/ui | user `--ideate` request | 0.85 | v0.6/P3 |
|
|
||||||
| IDEATE-12 | REQ-043 | feature/ui | user `--ideate` request | 0.85 | v0.6/P4 |
|
|
||||||
| IDEATE-13 | REQ-044 | feature/ui | user `--ideate` request | 0.80 | v0.6/P5 |
|
|
||||||
| IDEATE-14 | REQ-045 | quality/security | D-069 + RESEARCH D-075 | 0.88 | v0.6/P1 |
|
|
||||||
|
|
||||||
Notes:
|
|
||||||
- IDEATE-09/14 ship in P1 (web foundation + firewall-first, same `web/` territory — vertical slice).
|
|
||||||
- IDEATE-10..13 ship in P2..P5 (one screen per phase, ordered by the Nomad happy path: Reach → Stash → Window → Standing → Bloom).
|
|
||||||
- The D-001 refinement-only filter does NOT apply (v0.6 is a feature milestone, not NFR).
|
|
||||||
|
|
||||||
## Milestone v0.1 Summary
|
## Milestone v0.1 Summary
|
||||||
- 10 REQs complete (skeleton + tests)
|
- 10 REQs complete (skeleton + tests)
|
||||||
@@ -175,15 +30,4 @@ Notes:
|
|||||||
- 9 REQs pending (future milestones v0.2-v0.4)
|
- 9 REQs pending (future milestones v0.2-v0.4)
|
||||||
- All locked constants verified by tests
|
- All locked constants verified by tests
|
||||||
- Lexicon fully compliant
|
- Lexicon fully compliant
|
||||||
- 53 unit tests passing across 11 modules (G-001 corrected count)
|
- 48 unit tests passing across 11 modules
|
||||||
|
|
||||||
## Milestone v0.2 Summary (The Mesh) — COMPLETE (skeleton + tests)
|
|
||||||
- 8 v0.2-scope REQs shipped as skeleton + tests: REQ-009, REQ-011, REQ-015, REQ-016, REQ-017, REQ-018, REQ-020, REQ-021
|
|
||||||
- 2 v0.2-scope components shipped beyond the REQ list: Bearers OY-LR + Beacon (D-029), Forex Engine v1 (D-030)
|
|
||||||
- REQ-012 (lexicon) enforced project-wide: per-module assertions in all 10 new/extended packages + project-wide meta-test (G-002 firewall NEW in v0.2)
|
|
||||||
- 10 new/extended packages: x/window, x/stand, x/guild, x/pact, x/partner, x/council, x/forex, x/bond, x/satellite, x/bearers(ext)
|
|
||||||
- All locked-const invariants green (9 Stands, 4 Partner tiers, 6 Pacts, 3 Councils, Mission Lock non-amendable, Bond 8% cap / 0% floor clamp, Guild 0% fee, Forex spread cap >=0, 5 L2 chains, Window status count)
|
|
||||||
- Coverage >=80% on all 10 new/extended packages (floor 95.9%, 8 of 10 at 100%)
|
|
||||||
- go.mod unchanged (zero external deps, G-006 / A-201)
|
|
||||||
- Tags: v0.1.0 (P0) -> v0.1.1 (P1) -> v0.1.2 (P2) -> v0.1.3 (P3) -> v0.1.4 (P4) -> v0.1.5 (P5 = v0.2 milestone release)
|
|
||||||
- Tag-line note (G-010): v0.1 pre-MVP shipped on the v0.0.x patch line (ROADMAP lines 4-13); v0.2 ships on the v0.1.x patch line (config tag_base). The v0.1.5 milestone release is NOT the deferred v0.1.0 "MVP" tag — they are different lines.
|
|
||||||
+1
-2095
File diff suppressed because it is too large
Load Diff
@@ -1,19 +0,0 @@
|
|||||||
# v0.6 Review (Nomad Web UI)
|
|
||||||
|
|
||||||
## Multi-persona code review across P1..P5
|
|
||||||
|
|
||||||
### 8 adversarial probes
|
|
||||||
|
|
||||||
1. **`go run ./web` starts with no external deps (G-006)** — PASS. `git diff v0.5.0..HEAD -- go.mod go.sum` is empty. HTMX is a vendored static asset (`web/static/htmx.min.js`), NOT a `go get`. Zero new require lines across the v0.6 milestone.
|
|
||||||
2. **All 5 screens reachable from the home page** — PASS. Nav in `web/templates/base.html` links to /reach, /stash, /window, /standing, /bloom. Each route returns 200 (handler tests + smoke test on dynamic port 47077/53907).
|
|
||||||
3. **`lexicon_meta_web/` firewall scans `web/templates/**` + `web/static/**` + `web/**/*.go`** — PASS. `go test ./lexicon_meta_web/...` green; G-013 walk-coverage test injects a synthetic banned-term fixture and finds it.
|
|
||||||
4. **Bread-scale conversion matches `x/bread/types` code constants (D-073)** — PASS. `TestStashBreadScaleConversionCorrectness` asserts GrainsPerBread=10000, Crumb=100 Grain (code values); would FAIL if the outdated docs 1000x values were used.
|
|
||||||
5. **Standing score uses locked formula constants** — PASS. `TestStandingScoreComputedFromLockedConstants` asserts PriorMean=4.0, PriorWeight=10, ComputeDiversityBonus, GetVoucherWeight, GetStandingBucket (all from x/standing/types, NOT hardcoded).
|
|
||||||
6. **Freeholder-eligible badge reflects `IsFreeholderEligible()`** — PASS. `TestFreeholderEligibleBadgeReflectsMethod` asserts the rendered badge matches the real method output for both eligible (holder-alia) and non-eligible (holder-bryn) Reaches.
|
|
||||||
7. **Window lifecycle transitions call `Window.Activate/Revoke/Expire`** — PASS. `TestWindowActivateTransitionsOpenToActive` + `TestWindowRevokeTransitionsToRevoked` assert the real x/window/types methods are invoked (status transitions verified). `TestWindowRevokeOnExpiredIsNoOp` asserts the v0.2 terminal-state contract (revoke-on-expired is a no-op).
|
|
||||||
8. **No banned terms in any rendered page** — PASS. Per-handler rendered-HTML lexicon checks (G-026) in all 5 phases scan BOTH 200 happy-path AND error response bodies (400/404). `lexicon_meta_web/` file-scan firewall green on all web/**/*.{html,js,go} files.
|
|
||||||
|
|
||||||
### Verdict: SHIP. No P0 issues. No P1+ issues flagged.
|
|
||||||
|
|
||||||
### G-028 audit (go.mod diff against v0.5.0 baseline)
|
|
||||||
`git diff v0.5.0..HEAD -- go.mod go.sum` — EMPTY. v0.6 adds zero Go dependencies (HTMX is a vendored static asset). G-006 preserved across the milestone.
|
|
||||||
+35
-221
@@ -14,230 +14,44 @@
|
|||||||
- Status: COMPLETE (local-only ship, no remote configured)
|
- Status: COMPLETE (local-only ship, no remote configured)
|
||||||
- MVP release (v0.1.0) deferred until system validated as production-ready
|
- MVP release (v0.1.0) deferred until system validated as production-ready
|
||||||
|
|
||||||
## Milestone v0.2 — The Mesh (COMPLETE)
|
## Phase 1 — Foundation (Year 1)
|
||||||
- [x] P0: Pre-Execution → v0.1.0
|
**Target**: first 10,000 Holders, 50 Master Ops
|
||||||
- [x] P1: Orgs + Window Foundation → v0.1.1
|
|
||||||
- [x] P2: Pacts + Partners → v0.1.2
|
|
||||||
- [x] P3: Councils + Forex → v0.1.3
|
|
||||||
- [x] P4: Bonds + Bearers + L2 → v0.1.4
|
|
||||||
- [x] P5: Final Review + Ship → v0.1.5 (milestone release)
|
|
||||||
- Status: COMPLETE (skeleton + tests layer; released as v0.1.5)
|
|
||||||
|
|
||||||
## Milestone v0.3 — Bearers & Documentation (COMPLETE; feature type; tags v0.2.x)
|
|
||||||
Target: Bearers skeleton (ROADMAP Phase 3 subset) + docs site for nomads and freeholders.
|
|
||||||
|
|
||||||
- [x] P0: Pre-Execution (spec/clarify/research/ideate/plan/grill) → v0.2.0
|
|
||||||
- [x] P1: Docs foundation + REQ-012 firewall extension → v0.2.1
|
|
||||||
- [x] P2: Nomads docs → v0.2.2
|
|
||||||
- [x] P3: Freeholders docs + reference → v0.2.3 (REQ-027 complete)
|
|
||||||
- [x] P4: Bearers skeleton I (x/exit, x/bridge, x/bearers, x/partner) → v0.2.4
|
|
||||||
- [x] P5: Bearers skeleton II (x/hub, x/services, x/bond) → v0.2.5
|
|
||||||
- [x] P6: Final Review + Audit + Ship → v0.2.6 (milestone release)
|
|
||||||
- Status: COMPLETE — Bearers skeleton (7 x/* packages) + docs site (26 pages) shipped
|
|
||||||
|
|
||||||
> v0.3 bundles two work-streams under one feature milestone: (A) Bearers
|
|
||||||
> skeleton+tests (D-020 pattern) and (B) README.md + MkDocs Material docs site
|
|
||||||
> organized by audience, with the REQ-012 lexicon firewall extended to docs.
|
|
||||||
|
|
||||||
| Phase | Type | Scope | Patch |
|
|
||||||
|---|---|---|---|
|
|
||||||
| P0 | docs | Pre-Execution (spec/clarify/research/ideate/plan/grill) | v0.2.0 |
|
|
||||||
| P1 | feat/test+docs | Docs foundation + REQ-012 firewall extension to docs/ + README.md + shared docs | v0.2.1 |
|
|
||||||
| P2 | docs | Nomads docs (docs/nomads/) | v0.2.2 |
|
|
||||||
| P3 | docs | Freeholders docs (docs/freeholders/) + docs/reference/ | v0.2.3 |
|
|
||||||
| P4 | feat | Bearers skeleton I: x/exit, x/bridge, x/bearers (OY-SAT, OY-QR), x/partner (Anchor) | v0.2.4 |
|
|
||||||
| P5 | feat | Bearers skeleton II: x/hub, x/services, x/bond (Growth Bonds + secondary market) | v0.2.5 |
|
|
||||||
| P6 | final | REVIEW + AUDIT + milestone SHIP | v0.2.6 (milestone release) |
|
|
||||||
|
|
||||||
### v0.3 Component mapping
|
|
||||||
|
|
||||||
| Component | Deliverable | v0.3 Skeleton Module | Phase |
|
|
||||||
|---|---|---|---|
|
|
||||||
| Cross-Chain & Exit (2) | L2/L1 bridge types, DEX swap types | x/exit, x/bridge | v0.3/P4 |
|
|
||||||
| Bearers expansion | OY-SAT, OY-QR bearer transport types | x/bearers (extended) | v0.3/P4 |
|
|
||||||
| Anchors | First institutional Partner tier | x/partner (extended: Anchor) | v0.3/P4 |
|
|
||||||
| Hub API | B2B backbone: custody, lending primitive, compliance types | x/hub | v0.3/P5 |
|
|
||||||
| Services | Care / SIM / Vault / Mail service types | x/services | v0.3/P5 |
|
|
||||||
| Bond market | Growth Bonds, secondary-market types | x/bond (extended) | v0.3/P5 |
|
|
||||||
| Documentation | README.md + MkDocs Material docs site | docs/, mkdocs.yml, README.md | v0.3/P1-P3 |
|
|
||||||
| Lexicon firewall | Extend REQ-012 to docs/ + README.md | lexicon_meta_docs_test.go | v0.3/P1 |
|
|
||||||
|
|
||||||
> **Tag-line note (G-010 continuation)**: v0.1 pre-MVP shipped on the `v0.0.x`
|
|
||||||
> patch line; v0.2 (The Mesh) shipped on the `v0.1.x` patch line; v0.3 (Bearers
|
|
||||||
> & Documentation) ships on the `v0.2.x` patch line (config.json `tag_base:
|
|
||||||
> v0.2.x`): P0 -> `v0.2.0`, P1..P5 -> `v0.2.1..v0.2.5`, P6 -> `v0.2.6`
|
|
||||||
> (= the v0.3 milestone release, per D-008 — final phase patch IS the
|
|
||||||
> milestone release; no separate minor tag).
|
|
||||||
|
|
||||||
## Milestone v0.4 — Refinement (COMPLETE; NFR type; tags v0.3.x)
|
|
||||||
|
|
||||||
Target: Close the v0.3 post-hoc forward-references (lexicon firewall drift,
|
|
||||||
hub↔bond const drift, council lifecycle type divergence) + land the deferred
|
|
||||||
docs build CI. Refinement-only NFR milestone: zero `feat:` phases.
|
|
||||||
|
|
||||||
- [x] P0: Pre-Execution (spec/clarify/research/plan/grill/mvp-ux) → v0.3.0
|
|
||||||
- [x] P1: Lexicon + const hardening (REQ-029, REQ-030) → v0.3.1
|
|
||||||
- [x] P2: Lifecycle divergence docs + regression guard (REQ-031) → v0.3.2
|
|
||||||
- [x] P3: Docs build CI (REQ-032) → v0.3.3
|
|
||||||
- [x] P4: Final Review + Audit + Ship → v0.3.4 (milestone release)
|
|
||||||
- Status: COMPLETE — 4 NFR REQs shipped; NFR purity gate GREEN (zero feat: commits); go.mod unchanged
|
|
||||||
|
|
||||||
> v0.4 closes three real v0.3 forward-references (GRILL G-014 lexicon helper,
|
|
||||||
> REVIEW P2/A-304 cross-const test, AUDIT §193 council divergence docs) and
|
|
||||||
> lands the D-046 docs-CI forward-reference. Live-runtime promotions of the
|
|
||||||
> v0.3 Bearers skeletons are deferred to v0.5+ (feat:-class, rejected by the
|
|
||||||
> D-001 refinement-only filter).
|
|
||||||
|
|
||||||
| Phase | Type | Scope | Patch |
|
|
||||||
|---|---|---|---|
|
|
||||||
| P0 | docs | Pre-Execution (spec/clarify/research/plan/grill/mvp-ux) | v0.3.0 |
|
|
||||||
| P1 | refactor+test | Lexicon shared helper (REQ-029) + cross-const test (REQ-030) | v0.3.1 |
|
|
||||||
| P2 | docs+test | Council lifecycle divergence docs (REQ-031) + regression guard | v0.3.2 |
|
|
||||||
| P3 | chore+ci | Docs build CI workflow (REQ-032) | v0.3.3 |
|
|
||||||
| P4 | final | REVIEW + AUDIT + milestone SHIP | v0.3.4 (milestone release) |
|
|
||||||
|
|
||||||
### v0.4 Component mapping
|
|
||||||
|
|
||||||
| Component | Deliverable | v0.4 Change | Phase |
|
|
||||||
|---|---|---|---|
|
|
||||||
| Lexicon firewall | Shared `SyntheticBannedStrings()` helper | `lexicon/lexicon.go` + both meta-tests refactored | v0.4/P1 |
|
|
||||||
| Mission-locked const firewall | Cross-package const-equality test | `x/hub/types/cross_const_test.go` (NEW) | v0.4/P1 |
|
|
||||||
| Council Voice/Council interface | Lifecycle divergence documentation + regression guard | ARCHITECTURE.md section + `x/council/types/types_test.go` intent test | v0.4/P2 |
|
|
||||||
| Docs CI | Gitea Actions workflow (build + artifact) | `.gitea/workflows/docs-build.yml` (NEW) | v0.4/P3 |
|
|
||||||
|
|
||||||
> **Tag-line note (G-010 continuation)**: v0.4 (NFR) ships on the `v0.3.x`
|
|
||||||
> patch line (config.json `tag_base: v0.3.x`): P0 -> `v0.3.0`, P1..P3 ->
|
|
||||||
> `v0.3.1..v0.3.3`, P4 -> `v0.3.4` (= the v0.4 milestone release, per D-008 —
|
|
||||||
> final phase patch IS the milestone release; no separate minor tag).
|
|
||||||
|
|
||||||
## Milestone v0.5 — Bearers Runtime (COMPLETE; feature type; tags v0.4.x)
|
|
||||||
|
|
||||||
Target: Promote the v0.3 Bearers skeletons from type+keeper-stub layers to
|
|
||||||
live runtime behavior (keeper MsgServer handlers + simtest-grade end-to-end
|
|
||||||
flows). NOT mainnet (D-020 pattern continues to govern network deployment);
|
|
||||||
runtime = simtest-grade message handlers, not mainnet deployment.
|
|
||||||
|
|
||||||
- [x] P0: Pre-Execution (spec/clarify/research/plan/grill/mvp-ux) → v0.4.0
|
|
||||||
- [x] P1: Exit + Bridge runtime (REQ-033) → v0.4.1
|
|
||||||
- [x] P2: Bearers transport runtime (REQ-034) → v0.4.2
|
|
||||||
- [x] P3: Anchors onboarding runtime (REQ-035) → v0.4.3
|
|
||||||
- [x] P4: Hub API B2B runtime (REQ-036) → v0.4.4
|
|
||||||
- [x] P5: Services runtime (REQ-037) → v0.4.5
|
|
||||||
- [x] P6: Bond market runtime (REQ-038) → v0.4.6
|
|
||||||
- [x] P7: Council governance runtime (REQ-039) → v0.4.7
|
|
||||||
- [x] P8: Final Review + Audit + Ship → v0.4.8 (milestone release)
|
|
||||||
- Status: COMPLETE — 7 runtime REQs shipped; all 8 keeper packages ≥80% coverage (82.1%..92.5%); G-003 firewall intact; locked-const firewall intact; cosmos-sdk v0.50.8 + ibc-go v8.2.1 added (D-055/D-062, G-006 controlled exception); 5 GRILL decisions ratified (D-055/D-062/D-063/D-064/D-065); 8 binding fixes landed (G-017..G-024); 5 P1+ flagged for v0.6+ mainnet-readiness.
|
|
||||||
|
|
||||||
| Phase | Type | Scope | Patch |
|
|
||||||
|---|---|---|---|
|
|
||||||
| P0 | docs | Pre-Execution (spec/clarify/research/plan/grill/mvp-ux) | v0.4.0 |
|
|
||||||
| P1 | feat | Exit + Bridge runtime: x/exit DEX swap routing + x/bridge IBC packet handlers (5 L2 chains) | v0.4.1 |
|
|
||||||
| P2 | feat | Bearers transport runtime: OY-SAT + OY-QR message handlers + session lifecycle | v0.4.2 |
|
|
||||||
| P3 | feat | Anchors onboarding runtime: x/partner Anchor credential lifecycle | v0.4.3 |
|
|
||||||
| P4 | feat | Hub API B2B runtime: custody/lending/compliance + CustodyKeyring interface (D-058) | v0.4.4 |
|
|
||||||
| P5 | feat | Services runtime: Care/SIM/Vault/Mail service lifecycle handlers | v0.4.5 |
|
|
||||||
| P6 | feat | Bond market runtime: Growth Bonds + secondary-market CLOB matching (REJECT above 800bps D-063) | v0.4.6 |
|
|
||||||
| P7 | feat | Council governance runtime: Proposal/VoteOption enums (AUDIT §193 P1-1) + MissionLockAmendment reject (D-064) | v0.4.7 |
|
|
||||||
| P8 | final | REVIEW + AUDIT + milestone SHIP | v0.4.8 (milestone release) |
|
|
||||||
|
|
||||||
### v0.5 Component mapping
|
|
||||||
|
|
||||||
| Component | Deliverable | v0.5 Runtime Module | Phase |
|
|
||||||
|---|---|---|---|
|
|
||||||
| Exit layer (Layer 3) | DEX swap routing + cross-chain exit handlers | x/exit/keeper + x/exit/module.go | v0.5/P1 |
|
|
||||||
| Bridge (L2↔L1) | IBC packet handlers (5 L2 chains, Solana wormhole-adapter) | x/bridge/keeper + x/bridge/module.go + ibc_module.go | v0.5/P1 |
|
|
||||||
| Bearers expansion | OY-SAT + OY-QR message handlers + session lifecycle | x/bearers/keeper + x/bearers/module.go | v0.5/P2 |
|
|
||||||
| Anchors | Anchor credential issuance/revocation runtime | x/partner/keeper + x/partner/module.go | v0.5/P3 |
|
|
||||||
| Hub API | Custody/lending/compliance runtime + CustodyKeyring interface | x/hub/keeper + x/hub/module.go + keyring_mem.go | v0.5/P4 |
|
|
||||||
| Services | Care/SIM/Vault/Mail service lifecycle runtime | x/services/keeper + x/services/module.go | v0.5/P5 |
|
|
||||||
| Bond market | Growth Bonds + secondary-market CLOB matching engine | x/bond/keeper + x/bond/module.go + clob.go | v0.5/P6 |
|
|
||||||
| Council governance | Proposal/VoteOption enums + governance message handlers | x/council/keeper + x/council/module.go | v0.5/P7 |
|
|
||||||
|
|
||||||
> **Tag-line note (G-010 continuation)**: v0.5 (feature) ships on the `v0.4.x`
|
|
||||||
> patch line (config.json `tag_base: v0.4.x`): P0 -> `v0.4.0`, P1..P7 ->
|
|
||||||
> `v0.4.1..v0.4.7`, P8 -> `v0.4.8` (= the v0.5 milestone release, per D-008 —
|
|
||||||
> final phase patch IS the milestone release; no separate minor tag).
|
|
||||||
|
|
||||||
### v0.5 deferred to v0.6+ (P1+ from REVIEW.md)
|
|
||||||
- P1 security: no proposal deposit/bond (governance spam gap — mainnet-readiness)
|
|
||||||
- P1 adversarial: CLOB per-tx front-running exposure (batch auction is a v0.6+ design)
|
|
||||||
- P1 maintainability: simtest doesn't exercise real IBC light-client verification
|
|
||||||
- P2 performance: CLOB `restingBookForBond` O(n) load (prefix-key for mainnet)
|
|
||||||
- P2 maintainability: `emitMatchEventHook` package-level mutable var (minor testability)
|
|
||||||
- SignalKind 4→5 expansion (AUDIT §193 P1-2; deferred to v0.6+ governance vote)
|
|
||||||
- Live chain launch / mainnet / real IBC channels / real bearer transports (D-020 continues)
|
|
||||||
- Real institutional Anchors onboarding (credential lifecycle in simtest only)
|
|
||||||
- Yield Token, Travel + 11 service categories (ROADMAP Phase 4 — Maturity)
|
|
||||||
|
|
||||||
## Milestone v0.6 — Nomad Web UI (COMPLETE; feature type; tags v0.5.x)
|
|
||||||
|
|
||||||
Target: The project's first UI milestone. A working prototype Web UI where a
|
|
||||||
person can sign up to be a Nomad (create a Reach + open a Stash) and exercise
|
|
||||||
basic functionality around the (Reach, Stash) components, plus Window
|
|
||||||
authorization, Standing progress, and Bloom accrual views. All data is
|
|
||||||
generated as test fixtures — no real blockchain interaction (D-020 continues).
|
|
||||||
Greenfield Go `html/template` + HTMX layer served by a Go mock HTTP server
|
|
||||||
(`web/`) that instantiates the real `x/*/types` structs from in-memory
|
|
||||||
fixtures. No keeper, no Cosmos runtime, no `app.go` (none exists in the repo).
|
|
||||||
|
|
||||||
- [x] P0: Pre-Execution (spec/clarify/research/ideate/plan/grill/mvp-ux) → v0.5.0
|
|
||||||
- [x] P1: Web foundation + Reach signup + lexicon firewall extension (REQ-040, REQ-045) → v0.5.1
|
|
||||||
- [x] P2: Stash dashboard (REQ-041) → v0.5.2
|
|
||||||
- [x] P3: Window authorization (REQ-042) → v0.5.3
|
|
||||||
- [x] P4: Standing + Freeholder signals (REQ-043) → v0.5.4
|
|
||||||
- [x] P5: Bloom accrual view (REQ-044) → v0.5.5
|
|
||||||
- [x] P6: Final Review + Audit + Ship → v0.5.6 (milestone release)
|
|
||||||
|
|
||||||
| Phase | Type | Scope | Patch |
|
|
||||||
|---|---|---|---|
|
|
||||||
| P0 | docs | Pre-Execution (spec/clarify/research/ideate/plan/grill/mvp-ux) | v0.5.0 |
|
|
||||||
| P1 | feat+test | Web foundation + Reach signup (REQ-040) + lexicon firewall extension to web/ (REQ-045) | v0.5.1 |
|
|
||||||
| P2 | feat | Stash dashboard: balance + Bread-scale conversion + 90-day maturity progress (REQ-041) | v0.5.2 |
|
|
||||||
| P3 | feat | Window authorization: open/lifecycle/audit-log view (REQ-042) | v0.5.3 |
|
|
||||||
| P4 | feat | Standing + Freeholder signals progress: computed from mock Ratings/Vouches/Slashes (REQ-043) | v0.5.4 |
|
|
||||||
| P5 | feat | Bloom accrual view: per-Stash BloomRecord (REQ-044) | v0.5.5 |
|
|
||||||
| P6 | final | REVIEW + AUDIT + milestone SHIP | v0.5.6 (milestone release) |
|
|
||||||
|
|
||||||
### v0.6 Component mapping
|
|
||||||
|
|
||||||
| Component | Deliverable | v0.6 Module | Phase |
|
|
||||||
|---|---|---|---|
|
|
||||||
| Web UI foundation | Go HTTP mock server + base templates + HTMX vendored | web/main.go, web/handlers/, web/store/, web/templates/, web/static/ | v0.6/P1 |
|
|
||||||
| Reach signup | "Create a Reach" form + Reach list/detail | web/handlers/reach.go, web/templates/reach.html | v0.6/P1 |
|
|
||||||
| Stash dashboard | Balance + Bread-scale + 90-day maturity | web/handlers/stash.go, web/templates/stash.html | v0.6/P2 |
|
|
||||||
| Window authorization | Open/lifecycle/audit-log view | web/handlers/window.go, web/templates/window.html | v0.6/P3 |
|
|
||||||
| Standing + Freeholder signals | Progress view from mock Ratings/Vouches/Slashes | web/handlers/standing.go, web/templates/standing.html | v0.6/P4 |
|
|
||||||
| Bloom accrual | Per-Stash BloomRecord view | web/handlers/bloom.go, web/templates/bloom.html | v0.6/P5 |
|
|
||||||
| Lexicon firewall | Extend REQ-012 to web/ | lexicon_meta_web/lexicon_meta_web_test.go | v0.6/P1 |
|
|
||||||
|
|
||||||
> **Tag-line note (G-010 continuation)**: v0.6 (feature) ships on the `v0.5.x`
|
|
||||||
> patch line (config.json `tag_base: v0.5.x`): P0 -> `v0.5.0`, P1..P5 ->
|
|
||||||
> `v0.5.1..v0.5.5`, P6 -> `v0.5.6` (= the v0.6 milestone release, per D-008 —
|
|
||||||
> final phase patch IS the milestone release; no separate minor tag).
|
|
||||||
|
|
||||||
### v0.6 deferred to v0.7+
|
|
||||||
- Real blockchain interaction / mainnet / IBC / real bearer transports (D-020 continues)
|
|
||||||
- A real `oyd` daemon / `app.go` / `cmd/oyd` (no chain runtime exists; wiring the UI to a real daemon is v0.7+)
|
|
||||||
- Authentication / sessions / real key management (mock; a Reach is created by form submission, stored in-memory)
|
|
||||||
- Persistence (mock store is in-memory; resets on restart)
|
|
||||||
- i18n / multi-language UI
|
|
||||||
- The 5 P1+ mainnet-readiness items deferred from v0.5 (governance spam deposit, CLOB front-running, real IBC simtest, CLOB perf, emitMatchEventHook testability) — those are v0.7+ mainnet-readiness, not UI work
|
|
||||||
- Bread-scale doc-fix (`docs/shared/bread-scale.md` is outdated vs code constants — P1+ follow-up, not v0.6 scope)
|
|
||||||
|
|
||||||
## Phase 3 — The Bearers (Year 3) — v0.3 PARTIAL SKELETON
|
|
||||||
**Target**: $10B annual volume → fee auto-declines to 0.07%
|
|
||||||
|
|
||||||
> v0.3 ships a skeleton+tests subset of Phase 3 (Cross-Chain/Exit, OY-SAT/OY-QR,
|
|
||||||
> Anchors, Hub API, Services, Bond market depth). Full runtime deferred to v0.4+.
|
|
||||||
|
|
||||||
| Component | Deliverable |
|
| Component | Deliverable |
|
||||||
|---|---|
|
|---|---|
|
||||||
| Cross-Chain & Exit (2) | Full L2/L1 bridges, DEX integration (runtime deferred to v0.4) |
|
| OY Chain & Mirror (1) | L1 chain launched, 9 Watchers bonded, Mirror live |
|
||||||
| Bearers expansion | OY-SAT, OY-QR (skeleton types in v0.3) |
|
| Bread Unit & Root Basket (3) | Forge/Fold on Ethereum + 2–3 L2s; initial Root Basket |
|
||||||
| Hub API | B2B backbone: custody, lending primitive, compliance (skeleton types in v0.3) |
|
| Storage Substrate (5) | Stash, Vault, Root-Pool contracts |
|
||||||
| Anchors | First institutional partners (skeleton types in v0.3) |
|
| Bloom Engine (4) | Bloom accrual loop tied to Mirror attestations |
|
||||||
| Services | Care / SIM / Vault / Mail (skeleton types in v0.3) |
|
| Fee Covenant (13) | 0.1% ceiling live, processor share 50%, internal minimum 1 Grain |
|
||||||
| Bond market | Full market, Growth Bonds (skeleton types in v0.3) |
|
| Identity, Standing & Citizenship (6) | Reach v1, Standing v1, Nomad/Freeholder system |
|
||||||
|
| Bearers & Processing Mesh (12) | Processing v1, OY-BLE, OY-WiFi-Direct |
|
||||||
|
| Mesh Experience (9) | Maps, Pay v1 |
|
||||||
|
|
||||||
|
## Phase 2 — The Mesh (Year 2)
|
||||||
|
**Target**: $1B annual volume, 4 service categories
|
||||||
|
|
||||||
|
| Component | Deliverable |
|
||||||
|
|---|---|
|
||||||
|
| Organizational Primitives (10) | 9 Stand types, Guilds (Hand-Passes free) |
|
||||||
|
| Partner Spectrum & Forex (11) | First Piers, Forex Engine v1 |
|
||||||
|
| Window Primitive (7) | Holder-authorized data channels |
|
||||||
|
| Pacts Suite (8) | Pause, Ground, Stance, Cover, Stand Registry |
|
||||||
|
| Governance (14) | Mesh Council activated |
|
||||||
|
| Bearers expansion | OY-LR + Beacon v1 |
|
||||||
|
| Bonds | First Mesh Bonds |
|
||||||
|
|
||||||
|
## Phase 3 — The Bearers (Year 3)
|
||||||
|
**Target**: $10B annual volume → fee auto-declines to 0.07%
|
||||||
|
|
||||||
|
| Component | Deliverable |
|
||||||
|
|---|---|
|
||||||
|
| Cross-Chain & Exit (2) | Full L2/L1 bridges, DEX integration |
|
||||||
|
| Bearers expansion | OY-SAT, OY-QR |
|
||||||
|
| Hub API | B2B backbone: custody, lending primitive, compliance |
|
||||||
|
| Anchors | First institutional partners |
|
||||||
|
| Services | Care / SIM / Vault / Mail |
|
||||||
|
| Bond market | Full market, Growth Bonds |
|
||||||
|
|
||||||
## Phase 4 — Maturity (Years 4–5+)
|
## Phase 4 — Maturity (Years 4–5+)
|
||||||
**Target**: $50–100B volume → fees auto-decline to 0.03%
|
**Target**: $50–100B volume → fees auto-decline to 0.03%
|
||||||
|
|||||||
@@ -1,55 +0,0 @@
|
|||||||
# OpenYield docs build CI (REQ-032, D-046 forward-reference, D-051, G-016).
|
|
||||||
#
|
|
||||||
# Runs the lexicon firewall (go test ./...) AND builds the MkDocs Material docs
|
|
||||||
# site on every push. The docs-build job DEPENDS on go-test (G-016 binding:
|
|
||||||
# firewall-gates-docs-build — a lexicon violation blocks the docs build so no
|
|
||||||
# false-green docs artifact is produced from a repo with a firewall failure).
|
|
||||||
#
|
|
||||||
# Scope (chore, not feat: per D-001 refinement-only filter):
|
|
||||||
# - go-test job: setup Go 1.22, run `go test ./...` (lexicon firewall + all
|
|
||||||
# x/* tests + the v0.4 cross-const test). Zero external Go deps (G-006).
|
|
||||||
# - docs-build job: setup Python, pip install mkdocs + mkdocs-material
|
|
||||||
# (build-only Python deps, ISOLATED to this job — go.mod is NOT modified),
|
|
||||||
# run `mkdocs build` (produces site/), upload site/ as a CI artifact.
|
|
||||||
#
|
|
||||||
# Out of scope (deferred per D-051): full Gitea Pages publishing. v0.4 ships
|
|
||||||
# build + artifact only; a hosting target is not configured.
|
|
||||||
#
|
|
||||||
# Triggers: on push (all branches) so the firewall + docs build are checked
|
|
||||||
# on every change, not just on main.
|
|
||||||
|
|
||||||
name: docs-build
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
go-test:
|
|
||||||
name: go test ./... (lexicon firewall + all x/* tests)
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v4
|
|
||||||
- uses: actions/setup-go@v5
|
|
||||||
with:
|
|
||||||
go-version: '1.22'
|
|
||||||
- name: go test ./...
|
|
||||||
run: go test ./...
|
|
||||||
|
|
||||||
docs-build:
|
|
||||||
name: mkdocs build (docs site artifact)
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
needs: go-test # G-016: firewall-gates-docs-build (no false-green docs build)
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v4
|
|
||||||
- uses: actions/setup-python@v5
|
|
||||||
with:
|
|
||||||
python-version: '3.11'
|
|
||||||
- name: install mkdocs + mkdocs-material
|
|
||||||
run: pip install mkdocs mkdocs-material
|
|
||||||
- name: mkdocs build
|
|
||||||
run: mkdocs build
|
|
||||||
- name: upload site/ artifact
|
|
||||||
uses: actions/upload-artifact@v4
|
|
||||||
with:
|
|
||||||
name: docs-site
|
|
||||||
path: site/
|
|
||||||
retention-days: 14
|
|
||||||
@@ -2,5 +2,3 @@
|
|||||||
.env.secrets
|
.env.secrets
|
||||||
.env.*
|
.env.*
|
||||||
.ciagent/.env.secrets
|
.ciagent/.env.secrets
|
||||||
# MkDocs build output (REQ-032 CI produces site/ as an artifact; never commit it)
|
|
||||||
site/
|
|
||||||
|
|||||||
@@ -1,112 +0,0 @@
|
|||||||
# OpenYield
|
|
||||||
|
|
||||||
OpenYield is a jurisdiction-light, public-good mesh for **real production** — a
|
|
||||||
protocol organized around Holders, Stands, and the Six Principles, designed to
|
|
||||||
hold real value without the words or the shapes that invite capture. The mesh
|
|
||||||
runs on OY Chain (Layer 1), a canonical state layer for the Bread unit, the
|
|
||||||
Storage Pools (Stash, Vault, Root-Pool), Standing, Watcher attestations, and
|
|
||||||
the Pact / Council / Partner surface. It is anti-greed by construction: Mission
|
|
||||||
Lock fixes the Six Principles and fee covenant so no council can amend them,
|
|
||||||
and the 8% coupon cap on bonds is a mission-locked ceiling, not a parameter.
|
|
||||||
|
|
||||||
## The Six Principles
|
|
||||||
|
|
||||||
1. **Real value** — the mesh holds real production, not speculation.
|
|
||||||
2. **Sustainability** — fees are floored and capped; the protocol cannot drain its users.
|
|
||||||
3. **Mission-lock** — the Six Principles and fee covenant are immutable; no council can amend them.
|
|
||||||
4. **Openness** — anyone may join; the mesh is a public good.
|
|
||||||
5. **Ownership** — Holders own their Stash and their Reach; custody is theirs.
|
|
||||||
6. **Self-service** — a Holder can act without a custodian; the mesh is jurisdiction-light.
|
|
||||||
|
|
||||||
## Bread unit & scale
|
|
||||||
|
|
||||||
The unit of value is **Bread**, scaled in 11 tiers: **Grain → Crumb → Bread →
|
|
||||||
Loaf → Batch → Cake → Bakery → Granary → Mill → Harvest → Earth.**
|
|
||||||
|
|
||||||
## Status
|
|
||||||
|
|
||||||
**v0.6 (Nomad Web UI) — in progress.** v0.5 shipped the Bearers Runtime
|
|
||||||
(simtest-grade keeper handlers for 8 x/ modules). v0.6 adds the project's
|
|
||||||
first UI: a Go `html/template` + HTMX prototype Web UI in `web/` where a
|
|
||||||
visitor can sign up to be a Nomad (create a Reach + open a Stash) and
|
|
||||||
exercise basic functionality around Reach, Stash, Window, Standing, and
|
|
||||||
Bloom. All data is generated test fixtures — no real chain. See
|
|
||||||
`.ciagent/oy/ROADMAP.md` for the phase plan and `.ciagent/oy/PROJECT.md`
|
|
||||||
for governance.
|
|
||||||
|
|
||||||
## Build & test
|
|
||||||
|
|
||||||
OpenYield is pure Go with **zero external dependencies** (`go.mod` has no
|
|
||||||
`require` lines; `go 1.22`). From the repo root:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
go build ./...
|
|
||||||
go test ./...
|
|
||||||
```
|
|
||||||
|
|
||||||
## Web UI
|
|
||||||
|
|
||||||
The Nomad Web UI (v0.6) is a Go `html/template` server with HTMX progressive
|
|
||||||
enhancement, served by a mock HTTP server in `web/` that instantiates the
|
|
||||||
real `x/*/types` structs from in-memory fixtures. No node, no build step,
|
|
||||||
no real chain. To run it:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
go run ./web
|
|
||||||
# opens on http://localhost:8080 (PORT env var overridable)
|
|
||||||
```
|
|
||||||
|
|
||||||
Five screens, all reachable from the home nav:
|
|
||||||
|
|
||||||
- `/reach` — create a Reach (sign up to be a Nomad) + Reach list/detail
|
|
||||||
- `/stash/{holderID}` — Stash dashboard (Grain balance + Bread scale + 90-day maturity)
|
|
||||||
- `/window` — Window authorization (open/lifecycle/audit log)
|
|
||||||
- `/standing/{reachID}` — Standing + Freeholder signals progress
|
|
||||||
- `/bloom/{stashID}` — Bloom accrual view
|
|
||||||
|
|
||||||
HTMX is a single vendored JS file (`web/static/htmx.min.js`), NOT a Go
|
|
||||||
dependency — `go.mod` stays unchanged (G-006).
|
|
||||||
|
|
||||||
## Docs
|
|
||||||
|
|
||||||
The docs site is [MkDocs Material](https://squidfunk.github.io/mkdocs-material/)
|
|
||||||
(a build-only Python dep; **not** a Go dep — `go.mod` is unchanged). To
|
|
||||||
preview locally:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
mkdocs serve
|
|
||||||
# or build to a static site/ dir:
|
|
||||||
mkdocs build
|
|
||||||
```
|
|
||||||
|
|
||||||
The site lives under `docs/` (see `mkdocs.yml` for the nav). Publishing CI is
|
|
||||||
deferred to v0.4 (D-046); v0.3 ships the source.
|
|
||||||
|
|
||||||
## Lexicon firewall
|
|
||||||
|
|
||||||
OpenYield bans 10 financial terms as standalone words (REQ-012) across all Go
|
|
||||||
source (`x/**/*.go`), all docs (`README.md` + `docs/**/*.md`), and all web UI
|
|
||||||
files (`web/**/*.{html,js,go}`). The banned terms are the words you would
|
|
||||||
expect a legacy financial institution to use; this README and the docs describe
|
|
||||||
them only by their **safe replacements**, so the firewall itself never trips.
|
|
||||||
The firewall is enforced in code by three sibling Go tests:
|
|
||||||
|
|
||||||
- `lexicon_meta_test.go` (v0.2) — scans `x/**/*.go`.
|
|
||||||
- `lexicon_meta_docs/lexicon_meta_docs_test.go` (v0.3) — scans `README.md` +
|
|
||||||
`docs/**/*.md`.
|
|
||||||
- `lexicon_meta_web/lexicon_meta_web_test.go` (v0.6) — scans
|
|
||||||
`web/templates/**` + `web/static/**` + `web/**/*.go`.
|
|
||||||
|
|
||||||
All three use `lexicon.FindBannedTerm` (word-boundary, case-insensitive), so
|
|
||||||
"OpenYield" is safe (word-boundary does not match the banned term inside an
|
|
||||||
identifier) but the standalone banned term is not — docs say **"real
|
|
||||||
production"** / **"real return"**, and a Holder's identity is **Holder** /
|
|
||||||
**Reach**, never the banned word for a custodial position. See
|
|
||||||
`docs/shared/lexicon.md` for the glossary of safe replacements.
|
|
||||||
|
|
||||||
## Governance
|
|
||||||
|
|
||||||
- `.ciagent/oy/PROJECT.md` — full vision, decisions (D-0xx), assumptions.
|
|
||||||
- `.ciagent/oy/PLANS.md` — phase plans (v0.1, v0.2, v0.3).
|
|
||||||
- `.ciagent/oy/REQUIREMENTS.md` — REQ coverage matrix.
|
|
||||||
- `.ciagent/oy/ROADMAP.md` — release roadmap.
|
|
||||||
@@ -1,47 +0,0 @@
|
|||||||
# Anchor Preview
|
|
||||||
|
|
||||||
An **Anchor** (REQ-023) is the fourth and highest tier of the
|
|
||||||
[Partner Spectrum](partner-spectrum.md) (REQ-018) — the first **institutional**
|
|
||||||
Partner tier. Anchors are coming in v0.3 P4. This page previews what an Anchor
|
|
||||||
is and what the v0.3 skeleton will deliver; the runtime behavior is deferred
|
|
||||||
to v0.4+.
|
|
||||||
|
|
||||||
## What an Anchor is
|
|
||||||
|
|
||||||
An Anchor is a Partner that carries an **AnchorCredential**: a jurisdiction
|
|
||||||
(e.g., "EU-MiCA"), a custody provider, and a set of attestation references.
|
|
||||||
The Anchor tier is how the jurisdiction-light mesh interfaces with
|
|
||||||
jurisdiction-bound institutional actors without becoming them. An Anchor
|
|
||||||
holds a credential; the [Holder](../nomads/reach.md) still holds their
|
|
||||||
[Stash](../nomads/stash.md). The mesh says **custody**, **compliance**, and
|
|
||||||
**jurisdiction** — never the legacy institutional words banned by the
|
|
||||||
[lexicon](../shared/lexicon.md).
|
|
||||||
|
|
||||||
## What is coming in v0.3 P4
|
|
||||||
|
|
||||||
v0.3 P4 (REQ-023) extends `x/partner` with the `AnchorCredential` struct and
|
|
||||||
a `Partner.AnchorCredential()` accessor (returns nil for non-Anchor tiers).
|
|
||||||
The four-tier `PartnerTier` enum (Op, Master Op, Pier, Anchor) is **unchanged**
|
|
||||||
— v0.3 adds Anchor-specific fields, not a new tier. The custody-provider-id
|
|
||||||
field is a by-ID-string reference to `x/hub` (the Hub API, coming in v0.3 P5),
|
|
||||||
empty in the v0.3 skeleton because the Hub is not live until P5/v0.4. This is
|
|
||||||
the P4→P5 ordering edge: `x/hub` in P5 references Anchor partner-ids from P4.
|
|
||||||
|
|
||||||
## Why Anchors matter to a Freeholder
|
|
||||||
|
|
||||||
A Freeholder engaging an Anchor gets a Partner with a verifiable credential
|
|
||||||
and a custody/compliance relationship — useful for cross-jurisdiction routes
|
|
||||||
and institutional [bonds](bonds.md). The Anchor's [Standing](standing.md) and
|
|
||||||
attestations are visible so the Freeholder can verify the Anchor is real
|
|
||||||
before opening a [Window](../nomads/window.md). See
|
|
||||||
[Partner Spectrum](partner-spectrum.md) for the other three tiers, and
|
|
||||||
[Councils & Voice](councils-voice.md) for how the Mesh Council can suspend or
|
|
||||||
revoke an Anchor.
|
|
||||||
|
|
||||||
## What v0.3 does not deliver
|
|
||||||
|
|
||||||
The v0.3 skeleton is types + tests only (D-035): the `AnchorCredential`
|
|
||||||
struct, the accessor, and the `ListAnchors()` keeper alias. Live custody
|
|
||||||
routing, attestation verification, and the Hub API integration are v0.4+
|
|
||||||
runtime work. See [Components](../reference/components.md) for the full
|
|
||||||
module map.
|
|
||||||
@@ -1,46 +0,0 @@
|
|||||||
# Bonds
|
|
||||||
|
|
||||||
A **Mesh Bond** (REQ-021, vision §17) is a [Stand](stands-guilds.md)-issued
|
|
||||||
instrument that pays a **coupon** to its holder over a term and returns the
|
|
||||||
principal at maturity. The coupon is bounded by a **mission-locked cap and
|
|
||||||
floor**: 8% upper cap, 0% floor (locked `CouponCapBps = 800` and
|
|
||||||
`CouponFloorBps = 0` in `x/bond`). The cap exists so the mesh cannot become a
|
|
||||||
speculative market; the floor exists so the coupon cannot go negative.
|
|
||||||
|
|
||||||
## The coupon clamp
|
|
||||||
|
|
||||||
The coupon is clamped to `[floor, cap]` by the `Clamp` helper in `x/bond`
|
|
||||||
(same shape as the [Fee Covenant](../shared/six-principles.md) clamp): a
|
|
||||||
coupon above 8% is reduced to 8%; a coupon below 0% is raised to 0%; a coupon
|
|
||||||
in range is unchanged. The clamp is a tested invariant: below floor → floor,
|
|
||||||
above cap → cap, in range → unchanged. This is the Mission Lock's expression
|
|
||||||
in the capital layer.
|
|
||||||
|
|
||||||
## Why a cap
|
|
||||||
|
|
||||||
OpenYield is a public-good mesh for **real production**, not a speculation
|
|
||||||
engine. An uncapped coupon market would let a Stand offer arbitrarily high
|
|
||||||
coupons to attract Bread, turning the mesh into a speculative race. The 8%
|
|
||||||
cap bounds the coupon at a level consistent with real production returns, and
|
|
||||||
the [Mission Lock](councils-voice.md) makes the cap non-amendable — no Council
|
|
||||||
vote can raise it. The mesh says **coupon** and **real return**, never the
|
|
||||||
passive-value or standalone-metric words banned by the
|
|
||||||
[lexicon](../shared/lexicon.md).
|
|
||||||
|
|
||||||
## The bond lifecycle
|
|
||||||
|
|
||||||
A Bond moves through five states (locked `BondStatus` enum in `x/bond`):
|
|
||||||
Issued → Active → Matured, with Defaulted and Repaid as terminal paths. The
|
|
||||||
issuer is a Stand (referenced by stand-id); the principal is denominated in
|
|
||||||
[Grain](../shared/bread-scale.md). The bond market is governed by the
|
|
||||||
[Stand Council](councils-voice.md) for the issuing Stand.
|
|
||||||
|
|
||||||
## Coming in v0.3 P5
|
|
||||||
|
|
||||||
v0.3 P5 (REQ-026) extends the bond market with **Growth Bonds** (a coupon that
|
|
||||||
grows over the term, still clamped to the 8% cap) and a **secondary market**
|
|
||||||
(Buy/Sell orders on issued bonds). The 8% / 0% consts are unchanged — the
|
|
||||||
D-028 regression firewall guarantees v0.3 cannot alter the v0.2 mission-locked
|
|
||||||
ceiling. See [Partner Spectrum](partner-spectrum.md) for how Partners relate
|
|
||||||
to the bond market, and [Anchor Preview](anchor-preview.md) for the
|
|
||||||
institutional tier.
|
|
||||||
@@ -1,48 +0,0 @@
|
|||||||
# Councils & Voice
|
|
||||||
|
|
||||||
OpenYield governs itself through three **Councils** (REQ-011, vision §19):
|
|
||||||
the Mesh Council, the Guild Council, and the Stand Council. Each Freeholder
|
|
||||||
participates through the Councils, weighted by **Voice** — a multi-source
|
|
||||||
weight that combines [Stash](../nomads/stash.md), [Standing](standing.md),
|
|
||||||
Vouch, Freeholder status, and Guild membership. The **Mission Lock** makes
|
|
||||||
the covenant non-amendable: no Council can vote to change the
|
|
||||||
[Six Principles](../shared/six-principles.md) or the fee covenant.
|
|
||||||
|
|
||||||
## The three Councils
|
|
||||||
|
|
||||||
- **Mesh Council** — the mesh-wide Council. Handles protocol-level proposals
|
|
||||||
that affect every Holder and every [Stand](stands-guilds.md).
|
|
||||||
- **Guild Council** — the Council for [Guilds](stands-guilds.md). Handles
|
|
||||||
Guild-scope proposals, referenced by guild-id.
|
|
||||||
- **Stand Council** — the Council for a single Stand, referenced by stand-id.
|
|
||||||
Handles Stand-scope proposals (e.g., Vault use, [Bond](bonds.md) issuance).
|
|
||||||
|
|
||||||
The three-tier shape mirrors the three [Storage Pools](../shared/storage-pools.md):
|
|
||||||
a Council exists at each layer where custody is held.
|
|
||||||
|
|
||||||
## Multi-source Voice
|
|
||||||
|
|
||||||
Voice is not one number. It is a weighted tally from five sources (locked as
|
|
||||||
the `VoiceSource` enum in `x/council`): Stash, Standing, Vouch, Freeholder,
|
|
||||||
and Guild. A Freeholder with high [Standing](standing.md) and a long-held
|
|
||||||
Stash carries more Voice than a freshly-minted one. The
|
|
||||||
[TallyResult](../reference/components.md) mirrors the Cosmos SDK `x/gov`
|
|
||||||
shape so the governance layer can wire to standard tooling. The VoteOption
|
|
||||||
enum is **Yes / No / Abstain** — there is no "no-with-veto", an anti-greed
|
|
||||||
design choice.
|
|
||||||
|
|
||||||
## Mission Lock
|
|
||||||
|
|
||||||
The Mission Lock is a locked `const bool` in `x/council`
|
|
||||||
(`MissionLockAmendable = false`). The Six Principles, the fee covenant
|
|
||||||
(ceiling 0.1% / floor 0.01% / 1-Grain minimum), and the bond coupon cap
|
|
||||||
([8% / 0%](bonds.md)) cannot be amended by any Council vote. This is the
|
|
||||||
firewall that keeps the mesh a public good: governance can act *within* the
|
|
||||||
covenant, never *on* the covenant.
|
|
||||||
|
|
||||||
## How a Freeholder participates
|
|
||||||
|
|
||||||
A Freeholder submits or votes on proposals in the Councils they belong to.
|
|
||||||
Each vote is weighted by multi-source Voice; the tally follows `x/gov`
|
|
||||||
semantics. See [Bonds](bonds.md) for the coupon cap the Mission Lock protects,
|
|
||||||
and [Standing](standing.md) for the metric that weights a Freeholder's Voice.
|
|
||||||
@@ -1,39 +0,0 @@
|
|||||||
# Freeholders
|
|
||||||
|
|
||||||
A **Freeholder** is a Holder who has earned all four Freeholder signals (REQ-005):
|
|
||||||
a 90-day [Stash](../nomads/stash.md), a [Standing](standing.md) threshold of
|
|
||||||
4.5★ or higher in 3 categories, the Capital signal, and the Vouch signal. A
|
|
||||||
Freeholder is the active participant in the OpenYield mesh — they sit in
|
|
||||||
[Stands & Guilds](stands-guilds.md), vote in the three
|
|
||||||
[Councils & Voice](councils-voice.md), issue [Bonds](bonds.md), and relate to
|
|
||||||
the four-tier [Partner Spectrum](partner-spectrum.md).
|
|
||||||
|
|
||||||
## The four signals
|
|
||||||
|
|
||||||
The signals are the gate to Freeholder participation. They are deliberately
|
|
||||||
heterogeneous — no single input can be pumped — so the path resists gaming:
|
|
||||||
|
|
||||||
- [Signals](signals.md) — the four Freeholder signals (REQ-005): 90-day Stash,
|
|
||||||
4.5★+ in 3 categories, Capital, Vouch.
|
|
||||||
- [Standing](standing.md) — the Bayesian anti-gaming formula (REQ-006):
|
|
||||||
Bayesian prior + time-decay + diversity + voucher-weighting − slashes.
|
|
||||||
- [Stands & Guilds](stands-guilds.md) — the nine Stand types (REQ-016) and
|
|
||||||
Guilds with free Hand-Passes (REQ-017).
|
|
||||||
- [Councils & Voice](councils-voice.md) — the three Councils and the
|
|
||||||
non-amendable Mission Lock (REQ-011).
|
|
||||||
- [Bonds](bonds.md) — the Mesh Bond Market, the 8% coupon cap / 0% floor
|
|
||||||
(REQ-021).
|
|
||||||
- [Partner Spectrum](partner-spectrum.md) — the four Partner tiers (REQ-018):
|
|
||||||
Op, Master Op, Pier, Anchor.
|
|
||||||
- [Anchor Preview](anchor-preview.md) — the first institutional Partner tier
|
|
||||||
(REQ-023), coming in v0.3 P4.
|
|
||||||
|
|
||||||
## What a Freeholder does
|
|
||||||
|
|
||||||
A Freeholder is a Holder who has crossed the signal gate. From there the mesh
|
|
||||||
opens: a Freeholder joins a [Stand](stands-guilds.md) (or forms a Guild), votes
|
|
||||||
in the [Councils](councils-voice.md) with multi-source Voice, issues or holds
|
|
||||||
[Bonds](bonds.md) under the mission-locked coupon cap, and engages the
|
|
||||||
[Partner Spectrum](partner-spectrum.md) — including the Anchor tier coming in
|
|
||||||
v0.3. The covenant is the same for every audience; the Freeholder pages
|
|
||||||
describe how it shows up in governance and capital.
|
|
||||||
@@ -1,42 +0,0 @@
|
|||||||
# Partner Spectrum
|
|
||||||
|
|
||||||
OpenYield defines a four-tier **Partner Spectrum** (REQ-018, vision §13):
|
|
||||||
**Op**, **Master Op**, **Pier**, and **Anchor**. Partners are the external
|
|
||||||
actors a [Freeholder](index.md) interacts with through the mesh — service
|
|
||||||
operators, route providers, and institutional bridges. The four tiers are
|
|
||||||
locked as the `PartnerTier` enum in `x/partner` (exactly 4, regression-tested).
|
|
||||||
|
|
||||||
## The four tiers
|
|
||||||
|
|
||||||
- **Op** — a service operator. Runs a service a Holder uses through a
|
|
||||||
[Window](../nomads/window.md) (e.g., a Maps provider). The lightest tier.
|
|
||||||
- **Master Op** — a senior operator. Coordinates multiple Ops or runs a
|
|
||||||
higher-trust service. "Op" is the safe short form; the full word is not
|
|
||||||
used as a standalone term.
|
|
||||||
- **Pier** — a routing Partner. Connects the mesh to external venues (e.g.,
|
|
||||||
a DEX or an off-mesh service) and sources [Forex](../reference/components.md)
|
|
||||||
rates. Piers route; they do not custody Holder value.
|
|
||||||
- **Anchor** — the first institutional Partner tier. Carries a credential
|
|
||||||
(jurisdiction, custody provider, attestations). See
|
|
||||||
[Anchor Preview](anchor-preview.md) for what is coming in v0.3 P4.
|
|
||||||
|
|
||||||
## How Freeholders relate to Partners
|
|
||||||
|
|
||||||
A Freeholder authorizes a Partner to act on their behalf through a scoped,
|
|
||||||
time-limited, revocable [Window](../nomads/window.md) — never by handing over
|
|
||||||
custody. The Partner holds a credential, not the Holder's [Stash](../nomads/stash.md).
|
|
||||||
A Partner's [Standing](standing.md) is visible so a Freeholder can choose an
|
|
||||||
operator with a real history over a freshly-spun-up alternative (see
|
|
||||||
[Maps & Pay](../nomads/maps-pay.md)).
|
|
||||||
|
|
||||||
## Partner status
|
|
||||||
|
|
||||||
Each Partner has a status (locked `PartnerStatus` enum in `x/partner`):
|
|
||||||
Pending → Active, with Suspended and Revoked as the governance paths. The
|
|
||||||
[Mesh Council](councils-voice.md) can suspend or revoke a Partner. The four
|
|
||||||
tiers and the status enum are unchanged by v0.3 — v0.3 only *extends*
|
|
||||||
`x/partner` with the Anchor credential shape (REQ-023), not a new tier.
|
|
||||||
|
|
||||||
See [Storage Pools](../shared/storage-pools.md) for why the mesh says
|
|
||||||
"Holder" and "Reach" rather than the legacy custodial words, and
|
|
||||||
[Bonds](bonds.md) for the coupon market a Partner may route to.
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
# The Four Freeholder Signals
|
|
||||||
|
|
||||||
The four **Freeholder signals** (REQ-005) are the gate to Freeholder
|
|
||||||
participation. A [Holder](../nomads/reach.md) who earns all four becomes a
|
|
||||||
[Freeholder](index.md) — eligible to join [Stands & Guilds](stands-guilds.md),
|
|
||||||
vote in the [Councils](councils-voice.md), and issue [Bonds](bonds.md). The
|
|
||||||
signals are deliberately heterogeneous: no single input can be pumped, so the
|
|
||||||
path resists gaming.
|
|
||||||
|
|
||||||
## 1. The 90-day Stash
|
|
||||||
|
|
||||||
A Holder must hold a [Stash](../nomads/stash.md) continuously for 90 days
|
|
||||||
(REQ-014). The signal is about **continuity, not size** — a small Stash held
|
|
||||||
steadily counts. This filters out transient actors who spin up a position to
|
|
||||||
game a vote and then leave. See [Storage Pools](../shared/storage-pools.md)
|
|
||||||
for the three-pool model.
|
|
||||||
|
|
||||||
## 2. Standing of 4.5★ or higher in 3 categories
|
|
||||||
|
|
||||||
A Holder must earn a [Standing](standing.md) of 4.5★ or higher in **three
|
|
||||||
distinct categories** (REQ-006). The diversity requirement is the anti-gaming
|
|
||||||
core: a Holder cannot reach Freeholder by repeating the same action with the
|
|
||||||
same counterparty. Three categories force breadth.
|
|
||||||
|
|
||||||
## 3. Capital
|
|
||||||
|
|
||||||
The Capital signal requires a Holder to hold a meaningful amount of
|
|
||||||
[Bread](../shared/bread-scale.md) in their Stash. The threshold is set by the
|
|
||||||
mesh [Councils](councils-voice.md) and is a stake, not a fee: the Holder keeps
|
|
||||||
the Bread. Capital aligns the Freeholder's stake with the mesh.
|
|
||||||
|
|
||||||
## 4. Vouch
|
|
||||||
|
|
||||||
The Vouch signal requires another Freeholder to vouch for the Holder. A
|
|
||||||
vouch from a high-[Standing](standing.md) Freeholder carries more weight
|
|
||||||
(voucher-weighting), so a single colluding vouch cannot carry a Holder over
|
|
||||||
the gate. Vouch is the social signal that ties the other three together.
|
|
||||||
|
|
||||||
## Why four, not one
|
|
||||||
|
|
||||||
Each signal covers a different attack surface: continuity (90-day Stash),
|
|
||||||
breadth (3-category Standing), stake (Capital), and social trust (Vouch).
|
|
||||||
Earning all four is the proof a Holder is a participant, not a transient
|
|
||||||
gamer. See [Standing](standing.md) for the anti-gaming math, and
|
|
||||||
[Bonds](bonds.md) for what a Freeholder can do once the signals are earned.
|
|
||||||
@@ -1,49 +0,0 @@
|
|||||||
# Bayesian Standing
|
|
||||||
|
|
||||||
**Standing** (REQ-006) is a Holder's measured history on the mesh — the
|
|
||||||
anti-gaming metric that gates [Freeholder](index.md) participation and weighs
|
|
||||||
[Voice](councils-voice.md) in the [Councils](councils-voice.md). Standing is
|
|
||||||
not a count of transactions and not a reputation score you can farm. It is a
|
|
||||||
Bayesian score that resists the obvious attacks: volume spam, self-dealing,
|
|
||||||
fake vouches.
|
|
||||||
|
|
||||||
## The formula, at conceptual depth
|
|
||||||
|
|
||||||
Standing combines four signals and a penalty:
|
|
||||||
|
|
||||||
- **Bayesian prior + updates.** The mesh starts with a prior for each Holder
|
|
||||||
and updates it from each observed action. A burst of activity cannot
|
|
||||||
inflate Standing because the prior anchors it.
|
|
||||||
- **Time-decay.** Old evidence decays, so a Holder cannot rest on a burst
|
|
||||||
from years ago. Standing reflects *recent, sustained* real production.
|
|
||||||
- **Diversity weighting.** A Holder who acts across many services, many
|
|
||||||
[Stands](stands-guilds.md), and many [bearers](../nomads/bearers.md) accrues
|
|
||||||
more Standing than one who repeats the same action with the same
|
|
||||||
counterparty. Diversity is the anti-collusion lever.
|
|
||||||
- **Voucher-weighting.** A vouch from a high-Standing Freeholder counts for
|
|
||||||
more than a vouch from a low-Standing one. This makes fake vouches expensive:
|
|
||||||
the voucher must themselves have Standing to lose.
|
|
||||||
- **Minus slashes.** Bad behavior (failed attestations, broken Pacts) removes
|
|
||||||
Standing. Slashes are the penalty that bounds the upside of gaming.
|
|
||||||
|
|
||||||
> The full sub-tables (priors, decay rates, diversity categories, slash
|
|
||||||
> conditions) are deferred per PROJECT.md Q2. This page gives the conceptual
|
|
||||||
> depth; the [nomads Standing page](../nomads/standing.md) gives the plain-
|
|
||||||
> language version.
|
|
||||||
|
|
||||||
## Why it cannot be gamed
|
|
||||||
|
|
||||||
There is no single input a Holder can pump. Volume is bounded by the Bayesian
|
|
||||||
prior; recency is bounded by time-decay; breadth is bounded by diversity;
|
|
||||||
social trust is bounded by voucher-weighting; and any attempt that misfires
|
|
||||||
costs Standing via slashes. The four signals (the [90-day Stash](signals.md),
|
|
||||||
3-category threshold, Capital, Vouch) sit on top of this metric, so the
|
|
||||||
Freeholder gate inherits the same anti-gaming property.
|
|
||||||
|
|
||||||
## What Standing is not
|
|
||||||
|
|
||||||
Standing is not a custodial position, a tier you buy, or legacy history. It
|
|
||||||
is a measured, decayed, diversified Bayesian score. See
|
|
||||||
[Storage Pools](../shared/storage-pools.md) for why the mesh says "Stash"
|
|
||||||
rather than the legacy custodial words, and [Councils & Voice](councils-voice.md)
|
|
||||||
for how Standing weights a Freeholder's vote.
|
|
||||||
@@ -1,47 +0,0 @@
|
|||||||
# Stands & Guilds
|
|
||||||
|
|
||||||
A **Stand** is a governed group of Holders that holds a [Vault](../shared/storage-pools.md)
|
|
||||||
in common (REQ-016). A **Guild** is a looser association of Holders that can
|
|
||||||
pass value among its members for free (REQ-017). Both are the organizational
|
|
||||||
layer a [Freeholder](index.md) joins after earning the four
|
|
||||||
[signals](signals.md).
|
|
||||||
|
|
||||||
## The nine Stand types
|
|
||||||
|
|
||||||
OpenYield defines exactly nine Stand types (REQ-016, vision §11), locked as a
|
|
||||||
const in `x/stand`:
|
|
||||||
|
|
||||||
1. **Household** — a family-scale group.
|
|
||||||
2. **Crew** — a working team.
|
|
||||||
3. **Entity** — a single legal actor.
|
|
||||||
4. **Co-op** — a cooperative.
|
|
||||||
5. **Circle** — an affinity group.
|
|
||||||
6. **Trust** — a trust arrangement.
|
|
||||||
7. **Foundation** — a purpose-bound entity.
|
|
||||||
8. **Confederation** — a federation of Stands.
|
|
||||||
9. **Shadow** — a privacy-preserving Stand.
|
|
||||||
|
|
||||||
A Stand's decision policy (threshold or weighted, mirroring the Cosmos SDK
|
|
||||||
`x/group` shape) governs how its Vault is used. A Stand can also issue
|
|
||||||
[Bonds](bonds.md) — the bond issuer is a Stand, referenced by stand-id.
|
|
||||||
|
|
||||||
## Guilds and Hand-Passes
|
|
||||||
|
|
||||||
A **Guild** is a looser association: it may affiliate with a Stand or stand
|
|
||||||
alone. Inside a Guild, a **Hand-Pass** moves [Bread](../shared/bread-scale.md)
|
|
||||||
between members at a **0% protocol fee** (REQ-017, locked `HandPassFeeBps = 0`
|
|
||||||
in `x/guild`). The 0% fee is mission-locked: the mesh does not tax the social
|
|
||||||
transfer of value among a self-organized group. See the
|
|
||||||
[Fee Covenant](../shared/six-principles.md) for the broader fee shape.
|
|
||||||
|
|
||||||
## How a Freeholder joins
|
|
||||||
|
|
||||||
A Freeholder joins a Stand by becoming a member (the Stand's policy admits
|
|
||||||
them) or forms a Guild as a founder. Membership is recorded in `x/stand`
|
|
||||||
and `x/guild` respectively, by stand-id / guild-id and the member's
|
|
||||||
[Reach](../nomads/reach.md). From a Stand a Freeholder gains Vault access and
|
|
||||||
the ability to issue [Bonds](bonds.md); from a Guild a Freeholder gains free
|
|
||||||
Hand-Passes with other members.
|
|
||||||
|
|
||||||
See [Councils & Voice](councils-voice.md) for how Stands and Guilds each get a
|
|
||||||
Council, and [Storage Pools](../shared/storage-pools.md) for the Vault layer.
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
# OpenYield
|
|
||||||
|
|
||||||
OpenYield is a jurisdiction-light, public-good mesh for **real production**. It
|
|
||||||
runs on OY Chain (Layer 1), a canonical state layer for the Bread unit, the
|
|
||||||
Storage Pools, Standing, Watcher attestations, and the Pact / Council /
|
|
||||||
Partner surface. The mesh is anti-greed by construction: Mission Lock fixes
|
|
||||||
the Six Principles and fee covenant so no council can amend them, and the
|
|
||||||
coupon cap on bonds is a mission-locked ceiling, not a parameter.
|
|
||||||
|
|
||||||
## Audiences
|
|
||||||
|
|
||||||
The docs are organized by audience:
|
|
||||||
|
|
||||||
- **Nomads** — the everyday Holder: your Reach, your Stash, your bearers, how
|
|
||||||
you pay (Maps-Pay), the Pacts you join, and the Window you open. See
|
|
||||||
[Nomads](nomads/index.md).
|
|
||||||
- **Freeholders** — the active participant: the four signals, Bayesian
|
|
||||||
Standing, Stands & Guilds, the three Councils and Voice, the bond market,
|
|
||||||
and the four-tier Partner Spectrum. See [Freeholders](freeholders/index.md).
|
|
||||||
- **Shared** — concepts common to every audience: the Six Principles, the
|
|
||||||
Bread scale, the three Storage Pools, the Watchers & Mirror, the lexicon
|
|
||||||
glossary, and the vision overview. See [Shared](shared/index.md).
|
|
||||||
- **Reference** — the architecture and component map. See
|
|
||||||
[Reference](reference/architecture.md).
|
|
||||||
|
|
||||||
## Build the docs
|
|
||||||
|
|
||||||
This site is [MkDocs Material](https://squidfunk.github.io/mkdocs-material/),
|
|
||||||
a build-only Python dep (not a Go dep). To preview locally, see the
|
|
||||||
[README](../README.md) for build instructions.
|
|
||||||
@@ -1,46 +0,0 @@
|
|||||||
# Bearers
|
|
||||||
|
|
||||||
The **bearers** (REQ-019) are how a Nomad reaches the mesh. OpenYield ships
|
|
||||||
six bearers through a single **Unified Bearer Layer**: the mesh does not
|
|
||||||
care which bearer a Holder uses — first-to-deliver-wins, and a Nomad can
|
|
||||||
switch bearers without switching identity. The [Mirror](../shared/watchers-mirror.md)
|
|
||||||
mirrors the canonical state to every bearer so a Nomad can read the mesh's
|
|
||||||
real return on any of them.
|
|
||||||
|
|
||||||
## The six bearers
|
|
||||||
|
|
||||||
| Bearer | Live in v0.2 | What it is |
|
|
||||||
|---|---|---|
|
|
||||||
| **Internet** | yes | the default bearer; OY Chain over the open internet. |
|
|
||||||
| **OY-BLE** | yes | Bluetooth Low Energy; short-range, peer-to-peer, no phone plan. |
|
|
||||||
| **OY-WiFi-Direct** | yes | WiFi Direct; local mesh without an access point. |
|
|
||||||
| **OY-LR** | yes | Long Range radio (LoRa-class); long-distance, low-bandwidth, surveillance-resistant. |
|
|
||||||
| **OY-SAT** | coming (v0.3 P4) | satellite; offline coverage via a satellite constellation. |
|
|
||||||
| **OY-QR** | coming (v0.3 P4) | signed QR code; one-shot offline transfer scanned by a peer. |
|
|
||||||
|
|
||||||
## What this means for a Nomad
|
|
||||||
|
|
||||||
A Nomad does not pick "the right bearer". The four already-live bearers
|
|
||||||
(Internet, OY-BLE, OY-WiFi-Direct, OY-LR) cover the everyday situations:
|
|
||||||
on the open internet, in a room with another Holder, in a local group with
|
|
||||||
no router, or kilometers away with no infrastructure. OY-SAT and OY-QR
|
|
||||||
extend that to true-offline paths and are coming in the next phase.
|
|
||||||
|
|
||||||
## Surveillance resistance
|
|
||||||
|
|
||||||
OY-LR, OY-BLE, OY-WiFi-Direct, OY-SAT, and OY-QR are designed to be
|
|
||||||
surveillance-resistant: a Nomad can send or receive value without a
|
|
||||||
phone plan, a SIM, or a custodial on-ramp. The bearer is the transport; the
|
|
||||||
[Reach](reach.md) is the identity; the [Stash](stash.md) is the storage. None
|
|
||||||
of them depends on a custodial position.
|
|
||||||
|
|
||||||
## First-to-deliver-wins
|
|
||||||
|
|
||||||
The Unified Bearer Layer is first-to-deliver-wins: if a Nomad sends a
|
|
||||||
transfer over two bearers at once, the mesh accepts the first one that
|
|
||||||
arrives and drops the duplicate. This is why a Nomad can switch bearers
|
|
||||||
mid-transfer without double-spending.
|
|
||||||
|
|
||||||
See [Watchers & Mirror](../shared/watchers-mirror.md) for how the canonical
|
|
||||||
state is mirrored to every bearer, and [Maps & Pay](maps-pay.md) for how a
|
|
||||||
Nomad uses a bearer to find and pay for services.
|
|
||||||
@@ -1,42 +0,0 @@
|
|||||||
# Nomads
|
|
||||||
|
|
||||||
A **Nomad** is a person using the OpenYield mesh through a **Reach** — the
|
|
||||||
protocol-level identity a Holder uses to act on the mesh without a
|
|
||||||
custodian, a gatekeeper, or a legacy financial position. The Nomad path
|
|
||||||
is the entry path: a Nomad is a Holder who has a Reach and a [Stash](stash.md)
|
|
||||||
and is on the way to earning the four Freeholder signals, but has not yet
|
|
||||||
earned all four.
|
|
||||||
|
|
||||||
## The Nomad path
|
|
||||||
|
|
||||||
The pages here cover what a Nomad does day-to-day on the mesh:
|
|
||||||
|
|
||||||
- [Reach](reach.md) — the identity; the first Freeholder signal (REQ-005).
|
|
||||||
- [Stash](stash.md) — the personal [Storage Pool](../shared/storage-pools.md)
|
|
||||||
where a Nomad holds Bread (REQ-014).
|
|
||||||
- [Bearers](bearers.md) — how a Nomad reaches the mesh (REQ-019): Internet,
|
|
||||||
OY-BLE, OY-WiFi-Direct, OY-LR live now; OY-SAT and OY-QR coming.
|
|
||||||
- [Maps & Pay](maps-pay.md) — finding services and paying for them.
|
|
||||||
- [Pacts](pacts.md) — the six contract shapes a Nomad encounters
|
|
||||||
(REQ-020): Pause, Ground, Stance, Cover, Stand Registry, Hub API.
|
|
||||||
- [Standing](standing.md) — the Bayesian anti-gaming metric (REQ-006),
|
|
||||||
and why the mesh cannot be gamed.
|
|
||||||
- [Window](window.md) — the delegation primitive (REQ-015): scope,
|
|
||||||
duration, rate-limit, audit-log, revoke.
|
|
||||||
|
|
||||||
## Where a Nomad starts
|
|
||||||
|
|
||||||
A Nomad starts with a Reach and a Stash — that is enough to begin. From
|
|
||||||
there the bearers carry value to the Stash, Maps finds services, Pay and
|
|
||||||
the Window let a Nomad use them without giving up custody, and Standing
|
|
||||||
accrues as the Nomad acts. A Nomad who earns the 90-day Stash signal, the
|
|
||||||
Standing threshold, the Capital signal, and the Vouch signal becomes a
|
|
||||||
Freeholder (see the Freeholders section).
|
|
||||||
|
|
||||||
## Shared concepts
|
|
||||||
|
|
||||||
The Nomad path rests on the [shared concepts](../shared/index.md): the
|
|
||||||
[Six Principles](../shared/six-principles.md), the [Bread scale](../shared/bread-scale.md),
|
|
||||||
the [Storage Pools](../shared/storage-pools.md), the [Watchers & Mirror](../shared/watchers-mirror.md),
|
|
||||||
and the [Lexicon](../shared/lexicon.md). The covenant is the same for
|
|
||||||
every audience; the Nomad pages describe how it shows up in everyday use.
|
|
||||||
@@ -1,46 +0,0 @@
|
|||||||
# Maps & Pay
|
|
||||||
|
|
||||||
**Maps** and **Pay** are the day-to-day Mesh Experience a Nomad uses on the
|
|
||||||
mesh. Maps finds services; Pay settles them. Both run over the
|
|
||||||
[bearers](bearers.md) and read the [Mirror](../shared/watchers-mirror.md) so a
|
|
||||||
Nomad can find and pay for a service on a surveillance-resistant bearer
|
|
||||||
without an internet connection to OY Chain.
|
|
||||||
|
|
||||||
## Maps
|
|
||||||
|
|
||||||
Maps is the directory of services a Nomad can reach. A service is anything
|
|
||||||
a Partner or a Stand exposes to the mesh: a Care service, a SIM, a Vault,
|
|
||||||
a Mailbox (preview of v0.3 P5 — see [Pacts](pacts.md) for the Hub API). Maps
|
|
||||||
is sorted by geographic proximity (REQ-007): a Nomad physically closer to a
|
|
||||||
service or its operator is shown that service first. There is no paid
|
|
||||||
ranking; the order is proximity, not promotion.
|
|
||||||
|
|
||||||
## Pay
|
|
||||||
|
|
||||||
Pay is how a Nomad settles a service. A payment is a transfer of Bread
|
|
||||||
from the Nomad's [Stash](stash.md) to the service operator's Stash, signed
|
|
||||||
by the Nomad's [Reach](reach.md). The fee covenant floors and caps the fee;
|
|
||||||
inside a Guild, a Hand-Pass is free at the protocol level (REQ-017). Pay
|
|
||||||
runs over any bearer, first-to-deliver-wins.
|
|
||||||
|
|
||||||
## Authorize, don't hand over
|
|
||||||
|
|
||||||
For recurring services a Nomad does not re-sign every payment. Instead
|
|
||||||
the Nomad opens a [Window](window.md) to the service: a scoped,
|
|
||||||
time-limited, rate-limited, revocable capability that lets the service pull
|
|
||||||
value from the Stash within bounds the Nomad set. The Window is audited;
|
|
||||||
the Nomad can revoke it at any time. This is the self-service principle in
|
|
||||||
practice: the Nomad delegates a capability, not custody.
|
|
||||||
|
|
||||||
## Find, pay, verify
|
|
||||||
|
|
||||||
A Nomad's loop is:
|
|
||||||
|
|
||||||
1. **Find** a service on Maps.
|
|
||||||
2. **Pay** once, or **authorize** a [Window](window.md) for recurring use.
|
|
||||||
3. **Verify** the service against the Watcher attestations on the Mirror
|
|
||||||
(see [Watchers & Mirror](../shared/watchers-mirror.md)).
|
|
||||||
|
|
||||||
See [Stash](stash.md) for where the Bread comes from, [Window](window.md)
|
|
||||||
for the delegation primitive, and [Standing](standing.md) for how a
|
|
||||||
service operator's history is measured.
|
|
||||||
@@ -1,41 +0,0 @@
|
|||||||
# Pacts
|
|
||||||
|
|
||||||
The **six Pacts** (REQ-020) are the contract shapes a Nomad encounters on
|
|
||||||
the mesh. A Pact is a typed, mission-locked agreement between parties; the
|
|
||||||
core terms of the Pause, Ground, and Stance Pacts are **non-amendable** —
|
|
||||||
no Council can rewrite them after the fact. A Nomad mostly interacts with
|
|
||||||
Pacts through [Maps & Pay](maps-pay.md) and the [Window](window.md)
|
|
||||||
primitive, but it helps to know what each one is.
|
|
||||||
|
|
||||||
## The six Pacts
|
|
||||||
|
|
||||||
| Pact | What it does for a Nomad |
|
|
||||||
|---|---|
|
|
||||||
| **Pause** | A temporary hold. A Nomad can pause a recurring payment or a Window without voiding it; the Pause core terms are non-amendable. |
|
|
||||||
| **Ground** | A baseline obligation the mesh enforces by default — the "ground rules" between a Nomad and a service operator. Non-amendable. |
|
|
||||||
| **Stance** | A stated position a party commits to (e.g., a service operator's Stance on jurisdiction-light operation). Non-amendable. |
|
|
||||||
| **Cover** | A flat commitment a Stand or a Partner offers to cover a Nomad against a defined failure; a Nomad reads Cover when choosing a service. |
|
|
||||||
| **Stand Registry** | The registry of the nine [Stand](../shared/storage-pools.md) types (Household, Crew, Entity, Co-op, Circle, Trust, Foundation, Confederation, Shadow) a Nomad can join. |
|
|
||||||
| **Hub API** | The B2B backbone (preview of v0.3 P5) — the Hub Pact exposes custody, a lending primitive, and compliance to service operators. A Nomad sees the Hub through Maps, not directly. |
|
|
||||||
|
|
||||||
## What a Nomad actually does with Pacts
|
|
||||||
|
|
||||||
A Nomad does not draft Pacts by hand. The flow is:
|
|
||||||
|
|
||||||
1. **Find** a service on [Maps & Pay](maps-pay.md).
|
|
||||||
2. The service's terms are backed by one or more Pacts (e.g., a recurring
|
|
||||||
payment is a Pause-able Window; a Stand's service is registered in the
|
|
||||||
Stand Registry).
|
|
||||||
3. The Nomad **authorizes** a [Window](window.md) scoped to those terms.
|
|
||||||
|
|
||||||
## Mission Lock
|
|
||||||
|
|
||||||
The Pause, Ground, and Stance core terms are mission-locked: a `const`
|
|
||||||
flag in the Pact module marks them non-amendable, and an invariant test
|
|
||||||
asserts that flag can never flip. A Nomad can rely on the ground rules
|
|
||||||
not changing. See [Six Principles](../shared/six-principles.md) for the
|
|
||||||
mission-lock covenant.
|
|
||||||
|
|
||||||
See [Window](window.md) for the delegation primitive the Pacts are
|
|
||||||
delivered through, and [Standing](standing.md) for how a service
|
|
||||||
operator's history is measured.
|
|
||||||
@@ -1,48 +0,0 @@
|
|||||||
# Reach
|
|
||||||
|
|
||||||
A **Nomad** is a person using the OpenYield mesh through a **Reach** — the
|
|
||||||
protocol-level identity that lets a Holder act on the mesh without a
|
|
||||||
custodian, a gatekeeper, or a legacy financial position. The Reach is the
|
|
||||||
first of the four Freeholder signals (REQ-005), and it is the baseline every
|
|
||||||
Nomad starts from: a Nomad is a Holder who has a Reach and a Stash but has not
|
|
||||||
yet earned all four Freeholder signals.
|
|
||||||
|
|
||||||
## What a Reach is
|
|
||||||
|
|
||||||
A Reach is an identity, not a custodial position. It is the by-ID-string a
|
|
||||||
Holder uses to receive value, open a [Window](window.md), join a Stand, or
|
|
||||||
pay for a service. The protocol does not require KYC at the protocol layer;
|
|
||||||
the Reach is the unit of self-service (see [Six
|
|
||||||
Principles](../shared/six-principles.md)).
|
|
||||||
|
|
||||||
## How a Nomad starts
|
|
||||||
|
|
||||||
A Nomad starts with two things:
|
|
||||||
|
|
||||||
1. **A Reach** — the identity.
|
|
||||||
2. **A [Stash](stash.md)** — the personal [Storage Pool](../shared/storage-pools.md)
|
|
||||||
where the Holder holds Bread.
|
|
||||||
|
|
||||||
That pair is enough to begin. From there a Nomad can use the [bearers](bearers.md)
|
|
||||||
to reach the mesh, find services on [Maps & Pay](maps-pay.md), authorize a
|
|
||||||
[Window](window.md) to a partner, and accrue [Standing](standing.md).
|
|
||||||
|
|
||||||
## Geographic proximity
|
|
||||||
|
|
||||||
The mesh processes actions first-come, first-served with a
|
|
||||||
geographic-proximity preference (REQ-007) — a Nomad physically closer to a
|
|
||||||
service or a Stand's region is served first. The Reach is how the mesh
|
|
||||||
identifies the Nomad for that ordering; there is no separate tier to buy into.
|
|
||||||
|
|
||||||
## The four Freeholder signals
|
|
||||||
|
|
||||||
The Reach is the first Freeholder signal. The four signals (REQ-005) are
|
|
||||||
earned over time: the 90-day [Stash](stash.md) signal, the Standing
|
|
||||||
threshold, the Capital signal, and the Vouch signal. A Nomad who earns all
|
|
||||||
four becomes a Freeholder (see the Freeholders section). The pages here cover
|
|
||||||
the Nomad path — everything up to that point.
|
|
||||||
|
|
||||||
See [Stash](stash.md) for the Storage Pool a Reach holds Bread in,
|
|
||||||
[Bearers](bearers.md) for how to reach the mesh, and
|
|
||||||
[Standing](standing.md) for the anti-gaming metric that accrues as a Nomad
|
|
||||||
acts on the mesh.
|
|
||||||
@@ -1,44 +0,0 @@
|
|||||||
# Standing
|
|
||||||
|
|
||||||
**Standing** (REQ-006) is a Holder's measured history on the mesh. It is
|
|
||||||
the anti-gaming metric: a Bayesian score with time-decay, diversity
|
|
||||||
weighting, and voucher-weighting, minus slashes for bad behavior. For a
|
|
||||||
Nomad, the headline is that the mesh **cannot be gamed** — Standing
|
|
||||||
rewards real production and resists the obvious attacks (volume spam,
|
|
||||||
self-dealing, fake vouches).
|
|
||||||
|
|
||||||
## What Standing is, in plain language
|
|
||||||
|
|
||||||
Standing is not a count of transactions. It is a Bayesian score: the mesh
|
|
||||||
starts with a prior, updates it from each observed action, and decays
|
|
||||||
old evidence so a Holder cannot rest on a burst of activity from years
|
|
||||||
ago. Diversity weighting means a Nomad who acts across many services,
|
|
||||||
many Stands, and many bearers accrues more Standing than a Nomad who
|
|
||||||
repeats the same action with the same counterparty. Voucher-weighting
|
|
||||||
means a vouch from a Holder with high Standing counts for more.
|
|
||||||
|
|
||||||
## Why it matters to a Nomad
|
|
||||||
|
|
||||||
A Nomad mostly reads Standing, not computes it. Two places it shows up:
|
|
||||||
|
|
||||||
- **Choosing a service.** Maps shows a service operator's Standing so a
|
|
||||||
Nomad can pick an operator with a real history over a freshly-spun-up
|
|
||||||
alternative (see [Maps & Pay](maps-pay.md)).
|
|
||||||
- **The Freeholder path.** Earning a Standing threshold in 3 categories
|
|
||||||
is one of the four Freeholder signals (REQ-005). A Nomad who accrues
|
|
||||||
Standing over time is on the path to becoming a Freeholder.
|
|
||||||
|
|
||||||
## What Standing is not
|
|
||||||
|
|
||||||
Standing is not a custodial position, a tier you buy, or a reputation
|
|
||||||
score you can farm. It is not legacy custodial history. The
|
|
||||||
Bayesian + time-decay + diversity design is exactly what makes it hard to
|
|
||||||
game: there is no single input a Holder can pump.
|
|
||||||
|
|
||||||
## The math, deferred
|
|
||||||
|
|
||||||
The full Bayesian formula (priors, decay rates, diversity sub-tables,
|
|
||||||
slash conditions) is documented in the Freeholders section — a Nomad does
|
|
||||||
not need the math to use the mesh. See
|
|
||||||
[Six Principles](../shared/six-principles.md) for the covenant Standing
|
|
||||||
enforces, and [Reach](reach.md) for the identity a Standing accrues to.
|
|
||||||
@@ -1,48 +0,0 @@
|
|||||||
# Stash
|
|
||||||
|
|
||||||
A **Stash** is a Holder's personal [Storage Pool](../shared/storage-pools.md)
|
|
||||||
(REQ-014). It is the place a Nomad holds Bread, and it is the second thing a
|
|
||||||
Nomad needs after a [Reach](reach.md) to begin. The Stash is the unit of
|
|
||||||
self-service: the Holder owns it, controls it, and can delegate a scoped,
|
|
||||||
time-limited, revocable [Window](window.md) to a partner or a service
|
|
||||||
without giving up custody.
|
|
||||||
|
|
||||||
## What a Stash is
|
|
||||||
|
|
||||||
The Stash is the Holder-level layer of the three Storage Pools (Stash,
|
|
||||||
Vault, Root-Pool). It is a storage layer, not a custodial position: the
|
|
||||||
protocol holds the canonical state that records who owns what; the Holder
|
|
||||||
holds the value. There is no custodian between a Nomad and their Stash.
|
|
||||||
|
|
||||||
## How a Nomad uses a Stash
|
|
||||||
|
|
||||||
A Nomad moves Bread into a Stash through the [bearers](bearers.md) — a
|
|
||||||
Holder on a surveillance-resistant bearer can receive value without an
|
|
||||||
internet connection to OY Chain. From the Stash a Nomad can:
|
|
||||||
|
|
||||||
- **Hold** Bread (the unit of value — see [Bread scale](../shared/bread-scale.md)).
|
|
||||||
- **Pass** value to another Reach (the Hand-Pass, free at the protocol
|
|
||||||
level inside a Guild).
|
|
||||||
- **Pay** for a service via [Maps & Pay](maps-pay.md).
|
|
||||||
- **Authorize** a [Window](window.md) so a partner or service can read the
|
|
||||||
Stash within bounds the Holder set.
|
|
||||||
|
|
||||||
## The 90-day Freeholder signal
|
|
||||||
|
|
||||||
Holding a Stash continuously for 90 days is the first of the four
|
|
||||||
Freeholder signals (REQ-005). The Stash does not need to hold a large
|
|
||||||
amount — the signal is about continuity, not size. A Nomad who keeps a
|
|
||||||
Stash for 90 days and earns the other three signals (Standing, Capital,
|
|
||||||
Vouch) becomes a Freeholder.
|
|
||||||
|
|
||||||
## Delegation, not custody
|
|
||||||
|
|
||||||
The Stash stays the Holder's. When a Nomad opens a Window to a service,
|
|
||||||
the service gets a scoped capability (e.g., "read Stash balance for the
|
|
||||||
next hour", "spend up to N Grain on this service this week") — it does not
|
|
||||||
get custody. The Window is revocable, rate-limited, and audited. See
|
|
||||||
[Window](window.md) for the primitive.
|
|
||||||
|
|
||||||
See [Storage Pools](../shared/storage-pools.md) for the full three-pool
|
|
||||||
model, and [Bearers](bearers.md) for how value reaches a Stash over a
|
|
||||||
surveillance-resistant bearer.
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
# Window
|
|
||||||
|
|
||||||
A **Window** (REQ-015) is the primitive a Nomad uses to delegate a
|
|
||||||
capability without delegating custody. It is scoped, time-limited,
|
|
||||||
rate-limited, audited, and revocable. A Nomad opens a Window so a partner
|
|
||||||
or a service can act on the Nomad's [Stash](stash.md) within bounds the
|
|
||||||
Nomad set — the partner never gets custody, and the Nomad can close the
|
|
||||||
Window at any time.
|
|
||||||
|
|
||||||
## The five parts of a Window
|
|
||||||
|
|
||||||
| Part | What it bounds |
|
|
||||||
|---|---|
|
|
||||||
| **Scope** | what the grantee can do (e.g., read Stash balance, spend up to N Grain on a specific service). |
|
|
||||||
| **Duration** | when the Window starts and ends (a start time and an end time). |
|
|
||||||
| **Rate limit** | how many actions per duration window (e.g., at most 10 reads per hour). |
|
|
||||||
| **Audit log** | an append-only log of every action the grantee took under the Window. |
|
|
||||||
| **Revoke** | the Nomad can revoke the Window at any time; revoke after expiry is a no-op. |
|
|
||||||
|
|
||||||
## Why a Nomad opens one
|
|
||||||
|
|
||||||
A Nomad opens a Window for the same reason a Nomad uses [Maps & Pay](maps-pay.md):
|
|
||||||
to let a service do something on the Nomad's behalf without handing over
|
|
||||||
the Stash. Common examples:
|
|
||||||
|
|
||||||
- A recurring service (e.g., a Care service) pulls a capped amount of
|
|
||||||
Bread from the Stash each week, within a rate limit the Nomad set.
|
|
||||||
- A partner reads the Stash balance for a compliance check, scoped to
|
|
||||||
read-only, time-limited to one hour.
|
|
||||||
- A Stand operator processes a Pass-Act on the Nomad's behalf inside a
|
|
||||||
scoped, audited Window.
|
|
||||||
|
|
||||||
## Lifecycle
|
|
||||||
|
|
||||||
A Window moves through a fixed lifecycle: **Open → Active → Revoked** or
|
|
||||||
**Expired**. A Nomad can revoke at any point; revoking after expiry is a
|
|
||||||
no-op (idempotent). The lifecycle is mission-locked: a partner cannot
|
|
||||||
extend a Window past its end time — the Nomad must open a new one.
|
|
||||||
|
|
||||||
## Self-service, by design
|
|
||||||
|
|
||||||
The Window is the self-service principle in code. The protocol records
|
|
||||||
the Window on OY Chain; the partner holds only the capability, never the
|
|
||||||
value. See [Six Principles](../shared/six-principles.md) for the covenant,
|
|
||||||
and [Pacts](pacts.md) for the contract shapes delivered through Windows.
|
|
||||||
@@ -1,51 +0,0 @@
|
|||||||
# Architecture
|
|
||||||
|
|
||||||
This is the architecture index for OpenYield. The mesh is built from 14
|
|
||||||
modular components and 6 cross-component interfaces, with a critical blocker
|
|
||||||
chain that fixes the build order. The full governance source lives in
|
|
||||||
`.ciagent/oy/ARCHITECTURE.md`; this page is the user-facing rewrite, kept
|
|
||||||
lexicon-clean by the [docs firewall](../shared/lexicon.md).
|
|
||||||
|
|
||||||
## The 14 modular components
|
|
||||||
|
|
||||||
| # | Component | Vision § | Phase |
|
|
||||||
|---|---|---|---|
|
|
||||||
| 1 | OY Chain & Mirror | §7 | P1 |
|
|
||||||
| 2 | Cross-Chain & Exit | §7 | P3 |
|
|
||||||
| 3 | Bread Unit & Root Basket | §6, §16 | P1 |
|
|
||||||
| 4 | Bloom Engine | §6 | P1 |
|
|
||||||
| 5 | Storage Substrate | §5 | P1 |
|
|
||||||
| 6 | Identity, Standing & Citizenship | §8, §9 | P1 |
|
|
||||||
| 7 | Window Primitive | §10 | P2 |
|
|
||||||
| 8 | Pacts Suite (Pause, Ground, Stance, Cover, Stand Registry, Hub API, Bonds) | §16, §17 | P2 |
|
|
||||||
| 9 | Mesh Experience (Maps, Pay) | §8 | P1 |
|
|
||||||
| 10 | Organizational Primitives (Stands, Guilds) | §11, §12 | P2 |
|
|
||||||
| 11 | Partner Spectrum & Forex | §13 | P2 |
|
|
||||||
| 12 | Bearers & Processing Mesh | §14, §15 | P1 |
|
|
||||||
| 13 | Fee Covenant | §18 | P1 |
|
|
||||||
| 14 | Governance (Mesh/Guild/Stand Councils) | §19 | P2 |
|
|
||||||
|
|
||||||
## The 6 cross-component interfaces
|
|
||||||
|
|
||||||
1. **Standing API** — consumed by Identity, Window, Pacts, Orgs, Partners,
|
|
||||||
and Governance. See [Standing](../freeholders/standing.md).
|
|
||||||
2. **Forge / Fold Interface** — mints [Bread](../shared/bread-scale.md)
|
|
||||||
against Root Basket assets only. See the Bloom Engine.
|
|
||||||
3. **Watcher Attestation Interface (the Mirror)** — 9 Watchers, 6-of-9
|
|
||||||
quorum. See [Watchers & Mirror](../shared/watchers-mirror.md).
|
|
||||||
4. **Window Lifecycle Interface** — Holder-authorized, scope-bounded,
|
|
||||||
revocable. See [Window](../nomads/window.md).
|
|
||||||
5. **Fee Covenant Interface** — auto-decline, ceiling/floor enforced.
|
|
||||||
See [Six Principles](../shared/six-principles.md).
|
|
||||||
6. **Voice / Council Interface** — multi-source Voice, Mission Lock enforced.
|
|
||||||
See [Councils & Voice](../freeholders/councils-voice.md).
|
|
||||||
|
|
||||||
## The critical blocker chain
|
|
||||||
|
|
||||||
The components build in a fixed order: OY Chain (1) → Bread/Root Basket (3)
|
|
||||||
→ Storage (5) → Identity/Standing (6), which then unblocks {Window (7),
|
|
||||||
Pacts (8), Orgs (10), Partners (11), Governance (14)}. The Fee Covenant (13)
|
|
||||||
blocks Pacts, Orgs, Partners, and Bearers — the fee shape must exist before
|
|
||||||
any of those can ship. v0.3 adds the Cross-Chain & Exit layer (component 2)
|
|
||||||
and the Bearers/Partner/Bond extensions; see [Components](components.md) for
|
|
||||||
the `x/` module map and the v0.3 phase status.
|
|
||||||
@@ -1,62 +0,0 @@
|
|||||||
# Component Map
|
|
||||||
|
|
||||||
This is the `x/` module map for OpenYield. Each module is a Cosmos-SDK-style
|
|
||||||
`x/<name>/types/` package, zero external Go deps (G-006), referenced by
|
|
||||||
ID-string across modules (G-003 — no struct imports). The map covers v0.1,
|
|
||||||
v0.2, and v0.3 (skeleton + tests depth, D-020/D-035).
|
|
||||||
|
|
||||||
## v0.1 baseline (pre-MVP skeleton)
|
|
||||||
|
|
||||||
| Module | Vision § | REQ | Purpose |
|
|
||||||
|---|---|---|---|
|
|
||||||
| `x/mesh` | §7 | REQ-008 | OY Chain (Layer 1) shell |
|
|
||||||
| `x/mirror` | §7 | REQ-004 | Mirror of canonical state to bearers |
|
|
||||||
| `x/bread` | §4, §6 | REQ-013 | Bread unit + 11-tier scale |
|
|
||||||
| `x/bloom` | §6 | REQ-003 | Bloom Engine (real production only) |
|
|
||||||
| `x/forge` | §4.2 | REQ-003 | Forge/Fold minting against Root Basket |
|
|
||||||
| `x/rootpool` | §5 | REQ-014 | Root-Pool (mesh treasury) |
|
|
||||||
| `x/stash` | §5 | REQ-014 | Stash (Holder-level storage pool) |
|
|
||||||
| `x/vault` | §5 | REQ-014 | Vault (Stand-level storage pool) |
|
|
||||||
| `x/identity` | §8 | REQ-005 | Reach identity (Holder, no KYC) |
|
|
||||||
| `x/standing` | §9.2 | REQ-006 | Bayesian Standing |
|
|
||||||
| `x/processing` | §15 | REQ-007 | FCFS processing mesh |
|
|
||||||
| `x/watcher` | §7 | REQ-004 | 9 Watchers, 6-of-9 quorum |
|
|
||||||
| `x/feecovenant` | §18 | REQ-002 | Fee ceiling/floor/minimum |
|
|
||||||
| `x/still` | §3 | — | Still/Stir pause/resume state |
|
|
||||||
| `x/bearers` | §14 | REQ-019 | Unified Bearer Layer (6 bearers) |
|
|
||||||
|
|
||||||
## v0.2 (The Mesh — skeleton + tests)
|
|
||||||
|
|
||||||
| Module | Vision § | REQ | Purpose |
|
|
||||||
|---|---|---|---|
|
|
||||||
| `x/window` | §10 | REQ-015 | Window primitive (scope, rate-limit, revoke) |
|
|
||||||
| `x/stand` | §11 | REQ-016 | Nine Stand types |
|
|
||||||
| `x/guild` | §12 | REQ-017 | Guilds + Hand-Passes at 0% protocol fee |
|
|
||||||
| `x/pact` | §16 | REQ-020 | Six Pacts (Pause, Ground, Stance, Cover, Stand Registry, Hub API) |
|
|
||||||
| `x/partner` | §13 | REQ-018 | Four-tier Partner Spectrum (Op, Master Op, Pier, Anchor) |
|
|
||||||
| `x/council` | §19 | REQ-011 | Three Councils + Mission Lock (non-amendable) |
|
|
||||||
| `x/forex` | §13 | Forex v1 | Forex Engine v1 (pair type + oracle interface) |
|
|
||||||
| `x/bond` | §17 | REQ-021 | Mesh Bond Market (8% cap / 0% floor clamp) |
|
|
||||||
| `x/satellite` | §7 | REQ-009 | L2 IBC Satellite (Polygon active + 4 stubs) |
|
|
||||||
|
|
||||||
## v0.3 (Bearers & Documentation — in progress)
|
|
||||||
|
|
||||||
| Module | Vision § | REQ | Status | Purpose |
|
|
||||||
|---|---|---|---|---|
|
|
||||||
| `x/bridge` | §7 | REQ-010 | P4 (pending) | L2↔L1 bridge routes |
|
|
||||||
| `x/exit` | §7 | REQ-010 | P4 (pending) | Exit routes + DEX swaps |
|
|
||||||
| `x/bearers` (ext) | §14 | REQ-022 | P4 (pending) | OY-SAT + OY-QR transport stubs |
|
|
||||||
| `x/partner` (ext) | §13 | REQ-023 | P4 (pending) | AnchorCredential (Anchor tier) |
|
|
||||||
| `x/hub` | §13, §16 | REQ-024 | P5 (pending) | Hub API (Custody, Lending, Compliance) |
|
|
||||||
| `x/services` | §13 | REQ-025 | P5 (pending) | Services (Care, SIM, Vault, Mail) |
|
|
||||||
| `x/bond` (ext) | §17 | REQ-026 | P5 (pending) | Growth Bonds + secondary market |
|
|
||||||
|
|
||||||
## Notes
|
|
||||||
|
|
||||||
- Every module follows the same pattern: `types/types.go` + `types/types_test.go`
|
|
||||||
(package `types`), zero external deps, by-ID-string inter-module refs (G-003).
|
|
||||||
- Each new/extended test file includes a lexicon assertion (REQ-012); the
|
|
||||||
project-wide meta-test (`lexicon_meta_test.go`) scans all `x/**/*.go`.
|
|
||||||
- The docs firewall (`lexicon_meta_docs_test.go`) scans `README.md` + all
|
|
||||||
`docs/**/*.md`. See the [architecture index](architecture.md) for the
|
|
||||||
14-component view and the 6 cross-component interfaces.
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
# Bread scale
|
|
||||||
|
|
||||||
The unit of value in OpenYield is **Bread** (REQ-013). Bread is scaled in 11
|
|
||||||
tiers, each 1,000× the previous, so a Holder can reason about a Crumb and a
|
|
||||||
Granary in the same mental model:
|
|
||||||
|
|
||||||
| Tier | Name | Multiple |
|
|
||||||
|---|---|---|
|
|
||||||
| 1 | **Grain** | 1 |
|
|
||||||
| 2 | **Crumb** | 1,000 Grain |
|
|
||||||
| 3 | **Bread** | 1,000 Crumb |
|
|
||||||
| 4 | **Loaf** | 1,000 Bread |
|
|
||||||
| 5 | **Batch** | 1,000 Loaf |
|
|
||||||
| 6 | **Cake** | 1,000 Batch |
|
|
||||||
| 7 | **Bakery** | 1,000 Cake |
|
|
||||||
| 8 | **Granary** | 1,000 Bakery |
|
|
||||||
| 9 | **Mill** | 1,000 Granary |
|
|
||||||
| 10 | **Harvest** | 1,000 Mill |
|
|
||||||
| 11 | **Earth** | 1,000 Harvest |
|
|
||||||
|
|
||||||
## Why 11 tiers
|
|
||||||
|
|
||||||
The 11-tier scale gives the mesh a single unit for everything from a
|
|
||||||
1-Grain internal minimum (the Fee Covenant floor) to the Earth-tier totals
|
|
||||||
held in the Root-Pool. There is no separate "small unit" and "large unit":
|
|
||||||
the Bread scale is the unit. The 1-Grain minimum prevents dust games; the
|
|
||||||
tier names keep human-readable values at every scale.
|
|
||||||
|
|
||||||
## Where Bread lives
|
|
||||||
|
|
||||||
Bread is held in the three [Storage Pools](storage-pools.md): the Stash
|
|
||||||
(Holder-level), the Vault (Stand-level), and the Root-Pool (treasury). The
|
|
||||||
Watchers attest to the state of the pools daily; the Mirror mirrors the
|
|
||||||
canonical state to the bearers. See [Watchers & Mirror](watchers-mirror.md)
|
|
||||||
for the attestation layer.
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
# Shared concepts
|
|
||||||
|
|
||||||
The Shared section holds the concepts common to every OpenYield audience —
|
|
||||||
Nomads and Freeholders alike. These are the covenant-level ideas that make
|
|
||||||
OpenYield a public-good mesh rather than a custodial platform.
|
|
||||||
|
|
||||||
- [Six Principles](six-principles.md) — the immutable covenant (REQ-001).
|
|
||||||
- [Bread Scale](bread-scale.md) — the unit of value and its 11 tiers (REQ-013).
|
|
||||||
- [Storage Pools](storage-pools.md) — the three pools (Stash, Vault, Root-Pool) (REQ-014).
|
|
||||||
- [Watchers & Mirror](watchers-mirror.md) — the 9 Watchers, 6-of-9 quorum, the Mirror (REQ-004).
|
|
||||||
- [Lexicon](lexicon.md) — why 10 terms are banned, and what to say instead (REQ-012).
|
|
||||||
- [Vision](vision.md) — the OpenYield covenant in brief.
|
|
||||||
|
|
||||||
See the [README](../index.md) for build instructions, or the
|
|
||||||
[Nomads](../nomads/index.md) and [Freeholders](../freeholders/index.md)
|
|
||||||
sections for audience-specific docs.
|
|
||||||
@@ -1,148 +0,0 @@
|
|||||||
# Lexicon
|
|
||||||
|
|
||||||
OpenYield bans 10 financial terms as standalone words (REQ-012). The firewall
|
|
||||||
scans every Go file under `x/` and every Markdown file under `README.md` +
|
|
||||||
`docs/`, and fails the build on any standalone occurrence. This page documents
|
|
||||||
**why** the terms are banned and **what to say instead** — the replacements,
|
|
||||||
not the banned literals.
|
|
||||||
|
|
||||||
## Why a lexicon
|
|
||||||
|
|
||||||
The words a legacy financial institution uses carry the shapes of that
|
|
||||||
institution: custodial positions, jurisdiction-bound units, and
|
|
||||||
speculation-language. OpenYield is a jurisdiction-light, public-good mesh for
|
|
||||||
real production; using the old words would import the old shapes. The
|
|
||||||
lexicon firewall keeps the mesh's language aligned with its covenant. The
|
|
||||||
firewall is enforced in code by two sibling Go tests
|
|
||||||
(`lexicon_meta_test.go` for `x/**/*.go`;
|
|
||||||
`lexicon_meta_docs/lexicon_meta_docs_test.go` for `README.md` +
|
|
||||||
`docs/**/*.md`), both using `lexicon.FindBannedTerm` (word-boundary,
|
|
||||||
case-insensitive). Word-boundary matching means "OpenYield" is safe — the
|
|
||||||
firewall bans standalone words, not substrings.
|
|
||||||
|
|
||||||
## The 10 banned terms and their safe replacements
|
|
||||||
|
|
||||||
The firewall bans 10 standalone words. This page does not write the banned
|
|
||||||
words as literals (the firewall scans this page); it describes them by the
|
|
||||||
concept each belongs to, and gives the safe replacement.
|
|
||||||
|
|
||||||
### 1. The custodial-position word
|
|
||||||
|
|
||||||
A legacy institution holds your value in a custodial position. OpenYield
|
|
||||||
does not: a Holder owns their **Stash**, a Stand owns its **Vault**, the mesh
|
|
||||||
owns the **Root-Pool**. The Holder's identity is a **Reach**, and the Holder
|
|
||||||
themselves is a **Holder** — never the banned custodial-position word.
|
|
||||||
|
|
||||||
- Banned: the word for a custodial position.
|
|
||||||
- Safe: **Holder**, **Reach**, **Stash**, **Vault**, **Root-Pool**.
|
|
||||||
|
|
||||||
### 2. The legacy-institution word
|
|
||||||
|
|
||||||
The legacy financial institution itself is banned as a concept. OpenYield is
|
|
||||||
a **mesh**, a **public good**, a **protocol** — not that word.
|
|
||||||
|
|
||||||
- Banned: the word for a legacy financial institution.
|
|
||||||
- Safe: **mesh**, **protocol**, **public good**.
|
|
||||||
|
|
||||||
### 3. The place-value word
|
|
||||||
|
|
||||||
The word for a place to hold value under custody is banned. Use the
|
|
||||||
**Stash** (Holder-level), the **Vault** (Stand-level), or the **Root-Pool**
|
|
||||||
(treasury).
|
|
||||||
|
|
||||||
- Banned: the word for a place value is held.
|
|
||||||
- Safe: **Stash**, **Vault**, **Root-Pool**, **Storage Pools**.
|
|
||||||
|
|
||||||
### 4. The put-in word
|
|
||||||
|
|
||||||
The verb for putting value into a custodial position is banned. Use **hold**,
|
|
||||||
**store**, **move**, or **transfer**.
|
|
||||||
|
|
||||||
- Banned: the verb for placing value under custody.
|
|
||||||
- Safe: **hold**, **store**, **move**, **transfer**, **Pass-Act**.
|
|
||||||
|
|
||||||
### 5. The passive-value word
|
|
||||||
|
|
||||||
The word for value earned passively on a custodial position is banned. For
|
|
||||||
bonds, use **coupon**. For the mesh's metric, use **real production** or
|
|
||||||
**real return**.
|
|
||||||
|
|
||||||
- Banned: the word for passive value on a custodial position.
|
|
||||||
- Safe: **coupon**, **real production**, **real return**.
|
|
||||||
|
|
||||||
### 6. The standalone metric word
|
|
||||||
|
|
||||||
The standalone word for a return metric is banned (it is the same concept as
|
|
||||||
#5 in verb form). Use **real production**, **real return**, or **coupon**
|
|
||||||
(for bonds). "OpenYield" is safe — word-boundary matching does not flag the
|
|
||||||
banned term inside an identifier.
|
|
||||||
|
|
||||||
- Banned: the standalone return-metric word.
|
|
||||||
- Safe: **real production**, **real return**, **coupon**. **OpenYield** is safe.
|
|
||||||
|
|
||||||
### 7. The medium-of-exchange word
|
|
||||||
|
|
||||||
The word for a national medium of exchange is banned. The mesh's unit is
|
|
||||||
**Bread** (see [Bread scale](bread-scale.md)). For a foreign-exchange pair,
|
|
||||||
use **Forex** (allowed) with **base-asset** / **quote-asset** labels, or
|
|
||||||
**Bread / Asset**.
|
|
||||||
|
|
||||||
- Banned: the word for a national medium of exchange.
|
|
||||||
- Safe: **Bread**, **asset**, **Forex**, **base-asset**, **quote-asset**.
|
|
||||||
|
|
||||||
### 8. The first national-unit word
|
|
||||||
|
|
||||||
The word for the first major national unit is banned. Use **Bread** or
|
|
||||||
opaque chain names (e.g., "Polygon", "OY-Chain").
|
|
||||||
|
|
||||||
- Banned: the first national-unit word.
|
|
||||||
- Safe: **Bread**, **asset**, chain names.
|
|
||||||
|
|
||||||
### 9. The second national-unit word
|
|
||||||
|
|
||||||
The word for the second major national unit is banned (the firewall bans it
|
|
||||||
as a standalone word; "european" is safe by word-boundary). Use **Bread** or
|
|
||||||
opaque chain names.
|
|
||||||
|
|
||||||
- Banned: the second national-unit word.
|
|
||||||
- Safe: **Bread**, **asset**, chain names. **European** is safe (word-boundary).
|
|
||||||
|
|
||||||
### 10. The set-aside word
|
|
||||||
|
|
||||||
The word for value set aside under custody is banned. Use **Stash**,
|
|
||||||
**Vault**, or **Root-Pool**.
|
|
||||||
|
|
||||||
- Banned: the word for value set aside.
|
|
||||||
- Safe: **Stash**, **Vault**, **Root-Pool**.
|
|
||||||
|
|
||||||
### 11. The holder-of-value word
|
|
||||||
|
|
||||||
The word for the person who holds value under custody at a legacy
|
|
||||||
institution is banned. Use **Holder**, **Freeholder**, or **Nomad**.
|
|
||||||
|
|
||||||
- Banned: the word for a custodial-position holder.
|
|
||||||
- Safe: **Holder**, **Freeholder**, **Nomad**, **Reach**.
|
|
||||||
|
|
||||||
> **Note**: the firewall bans 10 standalone words; this page lists 11
|
|
||||||
> replacements because two of the banned words (the passive-value word and
|
|
||||||
> the standalone metric word) share a concept and get the same replacement
|
|
||||||
> family (**coupon** / **real production** / **real return**).
|
|
||||||
|
|
||||||
## How the firewall works
|
|
||||||
|
|
||||||
The firewall uses `lexicon.FindBannedTerm` — a word-boundary, case-insensitive
|
|
||||||
regex match — so:
|
|
||||||
|
|
||||||
- "OpenYield" is **safe**: the standalone banned term inside an identifier
|
|
||||||
does not match (word-boundary).
|
|
||||||
- "european" is **safe**: the standalone national-unit word inside a larger
|
|
||||||
word does not match.
|
|
||||||
- The standalone banned word in prose **is** matched and fails the build.
|
|
||||||
|
|
||||||
The firewall's own source (`lexicon/lexicon.go`) assembles the banned terms
|
|
||||||
at runtime from two-character fragments, so the firewall's own code does not
|
|
||||||
contain any banned term as a literal substring. The two sibling meta-tests
|
|
||||||
(`lexicon_meta_test.go` and `lexicon_meta_docs/lexicon_meta_docs_test.go`)
|
|
||||||
each include a self-test table that verifies detection of all 10 banned
|
|
||||||
terms from the single source `lexicon.BannedTerms()` (G-014 drift
|
|
||||||
prevention).
|
|
||||||
@@ -1,54 +0,0 @@
|
|||||||
# Six Principles
|
|
||||||
|
|
||||||
The Six Principles are the immutable covenant of OpenYield (REQ-001). They
|
|
||||||
are **Mission-locked**: no Council can amend them, and the fee covenant is
|
|
||||||
locked alongside them. The mesh exists to hold real production, not
|
|
||||||
speculation; everything else follows from that.
|
|
||||||
|
|
||||||
## 1. Real value
|
|
||||||
|
|
||||||
The mesh holds **real production**. The Bread unit is the unit of real value
|
|
||||||
held in the Storage Pools; the bond market caps coupons so the mesh cannot
|
|
||||||
become a speculation engine. "Real return" is the metric, not a nominal rate.
|
|
||||||
|
|
||||||
## 2. Sustainability
|
|
||||||
|
|
||||||
Fees are floored and capped. The fee covenant fixes a ceiling and a floor
|
|
||||||
(see the Fee Covenant module), and the 1-Grain internal minimum prevents dust
|
|
||||||
games. The protocol cannot drain its users, and it cannot starve its
|
|
||||||
Watchers.
|
|
||||||
|
|
||||||
## 3. Mission-lock
|
|
||||||
|
|
||||||
The Six Principles and the fee covenant are immutable. No Council — Mesh,
|
|
||||||
Guild, or Stand — can amend them. Mission Lock is a `const` in the council
|
|
||||||
module, and an invariant test asserts it can never be set to amendable. The
|
|
||||||
coupon cap on bonds is a mission-locked ceiling, not a parameter a Council
|
|
||||||
can tune.
|
|
||||||
|
|
||||||
## 4. Openness
|
|
||||||
|
|
||||||
Anyone may join. The mesh is a public good. A Holder needs only a Reach (an
|
|
||||||
identity) and a Stash (a storage pool) to begin; there is no gatekeeper and
|
|
||||||
no custodian.
|
|
||||||
|
|
||||||
## 5. Ownership
|
|
||||||
|
|
||||||
Holders own their Stash and their Reach. Custody is theirs: the Stash is the
|
|
||||||
Holder-level storage pool, the Vault is the Stand-level pool, and the
|
|
||||||
Root-Pool is the treasury. The protocol does not custody user value; it
|
|
||||||
holds the canonical state that records who owns what.
|
|
||||||
|
|
||||||
## 6. Self-service
|
|
||||||
|
|
||||||
A Holder can act without a custodian. The Window primitive lets a Holder
|
|
||||||
delegate a scope-bounded, time-limited, revocable capability to a partner or
|
|
||||||
a service; the bearers (OY-LR, OY-BLE, OY-WiFi-Direct, OY-SAT, OY-QR) let a
|
|
||||||
Holder reach the mesh without a phone plan or a custodial on-ramp. The mesh
|
|
||||||
is jurisdiction-light by design.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
See the [Vision](vision.md) for the covenant in brief, or the
|
|
||||||
[Lexicon](lexicon.md) for why the docs say "real production" and "Holder"
|
|
||||||
rather than the words a legacy financial institution would use.
|
|
||||||
@@ -1,48 +0,0 @@
|
|||||||
# Storage Pools
|
|
||||||
|
|
||||||
OpenYield has three Storage Pools (REQ-014). Each is a layer of custody
|
|
||||||
responsibility, and none of them is a custodial position — the protocol holds
|
|
||||||
the canonical state that records who owns what; the Holder, the Stand, and
|
|
||||||
the mesh treasury each hold their own pool.
|
|
||||||
|
|
||||||
| Pool | Level | Held by | Purpose |
|
|
||||||
|---|---|---|---|
|
|
||||||
| **Stash** | Holder | a single Holder | the personal storage pool; the unit of self-service |
|
|
||||||
| **Vault** | Stand | a Stand (a governed group) | the Stand-level pool; the unit of shared ownership |
|
|
||||||
| **Root-Pool** | Mesh | the mesh treasury | the canonical treasury; the unit of the public good |
|
|
||||||
|
|
||||||
## The Stash
|
|
||||||
|
|
||||||
The Stash is the Holder-level storage pool. A Holder needs only a Reach (an
|
|
||||||
identity) and a Stash to begin. The Stash is the unit of self-service: the
|
|
||||||
Holder owns it, controls it, and can delegate a scoped, time-limited,
|
|
||||||
revocable Window to a partner or a service without giving up custody. See
|
|
||||||
[Watchers & Mirror](watchers-mirror.md) for the attestation layer that
|
|
||||||
records Stash state.
|
|
||||||
|
|
||||||
## The Vault
|
|
||||||
|
|
||||||
The Vault is the Stand-level storage pool. A Stand is a governed group
|
|
||||||
(one of the nine Stand types: Household, Crew, Entity, Co-op, Circle,
|
|
||||||
Trust, Foundation, Confederation, Shadow) that holds a Vault in common. The
|
|
||||||
Stand's decision policy (threshold or weighted, mirroring the Cosmos SDK
|
|
||||||
`x/group` shape) governs how the Vault is used. See the Freeholders section
|
|
||||||
for Stands & Guilds.
|
|
||||||
|
|
||||||
## The Root-Pool
|
|
||||||
|
|
||||||
The Root-Pool is the mesh treasury. It holds the canonical state of the
|
|
||||||
Bread unit, the Watcher bonds, and the Root Basket. The Root-Pool is the
|
|
||||||
unit of the public good: the Watchers attest to its state daily, and the
|
|
||||||
Mirror mirrors it to the bearers so a Holder can verify the mesh's real
|
|
||||||
return without trusting a single custodian.
|
|
||||||
|
|
||||||
## Custody, not custody
|
|
||||||
|
|
||||||
The three pools are storage layers, not custodial positions. The protocol
|
|
||||||
does not custody user value; it holds the canonical state that records who
|
|
||||||
owns what. A Holder's Stash is theirs; a Stand's Vault is the Stand's; the
|
|
||||||
Root-Pool is the mesh's. The Window primitive lets a Holder delegate a
|
|
||||||
capability without delegating custody. See the [Lexicon](lexicon.md) for
|
|
||||||
why the docs say "Stash", "Vault", and "Root-Pool" rather than the words a
|
|
||||||
legacy financial institution would use.
|
|
||||||
@@ -1,64 +0,0 @@
|
|||||||
# Vision
|
|
||||||
|
|
||||||
OpenYield is a jurisdiction-light, public-good mesh for **real production**.
|
|
||||||
The vision is a covenant, not a product: the mesh holds real value, the Six
|
|
||||||
Principles are immutable, and the protocol cannot become a custodial
|
|
||||||
platform. This page is the brief overview; the full vision source lives in
|
|
||||||
`.ciagent/oy/PROJECT.md`.
|
|
||||||
|
|
||||||
## The covenant
|
|
||||||
|
|
||||||
OpenYield exists to hold **real production** — the real return of real work,
|
|
||||||
held in the Bread unit, in the three Storage Pools, attested by the Watchers,
|
|
||||||
mirrored by the Mirror. The covenant is anti-greed by construction:
|
|
||||||
|
|
||||||
- **Mission Lock** fixes the Six Principles and the fee covenant. No Council
|
|
||||||
— Mesh, Guild, or Stand — can amend them. The coupon cap on bonds is a
|
|
||||||
mission-locked ceiling, not a parameter.
|
|
||||||
- **Jurisdiction-light** — the bearers (OY-LR, OY-BLE, OY-WiFi-Direct, OY-SAT,
|
|
||||||
OY-QR) let a Holder reach the mesh without a phone plan or a custodial
|
|
||||||
on-ramp. A Holder needs only a Reach and a Stash to begin.
|
|
||||||
- **Public good** — the mesh is open to all. The Watchers attest daily; the
|
|
||||||
Mirror mirrors the state; anyone can verify the mesh's real return without
|
|
||||||
trusting a single custodian.
|
|
||||||
|
|
||||||
## The layers
|
|
||||||
|
|
||||||
1. **OY Chain** (Layer 1) — the canonical state: the Bread unit, the
|
|
||||||
Storage Pools, Standing, Watcher attestations, the Pact / Council /
|
|
||||||
Partner surface.
|
|
||||||
2. **Satellites** (Layer 2) — wrapped Bread propagates to satellite chains
|
|
||||||
(Polygon active; Base, Arbitrum, Optimism, Solana as enum placeholders)
|
|
||||||
via IBC.
|
|
||||||
3. **Bearers** — the surveillance-resistant transport layer: OY-LR (LoRa,
|
|
||||||
long-range), OY-BLE (Bluetooth), OY-WiFi-Direct, OY-SAT (satellite),
|
|
||||||
OY-QR (paper / QR code). The Mirror mirrors canonical state to them.
|
|
||||||
4. **Exits** — the Layer 3 exit layer: Holder-initiated DEX swaps and
|
|
||||||
off-mesh service exits, with bridge routes for cross-chain exits.
|
|
||||||
|
|
||||||
## The actors
|
|
||||||
|
|
||||||
- **Holders** (Nomads) — the everyday participants, each with a Reach and a
|
|
||||||
Stash.
|
|
||||||
- **Freeholders** — the active participants who run Stands, Guilds, and
|
|
||||||
Councils.
|
|
||||||
- **Partners** — the four-tier spectrum (Op, MasterOp, Pier, Anchor) that
|
|
||||||
processes Pass-Acts and provides credentials and institutional backing.
|
|
||||||
- **Watchers** — the 9 attesters with 6-of-9 quorum and 100,000 Bread bonds.
|
|
||||||
|
|
||||||
## The units
|
|
||||||
|
|
||||||
- **Bread** — the unit of real value (see [Bread scale](bread-scale.md)).
|
|
||||||
- **Standing** — the reputation layer (the four signals, Bayesian Standing).
|
|
||||||
- **Voice** — the governance input (multi-source: Stash, Standing, Vouch,
|
|
||||||
Freeholder, Guild).
|
|
||||||
- **Coupon** — the bond-market term (capped at 8% / floored at 0%, mission-locked).
|
|
||||||
|
|
||||||
## Where to go next
|
|
||||||
|
|
||||||
- [Six Principles](six-principles.md) — the immutable covenant.
|
|
||||||
- [Storage Pools](storage-pools.md) — the three pools.
|
|
||||||
- [Watchers & Mirror](watchers-mirror.md) — the attestation layer.
|
|
||||||
- [Lexicon](lexicon.md) — why the docs say "real production" and "Holder".
|
|
||||||
- [README](../../README.md) — build & test instructions.
|
|
||||||
- `.ciagent/oy/PROJECT.md` — the full vision source.
|
|
||||||
@@ -1,42 +0,0 @@
|
|||||||
# Watchers & Mirror
|
|
||||||
|
|
||||||
OpenYield is attested by **9 Watchers** with a **6-of-9 quorum** (REQ-004).
|
|
||||||
The Watchers make daily attestations to the canonical state, and each posts
|
|
||||||
a 100,000 Bread bond. The **Mirror** mirrors the canonical state to the
|
|
||||||
bearers so a Holder can verify the mesh's state without trusting a single
|
|
||||||
Watcher.
|
|
||||||
|
|
||||||
## The 9 Watchers
|
|
||||||
|
|
||||||
The Watchers are the attestation layer of the mesh. There are exactly 9, and
|
|
||||||
the quorum is 6-of-9: any 6 Watchers can attest to a state transition, but no
|
|
||||||
5 can. Each Watcher posts a 100,000 Bread bond, which is at risk if the
|
|
||||||
Watcher attests to a false state. The 9/6 split is a mission-locked
|
|
||||||
parameter — no Council can lower the quorum or the bond.
|
|
||||||
|
|
||||||
## Daily attestations
|
|
||||||
|
|
||||||
The Watchers attest to the state of the three [Storage Pools](storage-pools.md)
|
|
||||||
daily: the Stash totals, the Vault totals, and the Root-Pool. The
|
|
||||||
attestation is a signed statement that the canonical state recorded by OY
|
|
||||||
Chain matches the state the Watcher observed. A Holder who wants to verify
|
|
||||||
the mesh's real return can read the attestations and check that the
|
|
||||||
Watchers agree.
|
|
||||||
|
|
||||||
## The Mirror
|
|
||||||
|
|
||||||
The Mirror mirrors the canonical state to the bearers (OY-LR, OY-BLE,
|
|
||||||
OY-WiFi-Direct, OY-SAT, OY-QR). A Holder on a surveillance-resistant bearer
|
|
||||||
can read the mirrored state without an internet connection to OY Chain; the
|
|
||||||
Mirror is the read-side of the bearer layer. The Mirror is read-only: it
|
|
||||||
mirrors state, it does not author it. Authoritative state lives on OY Chain
|
|
||||||
and is attested by the Watchers.
|
|
||||||
|
|
||||||
## Why 6-of-9
|
|
||||||
|
|
||||||
The 9/6 split is a balance: 9 is large enough that no single adversary can
|
|
||||||
easily capture a quorum, and 6 is large enough that no small cabal can
|
|
||||||
attest to a false state. The 100,000 Bread bond per Watcher makes
|
|
||||||
capturing a quorum expensive. The split is locked by Mission Lock — no
|
|
||||||
Council can change it. See [Six Principles](six-principles.md) for the
|
|
||||||
mission-lock covenant.
|
|
||||||
@@ -1,154 +1,3 @@
|
|||||||
module github.com/oy/openyield
|
module github.com/oy/openyield
|
||||||
|
|
||||||
go 1.22
|
go 1.22
|
||||||
|
|
||||||
require (
|
|
||||||
cosmossdk.io/store v1.1.0
|
|
||||||
github.com/cosmos/cosmos-sdk v0.50.8
|
|
||||||
github.com/cosmos/ibc-go/modules/capability v1.0.0
|
|
||||||
github.com/cosmos/ibc-go/v8 v8.2.1
|
|
||||||
)
|
|
||||||
|
|
||||||
require (
|
|
||||||
cosmossdk.io/api v0.7.5 // indirect
|
|
||||||
cosmossdk.io/collections v0.4.0 // indirect
|
|
||||||
cosmossdk.io/core v0.11.0 // indirect
|
|
||||||
cosmossdk.io/depinject v1.0.0-alpha.4 // indirect
|
|
||||||
cosmossdk.io/errors v1.0.1 // indirect
|
|
||||||
cosmossdk.io/log v1.3.1 // indirect
|
|
||||||
cosmossdk.io/math v1.3.0 // indirect
|
|
||||||
cosmossdk.io/x/tx v0.13.3 // indirect
|
|
||||||
cosmossdk.io/x/upgrade v0.1.0 // indirect
|
|
||||||
filippo.io/edwards25519 v1.0.0 // indirect
|
|
||||||
github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
|
|
||||||
github.com/99designs/keyring v1.2.1 // indirect
|
|
||||||
github.com/DataDog/datadog-go v3.2.0+incompatible // indirect
|
|
||||||
github.com/DataDog/zstd v1.5.5 // indirect
|
|
||||||
github.com/beorn7/perks v1.0.1 // indirect
|
|
||||||
github.com/bgentry/speakeasy v0.1.1-0.20220910012023-760eaf8b6816 // indirect
|
|
||||||
github.com/btcsuite/btcd/btcec/v2 v2.3.2 // indirect
|
|
||||||
github.com/cenkalti/backoff/v4 v4.1.3 // indirect
|
|
||||||
github.com/cespare/xxhash v1.1.0 // indirect
|
|
||||||
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
||||||
github.com/cockroachdb/errors v1.11.1 // indirect
|
|
||||||
github.com/cockroachdb/logtags v0.0.0-20230118201751-21c54148d20b // indirect
|
|
||||||
github.com/cockroachdb/pebble v1.1.0 // indirect
|
|
||||||
github.com/cockroachdb/redact v1.1.5 // indirect
|
|
||||||
github.com/cockroachdb/tokenbucket v0.0.0-20230807174530-cc333fc44b06 // indirect
|
|
||||||
github.com/cometbft/cometbft v0.38.9 // indirect
|
|
||||||
github.com/cometbft/cometbft-db v0.9.1 // indirect
|
|
||||||
github.com/cosmos/btcutil v1.0.5 // indirect
|
|
||||||
github.com/cosmos/cosmos-db v1.0.2 // indirect
|
|
||||||
github.com/cosmos/cosmos-proto v1.0.0-beta.5 // indirect
|
|
||||||
github.com/cosmos/go-bip39 v1.0.0 // indirect
|
|
||||||
github.com/cosmos/gogogateway v1.2.0 // indirect
|
|
||||||
github.com/cosmos/gogoproto v1.5.0 // indirect
|
|
||||||
github.com/cosmos/iavl v1.1.2 // indirect
|
|
||||||
github.com/cosmos/ics23/go v0.10.0 // indirect
|
|
||||||
github.com/cosmos/ledger-cosmos-go v0.13.3 // indirect
|
|
||||||
github.com/danieljoos/wincred v1.1.2 // indirect
|
|
||||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
||||||
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
|
|
||||||
github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f // indirect
|
|
||||||
github.com/dgraph-io/badger/v2 v2.2007.4 // indirect
|
|
||||||
github.com/dgraph-io/ristretto v0.1.1 // indirect
|
|
||||||
github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
|
|
||||||
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
||||||
github.com/dvsekhvalnov/jose2go v1.6.0 // indirect
|
|
||||||
github.com/emicklei/dot v1.6.1 // indirect
|
|
||||||
github.com/fatih/color v1.15.0 // indirect
|
|
||||||
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
||||||
github.com/fsnotify/fsnotify v1.7.0 // indirect
|
|
||||||
github.com/getsentry/sentry-go v0.27.0 // indirect
|
|
||||||
github.com/go-kit/kit v0.12.0 // indirect
|
|
||||||
github.com/go-kit/log v0.2.1 // indirect
|
|
||||||
github.com/go-logfmt/logfmt v0.6.0 // indirect
|
|
||||||
github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
|
|
||||||
github.com/gogo/googleapis v1.4.1 // indirect
|
|
||||||
github.com/gogo/protobuf v1.3.2 // indirect
|
|
||||||
github.com/golang/glog v1.2.0 // indirect
|
|
||||||
github.com/golang/protobuf v1.5.4 // indirect
|
|
||||||
github.com/golang/snappy v0.0.4 // indirect
|
|
||||||
github.com/google/btree v1.1.2 // indirect
|
|
||||||
github.com/google/go-cmp v0.6.0 // indirect
|
|
||||||
github.com/gorilla/handlers v1.5.2 // indirect
|
|
||||||
github.com/gorilla/mux v1.8.1 // indirect
|
|
||||||
github.com/gorilla/websocket v1.5.0 // indirect
|
|
||||||
github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
|
|
||||||
github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
|
|
||||||
github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
|
|
||||||
github.com/hashicorp/go-hclog v1.5.0 // indirect
|
|
||||||
github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
|
|
||||||
github.com/hashicorp/go-metrics v0.5.3 // indirect
|
|
||||||
github.com/hashicorp/go-plugin v1.5.2 // indirect
|
|
||||||
github.com/hashicorp/golang-lru v1.0.2 // indirect
|
|
||||||
github.com/hashicorp/hcl v1.0.0 // indirect
|
|
||||||
github.com/hashicorp/yamux v0.1.1 // indirect
|
|
||||||
github.com/hdevalence/ed25519consensus v0.1.0 // indirect
|
|
||||||
github.com/huandu/skiplist v1.2.0 // indirect
|
|
||||||
github.com/iancoleman/strcase v0.3.0 // indirect
|
|
||||||
github.com/improbable-eng/grpc-web v0.15.0 // indirect
|
|
||||||
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
||||||
github.com/jmhodges/levigo v1.0.0 // indirect
|
|
||||||
github.com/klauspost/compress v1.17.7 // indirect
|
|
||||||
github.com/kr/pretty v0.3.1 // indirect
|
|
||||||
github.com/kr/text v0.2.0 // indirect
|
|
||||||
github.com/libp2p/go-buffer-pool v0.1.0 // indirect
|
|
||||||
github.com/linxGnu/grocksdb v1.8.14 // indirect
|
|
||||||
github.com/magiconair/properties v1.8.7 // indirect
|
|
||||||
github.com/mattn/go-colorable v0.1.13 // indirect
|
|
||||||
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
||||||
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
|
|
||||||
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
|
||||||
github.com/mtibben/percent v0.2.1 // indirect
|
|
||||||
github.com/oasisprotocol/curve25519-voi v0.0.0-20230904125328-1f23a7beb09a // indirect
|
|
||||||
github.com/oklog/run v1.1.0 // indirect
|
|
||||||
github.com/pelletier/go-toml/v2 v2.1.0 // indirect
|
|
||||||
github.com/petermattis/goid v0.0.0-20231207134359-e60b3f734c67 // indirect
|
|
||||||
github.com/pkg/errors v0.9.1 // indirect
|
|
||||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
||||||
github.com/prometheus/client_golang v1.19.0 // indirect
|
|
||||||
github.com/prometheus/client_model v0.6.1 // indirect
|
|
||||||
github.com/prometheus/common v0.52.2 // indirect
|
|
||||||
github.com/prometheus/procfs v0.13.0 // indirect
|
|
||||||
github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
|
|
||||||
github.com/rogpeppe/go-internal v1.12.0 // indirect
|
|
||||||
github.com/rs/cors v1.8.3 // indirect
|
|
||||||
github.com/rs/zerolog v1.32.0 // indirect
|
|
||||||
github.com/sagikazarmark/locafero v0.4.0 // indirect
|
|
||||||
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
|
|
||||||
github.com/sasha-s/go-deadlock v0.3.1 // indirect
|
|
||||||
github.com/sourcegraph/conc v0.3.0 // indirect
|
|
||||||
github.com/spf13/afero v1.11.0 // indirect
|
|
||||||
github.com/spf13/cast v1.6.0 // indirect
|
|
||||||
github.com/spf13/cobra v1.8.0 // indirect
|
|
||||||
github.com/spf13/pflag v1.0.5 // indirect
|
|
||||||
github.com/spf13/viper v1.18.2 // indirect
|
|
||||||
github.com/stretchr/testify v1.9.0 // indirect
|
|
||||||
github.com/subosito/gotenv v1.6.0 // indirect
|
|
||||||
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
|
|
||||||
github.com/tendermint/go-amino v0.16.0 // indirect
|
|
||||||
github.com/tidwall/btree v1.7.0 // indirect
|
|
||||||
github.com/zondax/hid v0.9.2 // indirect
|
|
||||||
github.com/zondax/ledger-go v0.14.3 // indirect
|
|
||||||
go.etcd.io/bbolt v1.3.8 // indirect
|
|
||||||
go.uber.org/multierr v1.10.0 // indirect
|
|
||||||
golang.org/x/crypto v0.22.0 // indirect
|
|
||||||
golang.org/x/exp v0.0.0-20240404231335-c0f41cb1a7a0 // indirect
|
|
||||||
golang.org/x/net v0.24.0 // indirect
|
|
||||||
golang.org/x/sync v0.7.0 // indirect
|
|
||||||
golang.org/x/sys v0.19.0 // indirect
|
|
||||||
golang.org/x/term v0.19.0 // indirect
|
|
||||||
golang.org/x/text v0.14.0 // indirect
|
|
||||||
google.golang.org/genproto v0.0.0-20240227224415-6ceb2ff114de // indirect
|
|
||||||
google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de // indirect
|
|
||||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda // indirect
|
|
||||||
google.golang.org/grpc v1.63.2 // indirect
|
|
||||||
google.golang.org/protobuf v1.33.0 // indirect
|
|
||||||
gopkg.in/ini.v1 v1.67.0 // indirect
|
|
||||||
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
||||||
gotest.tools/v3 v3.5.1 // indirect
|
|
||||||
nhooyr.io/websocket v1.8.6 // indirect
|
|
||||||
pgregory.net/rapid v1.1.0 // indirect
|
|
||||||
sigs.k8s.io/yaml v1.4.0 // indirect
|
|
||||||
)
|
|
||||||
|
|||||||
@@ -1,125 +0,0 @@
|
|||||||
// Package lexicon holds the project-wide lexicon firewall (REQ-012).
|
|
||||||
//
|
|
||||||
// The 9 banned financial terms must never appear in any production or test
|
|
||||||
// .go file under x/. This package exposes the banned-terms list and detection
|
|
||||||
// helpers; the terms themselves are assembled at runtime from two-character
|
|
||||||
// fragments so that the SOURCE of this package does not contain any banned
|
|
||||||
// term as a literal substring. This is the standard lexicon-test bootstrapping
|
|
||||||
// pattern: the firewall's own code must not trip the firewall.
|
|
||||||
//
|
|
||||||
// The lexicon firewall is NEW in v0.2 (G-002): v0.1 is lexicon-clean in
|
|
||||||
// practice but has zero lexicon tests. The project-wide meta-test in
|
|
||||||
// P1-04-02 (lexicon_meta_test.go) is the durable firewall; per-package
|
|
||||||
// lexicon assertions in each new module's types_test.go scan the module's
|
|
||||||
// production files.
|
|
||||||
package lexicon
|
|
||||||
|
|
||||||
import (
|
|
||||||
"regexp"
|
|
||||||
"strings"
|
|
||||||
)
|
|
||||||
|
|
||||||
// term is a banned term assembled from two halves so the source file does
|
|
||||||
// not contain the literal banned word.
|
|
||||||
type term struct {
|
|
||||||
a, b string
|
|
||||||
}
|
|
||||||
|
|
||||||
// fragments holds the 9 banned terms as (a, b) halves. Neither half alone
|
|
||||||
// is a banned term, and concatenation produces the banned term at runtime.
|
|
||||||
var fragments = []term{
|
|
||||||
{"ba", "nk"}, // bank
|
|
||||||
{"depo", "sit"}, // deposit
|
|
||||||
{"intere", "st"}, // interest
|
|
||||||
{"yie", "ld"}, // yield
|
|
||||||
{"curre", "ncy"}, // currency
|
|
||||||
{"dol", "lar"}, // dollar
|
|
||||||
{"eu", "ro"}, // euro
|
|
||||||
{"acco", "unt"}, // account
|
|
||||||
{"savin", "gs"}, // savings
|
|
||||||
{"deposito", "r"}, // depositor
|
|
||||||
}
|
|
||||||
|
|
||||||
// BannedTerms returns the banned financial terms (REQ-012). The spec lists
|
|
||||||
// 10 terms (often described as "9" in plan docs, counting dollar/euro as a
|
|
||||||
// pair): bank, deposit, interest, yield, currency, dollar, euro, account,
|
|
||||||
// savings, depositor. The terms are assembled at runtime from fragments so
|
|
||||||
// this package's source does not contain any banned term as a literal
|
|
||||||
// substring.
|
|
||||||
func BannedTerms() []string {
|
|
||||||
out := make([]string, len(fragments))
|
|
||||||
for i, t := range fragments {
|
|
||||||
out[i] = t.a + t.b
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// bannedTermRegexes are the compiled word-boundary regexes for the 9 banned
|
|
||||||
// terms. Word boundaries prevent false positives like "openyield" matching
|
|
||||||
// "yield" or "european" matching "euro" — the firewall bans the words as
|
|
||||||
// concepts, not as arbitrary substrings. The regexes are case-insensitive.
|
|
||||||
var bannedTermRegexes = func() []*regexp.Regexp {
|
|
||||||
terms := BannedTerms()
|
|
||||||
out := make([]*regexp.Regexp, len(terms))
|
|
||||||
for i, t := range terms {
|
|
||||||
out[i] = regexp.MustCompile(`\b` + regexp.QuoteMeta(t) + `\b`)
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}()
|
|
||||||
|
|
||||||
// FindBannedTerm returns the first banned term found in s (case-insensitive,
|
|
||||||
// word-boundary match) and true, or "" and false if none. Used by the
|
|
||||||
// project-wide meta-test (P1-04-02) and the per-package lexicon assertions.
|
|
||||||
func FindBannedTerm(s string) (string, bool) {
|
|
||||||
lower := strings.ToLower(s)
|
|
||||||
terms := BannedTerms()
|
|
||||||
for i, re := range bannedTermRegexes {
|
|
||||||
if re.MatchString(lower) {
|
|
||||||
return terms[i], true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return "", false
|
|
||||||
}
|
|
||||||
|
|
||||||
// ContainsBannedTerm is an alias for FindBannedTerm kept for compatibility.
|
|
||||||
func ContainsBannedTerm(s string) (string, bool) {
|
|
||||||
return FindBannedTerm(s)
|
|
||||||
}
|
|
||||||
|
|
||||||
// SyntheticBannedStrings returns one synthetic string per banned term, each
|
|
||||||
// embedding exactly one banned term in a plausible sentence context. This
|
|
||||||
// is the single source of truth (REQ-029, GRILL G-014) for the synthetic
|
|
||||||
// self-test table consumed by BOTH project-wide meta-tests:
|
|
||||||
//
|
|
||||||
// lexicon_meta_test.go :: TestLexiconMetaSelfTestTable (package lexicon_meta, scans x/**/*.go)
|
|
||||||
// lexicon_meta_docs_test.go :: TestLexiconMetaDocsSelfTestTable (package lexicon_meta_docs, scans README.md + docs/**/*.md)
|
|
||||||
//
|
|
||||||
// Before REQ-029, both meta-tests DUPLICATED their own 10-string synthetic
|
|
||||||
// table (byte-identical), creating a drift risk: a future banned-term
|
|
||||||
// addition updating one table but not the other would silently drop coverage
|
|
||||||
// in the unmaintained firewall. SyntheticBannedStrings() eliminates the
|
|
||||||
// duplication — both meta-tests now consume this helper, so a future addition
|
|
||||||
// updates both firewalls from one place. The strings are built from
|
|
||||||
// BannedTerms() (already fragment-assembled), so this package's own source
|
|
||||||
// stays lexicon-clean (the firewall's own code is allowed to name the terms
|
|
||||||
// it bans, but only via the fragment-assembly bootstrapping pattern).
|
|
||||||
//
|
|
||||||
// The returned slice is indexed positionally against BannedTerms(): the i-th
|
|
||||||
// synthetic string embeds the i-th banned term. Both meta-tests assert
|
|
||||||
// len(SyntheticBannedStrings()) == len(BannedTerms()) and that each string
|
|
||||||
// triggers FindBannedTerm with the matching term.
|
|
||||||
func SyntheticBannedStrings() []string {
|
|
||||||
terms := BannedTerms()
|
|
||||||
return []string{
|
|
||||||
"open a " + terms[0] + " here", // bank
|
|
||||||
"make a " + terms[1] + " now", // deposit
|
|
||||||
"compounding " + terms[2] + " rate", // interest
|
|
||||||
"the " + terms[3] + " is 5pct", // yield
|
|
||||||
"foreign " + terms[4] + " pair", // currency
|
|
||||||
"price in " + terms[5], // dollar
|
|
||||||
"price in " + terms[6], // euro
|
|
||||||
"freeze the " + terms[7], // account
|
|
||||||
"move to " + terms[8] + " now", // savings
|
|
||||||
"the " + terms[9] + " lost money", // depositor
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,296 +0,0 @@
|
|||||||
// Package lexicon_meta_docs holds the docs lexicon firewall (REQ-028, D-043).
|
|
||||||
//
|
|
||||||
// It is a NEW sibling meta-test created in v0.3 P1 Wave 1 that MIRRORS the v0.2
|
|
||||||
// project-wide firewall (lexicon_meta_test.go, package lexicon_meta) but scans
|
|
||||||
// the docs surface (README.md + docs/**/*.md) instead of x/**/*.go. It uses
|
|
||||||
// the SAME lexicon.FindBannedTerm (word-boundary, case-insensitive) — NO
|
|
||||||
// detection reimplementation — so the two firewalls share a single source of
|
|
||||||
// truth for the 10 banned terms (bank, deposit, interest, yield, currency,
|
|
||||||
// dollar, euro, account, savings, depositor).
|
|
||||||
//
|
|
||||||
// Placement: this file lives in lexicon_meta_docs/ (a subdirectory of the
|
|
||||||
// repo root) because Go does not permit two distinct packages in the same
|
|
||||||
// directory; the v0.2 firewall is package lexicon_meta at the repo root.
|
|
||||||
// The invocation `go test ./lexicon_meta_docs/...` (PLANS P1-03-01) resolves
|
|
||||||
// to this package. Run via `go test ./...` from the repo root as well.
|
|
||||||
//
|
|
||||||
// G-013 walk-coverage: TestLexiconMetaDocsWalkCoverage injects a synthetic
|
|
||||||
// banned-term .md into a temp docs/ subtree and asserts the walk FINDS it.
|
|
||||||
// This closes the "silently scans nothing and reports green" failure mode
|
|
||||||
// that the G-009 self-test table (detection) alone does not cover.
|
|
||||||
//
|
|
||||||
// G-014 self-test drift: the self-test table and banned-term count assertion
|
|
||||||
// reuse lexicon.BannedTerms() (the single source). A cross-reference comment
|
|
||||||
// keeps this file's table in lockstep with lexicon_meta_test.go's table; if
|
|
||||||
// a banned term is added, both firewalls update from one place.
|
|
||||||
package lexicon_meta_docs
|
|
||||||
|
|
||||||
import (
|
|
||||||
"os"
|
|
||||||
"path/filepath"
|
|
||||||
"runtime"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/lexicon"
|
|
||||||
)
|
|
||||||
|
|
||||||
// repoRoot returns the absolute path to the repo root by walking up from
|
|
||||||
// this test file (the test lives at <repoRoot>/lexicon_meta_docs/).
|
|
||||||
func repoRoot(t *testing.T) string {
|
|
||||||
t.Helper()
|
|
||||||
_, file, _, ok := runtime.Caller(0)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("runtime.Caller failed")
|
|
||||||
}
|
|
||||||
// file = .../oy/lexicon_meta_docs/lexicon_meta_docs_test.go
|
|
||||||
// repo root = filepath.Dir(filepath.Dir(file))
|
|
||||||
return filepath.Dir(filepath.Dir(file))
|
|
||||||
}
|
|
||||||
|
|
||||||
// thisFile returns the absolute path of this meta-test file (to exclude it
|
|
||||||
// from its own scan — it references banned terms via the lexicon package,
|
|
||||||
// whose source assembles terms from fragments, so no banned-term literal
|
|
||||||
// appears in the firewall's own code).
|
|
||||||
func thisFile(t *testing.T) string {
|
|
||||||
t.Helper()
|
|
||||||
_, file, _, ok := runtime.Caller(0)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("runtime.Caller failed")
|
|
||||||
}
|
|
||||||
return file
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaDocsNoBannedTermsInDocs is the docs firewall (D-043). It
|
|
||||||
// walks README.md (repo root) + every *.md under docs/ (recursive), reads each
|
|
||||||
// file's source, and asserts no banned term is present (word-boundary,
|
|
||||||
// case-insensitive). Excludes .ciagent/ (firewall meta-files discuss banned
|
|
||||||
// terms by name for governance; not user-facing), .git/ (VCS), and this test
|
|
||||||
// file itself (self-exclusion via runtime.Caller(0)).
|
|
||||||
//
|
|
||||||
// Passes at P1 Wave 1 with zero docs (a walk that scans nothing reports green
|
|
||||||
// on zero hits — closed by TestLexiconMetaDocsWalkCoverage below). With the
|
|
||||||
// Wave 2 docs present (README + index + 6 shared pages), all are lexicon-clean
|
|
||||||
// by construction.
|
|
||||||
func TestLexiconMetaDocsNoBannedTermsInDocs(t *testing.T) {
|
|
||||||
root := repoRoot(t)
|
|
||||||
this := thisFile(t)
|
|
||||||
hits := []string{}
|
|
||||||
err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if info.IsDir() {
|
|
||||||
base := filepath.Base(path)
|
|
||||||
if base == ".ciagent" || base == ".git" {
|
|
||||||
return filepath.SkipDir
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
// Self-exclusion: skip this meta-test file.
|
|
||||||
if path == this {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
// Only scan .md files.
|
|
||||||
if !strings.HasSuffix(path, ".md") {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
// Only scan README.md (repo root) + docs/**/*.md.
|
|
||||||
rel, rerr := filepath.Rel(root, path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if rel != "README.md" && !strings.HasPrefix(rel, "docs"+string(filepath.Separator)) && rel != "docs" {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
bz, rerr := os.ReadFile(path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
|
||||||
hits = append(hits, rel+" contains banned term "+found)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
})
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("walk: %v", err)
|
|
||||||
}
|
|
||||||
if len(hits) > 0 {
|
|
||||||
t.Errorf("REQ-028 docs lexicon firewall violations:\n %s",
|
|
||||||
strings.Join(hits, "\n "))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaDocsSelfTestTable (G-009 for docs) is the firewall's own
|
|
||||||
// detection-coverage guard. Each synthetic string embeds exactly one banned
|
|
||||||
// term in a plausible sentence context and is asserted to trigger detection,
|
|
||||||
// so the firewall's detection logic is durably verified — if detection ever
|
|
||||||
// breaks, this test fails before the firewall silently passes a real
|
|
||||||
// violation in a docs page.
|
|
||||||
//
|
|
||||||
// REQ-029 (GRILL G-014): the synthetic strings are sourced from
|
|
||||||
// lexicon.SyntheticBannedStrings(), the single source of truth shared with
|
|
||||||
// lexicon_meta_test.go :: TestLexiconMetaSelfTestTable. Before REQ-029, this
|
|
||||||
// file DUPLICATED its own 10-string table (byte-identical to the x/ meta-
|
|
||||||
// test), creating a drift risk; the shared helper closes it. This file no
|
|
||||||
// longer builds its own synthetic table — both meta-tests consume the same
|
|
||||||
// helper, so a future banned-term addition updates both firewalls from one
|
|
||||||
// place.
|
|
||||||
func TestLexiconMetaDocsSelfTestTable(t *testing.T) {
|
|
||||||
terms := lexicon.BannedTerms()
|
|
||||||
// The spec lists 10 banned terms (plan docs say "9", counting dollar/euro
|
|
||||||
// as a pair): bank, deposit, interest, yield, currency, dollar, euro,
|
|
||||||
// account, savings, depositor.
|
|
||||||
if len(terms) != 10 {
|
|
||||||
t.Fatalf("BannedTerms() len = %d, want 10", len(terms))
|
|
||||||
}
|
|
||||||
// REQ-029: consume the shared synthetic-string helper (G-014 single source).
|
|
||||||
synthetic := lexicon.SyntheticBannedStrings()
|
|
||||||
if len(synthetic) != len(terms) {
|
|
||||||
t.Fatalf("SyntheticBannedStrings() len = %d, want %d (must match BannedTerms())", len(synthetic), len(terms))
|
|
||||||
}
|
|
||||||
for i, s := range synthetic {
|
|
||||||
found, ok := lexicon.FindBannedTerm(s)
|
|
||||||
if !ok {
|
|
||||||
t.Errorf("G-009 docs self-test [%d]: synthetic string did not trigger detection: %q", i, s)
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
if found != terms[i] {
|
|
||||||
t.Errorf("G-009 docs self-test [%d]: detected %q, want %q (in %q)", i, found, terms[i], s)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaDocsBannedTermsCount asserts exactly 10 banned terms are
|
|
||||||
// configured (locked-const for the firewall's scope; spec lists 10, plan docs
|
|
||||||
// say "9" counting dollar/euro as a pair). Derived from lexicon.BannedTerms()
|
|
||||||
// — the single source — so a count change breaks both this firewall and the
|
|
||||||
// v0.2 x/*.go firewall (G-014 drift prevention).
|
|
||||||
func TestLexiconMetaDocsBannedTermsCount(t *testing.T) {
|
|
||||||
terms := lexicon.BannedTerms()
|
|
||||||
if len(terms) != 10 {
|
|
||||||
t.Errorf("BannedTerms() len = %d, want 10 (REQ-012/REQ-028)", len(terms))
|
|
||||||
}
|
|
||||||
seen := map[string]bool{}
|
|
||||||
for _, tr := range terms {
|
|
||||||
if seen[tr] {
|
|
||||||
t.Errorf("duplicate banned term %q", tr)
|
|
||||||
}
|
|
||||||
seen[tr] = true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaDocsNoFalsePositiveOnOpenYield asserts the module name
|
|
||||||
// "openyield" does NOT trigger the "yield" banned term and "european" does
|
|
||||||
// NOT trigger the "euro" banned term (word-boundary matching must not match
|
|
||||||
// substrings of identifiers). This is the regression firewall for the
|
|
||||||
// word-boundary detection design — mirrors the v0.2
|
|
||||||
// TestLexiconMetaNoFalsePositiveOnOpenYield.
|
|
||||||
func TestLexiconMetaDocsNoFalsePositiveOnOpenYield(t *testing.T) {
|
|
||||||
cases := []string{
|
|
||||||
"github.com/oy/openyield/x/window/types",
|
|
||||||
"package openyield",
|
|
||||||
"openyield is the module",
|
|
||||||
"european resident",
|
|
||||||
"# OpenYield docs",
|
|
||||||
"the OpenYield mesh",
|
|
||||||
}
|
|
||||||
for _, s := range cases {
|
|
||||||
if _, ok := lexicon.FindBannedTerm(s); ok {
|
|
||||||
t.Errorf("false positive: %q triggered a banned term (word-boundary must avoid this)", s)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaDocsWalkCoverage (G-013) is the walk-coverage firewall. The
|
|
||||||
// G-009 self-test table (above) verifies DETECTION (FindBannedTerm on
|
|
||||||
// synthetic strings) but NOT the WALK (which files are scanned). A walk bug
|
|
||||||
// — e.g. wrong path prefix, missing docs/ recursion, a typo in the .md
|
|
||||||
// suffix check — would silently scan nothing and report green on zero
|
|
||||||
// files. This test closes that gap by injecting a synthetic banned-term .md
|
|
||||||
// into a fixture dir under the real docs/ path the walk scans and asserting
|
|
||||||
// the walk FINDS it.
|
|
||||||
//
|
|
||||||
// The fixture is created under docs/.lexicon_fixture/ (a real docs/ subtree
|
|
||||||
// the walk reaches) and removed via defer so it never leaks into the repo.
|
|
||||||
// If the walk logic misses the fixture, this test fails loudly instead of
|
|
||||||
// letting a broken walk pass the firewall green on zero files scanned.
|
|
||||||
func TestLexiconMetaDocsWalkCoverage(t *testing.T) {
|
|
||||||
root := repoRoot(t)
|
|
||||||
this := thisFile(t)
|
|
||||||
|
|
||||||
// Build a synthetic banned term from fragments so THIS file does not
|
|
||||||
// contain a banned-term literal (it is excluded from its own scan, but
|
|
||||||
// the synthetic stays clean for readability/searchability).
|
|
||||||
terms := lexicon.BannedTerms()
|
|
||||||
if len(terms) == 0 {
|
|
||||||
t.Fatal("BannedTerms() returned no terms — cannot run walk-coverage")
|
|
||||||
}
|
|
||||||
// Use the first banned term ("bank") assembled from two halves.
|
|
||||||
syntheticTerm := terms[0][:2] + terms[0][2:] // reassemble (no literal in source)
|
|
||||||
badContent := []byte("# fixture\nthis file contains a banned term: " + syntheticTerm + "\n")
|
|
||||||
|
|
||||||
fixtureDir := filepath.Join(root, "docs", ".lexicon_fixture")
|
|
||||||
fixtureFile := filepath.Join(fixtureDir, "bad_fixture.md")
|
|
||||||
if err := os.MkdirAll(fixtureDir, 0o755); err != nil {
|
|
||||||
t.Fatalf("mkdir fixture: %v", err)
|
|
||||||
}
|
|
||||||
defer os.RemoveAll(fixtureDir)
|
|
||||||
if err := os.WriteFile(fixtureFile, badContent, 0o644); err != nil {
|
|
||||||
t.Fatalf("write fixture: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Run the SAME walk logic as TestLexiconMetaDocsNoBannedTermsInDocs and
|
|
||||||
// assert it FINDS the fixture's banned term. A walk that returns zero
|
|
||||||
// hits here proves the walk logic is broken (the fixture is a known-bad
|
|
||||||
// file inside docs/ that MUST be detected).
|
|
||||||
hits := []string{}
|
|
||||||
err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if info.IsDir() {
|
|
||||||
base := filepath.Base(path)
|
|
||||||
if base == ".ciagent" || base == ".git" {
|
|
||||||
return filepath.SkipDir
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
if path == this {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
if !strings.HasSuffix(path, ".md") {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
rel, rerr := filepath.Rel(root, path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if rel != "README.md" && !strings.HasPrefix(rel, "docs"+string(filepath.Separator)) {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
bz, rerr := os.ReadFile(path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
|
||||||
hits = append(hits, rel+" contains banned term "+found)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
})
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("walk: %v", err)
|
|
||||||
}
|
|
||||||
// Assert the fixture was found. The rel path uses OS-specific separator;
|
|
||||||
// match on the suffix so the test is portable.
|
|
||||||
foundFixture := false
|
|
||||||
for _, h := range hits {
|
|
||||||
if strings.Contains(h, "bad_fixture.md") && strings.Contains(h, syntheticTerm) {
|
|
||||||
foundFixture = true
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if !foundFixture {
|
|
||||||
t.Errorf("G-013 walk-coverage: the walk did NOT find the synthetic banned-term fixture at %s — the docs firewall walk logic is broken (it would silently scan nothing and report green). hits=%v", fixtureFile, hits)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,167 +0,0 @@
|
|||||||
// Package lexicon_meta holds the project-wide lexicon firewall meta-test
|
|
||||||
// (REQ-012, G-004, G-009). It is the durable firewall created in v0.2 P1
|
|
||||||
// Wave 3; P5-01-01 EXTENDS it rather than recreating it.
|
|
||||||
//
|
|
||||||
// The meta-test scans every .go file under x/ (production + test) for the 9
|
|
||||||
// banned financial terms and fails on any hit. It includes a self-test table
|
|
||||||
// (G-009) of synthetic strings — one per banned term — asserted to each
|
|
||||||
// trigger detection, so the meta-test's own detection coverage is durably
|
|
||||||
// verified without manual spikes.
|
|
||||||
//
|
|
||||||
// The meta-test file itself is excluded from the scan (it must reference the
|
|
||||||
// banned terms via the shared lexicon package, whose source assembles terms
|
|
||||||
// from fragments so no banned term appears as a literal substring anywhere
|
|
||||||
// in the firewall's own code — the standard lexicon-test bootstrapping
|
|
||||||
// pattern).
|
|
||||||
package lexicon_meta
|
|
||||||
|
|
||||||
import (
|
|
||||||
"os"
|
|
||||||
"path/filepath"
|
|
||||||
"runtime"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/lexicon"
|
|
||||||
)
|
|
||||||
|
|
||||||
// TestLexiconMetaNoBannedTermsInX is the project-wide firewall (G-004).
|
|
||||||
// It walks every .go file under x/ (production + test), reads its source,
|
|
||||||
// and asserts no banned term is present (word-boundary, case-insensitive).
|
|
||||||
// The meta-test file itself is excluded (it is the firewall's own code and
|
|
||||||
// references the banned terms via the lexicon package, whose source uses
|
|
||||||
// fragments).
|
|
||||||
//
|
|
||||||
// Passes at P1: the v0.1 baseline (15 modules) plus the 3 new P1 modules
|
|
||||||
// (window, stand, guild) are all lexicon-clean.
|
|
||||||
func TestLexiconMetaNoBannedTermsInX(t *testing.T) {
|
|
||||||
xRoot := repoXRoot(t)
|
|
||||||
thisFile := thisFile(t)
|
|
||||||
hits := []string{}
|
|
||||||
err := filepath.Walk(xRoot, func(path string, info os.FileInfo, err error) error {
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if info.IsDir() {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
if !strings.HasSuffix(path, ".go") {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
// Exclude the meta-test file itself (the firewall's own code).
|
|
||||||
if path == thisFile {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
bz, rerr := os.ReadFile(path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
|
||||||
rel, _ := filepath.Rel(xRoot, path)
|
|
||||||
hits = append(hits, rel+" contains banned term "+found)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
})
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("walk: %v", err)
|
|
||||||
}
|
|
||||||
if len(hits) > 0 {
|
|
||||||
t.Errorf("REQ-012 lexicon firewall violations:\n %s",
|
|
||||||
strings.Join(hits, "\n "))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaSelfTestTable (G-009) is the meta-test's own coverage
|
|
||||||
// firewall. Each synthetic string is asserted to trigger detection so the
|
|
||||||
// firewall's detection logic is durably verified — if detection ever breaks,
|
|
||||||
// this test fails before the firewall silently passes a real violation.
|
|
||||||
//
|
|
||||||
// REQ-029 (GRILL G-014): the synthetic strings are sourced from
|
|
||||||
// lexicon.SyntheticBannedStrings(), the single source of truth shared with
|
|
||||||
// lexicon_meta_docs_test.go :: TestLexiconMetaDocsSelfTestTable. Before
|
|
||||||
// REQ-029, both meta-tests DUPLICATED their own 10-string table, creating a
|
|
||||||
// drift risk; the shared helper closes it. This file no longer builds its
|
|
||||||
// own synthetic table.
|
|
||||||
func TestLexiconMetaSelfTestTable(t *testing.T) {
|
|
||||||
terms := lexicon.BannedTerms()
|
|
||||||
// The spec lists 10 banned terms (plan docs say "9", counting dollar/euro
|
|
||||||
// as a pair): bank, deposit, interest, yield, currency, dollar, euro,
|
|
||||||
// account, savings, depositor.
|
|
||||||
if len(terms) != 10 {
|
|
||||||
t.Fatalf("BannedTerms() len = %d, want 10", len(terms))
|
|
||||||
}
|
|
||||||
// REQ-029: consume the shared synthetic-string helper (G-014 single source).
|
|
||||||
synthetic := lexicon.SyntheticBannedStrings()
|
|
||||||
if len(synthetic) != len(terms) {
|
|
||||||
t.Fatalf("SyntheticBannedStrings() len = %d, want %d (must match BannedTerms())", len(synthetic), len(terms))
|
|
||||||
}
|
|
||||||
for i, s := range synthetic {
|
|
||||||
found, ok := lexicon.FindBannedTerm(s)
|
|
||||||
if !ok {
|
|
||||||
t.Errorf("G-009 self-test [%d]: synthetic string did not trigger detection: %q", i, s)
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
if found != terms[i] {
|
|
||||||
t.Errorf("G-009 self-test [%d]: detected %q, want %q (in %q)", i, found, terms[i], s)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaBannedTermsCount asserts exactly 10 banned terms are
|
|
||||||
// configured (locked-const for the firewall's scope; spec lists 10, plan docs
|
|
||||||
// say "9" counting dollar/euro as a pair).
|
|
||||||
func TestLexiconMetaBannedTermsCount(t *testing.T) {
|
|
||||||
terms := lexicon.BannedTerms()
|
|
||||||
if len(terms) != 10 {
|
|
||||||
t.Errorf("BannedTerms() len = %d, want 10 (REQ-012)", len(terms))
|
|
||||||
}
|
|
||||||
seen := map[string]bool{}
|
|
||||||
for _, tr := range terms {
|
|
||||||
if seen[tr] {
|
|
||||||
t.Errorf("duplicate banned term %q", tr)
|
|
||||||
}
|
|
||||||
seen[tr] = true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaNoFalsePositiveOnOpenYield asserts the module name
|
|
||||||
// "openyield" does NOT trigger the "yield" banned term (word-boundary
|
|
||||||
// matching must not match substrings of identifiers). This is the
|
|
||||||
// regression firewall for the word-boundary detection design.
|
|
||||||
func TestLexiconMetaNoFalsePositiveOnOpenYield(t *testing.T) {
|
|
||||||
cases := []string{
|
|
||||||
"github.com/oy/openyield/x/window/types",
|
|
||||||
"package openyield",
|
|
||||||
"openyield is the module",
|
|
||||||
"european resident",
|
|
||||||
}
|
|
||||||
for _, s := range cases {
|
|
||||||
if _, ok := lexicon.FindBannedTerm(s); ok {
|
|
||||||
t.Errorf("false positive: %q triggered a banned term (word-boundary must avoid this)", s)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// repoXRoot returns the absolute path to the repo's x/ directory by walking
|
|
||||||
// up from this test file.
|
|
||||||
func repoXRoot(t *testing.T) string {
|
|
||||||
t.Helper()
|
|
||||||
_, file, _, ok := runtime.Caller(0)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("runtime.Caller failed")
|
|
||||||
}
|
|
||||||
// file = .../oy/lexicon_meta_test.go -> repo root is its dir; x/ is repo/x
|
|
||||||
repoRoot := filepath.Dir(file)
|
|
||||||
return filepath.Join(repoRoot, "x")
|
|
||||||
}
|
|
||||||
|
|
||||||
// thisFile returns the absolute path of this meta-test file (to exclude it
|
|
||||||
// from its own scan).
|
|
||||||
func thisFile(t *testing.T) string {
|
|
||||||
t.Helper()
|
|
||||||
_, file, _, ok := runtime.Caller(0)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("runtime.Caller failed")
|
|
||||||
}
|
|
||||||
return file
|
|
||||||
}
|
|
||||||
@@ -1,307 +0,0 @@
|
|||||||
// Package lexicon_meta_web holds the web lexicon firewall (REQ-045, D-069).
|
|
||||||
//
|
|
||||||
// It is a NEW sibling meta-test created in v0.6 P1 Wave 1 that MIRRORS the
|
|
||||||
// v0.3 docs firewall (lexicon_meta_docs/lexicon_meta_docs_test.go, package
|
|
||||||
// lexicon_meta_docs) but scans the web surface (web/templates/**/*.html +
|
|
||||||
// web/static/**/*.js + web/**/*.go) instead of README.md + docs/**/*.md. It
|
|
||||||
// uses the SAME lexicon.FindBannedTerm (word-boundary, case-insensitive) —
|
|
||||||
// NO detection reimplementation — so the three firewalls (x/*.go, docs, web)
|
|
||||||
// share a single source of truth for the 10 banned terms (bank, deposit,
|
|
||||||
// interest, yield, currency, dollar, euro, account, savings, depositor).
|
|
||||||
//
|
|
||||||
// Placement: this file lives in lexicon_meta_web/ (a subdirectory of the
|
|
||||||
// repo root) because Go does not permit two distinct packages in the same
|
|
||||||
// directory; the v0.2 firewall is package lexicon_meta at the repo root and
|
|
||||||
// the v0.3 firewall is package lexicon_meta_docs in lexicon_meta_docs/. The
|
|
||||||
// invocation `go test ./lexicon_meta_web/...` (PLANS P1-01-01) resolves to
|
|
||||||
// this package. Run via `go test ./...` from the repo root as well.
|
|
||||||
//
|
|
||||||
// G-013 walk-coverage: TestLexiconMetaWebWalkCoverage injects a synthetic
|
|
||||||
// banned-term .html into a temp web/templates/ subtree and asserts the walk
|
|
||||||
// FINDS it. This closes the "silently scans nothing and reports green"
|
|
||||||
// failure mode that the G-009 self-test table (detection) alone does not
|
|
||||||
// cover.
|
|
||||||
//
|
|
||||||
// G-014 self-test drift: the self-test table and banned-term count assertion
|
|
||||||
// reuse lexicon.BannedTerms() (the single source). A cross-reference comment
|
|
||||||
// keeps this file's table in lockstep with lexicon_meta_test.go's table and
|
|
||||||
// lexicon_meta_docs_test.go's table; if a banned term is added, all three
|
|
||||||
// firewalls update from one place.
|
|
||||||
package lexicon_meta_web
|
|
||||||
|
|
||||||
import (
|
|
||||||
"os"
|
|
||||||
"path/filepath"
|
|
||||||
"runtime"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/lexicon"
|
|
||||||
)
|
|
||||||
|
|
||||||
// repoRoot returns the absolute path to the repo root by walking up from
|
|
||||||
// this test file (the test lives at <repoRoot>/lexicon_meta_web/).
|
|
||||||
func repoRoot(t *testing.T) string {
|
|
||||||
t.Helper()
|
|
||||||
_, file, _, ok := runtime.Caller(0)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("runtime.Caller failed")
|
|
||||||
}
|
|
||||||
// file = .../oy/lexicon_meta_web/lexicon_meta_web_test.go
|
|
||||||
// repo root = filepath.Dir(filepath.Dir(file))
|
|
||||||
return filepath.Dir(filepath.Dir(file))
|
|
||||||
}
|
|
||||||
|
|
||||||
// thisFile returns the absolute path of this meta-test file (to exclude it
|
|
||||||
// from its own scan — it references banned terms via the lexicon package,
|
|
||||||
// whose source assembles terms from fragments, so no banned-term literal
|
|
||||||
// appears in the firewall's own code).
|
|
||||||
func thisFile(t *testing.T) string {
|
|
||||||
t.Helper()
|
|
||||||
_, file, _, ok := runtime.Caller(0)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("runtime.Caller failed")
|
|
||||||
}
|
|
||||||
return file
|
|
||||||
}
|
|
||||||
|
|
||||||
// isWebTarget reports whether path (relative to repo root) is a file the web
|
|
||||||
// firewall scans: web/templates/**/*.html, web/static/**/*.js, and
|
|
||||||
// web/**/*.go (production + test). Non-{html,js,go} files under web/ (e.g.
|
|
||||||
// vendored binary assets) are skipped.
|
|
||||||
func isWebTarget(rel string) bool {
|
|
||||||
if !strings.HasPrefix(rel, "web"+string(filepath.Separator)) {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
return strings.HasSuffix(rel, ".html") || strings.HasSuffix(rel, ".js") || strings.HasSuffix(rel, ".go")
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaWebNoBannedTermsInWeb is the web firewall (D-069). It walks
|
|
||||||
// the repo root, targets web/templates/**/*.html + web/static/**/*.js +
|
|
||||||
// web/**/*.go (production + test), reads each file's source, and asserts no
|
|
||||||
// banned term is present (word-boundary, case-insensitive). Excludes
|
|
||||||
// .ciagent/ (firewall meta-files discuss banned terms by name for
|
|
||||||
// governance; not user-facing), .git/ (VCS), and this test file itself
|
|
||||||
// (self-exclusion via runtime.Caller(0)).
|
|
||||||
//
|
|
||||||
// Passes at P1 Wave 1 with zero web content (a walk that scans nothing
|
|
||||||
// reports green on zero hits — closed by TestLexiconMetaWebWalkCoverage
|
|
||||||
// below). With the Wave 2..4 web content present (templates, static assets,
|
|
||||||
// handlers, store), all are lexicon-clean by construction.
|
|
||||||
func TestLexiconMetaWebNoBannedTermsInWeb(t *testing.T) {
|
|
||||||
root := repoRoot(t)
|
|
||||||
this := thisFile(t)
|
|
||||||
hits := []string{}
|
|
||||||
err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if info.IsDir() {
|
|
||||||
base := filepath.Base(path)
|
|
||||||
if base == ".ciagent" || base == ".git" {
|
|
||||||
return filepath.SkipDir
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
// Self-exclusion: skip this meta-test file.
|
|
||||||
if path == this {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
rel, rerr := filepath.Rel(root, path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if !isWebTarget(rel) {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
bz, rerr := os.ReadFile(path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
|
||||||
hits = append(hits, rel+" contains banned term "+found)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
})
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("walk: %v", err)
|
|
||||||
}
|
|
||||||
if len(hits) > 0 {
|
|
||||||
t.Errorf("REQ-045 web lexicon firewall violations:\n %s",
|
|
||||||
strings.Join(hits, "\n "))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaWebSelfTestTable (G-009 for web) is the firewall's own
|
|
||||||
// detection-coverage guard. Each synthetic string embeds exactly one banned
|
|
||||||
// term in a plausible sentence context and is asserted to trigger detection,
|
|
||||||
// so the firewall's detection logic is durably verified — if detection ever
|
|
||||||
// breaks, this test fails before the firewall silently passes a real
|
|
||||||
// violation in a web template or handler.
|
|
||||||
//
|
|
||||||
// REQ-029 (GRILL G-014): the synthetic strings are sourced from
|
|
||||||
// lexicon.SyntheticBannedStrings(), the single source of truth shared with
|
|
||||||
// lexicon_meta_test.go :: TestLexiconMetaSelfTestTable and
|
|
||||||
// lexicon_meta_docs_test.go :: TestLexiconMetaDocsSelfTestTable. Before
|
|
||||||
// REQ-029, each meta-test DUPLICATED its own 10-string table (byte-identical),
|
|
||||||
// creating a drift risk; the shared helper closes it. This file no longer
|
|
||||||
// builds its own synthetic table — all three meta-tests consume the same
|
|
||||||
// helper, so a future banned-term addition updates all firewalls from one
|
|
||||||
// place.
|
|
||||||
func TestLexiconMetaWebSelfTestTable(t *testing.T) {
|
|
||||||
terms := lexicon.BannedTerms()
|
|
||||||
// The spec lists 10 banned terms (plan docs say "9", counting dollar/euro
|
|
||||||
// as a pair): bank, deposit, interest, yield, currency, dollar, euro,
|
|
||||||
// account, savings, depositor.
|
|
||||||
if len(terms) != 10 {
|
|
||||||
t.Fatalf("BannedTerms() len = %d, want 10", len(terms))
|
|
||||||
}
|
|
||||||
// REQ-029: consume the shared synthetic-string helper (G-014 single source).
|
|
||||||
synthetic := lexicon.SyntheticBannedStrings()
|
|
||||||
if len(synthetic) != len(terms) {
|
|
||||||
t.Fatalf("SyntheticBannedStrings() len = %d, want %d (must match BannedTerms())", len(synthetic), len(terms))
|
|
||||||
}
|
|
||||||
for i, s := range synthetic {
|
|
||||||
found, ok := lexicon.FindBannedTerm(s)
|
|
||||||
if !ok {
|
|
||||||
t.Errorf("G-009 web self-test [%d]: synthetic string did not trigger detection: %q", i, s)
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
if found != terms[i] {
|
|
||||||
t.Errorf("G-009 web self-test [%d]: detected %q, want %q (in %q)", i, found, terms[i], s)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaWebBannedTermsCount asserts exactly 10 banned terms are
|
|
||||||
// configured (locked-const for the firewall's scope; spec lists 10, plan docs
|
|
||||||
// say "9" counting dollar/euro as a pair). Derived from lexicon.BannedTerms()
|
|
||||||
// — the single source — so a count change breaks all three firewalls (x/*.go,
|
|
||||||
// docs, web) (G-014 drift prevention).
|
|
||||||
func TestLexiconMetaWebBannedTermsCount(t *testing.T) {
|
|
||||||
terms := lexicon.BannedTerms()
|
|
||||||
if len(terms) != 10 {
|
|
||||||
t.Errorf("BannedTerms() len = %d, want 10 (REQ-012/REQ-045)", len(terms))
|
|
||||||
}
|
|
||||||
seen := map[string]bool{}
|
|
||||||
for _, tr := range terms {
|
|
||||||
if seen[tr] {
|
|
||||||
t.Errorf("duplicate banned term %q", tr)
|
|
||||||
}
|
|
||||||
seen[tr] = true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaWebNoFalsePositiveOnOpenYield asserts the module name
|
|
||||||
// "openyield" does NOT trigger the "yield" banned term and "european" does
|
|
||||||
// NOT trigger the "euro" banned term (word-boundary matching must not match
|
|
||||||
// substrings of identifiers). This is the regression firewall for the
|
|
||||||
// word-boundary detection design — mirrors the v0.2
|
|
||||||
// TestLexiconMetaNoFalsePositiveOnOpenYield and the v0.3
|
|
||||||
// TestLexiconMetaDocsNoFalsePositiveOnOpenYield.
|
|
||||||
func TestLexiconMetaWebNoFalsePositiveOnOpenYield(t *testing.T) {
|
|
||||||
cases := []string{
|
|
||||||
"github.com/oy/openyield/x/window/types",
|
|
||||||
"package openyield",
|
|
||||||
"openyield is the module",
|
|
||||||
"european resident",
|
|
||||||
"# OpenYield web",
|
|
||||||
"the OpenYield mesh",
|
|
||||||
}
|
|
||||||
for _, s := range cases {
|
|
||||||
if _, ok := lexicon.FindBannedTerm(s); ok {
|
|
||||||
t.Errorf("false positive: %q triggered a banned term (word-boundary must avoid this)", s)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaWebWalkCoverage (G-013) is the walk-coverage firewall. The
|
|
||||||
// G-009 self-test table (above) verifies DETECTION (FindBannedTerm on
|
|
||||||
// synthetic strings) but NOT the WALK (which files are scanned). A walk bug
|
|
||||||
// — e.g. wrong path prefix, missing web/ recursion, a typo in the .html
|
|
||||||
// suffix check — would silently scan nothing and report green on zero
|
|
||||||
// files. This test closes that gap by injecting a synthetic banned-term
|
|
||||||
// .html into a fixture dir under the real web/templates/ path the walk scans
|
|
||||||
// and asserting the walk FINDS it.
|
|
||||||
//
|
|
||||||
// The fixture is created under web/templates/.lexicon_fixture/ (a real
|
|
||||||
// web/templates/ subtree the walk reaches) and removed via defer so it never
|
|
||||||
// leaks into the repo. If the walk logic misses the fixture, this test fails
|
|
||||||
// loudly instead of letting a broken walk pass the firewall green on zero
|
|
||||||
// files scanned.
|
|
||||||
func TestLexiconMetaWebWalkCoverage(t *testing.T) {
|
|
||||||
root := repoRoot(t)
|
|
||||||
this := thisFile(t)
|
|
||||||
|
|
||||||
// Build a synthetic banned term from fragments so THIS file does not
|
|
||||||
// contain a banned-term literal (it is excluded from its own scan, but
|
|
||||||
// the synthetic stays clean for readability/searchability).
|
|
||||||
terms := lexicon.BannedTerms()
|
|
||||||
if len(terms) == 0 {
|
|
||||||
t.Fatal("BannedTerms() returned no terms — cannot run walk-coverage")
|
|
||||||
}
|
|
||||||
// Use the first banned term ("bank") assembled from two halves.
|
|
||||||
syntheticTerm := terms[0][:2] + terms[0][2:] // reassemble (no literal in source)
|
|
||||||
badContent := []byte("<!-- fixture -->\nthis file contains a banned term: " + syntheticTerm + "\n")
|
|
||||||
|
|
||||||
fixtureDir := filepath.Join(root, "web", "templates", ".lexicon_fixture")
|
|
||||||
fixtureFile := filepath.Join(fixtureDir, "bad_fixture.html")
|
|
||||||
if err := os.MkdirAll(fixtureDir, 0o755); err != nil {
|
|
||||||
t.Fatalf("mkdir fixture: %v", err)
|
|
||||||
}
|
|
||||||
defer os.RemoveAll(fixtureDir)
|
|
||||||
if err := os.WriteFile(fixtureFile, badContent, 0o644); err != nil {
|
|
||||||
t.Fatalf("write fixture: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Run the SAME walk logic as TestLexiconMetaWebNoBannedTermsInWeb and
|
|
||||||
// assert it FINDS the fixture's banned term. A walk that returns zero
|
|
||||||
// hits here proves the walk logic is broken (the fixture is a known-bad
|
|
||||||
// file inside web/templates/ that MUST be detected).
|
|
||||||
hits := []string{}
|
|
||||||
err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if info.IsDir() {
|
|
||||||
base := filepath.Base(path)
|
|
||||||
if base == ".ciagent" || base == ".git" {
|
|
||||||
return filepath.SkipDir
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
if path == this {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
rel, rerr := filepath.Rel(root, path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if !isWebTarget(rel) {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
bz, rerr := os.ReadFile(path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
|
||||||
hits = append(hits, rel+" contains banned term "+found)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
})
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("walk: %v", err)
|
|
||||||
}
|
|
||||||
// Assert the fixture was found. The rel path uses OS-specific separator;
|
|
||||||
// match on the suffix so the test is portable.
|
|
||||||
foundFixture := false
|
|
||||||
for _, h := range hits {
|
|
||||||
if strings.Contains(h, "bad_fixture.html") && strings.Contains(h, syntheticTerm) {
|
|
||||||
foundFixture = true
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if !foundFixture {
|
|
||||||
t.Errorf("G-013 walk-coverage: the walk did NOT find the synthetic banned-term fixture at %s — the web firewall walk logic is broken (it would silently scan nothing and report green). hits=%v", fixtureFile, hits)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
-63
@@ -1,63 +0,0 @@
|
|||||||
# OpenYield docs site (MkDocs Material, D-042).
|
|
||||||
#
|
|
||||||
# Build-only Python dep (mkdocs + mkdocs-material); NOT a Go dep (G-006 —
|
|
||||||
# go.mod stays zero-require). Invoke locally with `mkdocs serve` or
|
|
||||||
# `mkdocs build` (see README). No publishing CI in v0.3 (D-046 — publishing
|
|
||||||
# to GitHub/Gitea Pages deferred to v0.4).
|
|
||||||
#
|
|
||||||
# Nav completeness (G-011): the nav lists ALL 26 pages that will exist by end
|
|
||||||
# of P3. P1 creates the shared/ pages + index (8 files); P2 adds nomads/
|
|
||||||
# (8 files); P3 adds freeholders/ (8 files) + reference/ (2 files). Only the
|
|
||||||
# files that exist at P1 ship today; the nav references the not-yet-created
|
|
||||||
# P2/P3 pages by path so the structure is complete and P2/P3 just add files.
|
|
||||||
# mkdocs.yml is a config file, NOT validated by Go tests; the docs firewall
|
|
||||||
# (lexicon_meta_docs_test.go) validates .md content, not nav.
|
|
||||||
|
|
||||||
site_name: OpenYield
|
|
||||||
site_description: OpenYield — a jurisdiction-light, public-good mesh for real production, organized around Holders, Stands, and the Six Principles.
|
|
||||||
|
|
||||||
theme:
|
|
||||||
name: material
|
|
||||||
features:
|
|
||||||
- navigation.sections
|
|
||||||
- navigation.expand
|
|
||||||
- toc.integrate
|
|
||||||
|
|
||||||
markdown_extensions:
|
|
||||||
- admonition
|
|
||||||
- toc:
|
|
||||||
permalink: true
|
|
||||||
- codehilite
|
|
||||||
- pymdownx.superfences
|
|
||||||
|
|
||||||
nav:
|
|
||||||
- Home: index.md
|
|
||||||
- Nomads:
|
|
||||||
- Overview: nomads/index.md
|
|
||||||
- Reach: nomads/reach.md
|
|
||||||
- Stash: nomads/stash.md
|
|
||||||
- Bearers: nomads/bearers.md
|
|
||||||
- Maps-Pay: nomads/maps-pay.md
|
|
||||||
- Pacts: nomads/pacts.md
|
|
||||||
- Standing: nomads/standing.md
|
|
||||||
- Window: nomads/window.md
|
|
||||||
- Freeholders:
|
|
||||||
- Overview: freeholders/index.md
|
|
||||||
- Signals: freeholders/signals.md
|
|
||||||
- Standing: freeholders/standing.md
|
|
||||||
- Stands & Guilds: freeholders/stands-guilds.md
|
|
||||||
- Councils & Voice: freeholders/councils-voice.md
|
|
||||||
- Bonds: freeholders/bonds.md
|
|
||||||
- Partner Spectrum: freeholders/partner-spectrum.md
|
|
||||||
- Anchor Preview: freeholders/anchor-preview.md
|
|
||||||
- Shared:
|
|
||||||
- Overview: shared/index.md
|
|
||||||
- Six Principles: shared/six-principles.md
|
|
||||||
- Bread Scale: shared/bread-scale.md
|
|
||||||
- Storage Pools: shared/storage-pools.md
|
|
||||||
- Watchers & Mirror: shared/watchers-mirror.md
|
|
||||||
- Lexicon: shared/lexicon.md
|
|
||||||
- Vision: shared/vision.md
|
|
||||||
- Reference:
|
|
||||||
- Architecture: reference/architecture.md
|
|
||||||
- Components: reference/components.md
|
|
||||||
@@ -1,50 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
|
|
||||||
bloomtypes "github.com/oy/openyield/x/bloom/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// registerBloom wires the Bloom accrual route (REQ-044).
|
|
||||||
func (s *Server) registerBloom(mux *http.ServeMux) {
|
|
||||||
mux.HandleFunc("GET /bloom/{stashID}", s.handleBloom)
|
|
||||||
}
|
|
||||||
|
|
||||||
// bloomViewData is the template data for the Bloom accrual view.
|
|
||||||
type bloomViewData struct {
|
|
||||||
StashID string
|
|
||||||
Found bool
|
|
||||||
Record bloomtypes.BloomRecord
|
|
||||||
RatePct float64 // RateBasisPoints as a percentage (450 -> 4.5)
|
|
||||||
TargetRatePct float64 // TargetBloomRateBasisPoints as %
|
|
||||||
MinRatePct float64
|
|
||||||
MaxRatePct float64
|
|
||||||
AccrualPeriod int64
|
|
||||||
MissionLockNote string
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleBloom renders the Bloom accrual view (REQ-044): per-Stash BloomRecord
|
|
||||||
// (AccruedGrain, RateBasisPoints as %, LastAccrualBlock) + the 4.5% target rate
|
|
||||||
// (read from x/bloom/types.TargetBloomRateBasisPoints — D-073 code-constant
|
|
||||||
// source-of-truth, NOT hardcoded). Bloom is conceptually close to a banned
|
|
||||||
// financial term; labels use "Bloom"/"real production"/"accrual" only.
|
|
||||||
func (s *Server) handleBloom(w http.ResponseWriter, r *http.Request) {
|
|
||||||
stashID := r.PathValue("stashID")
|
|
||||||
rec, ok := s.Store.GetBloomRecord(stashID)
|
|
||||||
if !ok {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
s.render(w, "bloom.html", bloomViewData{
|
|
||||||
StashID: stashID,
|
|
||||||
Found: true,
|
|
||||||
Record: rec,
|
|
||||||
RatePct: float64(rec.RateBasisPoints) / 100,
|
|
||||||
TargetRatePct: float64(bloomtypes.TargetBloomRateBasisPoints) / 100,
|
|
||||||
MinRatePct: float64(bloomtypes.MinBloomRateBasisPoints) / 100,
|
|
||||||
MaxRatePct: float64(bloomtypes.MaxBloomRateBasisPoints) / 100,
|
|
||||||
AccrualPeriod: bloomtypes.AccrualPeriodBlocks,
|
|
||||||
MissionLockNote: bloomtypes.MissionLockBloom,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
@@ -1,137 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
bloomtypes "github.com/oy/openyield/x/bloom/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestBloomSeededRecordRendersTargetRate(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/bloom/stash-holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /bloom/stash-holder-alia: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// Accrued Grain present.
|
|
||||||
if !strings.Contains(body, "Grain") {
|
|
||||||
t.Errorf("body missing 'Grain'")
|
|
||||||
}
|
|
||||||
// Target rate 4.5% (from TargetBloomRateBasisPoints=450).
|
|
||||||
want := formatFloat(float64(bloomtypes.TargetBloomRateBasisPoints) / 100)
|
|
||||||
if !strings.Contains(body, want) {
|
|
||||||
t.Errorf("body missing target rate %s%% (TargetBloomRateBasisPoints=%d)", want, bloomtypes.TargetBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
// Mission Lock note present.
|
|
||||||
if !strings.Contains(body, "real production") {
|
|
||||||
t.Errorf("body missing Mission Lock note about real production")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestBloomMissingReturns404(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/bloom/stash-nobody", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusNotFound {
|
|
||||||
t.Fatalf("GET /bloom/stash-nobody: status %d, want 404", rec.Code)
|
|
||||||
}
|
|
||||||
// G-026: rendered-HTML lexicon check on the ERROR response body too.
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestBloomTargetRateFromCodeConstant (D-073 regression guard): asserts the
|
|
||||||
// handler reads x/bloom/types.TargetBloomRateBasisPoints=450 (NOT a hardcoded
|
|
||||||
// 450 or a docs value). This test would FAIL if the handler hardcoded the rate
|
|
||||||
// instead of reading the code constant.
|
|
||||||
func TestBloomTargetRateFromCodeConstant(t *testing.T) {
|
|
||||||
// D-073: the code constant is the source of truth.
|
|
||||||
if bloomtypes.TargetBloomRateBasisPoints != 450 {
|
|
||||||
t.Fatalf("D-073: TargetBloomRateBasisPoints = %d, want 450 (code constant)", bloomtypes.TargetBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
if bloomtypes.MinBloomRateBasisPoints != 400 {
|
|
||||||
t.Fatalf("D-073: MinBloomRateBasisPoints = %d, want 400 (code constant)", bloomtypes.MinBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
if bloomtypes.MaxBloomRateBasisPoints != 500 {
|
|
||||||
t.Fatalf("D-073: MaxBloomRateBasisPoints = %d, want 500 (code constant)", bloomtypes.MaxBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/bloom/stash-holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
body := rec.Body.String()
|
|
||||||
|
|
||||||
// The rendered target rate must be the code constant / 100 = 4.5.
|
|
||||||
wantTarget := formatFloat(float64(bloomtypes.TargetBloomRateBasisPoints) / 100)
|
|
||||||
if !strings.Contains(body, wantTarget) {
|
|
||||||
t.Errorf("D-073: body missing target rate %s%% (from code constant %d)", wantTarget, bloomtypes.TargetBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
// The seeded record for holder-alia uses RateBasisPoints=450 (the target).
|
|
||||||
rec2, ok := srv.Store.GetBloomRecord("stash-holder-alia")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded bloom record stash-holder-alia missing")
|
|
||||||
}
|
|
||||||
if rec2.RateBasisPoints != bloomtypes.TargetBloomRateBasisPoints {
|
|
||||||
t.Errorf("D-073: seeded record RateBasisPoints = %d, want %d (code constant)", rec2.RateBasisPoints, bloomtypes.TargetBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
// The rate band must be rendered from the code constants.
|
|
||||||
wantMin := formatFloat(float64(bloomtypes.MinBloomRateBasisPoints) / 100)
|
|
||||||
wantMax := formatFloat(float64(bloomtypes.MaxBloomRateBasisPoints) / 100)
|
|
||||||
if !strings.Contains(body, wantMin) {
|
|
||||||
t.Errorf("D-073: body missing min rate %s%% (from code constant)", wantMin)
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, wantMax) {
|
|
||||||
t.Errorf("D-073: body missing max rate %s%% (from code constant)", wantMax)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertion that the handler uses the real x/bloom/types struct.
|
|
||||||
var _ bloomtypes.BloomRecord
|
|
||||||
|
|
||||||
// formatFloat formats a float to 1 decimal place without importing strconv
|
|
||||||
// (keeps the test deps minimal; matches the template's printf "%.1f").
|
|
||||||
func formatFloat(f float64) string {
|
|
||||||
// Round to 1 decimal.
|
|
||||||
rounded := float64(int(f*10+0.5)) / 10
|
|
||||||
whole := int(rounded)
|
|
||||||
frac := int((rounded - float64(whole)) * 10)
|
|
||||||
if frac == 0 {
|
|
||||||
return formatInt2(int64(whole)) + ".0"
|
|
||||||
}
|
|
||||||
return formatInt2(int64(whole)) + "." + string(rune('0'+frac))
|
|
||||||
}
|
|
||||||
|
|
||||||
func formatInt2(n int64) string {
|
|
||||||
if n == 0 {
|
|
||||||
return "0"
|
|
||||||
}
|
|
||||||
neg := n < 0
|
|
||||||
if neg {
|
|
||||||
n = -n
|
|
||||||
}
|
|
||||||
var buf [20]byte
|
|
||||||
i := len(buf)
|
|
||||||
for n > 0 {
|
|
||||||
i--
|
|
||||||
buf[i] = byte('0' + n%10)
|
|
||||||
n /= 10
|
|
||||||
}
|
|
||||||
if neg {
|
|
||||||
i--
|
|
||||||
buf[i] = '-'
|
|
||||||
}
|
|
||||||
return string(buf[i:])
|
|
||||||
}
|
|
||||||
@@ -1,90 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
|
|
||||||
identitytypes "github.com/oy/openyield/x/identity/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// registerReach wires the Reach signup routes (REQ-040) into the mux.
|
|
||||||
// Go 1.22 method-pattern routing: GET /reach (list), GET /reach/new (form),
|
|
||||||
// POST /reach (atomic create + redirect per D-071), GET /reach/{id} (detail).
|
|
||||||
func (s *Server) registerReach(mux *http.ServeMux) {
|
|
||||||
mux.HandleFunc("GET /reach", s.handleReachList)
|
|
||||||
mux.HandleFunc("GET /reach/new", s.handleReachNew)
|
|
||||||
mux.HandleFunc("POST /reach", s.handleReachCreate)
|
|
||||||
mux.HandleFunc("GET /reach/{id}", s.handleReachDetail)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleReachList renders all Reaches (seeded + created).
|
|
||||||
func (s *Server) handleReachList(w http.ResponseWriter, r *http.Request) {
|
|
||||||
reaches := s.Store.ListReaches()
|
|
||||||
s.render(w, "reach_list.html", map[string]any{"Reaches": reaches})
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleReachNew renders the "Create a Reach" form. Lexicon-clean: "Create a
|
|
||||||
// Reach", NOT a legacy custodial-position label (REQ-012 bans that word).
|
|
||||||
func (s *Server) handleReachNew(w http.ResponseWriter, r *http.Request) {
|
|
||||||
s.render(w, "reach_new.html", nil)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleReachCreate handles the POST from the "Create a Reach" form. Calls
|
|
||||||
// store.CreateReach (atomic Reach + Stash per D-071). On validation error
|
|
||||||
// (G-027) returns 400 with a lexicon-clean message; on duplicate returns 409.
|
|
||||||
// On success redirects (302) to the new Reach detail page.
|
|
||||||
func (s *Server) handleReachCreate(w http.ResponseWriter, r *http.Request) {
|
|
||||||
holderID := r.FormValue("holder_id")
|
|
||||||
publicKey := r.FormValue("public_key")
|
|
||||||
reach, _, err := s.Store.CreateReach(holderID, publicKey)
|
|
||||||
if err != nil {
|
|
||||||
// G-026: rendered-HTML lexicon check scans error response bodies too;
|
|
||||||
// keep the error message lexicon-clean (no banned terms).
|
|
||||||
status := http.StatusBadRequest
|
|
||||||
if isDuplicate(err) {
|
|
||||||
status = http.StatusConflict
|
|
||||||
}
|
|
||||||
http.Error(w, "Could not create a Reach: "+err.Error(), status)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Redirect(w, r, "/reach/"+reach.HolderID, http.StatusFound)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleReachDetail renders one Reach + its associated Stash (BalanceGrain).
|
|
||||||
func (s *Server) handleReachDetail(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("id")
|
|
||||||
reach, ok := s.Store.GetReach(id)
|
|
||||||
if !ok {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
stash, _ := s.Store.GetStash(id)
|
|
||||||
s.render(w, "reach_detail.html", map[string]any{
|
|
||||||
"Reach": reach,
|
|
||||||
"Stash": stash,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
// isDuplicate reports whether err is a duplicate-holder error from
|
|
||||||
// store.CreateReach. Kept as a string match to avoid exporting store errors.
|
|
||||||
func isDuplicate(err error) bool {
|
|
||||||
return err != nil && contains(err.Error(), "already has a Reach")
|
|
||||||
}
|
|
||||||
|
|
||||||
func contains(s, sub string) bool {
|
|
||||||
return len(s) >= len(sub) && (s == sub || indexOf(s, sub) >= 0)
|
|
||||||
}
|
|
||||||
|
|
||||||
func indexOf(s, sub string) int {
|
|
||||||
for i := 0; i+len(sub) <= len(s); i++ {
|
|
||||||
if s[i:i+len(sub)] == sub {
|
|
||||||
return i
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return -1
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions that the handlers use the real x/*/types structs
|
|
||||||
// (D-067: the UI grounds in the real Go type definitions).
|
|
||||||
var _ identitytypes.Reach
|
|
||||||
var _ stashtypes.Stash
|
|
||||||
@@ -1,185 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/lexicon"
|
|
||||||
"github.com/oy/openyield/web/store"
|
|
||||||
)
|
|
||||||
|
|
||||||
// newTestServer builds a Server with a fresh store + templates parsed from
|
|
||||||
// web/templates (relative to repo root via the handlers test working dir).
|
|
||||||
func newTestServer(t *testing.T) *Server {
|
|
||||||
t.Helper()
|
|
||||||
srv, err := New(store.NewStore(), "../../web/templates")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("new handlers server: %v", err)
|
|
||||||
}
|
|
||||||
return srv
|
|
||||||
}
|
|
||||||
|
|
||||||
// assertNoBannedTerms checks the rendered response body for banned terms
|
|
||||||
// (G-026: applies to BOTH 200 happy-path AND error response bodies).
|
|
||||||
func assertNoBannedTerms(t *testing.T, body string) {
|
|
||||||
t.Helper()
|
|
||||||
if term, ok := lexicon.FindBannedTerm(body); ok {
|
|
||||||
t.Errorf("rendered HTML contains banned term %q (REQ-012/G-026)", term)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachListReturnsSeededReaches(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/reach", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /reach: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, "holder-alia") {
|
|
||||||
t.Errorf("GET /reach: body missing seeded reach holder-alia")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "holder-bryn") {
|
|
||||||
t.Errorf("GET /reach: body missing seeded reach holder-bryn")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachNewReturnsForm(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/reach/new", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /reach/new: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, "Create a Reach") {
|
|
||||||
t.Errorf("GET /reach/new: body missing 'Create a Reach' label")
|
|
||||||
}
|
|
||||||
// The legacy custodial-position word is BANNED (REQ-012) — must not appear.
|
|
||||||
// Check the full banned-terms list via the lexicon package (no literals in
|
|
||||||
// source); FindBannedTerm does word-boundary matching so this is stricter
|
|
||||||
// than a naive substring check.
|
|
||||||
if term, ok := lexicon.FindBannedTerm(body); ok {
|
|
||||||
t.Errorf("GET /reach/new: body contains banned word %q", term)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachCreateValidRedirectsAndAtomicallyCreates(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/reach", strings.NewReader("holder_id=holder-new&public_key=pk-new"))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusFound {
|
|
||||||
t.Fatalf("POST /reach valid: status %d, want 302 (Found)", rec.Code)
|
|
||||||
}
|
|
||||||
loc := rec.Header().Get("Location")
|
|
||||||
if !strings.Contains(loc, "/reach/holder-new") {
|
|
||||||
t.Errorf("POST /reach: Location %q, want redirect to /reach/holder-new", loc)
|
|
||||||
}
|
|
||||||
// D-071: atomic creation — both Reach + Stash must be present.
|
|
||||||
reach, ok := srv.Store.GetReach("holder-new")
|
|
||||||
if !ok {
|
|
||||||
t.Fatalf("POST /reach: GetReach miss after create (atomicity broken)")
|
|
||||||
}
|
|
||||||
if !reach.IsNomad {
|
|
||||||
t.Errorf("POST /reach: created Reach IsNomad=false, want true (D-071)")
|
|
||||||
}
|
|
||||||
stash, ok := srv.Store.GetStash("holder-new")
|
|
||||||
if !ok {
|
|
||||||
t.Fatalf("POST /reach: GetStash miss after create (atomicity broken — D-071)")
|
|
||||||
}
|
|
||||||
if stash.HolderID != reach.HolderID {
|
|
||||||
t.Errorf("POST /reach: stash.HolderID %q != reach.HolderID %q (D-071)", stash.HolderID, reach.HolderID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachCreateEmptyHolderIDReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/reach", strings.NewReader("holder_id=&public_key=pk"))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST /reach empty holder: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
// G-026: rendered-HTML lexicon check scans the ERROR response body too.
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachCreatePathSeparatorReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/reach", strings.NewReader("holder_id=h/x&public_key=pk"))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST /reach path separator: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachCreateDuplicateReturns409(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/reach", strings.NewReader("holder_id=holder-alia&public_key=pk"))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusConflict {
|
|
||||||
t.Fatalf("POST /reach duplicate: status %d, want 409", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachDetailSeededReturnsReachAndStash(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/reach/holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /reach/holder-alia: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, "reach-holder-alia") {
|
|
||||||
t.Errorf("GET /reach/holder-alia: body missing reach-holder-alia")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "stash-holder-alia") {
|
|
||||||
t.Errorf("GET /reach/holder-alia: body missing associated stash-holder-alia")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "Grain") {
|
|
||||||
t.Errorf("GET /reach/holder-alia: body missing Stash balance in Grain")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachDetailMissingReturns404(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/reach/nobody", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusNotFound {
|
|
||||||
t.Fatalf("GET /reach/nobody: status %d, want 404", rec.Code)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,125 +0,0 @@
|
|||||||
// Package handlers holds the HTTP handlers for the OpenYield web UI screens.
|
|
||||||
//
|
|
||||||
// Each screen (Reach signup, Stash dashboard, Window authorization, Standing
|
|
||||||
// progress, Bloom accrual) gets its own handler file. handlers/server.go wires
|
|
||||||
// routes into the mux from web/server.go. Handlers render html/template
|
|
||||||
// templates against the mock store (web/store). Lexicon-clean by construction
|
|
||||||
// (REQ-012 / REQ-045): the lexicon_meta_web firewall scans these files.
|
|
||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
"html/template"
|
|
||||||
"net/http"
|
|
||||||
"os"
|
|
||||||
"path/filepath"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/web/store"
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
windowtypes "github.com/oy/openyield/x/window/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Server bundles the mock store + per-page templates + route registration.
|
|
||||||
// Each screen handler is a method on Server so it shares the store + tmpl.
|
|
||||||
//
|
|
||||||
// Template loading: base.html is parsed once, then each page template is
|
|
||||||
// parsed in a CLONE of the base set so the per-page "content" block does not
|
|
||||||
// collide across pages (Go html/template shares the block namespace within
|
|
||||||
// one set; cloning per page isolates each page's content block). This is the
|
|
||||||
// standard Go template pattern for layouts + pages.
|
|
||||||
type Server struct {
|
|
||||||
Store *store.Store
|
|
||||||
Pages map[string]*template.Template
|
|
||||||
}
|
|
||||||
|
|
||||||
// New constructs a Server with the given store + per-page templates loaded
|
|
||||||
// from templatesDir (the absolute or relative path to web/templates/).
|
|
||||||
func New(s *store.Store, templatesDir string) (*Server, error) {
|
|
||||||
funcs := template.FuncMap{
|
|
||||||
"divGrain": func(grain, unit int64) int64 {
|
|
||||||
if unit == 0 {
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
return grain / unit
|
|
||||||
},
|
|
||||||
"string": func(v any) string {
|
|
||||||
switch t := v.(type) {
|
|
||||||
case string:
|
|
||||||
return t
|
|
||||||
case windowtypes.WindowStatus:
|
|
||||||
return string(t)
|
|
||||||
case standingtypes.StandingBucket:
|
|
||||||
return string(t)
|
|
||||||
default:
|
|
||||||
return ""
|
|
||||||
}
|
|
||||||
},
|
|
||||||
}
|
|
||||||
basePath := filepath.Join(templatesDir, "base.html")
|
|
||||||
base, err := template.New("base.html").Funcs(funcs).ParseFiles(basePath)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("parse base: %w", err)
|
|
||||||
}
|
|
||||||
pages := map[string]*template.Template{}
|
|
||||||
pageGlob := filepath.Join(templatesDir, "*.html")
|
|
||||||
matches, err := filepath.Glob(pageGlob)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("glob pages: %w", err)
|
|
||||||
}
|
|
||||||
for _, p := range matches {
|
|
||||||
name := filepath.Base(p)
|
|
||||||
if name == "base.html" {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
clone, cerr := base.Clone()
|
|
||||||
if cerr != nil {
|
|
||||||
return nil, fmt.Errorf("clone for %s: %w", name, cerr)
|
|
||||||
}
|
|
||||||
pt, perr := clone.ParseFiles(p)
|
|
||||||
if perr != nil {
|
|
||||||
return nil, fmt.Errorf("parse %s: %w", name, perr)
|
|
||||||
}
|
|
||||||
pages[name] = pt
|
|
||||||
}
|
|
||||||
return &Server{Store: s, Pages: pages}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Register wires all screen routes into the given mux (Go 1.22 method
|
|
||||||
// patterns). Called by web/server.go after constructing the Server.
|
|
||||||
func (s *Server) Register(mux *http.ServeMux) {
|
|
||||||
s.registerReach(mux)
|
|
||||||
s.registerStash(mux)
|
|
||||||
s.registerWindow(mux)
|
|
||||||
s.registerStanding(mux)
|
|
||||||
s.registerBloom(mux)
|
|
||||||
}
|
|
||||||
|
|
||||||
// render executes the named page template with the given data, writing HTML
|
|
||||||
// to w. The page template invokes base.html and overrides the "content" block.
|
|
||||||
func (s *Server) render(w http.ResponseWriter, name string, data any) {
|
|
||||||
tmpl, ok := s.Pages[name]
|
|
||||||
if !ok {
|
|
||||||
http.Error(w, "template not found: "+name, http.StatusInternalServerError)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
||||||
if err := tmpl.ExecuteTemplate(w, "base.html", data); err != nil {
|
|
||||||
http.Error(w, "render error", http.StatusInternalServerError)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// RenderHome renders the home page (public so web/server.go can call it for
|
|
||||||
// the "/" route which lives outside handlers.Register).
|
|
||||||
func (s *Server) RenderHome(w http.ResponseWriter, data any) {
|
|
||||||
s.render(w, "home.html", data)
|
|
||||||
}
|
|
||||||
|
|
||||||
// templatesDir returns the default web/templates directory relative to the
|
|
||||||
// working directory. Used by web/server.go when constructing via New().
|
|
||||||
func DefaultTemplatesDir() string {
|
|
||||||
dir, _ := os.Getwd()
|
|
||||||
if filepath.Base(dir) == "web" || filepath.Base(dir) == "handlers" {
|
|
||||||
return filepath.Join(dir, "templates")
|
|
||||||
}
|
|
||||||
return "web/templates"
|
|
||||||
}
|
|
||||||
@@ -1,59 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// registerStanding wires the Standing + Freeholder signals route (REQ-043).
|
|
||||||
func (s *Server) registerStanding(mux *http.ServeMux) {
|
|
||||||
mux.HandleFunc("GET /standing/{reachID}", s.handleStanding)
|
|
||||||
}
|
|
||||||
|
|
||||||
// standingViewData is the template data for the Standing screen.
|
|
||||||
type standingViewData struct {
|
|
||||||
ReachID string
|
|
||||||
Found bool
|
|
||||||
Score float64
|
|
||||||
Bucket standingtypes.StandingBucket
|
|
||||||
Ratings []standingtypes.Rating
|
|
||||||
Vouches []standingtypes.Vouch
|
|
||||||
Slashes []standingtypes.Slash
|
|
||||||
Signals standingtypes.FreeholderSignals
|
|
||||||
Eligible bool
|
|
||||||
MinScore float64
|
|
||||||
MinCats int
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleStanding renders the Standing + Freeholder signals progress (REQ-043).
|
|
||||||
// Computed from mock Ratings/Vouches/Slashes using the locked x/standing/types
|
|
||||||
// constants + GetStandingBucket/ComputeDiversityBonus/GetVoucherWeight; the
|
|
||||||
// 4-signal progress via FreeholderSignals.IsFreeholderEligible().
|
|
||||||
func (s *Server) handleStanding(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("reachID")
|
|
||||||
_, ok := s.Store.GetReach(id)
|
|
||||||
if !ok {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
score, bucket := s.Store.ComputeStandingScore(id)
|
|
||||||
ratings := s.Store.ListRatings(id)
|
|
||||||
vouches := s.Store.ListVouches(id)
|
|
||||||
slashes := s.Store.ListSlashes(id)
|
|
||||||
signals := s.Store.ComputeFreeholderSignals(id)
|
|
||||||
|
|
||||||
s.render(w, "standing.html", standingViewData{
|
|
||||||
ReachID: id,
|
|
||||||
Found: true,
|
|
||||||
Score: score,
|
|
||||||
Bucket: bucket,
|
|
||||||
Ratings: ratings,
|
|
||||||
Vouches: vouches,
|
|
||||||
Slashes: slashes,
|
|
||||||
Signals: signals,
|
|
||||||
Eligible: signals.IsFreeholderEligible(),
|
|
||||||
MinScore: standingtypes.FreeholderMinStandingScore,
|
|
||||||
MinCats: standingtypes.FreeholderMinCategories,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
@@ -1,146 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestStandingEligibleHolderRendersAllSignalsEarned(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/standing/holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /standing/holder-alia: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// holder-alia: 12 ratings in 4 categories, 1 Vouch, mature Stash, balance 920000.
|
|
||||||
// All 4 signals earned -> Freeholder-eligible.
|
|
||||||
if !strings.Contains(body, "Freeholder-eligible") {
|
|
||||||
t.Errorf("body missing 'Freeholder-eligible' label")
|
|
||||||
}
|
|
||||||
// Score displayed with 1 decimal.
|
|
||||||
if !strings.Contains(body, "4.") {
|
|
||||||
t.Errorf("body missing score (expected 4.x)")
|
|
||||||
}
|
|
||||||
// All 4 signals should show 'earned'.
|
|
||||||
earnedCount := strings.Count(body, "earned")
|
|
||||||
if earnedCount < 4 {
|
|
||||||
t.Errorf("body has %d 'earned' badges, want >=4 (all signals earned for holder-alia)", earnedCount)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestStandingNotEligibleHolderShowsNotYet(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/standing/holder-bryn", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /standing/holder-bryn: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// holder-bryn: 3 ratings in 1 category, no Vouch, immature Stash.
|
|
||||||
// Not eligible.
|
|
||||||
if !strings.Contains(body, "not yet") {
|
|
||||||
t.Errorf("body missing 'not yet' badge for non-eligible holder-bryn")
|
|
||||||
}
|
|
||||||
if strings.Contains(body, "Freeholder-eligible\">yes") {
|
|
||||||
t.Errorf("body shows eligible=yes for holder-bryn (should not be eligible)")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestStandingMissingReturns404(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/standing/nobody", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusNotFound {
|
|
||||||
t.Fatalf("GET /standing/nobody: status %d, want 404", rec.Code)
|
|
||||||
}
|
|
||||||
// G-026: rendered-HTML lexicon check on the ERROR response body too.
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestStandingScoreComputedFromLockedConstants (P4 regression guard): asserts
|
|
||||||
// ComputeStandingScore uses the x/standing/types locked constants
|
|
||||||
// (PriorMean=4.0, PriorWeight=10, ComputeDiversityBonus, GetVoucherWeight,
|
|
||||||
// GetStandingBucket) — NOT a hardcoded score. This test would FAIL if the
|
|
||||||
// handler hardcoded a score instead of computing from the locked constants.
|
|
||||||
func TestStandingScoreComputedFromLockedConstants(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
score, bucket := srv.Store.ComputeStandingScore("holder-alia")
|
|
||||||
// D-073 pattern: the score must be derived from the locked constants, not
|
|
||||||
// a magic number. Assert the prior mean is 4.0 and the score is pulled
|
|
||||||
// toward it (Bayesian shrinkage) + diversity bonus for 4 categories.
|
|
||||||
if standingtypes.PriorMean != 4.0 {
|
|
||||||
t.Fatalf("D-073: PriorMean = %v, want 4.0 (locked constant)", standingtypes.PriorMean)
|
|
||||||
}
|
|
||||||
if standingtypes.PriorWeight != 10 {
|
|
||||||
t.Fatalf("D-073: PriorWeight = %v, want 10 (locked constant)", standingtypes.PriorWeight)
|
|
||||||
}
|
|
||||||
// holder-alia has 4 categories -> diversity bonus 0.10 (DiversityBonus4Cats).
|
|
||||||
bonus := standingtypes.ComputeDiversityBonus(4)
|
|
||||||
if bonus != standingtypes.DiversityBonus4Cats {
|
|
||||||
t.Errorf("ComputeDiversityBonus(4) = %v, want %v (locked constant)", bonus, standingtypes.DiversityBonus4Cats)
|
|
||||||
}
|
|
||||||
// The score must be > 4.5 (ratings 4.6-4.9 + diversity bonus 0.10).
|
|
||||||
if score < 4.5 {
|
|
||||||
t.Errorf("score for holder-alia = %.2f, want >= 4.5 (12 ratings 4.6-4.9 + 4-cat bonus)", score)
|
|
||||||
}
|
|
||||||
// Bucket must be Preferred or Top (score >= 4.5, 12 ratings >= 10).
|
|
||||||
if bucket != standingtypes.BucketPreferred && bucket != standingtypes.BucketTop {
|
|
||||||
t.Errorf("bucket for holder-alia = %q, want Preferred or Top", bucket)
|
|
||||||
}
|
|
||||||
// holder-bryn has 3 ratings in 1 category -> bucket New (< 10 ratings).
|
|
||||||
_, brynBucket := srv.Store.ComputeStandingScore("holder-bryn")
|
|
||||||
if brynBucket != standingtypes.BucketNew {
|
|
||||||
t.Errorf("bucket for holder-bryn = %q, want New (< 10 ratings)", brynBucket)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestFreeholderEligibleBadgeReflectsMethod: asserts the rendered badge
|
|
||||||
// matches FreeholderSignals.IsFreeholderEligible() (the real method).
|
|
||||||
func TestFreeholderEligibleBadgeReflectsMethod(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
|
|
||||||
// holder-alia: eligible (all 4 signals true).
|
|
||||||
aliaSignals := srv.Store.ComputeFreeholderSignals("holder-alia")
|
|
||||||
if !aliaSignals.IsFreeholderEligible() {
|
|
||||||
t.Errorf("holder-alia IsFreeholderEligible = false, want true (signals=%+v)", aliaSignals)
|
|
||||||
}
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/standing/holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if !strings.Contains(rec.Body.String(), "yes") {
|
|
||||||
t.Errorf("holder-alia: body missing 'yes' eligible badge (IsFreeholderEligible=true)")
|
|
||||||
}
|
|
||||||
|
|
||||||
// holder-bryn: not eligible.
|
|
||||||
brynSignals := srv.Store.ComputeFreeholderSignals("holder-bryn")
|
|
||||||
if brynSignals.IsFreeholderEligible() {
|
|
||||||
t.Errorf("holder-bryn IsFreeholderEligible = true, want false (signals=%+v)", brynSignals)
|
|
||||||
}
|
|
||||||
rec2 := httptest.NewRecorder()
|
|
||||||
req2 := httptest.NewRequest("GET", "/standing/holder-bryn", nil)
|
|
||||||
mux.ServeHTTP(rec2, req2)
|
|
||||||
if !strings.Contains(rec2.Body.String(), "not yet") {
|
|
||||||
t.Errorf("holder-bryn: body missing 'not yet' (IsFreeholderEligible=false)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertion that the handler uses the real x/standing/types struct.
|
|
||||||
var _ standingtypes.FreeholderSignals
|
|
||||||
@@ -1,68 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
|
|
||||||
breadtypes "github.com/oy/openyield/x/bread/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// registerStash wires the Stash dashboard route (REQ-041) into the mux.
|
|
||||||
func (s *Server) registerStash(mux *http.ServeMux) {
|
|
||||||
mux.HandleFunc("GET /stash/{holderID}", s.handleStashDashboard)
|
|
||||||
}
|
|
||||||
|
|
||||||
// stashViewData is the template data for the Stash dashboard. It carries the
|
|
||||||
// real x/*/types structs plus the Bread-scale conversion (computed from the
|
|
||||||
// x/bread/types code constants per D-073) and the maturity progress.
|
|
||||||
type stashViewData struct {
|
|
||||||
Stash stashtypes.Stash
|
|
||||||
Activity stashtypes.StashActivity
|
|
||||||
Found bool
|
|
||||||
BreadScale []breadtypes.BreadScale
|
|
||||||
BalanceBread int64
|
|
||||||
MaturityPct int
|
|
||||||
Mature bool
|
|
||||||
ThresholdDays uint32
|
|
||||||
MaxGapDays uint32
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleStashDashboard renders the Stash dashboard (REQ-041): balance in Grain
|
|
||||||
// + Bread-scale conversion (using x/bread/types.BreadScaleAll() + GrainsPerBread
|
|
||||||
// per D-073 — code constants, NOT docs) + 90-day maturity progress bar
|
|
||||||
// (StashActivity.IsMature, MaturityThresholdDays=90).
|
|
||||||
func (s *Server) handleStashDashboard(w http.ResponseWriter, r *http.Request) {
|
|
||||||
holderID := r.PathValue("holderID")
|
|
||||||
stash, ok := s.Store.GetStash(holderID)
|
|
||||||
if !ok {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
activity, _ := s.Store.GetStashActivity(stash.StashID)
|
|
||||||
|
|
||||||
// D-073: Bread-scale conversion from x/bread/types code constants.
|
|
||||||
scale := breadtypes.BreadScaleAll()
|
|
||||||
balanceBread := stash.BalanceGrain / breadtypes.GrainsPerBread
|
|
||||||
|
|
||||||
// Maturity progress: ActiveDays / MaturityThresholdDays, capped at 100%.
|
|
||||||
threshold := uint32(stashtypes.MaturityThresholdDays)
|
|
||||||
pct := int(float64(activity.ActiveDays) / float64(threshold) * 100)
|
|
||||||
if pct > 100 {
|
|
||||||
pct = 100
|
|
||||||
}
|
|
||||||
if pct < 0 {
|
|
||||||
pct = 0
|
|
||||||
}
|
|
||||||
|
|
||||||
s.render(w, "stash.html", stashViewData{
|
|
||||||
Stash: stash,
|
|
||||||
Activity: activity,
|
|
||||||
Found: true,
|
|
||||||
BreadScale: scale,
|
|
||||||
BalanceBread: balanceBread,
|
|
||||||
MaturityPct: pct,
|
|
||||||
Mature: activity.IsMature(),
|
|
||||||
ThresholdDays: threshold,
|
|
||||||
MaxGapDays: stashtypes.MaxGapForMaturity,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
@@ -1,156 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
breadtypes "github.com/oy/openyield/x/bread/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestStashDashboardSeededMatureHolder(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/stash/holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /stash/holder-alia: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// Balance in Grain present.
|
|
||||||
if !strings.Contains(body, "Grain") {
|
|
||||||
t.Errorf("body missing 'Grain' balance")
|
|
||||||
}
|
|
||||||
// Bread-scale conversion table present (all 11 denominations from BreadScaleAll).
|
|
||||||
for _, ds := range breadtypes.BreadScaleAll() {
|
|
||||||
if !strings.Contains(body, ds.Name) {
|
|
||||||
t.Errorf("body missing Bread-scale denomination %q", ds.Name)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// Mature holder (ActiveDays=92, MaxGap=10): progress ~100%, Mature badge.
|
|
||||||
if !strings.Contains(body, "Mature") {
|
|
||||||
t.Errorf("body missing 'Mature' badge for mature holder-alia")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestStashDashboardImmatureHolder(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/stash/holder-bryn", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /stash/holder-bryn: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// Immature holder (ActiveDays=45, MaxGap=5): Not mature badge.
|
|
||||||
if !strings.Contains(body, "Not mature") {
|
|
||||||
t.Errorf("body missing 'Not mature' badge for immature holder-bryn")
|
|
||||||
}
|
|
||||||
// Progress bar at 50% (45/90).
|
|
||||||
if !strings.Contains(body, "50%") {
|
|
||||||
t.Errorf("body missing 50%% progress for holder-bryn (45/90 days)")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestStashDashboardMissingReturns404(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/stash/nobody", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusNotFound {
|
|
||||||
t.Fatalf("GET /stash/nobody: status %d, want 404", rec.Code)
|
|
||||||
}
|
|
||||||
// G-026: rendered-HTML lexicon check on the ERROR response body too.
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestStashBreadScaleConversionCorrectness (D-073 regression guard): asserts
|
|
||||||
// the Stash dashboard uses x/bread/types code constants (GrainsPerBread=10000,
|
|
||||||
// BreadScaleAll() with Grain=1, Crumb=100, Bread=10000...), NOT the outdated
|
|
||||||
// docs/shared/bread-scale.md (which claims 1,000x ratios). This test would FAIL
|
|
||||||
// if the handler hardcoded the docs values instead of using the code constants.
|
|
||||||
func TestStashBreadScaleConversionCorrectness(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/stash/holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
body := rec.Body.String()
|
|
||||||
|
|
||||||
// D-073: the code constants are the source of truth.
|
|
||||||
// GrainsPerBread must be 10000 (code), NOT 1000 (docs claim 1 Crumb=1000 Grain).
|
|
||||||
if breadtypes.GrainsPerBread != 10000 {
|
|
||||||
t.Fatalf("D-073: x/bread/types.GrainsPerBread = %d, want 10000 (code constant)", breadtypes.GrainsPerBread)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The handler computes BalanceBread = BalanceGrain / GrainsPerBread.
|
|
||||||
// holder-alia seed: BalanceGrain = 920000 -> 92 Bread.
|
|
||||||
stash, ok := srv.Store.GetStash("holder-alia")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded holder-alia stash missing")
|
|
||||||
}
|
|
||||||
wantBread := stash.BalanceGrain / breadtypes.GrainsPerBread
|
|
||||||
wantBreadStr := []byte(formatInt(wantBread))
|
|
||||||
if !strings.Contains(body, string(wantBreadStr)) {
|
|
||||||
t.Errorf("D-073: body missing expected Bread conversion %d (from %d Grain / %d GrainsPerBread)",
|
|
||||||
wantBread, stash.BalanceGrain, breadtypes.GrainsPerBread)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The Bread-scale table must include the code-constant Grain values.
|
|
||||||
scale := breadtypes.BreadScaleAll()
|
|
||||||
for _, ds := range scale {
|
|
||||||
if !strings.Contains(body, formatInt(ds.GrainValue)) {
|
|
||||||
t.Errorf("D-073: body missing Bread-scale GrainValue %d for %s", ds.GrainValue, ds.Name)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Regression guard: if someone used the outdated docs value (1 Crumb = 1000
|
|
||||||
// Grain) instead of the code constant (1 Crumb = 100 Grain), the Crumb row
|
|
||||||
// would show 1000 — assert it shows 100 (the code value).
|
|
||||||
crumbs := scale[1] // index 1 = Crumb
|
|
||||||
if crumbs.Name != "Crumb" || crumbs.GrainValue != 100 {
|
|
||||||
t.Fatalf("D-073: BreadScaleAll()[1] = {%s, %d}, want {Crumb, 100}", crumbs.Name, crumbs.GrainValue)
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "100") {
|
|
||||||
t.Errorf("D-073: body missing code-constant Crumb=100 Grain (would show 1000 if docs values were used)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions that the handler uses the real x/*/types structs
|
|
||||||
// (D-067: the UI grounds in the real Go type definitions).
|
|
||||||
var _ stashtypes.Stash
|
|
||||||
var _ stashtypes.StashActivity
|
|
||||||
|
|
||||||
// formatInt is a tiny strconv.Itoa without the import (keeps test deps minimal).
|
|
||||||
func formatInt(n int64) string {
|
|
||||||
if n == 0 {
|
|
||||||
return "0"
|
|
||||||
}
|
|
||||||
neg := n < 0
|
|
||||||
if neg {
|
|
||||||
n = -n
|
|
||||||
}
|
|
||||||
var buf [20]byte
|
|
||||||
i := len(buf)
|
|
||||||
for n > 0 {
|
|
||||||
i--
|
|
||||||
buf[i] = byte('0' + n%10)
|
|
||||||
n /= 10
|
|
||||||
}
|
|
||||||
if neg {
|
|
||||||
i--
|
|
||||||
buf[i] = '-'
|
|
||||||
}
|
|
||||||
return string(buf[i:])
|
|
||||||
}
|
|
||||||
@@ -1,119 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"strconv"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
windowtypes "github.com/oy/openyield/x/window/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// registerWindow wires the Window authorization routes (REQ-042) into the mux.
|
|
||||||
func (s *Server) registerWindow(mux *http.ServeMux) {
|
|
||||||
mux.HandleFunc("GET /window", s.handleWindowList)
|
|
||||||
mux.HandleFunc("GET /window/new", s.handleWindowNew)
|
|
||||||
mux.HandleFunc("POST /window", s.handleWindowOpen)
|
|
||||||
mux.HandleFunc("GET /window/{id}", s.handleWindowDetail)
|
|
||||||
mux.HandleFunc("POST /window/{id}/activate", s.handleWindowActivate)
|
|
||||||
mux.HandleFunc("POST /window/{id}/revoke", s.handleWindowRevoke)
|
|
||||||
mux.HandleFunc("POST /window/{id}/expire", s.handleWindowExpire)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowList renders all Windows for a grantor holder (defaults to
|
|
||||||
// holder-alia if no query param, so the list view has something to show).
|
|
||||||
func (s *Server) handleWindowList(w http.ResponseWriter, r *http.Request) {
|
|
||||||
grantor := r.URL.Query().Get("grantor")
|
|
||||||
if grantor == "" {
|
|
||||||
grantor = "holder-alia"
|
|
||||||
}
|
|
||||||
windows := s.Store.ListWindows(grantor)
|
|
||||||
s.render(w, "window_list.html", map[string]any{"Windows": windows, "Grantor": grantor})
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowNew renders the "Open a Window" form.
|
|
||||||
func (s *Server) handleWindowNew(w http.ResponseWriter, r *http.Request) {
|
|
||||||
s.render(w, "window_new.html", nil)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowOpen handles the POST from the "Open a Window" form. Calls
|
|
||||||
// store.OpenWindow (creates a Window status=Open + an initial AuditEntry).
|
|
||||||
func (s *Server) handleWindowOpen(w http.ResponseWriter, r *http.Request) {
|
|
||||||
grantor := r.FormValue("grantor_holder")
|
|
||||||
grantee := r.FormValue("grantee")
|
|
||||||
scopeKind := windowtypes.ScopeKind(r.FormValue("scope_kind"))
|
|
||||||
resourceID := r.FormValue("resource_id")
|
|
||||||
startStr := r.FormValue("start_unix")
|
|
||||||
endStr := r.FormValue("end_unix")
|
|
||||||
maxActionsStr := r.FormValue("max_actions")
|
|
||||||
|
|
||||||
if grantor == "" {
|
|
||||||
http.Error(w, "grantor holder is required", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
if grantee == "" {
|
|
||||||
http.Error(w, "grantee is required", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
start, _ := strconv.ParseInt(startStr, 10, 64)
|
|
||||||
end, _ := strconv.ParseInt(endStr, 10, 64)
|
|
||||||
if start == 0 {
|
|
||||||
start = time.Now().Unix()
|
|
||||||
}
|
|
||||||
if end == 0 {
|
|
||||||
end = start + 3600
|
|
||||||
}
|
|
||||||
maxActions, _ := strconv.ParseUint(maxActionsStr, 10, 32)
|
|
||||||
if maxActions == 0 {
|
|
||||||
maxActions = 10
|
|
||||||
}
|
|
||||||
scope := windowtypes.Scope{Kind: scopeKind, ResourceID: resourceID}
|
|
||||||
rateLimit := windowtypes.RateLimit{MaxActions: uint32(maxActions), PerDurationSeconds: 3600}
|
|
||||||
win, err := s.Store.OpenWindow(grantor, grantee, scope, start, end, rateLimit)
|
|
||||||
if err != nil {
|
|
||||||
http.Error(w, "could not open a Window: "+err.Error(), http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Redirect(w, r, "/window/"+win.WindowID, http.StatusFound)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowDetail renders one Window + its lifecycle state + audit log.
|
|
||||||
func (s *Server) handleWindowDetail(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("id")
|
|
||||||
win, ok := s.Store.GetWindow(id)
|
|
||||||
if !ok {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
auditLog := s.Store.GetAuditLog(id)
|
|
||||||
s.render(w, "window_detail.html", map[string]any{"Window": win, "AuditLog": auditLog})
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowActivate transitions Open → Active (calls Window.Activate).
|
|
||||||
func (s *Server) handleWindowActivate(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("id")
|
|
||||||
if err := s.Store.ActivateWindow(id); err != nil {
|
|
||||||
http.Error(w, "could not activate: "+err.Error(), http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Redirect(w, r, "/window/"+id, http.StatusSeeOther)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowRevoke transitions to Revoked (calls Window.Revoke; idempotent).
|
|
||||||
func (s *Server) handleWindowRevoke(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("id")
|
|
||||||
if err := s.Store.RevokeWindow(id); err != nil {
|
|
||||||
http.Error(w, "could not revoke: "+err.Error(), http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Redirect(w, r, "/window/"+id, http.StatusSeeOther)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowExpire transitions to Expired (calls Window.Expire).
|
|
||||||
func (s *Server) handleWindowExpire(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("id")
|
|
||||||
if err := s.Store.ExpireWindow(id); err != nil {
|
|
||||||
http.Error(w, "could not expire: "+err.Error(), http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Redirect(w, r, "/window/"+id, http.StatusSeeOther)
|
|
||||||
}
|
|
||||||
@@ -1,363 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
windowtypes "github.com/oy/openyield/x/window/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestWindowOpenCreatesWindowStatusOpen(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
body := "grantor_holder=holder-alia&grantee=service-1&scope_kind=ReadStash&resource_id=stash-holder-alia&max_actions=5"
|
|
||||||
req := httptest.NewRequest("POST", "/window", strings.NewReader(body))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusFound {
|
|
||||||
t.Fatalf("POST /window: status %d, want 302", rec.Code)
|
|
||||||
}
|
|
||||||
loc := rec.Header().Get("Location")
|
|
||||||
if !strings.HasPrefix(loc, "/window/window-") {
|
|
||||||
t.Errorf("POST /window: Location %q, want /window/window-...", loc)
|
|
||||||
}
|
|
||||||
// Extract the windowID and verify it exists with Status=Open + an initial AuditEntry.
|
|
||||||
windowID := strings.TrimPrefix(loc, "/window/")
|
|
||||||
win, ok := srv.Store.GetWindow(windowID)
|
|
||||||
if !ok {
|
|
||||||
t.Fatalf("POST /window: GetWindow(%q) miss", windowID)
|
|
||||||
}
|
|
||||||
if win.Status != windowtypes.StatusOpen {
|
|
||||||
t.Errorf("POST /window: created Window status %q, want Open", win.Status)
|
|
||||||
}
|
|
||||||
audit := srv.Store.GetAuditLog(windowID)
|
|
||||||
if len(audit) != 1 {
|
|
||||||
t.Errorf("POST /window: audit log len %d, want 1 (initial entry)", len(audit))
|
|
||||||
}
|
|
||||||
if audit[0].Action != "open" {
|
|
||||||
t.Errorf("POST /window: initial audit action %q, want open", audit[0].Action)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowActivateTransitionsOpenToActive(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, err := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("OpenWindow: %v", err)
|
|
||||||
}
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/"+win.WindowID+"/activate", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusSeeOther {
|
|
||||||
t.Fatalf("POST activate: status %d, want 303", rec.Code)
|
|
||||||
}
|
|
||||||
// Lifecycle correctness: assert the real Window.Activate() was invoked
|
|
||||||
// (the handler calls store.ActivateWindow which calls w.Activate()).
|
|
||||||
updated, ok := srv.Store.GetWindow(win.WindowID)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("window missing after activate")
|
|
||||||
}
|
|
||||||
if updated.Status != windowtypes.StatusActive {
|
|
||||||
t.Errorf("after activate: status %q, want Active (Window.Activate was NOT invoked)", updated.Status)
|
|
||||||
}
|
|
||||||
audit := srv.Store.GetAuditLog(win.WindowID)
|
|
||||||
if len(audit) != 2 {
|
|
||||||
t.Errorf("after activate: audit log len %d, want 2 (initial + activate)", len(audit))
|
|
||||||
}
|
|
||||||
if audit[1].Action != "activate" {
|
|
||||||
t.Errorf("after activate: audit[1].Action %q, want activate", audit[1].Action)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowRevokeTransitionsToRevoked(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/"+win.WindowID+"/revoke", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusSeeOther {
|
|
||||||
t.Fatalf("POST revoke: status %d, want 303", rec.Code)
|
|
||||||
}
|
|
||||||
updated, _ := srv.Store.GetWindow(win.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusRevoked {
|
|
||||||
t.Errorf("after revoke: status %q, want Revoked (Window.Revoke was NOT invoked)", updated.Status)
|
|
||||||
}
|
|
||||||
if !updated.Revoked {
|
|
||||||
t.Errorf("after revoke: Revoked flag false, want true")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowRevokeIdempotentOnAlreadyRevoked(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
_ = srv.Store.RevokeWindow(win.WindowID)
|
|
||||||
auditBefore := len(srv.Store.GetAuditLog(win.WindowID))
|
|
||||||
|
|
||||||
// Second revoke is a no-op (idempotent): no new AuditEntry.
|
|
||||||
_ = srv.Store.RevokeWindow(win.WindowID)
|
|
||||||
auditAfter := len(srv.Store.GetAuditLog(win.WindowID))
|
|
||||||
if auditAfter != auditBefore {
|
|
||||||
t.Errorf("idempotent revoke: audit log grew %d -> %d (revoke on already-revoked must be a no-op)", auditBefore, auditAfter)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowRevokeOnExpiredIsNoOp(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
_ = srv.Store.ExpireWindow(win.WindowID)
|
|
||||||
auditBefore := len(srv.Store.GetAuditLog(win.WindowID))
|
|
||||||
|
|
||||||
// Revoke on an Expired window is a no-op (Expired is terminal — v0.2 contract).
|
|
||||||
_ = srv.Store.RevokeWindow(win.WindowID)
|
|
||||||
updated, _ := srv.Store.GetWindow(win.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusExpired {
|
|
||||||
t.Errorf("revoke-on-expired: status %q, want Expired (terminal state must win)", updated.Status)
|
|
||||||
}
|
|
||||||
auditAfter := len(srv.Store.GetAuditLog(win.WindowID))
|
|
||||||
if auditAfter != auditBefore {
|
|
||||||
t.Errorf("revoke-on-expired: audit log grew %d -> %d (must be a no-op)", auditBefore, auditAfter)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowExpireTransitionsToExpired(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
|
|
||||||
_ = srv.Store.ExpireWindow(win.WindowID)
|
|
||||||
updated, _ := srv.Store.GetWindow(win.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusExpired {
|
|
||||||
t.Errorf("after expire: status %q, want Expired (Window.Expire was NOT invoked)", updated.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowDetailRendersLifecycleAndAuditLog(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/window/"+win.WindowID, nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /window/%s: status %d, want 200", win.WindowID, rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, "Active") {
|
|
||||||
t.Errorf("detail: body missing Active badge")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "activate") {
|
|
||||||
t.Errorf("detail: body missing activate audit-log entry")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "open") {
|
|
||||||
t.Errorf("detail: body missing open audit-log entry")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowDetailMissingReturns404(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/window/window-nobody", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusNotFound {
|
|
||||||
t.Fatalf("GET /window/window-nobody: status %d, want 404", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowOpenEmptyGrantorReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
body := "grantor_holder=&grantee=service-1&scope_kind=ReadStash"
|
|
||||||
req := httptest.NewRequest("POST", "/window", strings.NewReader(body))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST /window empty grantor: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
// G-026: rendered-HTML lexicon check on the ERROR response body too.
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertion that the handler uses the real x/window/types struct
|
|
||||||
// (D-067: the UI grounds in the real Go type definitions).
|
|
||||||
var _ windowtypes.Window
|
|
||||||
|
|
||||||
func TestWindowListRendersSeededEmpty(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/window", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /window: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// No windows yet for holder-alia (fresh store) -> empty message.
|
|
||||||
if !strings.Contains(body, "Open a Window") {
|
|
||||||
t.Errorf("GET /window: body missing 'Open a Window' link")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowListRendersCreatedWindows(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 5, PerDurationSeconds: 3600}
|
|
||||||
w, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/window", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /window: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, w.WindowID) {
|
|
||||||
t.Errorf("GET /window: body missing created window %s", w.WindowID)
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "service-1") {
|
|
||||||
t.Errorf("GET /window: body missing grantee service-1")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowNewRendersForm(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/window/new", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /window/new: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, "Open a Window") {
|
|
||||||
t.Errorf("GET /window/new: body missing 'Open a Window' label")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "ReadStash") {
|
|
||||||
t.Errorf("GET /window/new: body missing ScopeKind option ReadStash")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "ProcessPassActForStand") {
|
|
||||||
t.Errorf("GET /window/new: body missing ScopeKind option ProcessPassActForStand")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowOpenEmptyGranteeReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
body := "grantor_holder=holder-alia&grantee=&scope_kind=ReadStash"
|
|
||||||
req := httptest.NewRequest("POST", "/window", strings.NewReader(body))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST /window empty grantee: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowActivateNotFoundReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/window-nobody/activate", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST activate nobody: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowRevokeNotFoundReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/window-nobody/revoke", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST revoke nobody: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowExpireNotFoundReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/window-nobody/expire", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST expire nobody: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowRevokeAndExpireHandlersRedirect(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/"+win.WindowID+"/revoke", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusSeeOther {
|
|
||||||
t.Fatalf("POST revoke: status %d, want 303", rec.Code)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Expire on a revoked window: revoked is not terminal for expire, so it
|
|
||||||
// transitions to Expired (Window.Expire sets status unconditionally).
|
|
||||||
rec2 := httptest.NewRecorder()
|
|
||||||
req2 := httptest.NewRequest("POST", "/window/"+win.WindowID+"/expire", nil)
|
|
||||||
mux.ServeHTTP(rec2, req2)
|
|
||||||
if rec2.Code != http.StatusSeeOther {
|
|
||||||
t.Fatalf("POST expire: status %d, want 303", rec2.Code)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
package main
|
|
||||||
|
|
||||||
func main() {
|
|
||||||
runServer()
|
|
||||||
}
|
|
||||||
@@ -1,42 +0,0 @@
|
|||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"log"
|
|
||||||
"net/http"
|
|
||||||
"os"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/web/handlers"
|
|
||||||
"github.com/oy/openyield/web/store"
|
|
||||||
)
|
|
||||||
|
|
||||||
func runServer() {
|
|
||||||
port := os.Getenv("PORT")
|
|
||||||
if port == "" {
|
|
||||||
port = "8080"
|
|
||||||
}
|
|
||||||
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
|
|
||||||
srv, err := handlers.New(store.NewStore(), "web/templates")
|
|
||||||
if err != nil {
|
|
||||||
log.Fatalf("init handlers: %v", err)
|
|
||||||
}
|
|
||||||
srv.Register(mux)
|
|
||||||
|
|
||||||
// Home page (rendered via the handlers' page machinery too).
|
|
||||||
mux.HandleFunc("GET /", func(w http.ResponseWriter, r *http.Request) {
|
|
||||||
if r.URL.Path != "/" {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
srv.RenderHome(w, nil)
|
|
||||||
})
|
|
||||||
|
|
||||||
mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServer(http.Dir("web/static"))))
|
|
||||||
|
|
||||||
server := &http.Server{Addr: ":" + port, Handler: mux}
|
|
||||||
log.Printf("OpenYield web on :%s", port)
|
|
||||||
if err := server.ListenAndServe(); err != nil {
|
|
||||||
log.Fatalf("server: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Vendored
-5
File diff suppressed because one or more lines are too long
@@ -1,78 +0,0 @@
|
|||||||
/* style.css — OpenYield web UI minimal styling (lexicon-clean).
|
|
||||||
No banned terms in comments or class names (REQ-012/REQ-045). */
|
|
||||||
|
|
||||||
:root {
|
|
||||||
--bg: #0d1117;
|
|
||||||
--panel: #161b22;
|
|
||||||
--ink: #c9d1d9;
|
|
||||||
--muted: #8b949e;
|
|
||||||
--accent: #58a6ff;
|
|
||||||
--line: #30363d;
|
|
||||||
}
|
|
||||||
|
|
||||||
* { box-sizing: border-box; }
|
|
||||||
|
|
||||||
body {
|
|
||||||
margin: 0;
|
|
||||||
font-family: system-ui, -apple-system, sans-serif;
|
|
||||||
background: var(--bg);
|
|
||||||
color: var(--ink);
|
|
||||||
line-height: 1.5;
|
|
||||||
}
|
|
||||||
|
|
||||||
a { color: var(--accent); text-decoration: none; }
|
|
||||||
a:hover { text-decoration: underline; }
|
|
||||||
|
|
||||||
header.nav {
|
|
||||||
border-bottom: 1px solid var(--line);
|
|
||||||
padding: 0.75rem 1.5rem;
|
|
||||||
display: flex;
|
|
||||||
gap: 1.25rem;
|
|
||||||
align-items: center;
|
|
||||||
background: var(--panel);
|
|
||||||
}
|
|
||||||
header.nav .brand { font-weight: 600; color: var(--ink); }
|
|
||||||
header.nav a { color: var(--muted); }
|
|
||||||
header.nav a:hover { color: var(--accent); }
|
|
||||||
|
|
||||||
main { max-width: 960px; margin: 2rem auto; padding: 0 1.5rem; }
|
|
||||||
|
|
||||||
footer {
|
|
||||||
border-top: 1px solid var(--line);
|
|
||||||
padding: 1rem 1.5rem;
|
|
||||||
color: var(--muted);
|
|
||||||
font-size: 0.85rem;
|
|
||||||
text-align: center;
|
|
||||||
}
|
|
||||||
|
|
||||||
.panel {
|
|
||||||
background: var(--panel);
|
|
||||||
border: 1px solid var(--line);
|
|
||||||
border-radius: 6px;
|
|
||||||
padding: 1.25rem;
|
|
||||||
margin-bottom: 1.5rem;
|
|
||||||
}
|
|
||||||
|
|
||||||
table { width: 100%; border-collapse: collapse; }
|
|
||||||
th, td { text-align: left; padding: 0.5rem 0.75rem; border-bottom: 1px solid var(--line); }
|
|
||||||
th { color: var(--muted); font-weight: 600; font-size: 0.85rem; text-transform: uppercase; letter-spacing: 0.04em; }
|
|
||||||
|
|
||||||
form .field { margin-bottom: 1rem; }
|
|
||||||
form label { display: block; margin-bottom: 0.25rem; color: var(--muted); font-size: 0.9rem; }
|
|
||||||
form input[type=text], form input[type=password] {
|
|
||||||
width: 100%; max-width: 32rem;
|
|
||||||
padding: 0.5rem 0.65rem;
|
|
||||||
background: var(--bg);
|
|
||||||
border: 1px solid var(--line);
|
|
||||||
border-radius: 4px;
|
|
||||||
color: var(--ink);
|
|
||||||
font-family: monospace;
|
|
||||||
}
|
|
||||||
button, .btn {
|
|
||||||
background: var(--accent); color: #0d1117; border: none;
|
|
||||||
padding: 0.5rem 1rem; border-radius: 4px; font-weight: 600; cursor: pointer;
|
|
||||||
}
|
|
||||||
button:hover, .btn:hover { opacity: 0.9; text-decoration: none; }
|
|
||||||
|
|
||||||
.error { color: #f85149; }
|
|
||||||
.muted { color: var(--muted); }
|
|
||||||
@@ -1,137 +0,0 @@
|
|||||||
package store
|
|
||||||
|
|
||||||
import (
|
|
||||||
"time"
|
|
||||||
|
|
||||||
bloomtypes "github.com/oy/openyield/x/bloom/types"
|
|
||||||
identitytypes "github.com/oy/openyield/x/identity/types"
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// seed populates the store with a few pre-existing Reach/Stash pairs for the
|
|
||||||
// list view. All strings lexicon-clean ("Holder"/"Reach"/"Stash"; NOT the
|
|
||||||
// banned financial terms). Two fixtures: one mature (90+ active days),
|
|
||||||
// one immature (45 active days) so the Stash dashboard (P2) can show both
|
|
||||||
// states. P4 seeds Ratings/Vouches so the Standing screen can show a
|
|
||||||
// Freeholder-eligible Reach (holder-alia) vs a non-eligible one (holder-bryn).
|
|
||||||
func (s *Store) seed() {
|
|
||||||
now := time.Now().Unix()
|
|
||||||
seedOne(s, "holder-alia", "pk-alia-001", now, 920000, 92, 10)
|
|
||||||
seedOne(s, "holder-bryn", "pk-bryn-002", now, 410000, 45, 5)
|
|
||||||
seedStanding(s, now)
|
|
||||||
seedBloom(s, now)
|
|
||||||
}
|
|
||||||
|
|
||||||
// seedBloom seeds mock BloomRecords per Stash (P5). holder-alia gets a record
|
|
||||||
// at the target rate (450 bps = 4.5%); holder-bryn gets a record at 420 bps
|
|
||||||
// (4.2%, within the 4.0%-5.0% band). AccruedGrain is a mock value.
|
|
||||||
func seedBloom(s *Store, now int64) {
|
|
||||||
s.bloomRecords["stash-holder-alia"] = bloomtypes.BloomRecord{
|
|
||||||
StashID: "stash-holder-alia",
|
|
||||||
AccruedGrain: 45000,
|
|
||||||
LastAccrualBlock: 1000,
|
|
||||||
RateBasisPoints: bloomtypes.TargetBloomRateBasisPoints, // 450 (4.5%, D-073 code constant)
|
|
||||||
}
|
|
||||||
s.bloomRecords["stash-holder-bryn"] = bloomtypes.BloomRecord{
|
|
||||||
StashID: "stash-holder-bryn",
|
|
||||||
AccruedGrain: 18000,
|
|
||||||
LastAccrualBlock: 1000,
|
|
||||||
RateBasisPoints: 420, // 4.2% (within the 400-500 band)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// seedStanding seeds mock Ratings + Vouches. holder-alia gets 12 ratings
|
|
||||||
// across 4 categories at 4.6-4.9 (Freeholder-eligible: score >= 4.5 in >= 3
|
|
||||||
// cats) + 1 Vouch (CommunityEndorsement). holder-bryn gets 3 ratings in 1
|
|
||||||
// category (not eligible: < 3 categories, no Vouch).
|
|
||||||
func seedStanding(s *Store, now int64) {
|
|
||||||
// holder-alia: 12 ratings, 4 categories, scores 4.6-4.9.
|
|
||||||
aliaCats := []string{"care", "sim", "vault", "mail"}
|
|
||||||
for i := 0; i < 12; i++ {
|
|
||||||
cat := aliaCats[i%4]
|
|
||||||
score := 4.6 + float64(i%4)*0.1 // 4.6, 4.7, 4.8, 4.9 repeating
|
|
||||||
s.ratings["holder-alia"] = append(s.ratings["holder-alia"], standingtypes.Rating{
|
|
||||||
RaterID: "rater-" + itoa(i),
|
|
||||||
RateeID: "holder-alia",
|
|
||||||
Category: cat,
|
|
||||||
Score: score,
|
|
||||||
Weight: 1.0,
|
|
||||||
TxRef: "tx-r-" + itoa(i),
|
|
||||||
Timestamp: now - int64(i)*86400,
|
|
||||||
DecayBucket: 0, // 6mo bucket (1.0)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
// 1 Vouch for holder-alia (CommunityEndorsement signal).
|
|
||||||
s.vouches["holder-alia"] = []standingtypes.Vouch{{
|
|
||||||
VoucherID: "voucher-freeholder-1",
|
|
||||||
VoucheeID: "holder-alia",
|
|
||||||
Category: "care",
|
|
||||||
BondAmount: 100000,
|
|
||||||
Timestamp: now,
|
|
||||||
}}
|
|
||||||
|
|
||||||
// holder-bryn: 3 ratings, 1 category, scores 4.0-4.2 (not eligible: < 3 cats).
|
|
||||||
for i := 0; i < 3; i++ {
|
|
||||||
s.ratings["holder-bryn"] = append(s.ratings["holder-bryn"], standingtypes.Rating{
|
|
||||||
RaterID: "rater-b-" + itoa(i),
|
|
||||||
RateeID: "holder-bryn",
|
|
||||||
Category: "care",
|
|
||||||
Score: 4.0 + float64(i)*0.1,
|
|
||||||
Weight: 1.0,
|
|
||||||
TxRef: "tx-b-" + itoa(i),
|
|
||||||
Timestamp: now - int64(i)*86400,
|
|
||||||
DecayBucket: 0,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
// No Vouches for holder-bryn (CommunityEndorsement signal false).
|
|
||||||
}
|
|
||||||
|
|
||||||
func seedOne(s *Store, holderID, pubKey string, now int64, balanceGrain int64, activeDays, maxGap uint32) {
|
|
||||||
reachID := "reach-" + holderID
|
|
||||||
stashID := "stash-" + holderID
|
|
||||||
s.reaches[holderID] = identitytypes.Reach{
|
|
||||||
ReachID: reachID,
|
|
||||||
HolderID: holderID,
|
|
||||||
CreatedAt: now - int64(activeDays)*86400,
|
|
||||||
PublicKey: pubKey,
|
|
||||||
IsNomad: true,
|
|
||||||
}
|
|
||||||
s.stashes[holderID] = stashtypes.Stash{
|
|
||||||
HolderID: holderID,
|
|
||||||
StashID: stashID,
|
|
||||||
CreatedAt: now - int64(activeDays)*86400,
|
|
||||||
LastActive: now,
|
|
||||||
BalanceGrain: balanceGrain,
|
|
||||||
}
|
|
||||||
s.stashActivities[stashID] = stashtypes.StashActivity{
|
|
||||||
StashID: stashID,
|
|
||||||
ActiveDays: activeDays,
|
|
||||||
MaxGapDays: maxGap,
|
|
||||||
LastActivityDay: now,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// itoa is a tiny int->string helper to avoid importing strconv (keeps the
|
|
||||||
// fixtures file import-light; the mock data uses small integers only).
|
|
||||||
func itoa(n int) string {
|
|
||||||
if n == 0 {
|
|
||||||
return "0"
|
|
||||||
}
|
|
||||||
neg := n < 0
|
|
||||||
if neg {
|
|
||||||
n = -n
|
|
||||||
}
|
|
||||||
var buf [12]byte
|
|
||||||
i := len(buf)
|
|
||||||
for n > 0 {
|
|
||||||
i--
|
|
||||||
buf[i] = byte('0' + n%10)
|
|
||||||
n /= 10
|
|
||||||
}
|
|
||||||
if neg {
|
|
||||||
i--
|
|
||||||
buf[i] = '-'
|
|
||||||
}
|
|
||||||
return string(buf[i:])
|
|
||||||
}
|
|
||||||
@@ -1,108 +0,0 @@
|
|||||||
// import_test.go enforces the G-003/G-025 boundary for web/: web/ is the
|
|
||||||
// application layer that consumes protocol types (D-070), NOT a cross-x/
|
|
||||||
// production import. The invariant: every non-test .go file under web/ may
|
|
||||||
// import github.com/oy/openyield/x/<module>/types packages (the app-layer
|
|
||||||
// consumption direction), but MUST NOT import github.com/oy/openyield/
|
|
||||||
// x/<module>/keeper OR github.com/oy/openyield/x/<module> (the module.go
|
|
||||||
// packages — G-025 extends the original keeper-only check to also forbid
|
|
||||||
// module.go, since those packages carry Cosmos runtime machinery the mock UI
|
|
||||||
// must not reach into). This test uses go/parser (stdlib only — G-006) and
|
|
||||||
// mirrors the x/window/types/types_test.go G-003 pattern, but with the
|
|
||||||
// inverted rule: x/*/types is ALLOWED (app-layer consumption), x/*/keeper
|
|
||||||
// and x/<module> (module.go) are FORBIDDEN.
|
|
||||||
package store
|
|
||||||
|
|
||||||
import (
|
|
||||||
"go/parser"
|
|
||||||
"go/token"
|
|
||||||
"os"
|
|
||||||
"path/filepath"
|
|
||||||
"runtime"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestG025WebImportsOnlyTypesNotKeeperOrModule(t *testing.T) {
|
|
||||||
webRoot := webRoot(t)
|
|
||||||
fset := token.NewFileSet()
|
|
||||||
violations := []string{}
|
|
||||||
err := filepath.Walk(webRoot, func(path string, info os.FileInfo, err error) error {
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if info.IsDir() {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
if !strings.HasSuffix(path, ".go") {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
// Skip test files (G-025 is about production code only).
|
|
||||||
if strings.HasSuffix(path, "_test.go") {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
f, perr := parser.ParseFile(fset, path, nil, parser.ImportsOnly)
|
|
||||||
if perr != nil {
|
|
||||||
return perr
|
|
||||||
}
|
|
||||||
for _, imp := range f.Imports {
|
|
||||||
ip := strings.Trim(imp.Path.Value, `"`)
|
|
||||||
if isForbiddenXImport(ip) {
|
|
||||||
rel, _ := filepath.Rel(webRoot, path)
|
|
||||||
violations = append(violations, rel+" -> "+ip)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
})
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("walk web/: %v", err)
|
|
||||||
}
|
|
||||||
if len(violations) > 0 {
|
|
||||||
t.Errorf("G-025 violation: web/ production files importing forbidden x/ packages:\n %s",
|
|
||||||
strings.Join(violations, "\n "))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// isForbiddenXImport reports whether ip is an x/<module>/keeper or a bare
|
|
||||||
// x/<module> (module.go) import — both forbidden from web/ (G-025). The
|
|
||||||
// x/<module>/types packages are ALLOWED (D-070 app-layer consumption).
|
|
||||||
func isForbiddenXImport(ip string) bool {
|
|
||||||
const prefix = "github.com/oy/openyield/x/"
|
|
||||||
if !strings.HasPrefix(ip, prefix) {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
rest := strings.TrimPrefix(ip, prefix)
|
|
||||||
parts := strings.Split(rest, "/")
|
|
||||||
switch len(parts) {
|
|
||||||
case 1:
|
|
||||||
// x/<module> (module.go package) — forbidden (G-025).
|
|
||||||
return true
|
|
||||||
case 2:
|
|
||||||
// x/<module>/types -> allowed (D-070). x/<module>/keeper -> forbidden.
|
|
||||||
if parts[1] == "types" {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
return true
|
|
||||||
default:
|
|
||||||
// x/<module>/<sub>/... — forbid anything other than types (e.g.
|
|
||||||
// x/<module>/keeper/... sub-packages).
|
|
||||||
if parts[1] == "types" {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// webRoot returns the absolute path to the web/ directory by walking up
|
|
||||||
// from this test file (web/store/import_test.go -> repoRoot/web).
|
|
||||||
func webRoot(t *testing.T) string {
|
|
||||||
t.Helper()
|
|
||||||
_, file, _, ok := runtime.Caller(0)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("runtime.Caller failed")
|
|
||||||
}
|
|
||||||
// file = .../oy/web/store/import_test.go
|
|
||||||
// repoRoot = filepath.Dir(filepath.Dir(filepath.Dir(file)))
|
|
||||||
// webRoot = repoRoot/web
|
|
||||||
repoRoot := filepath.Dir(filepath.Dir(filepath.Dir(file)))
|
|
||||||
return filepath.Join(repoRoot, "web")
|
|
||||||
}
|
|
||||||
@@ -1,428 +0,0 @@
|
|||||||
// Package store is the in-memory mock data layer for the OpenYield web UI.
|
|
||||||
//
|
|
||||||
// It instantiates the real x/*/types structs (Reach, Stash, StashActivity)
|
|
||||||
// from in-memory fixtures and provides create/get/list methods. This is the
|
|
||||||
// app-layer consumption of protocol types (D-070), NOT a cross-x/ production
|
|
||||||
// import — web/ is NOT an x/ module. No keeper, no Cosmos runtime, no app.go
|
|
||||||
// (G-003 boundary enforced by import_test.go / G-025).
|
|
||||||
package store
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
"strings"
|
|
||||||
"sync"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
bloomtypes "github.com/oy/openyield/x/bloom/types"
|
|
||||||
identitytypes "github.com/oy/openyield/x/identity/types"
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
windowtypes "github.com/oy/openyield/x/window/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// seedBalanceGrain is the test balance seeded to a new Stash at signup (D-071
|
|
||||||
// example: 500000 Grain = 50 Bread per GrainsPerBread=10000).
|
|
||||||
const seedBalanceGrain int64 = 500000
|
|
||||||
|
|
||||||
// Store is the in-memory mock store. All methods are goroutine-safe (mu).
|
|
||||||
type Store struct {
|
|
||||||
mu sync.Mutex
|
|
||||||
reaches map[string]identitytypes.Reach
|
|
||||||
stashes map[string]stashtypes.Stash
|
|
||||||
stashActivities map[string]stashtypes.StashActivity
|
|
||||||
windows map[string]windowtypes.Window
|
|
||||||
auditLogs map[string][]windowtypes.AuditEntry
|
|
||||||
ratings map[string][]standingtypes.Rating
|
|
||||||
vouches map[string][]standingtypes.Vouch
|
|
||||||
slashes map[string][]standingtypes.Slash
|
|
||||||
bloomRecords map[string]bloomtypes.BloomRecord
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewStore constructs a Store seeded from fixtures (fixtures.go).
|
|
||||||
func NewStore() *Store {
|
|
||||||
s := &Store{
|
|
||||||
reaches: map[string]identitytypes.Reach{},
|
|
||||||
stashes: map[string]stashtypes.Stash{},
|
|
||||||
stashActivities: map[string]stashtypes.StashActivity{},
|
|
||||||
windows: map[string]windowtypes.Window{},
|
|
||||||
auditLogs: map[string][]windowtypes.AuditEntry{},
|
|
||||||
ratings: map[string][]standingtypes.Rating{},
|
|
||||||
vouches: map[string][]standingtypes.Vouch{},
|
|
||||||
slashes: map[string][]standingtypes.Slash{},
|
|
||||||
bloomRecords: map[string]bloomtypes.BloomRecord{},
|
|
||||||
}
|
|
||||||
s.seed()
|
|
||||||
return s
|
|
||||||
}
|
|
||||||
|
|
||||||
// CreateReach atomically creates a Reach (IsNomad=true) + a Stash (D-071).
|
|
||||||
// G-027: HolderID and PublicKey are validated (non-empty, <=128 bytes, no
|
|
||||||
// path separators, no template syntax) before any map write. Returns the
|
|
||||||
// created Reach + Stash.
|
|
||||||
func (s *Store) CreateReach(holderID, publicKey string) (identitytypes.Reach, stashtypes.Stash, error) {
|
|
||||||
if err := validateReachInput(holderID, publicKey); err != nil {
|
|
||||||
return identitytypes.Reach{}, stashtypes.Stash{}, err
|
|
||||||
}
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
if _, dup := s.reaches[holderID]; dup {
|
|
||||||
return identitytypes.Reach{}, stashtypes.Stash{}, fmt.Errorf("holder %q already has a Reach", holderID)
|
|
||||||
}
|
|
||||||
now := time.Now().Unix()
|
|
||||||
reachID := "reach-" + holderID
|
|
||||||
stashID := "stash-" + holderID
|
|
||||||
reach := identitytypes.Reach{
|
|
||||||
ReachID: reachID,
|
|
||||||
HolderID: holderID,
|
|
||||||
CreatedAt: now,
|
|
||||||
PublicKey: publicKey,
|
|
||||||
IsNomad: true,
|
|
||||||
}
|
|
||||||
stash := stashtypes.Stash{
|
|
||||||
HolderID: holderID,
|
|
||||||
StashID: stashID,
|
|
||||||
CreatedAt: now,
|
|
||||||
LastActive: now,
|
|
||||||
BalanceGrain: seedBalanceGrain,
|
|
||||||
}
|
|
||||||
activity := stashtypes.StashActivity{
|
|
||||||
StashID: stashID,
|
|
||||||
ActiveDays: 1,
|
|
||||||
MaxGapDays: 1,
|
|
||||||
LastActivityDay: now,
|
|
||||||
}
|
|
||||||
s.reaches[holderID] = reach
|
|
||||||
s.stashes[holderID] = stash
|
|
||||||
s.stashActivities[stashID] = activity
|
|
||||||
return reach, stash, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListReaches returns all seeded + created Reaches.
|
|
||||||
func (s *Store) ListReaches() []identitytypes.Reach {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
out := make([]identitytypes.Reach, 0, len(s.reaches))
|
|
||||||
for _, r := range s.reaches {
|
|
||||||
out = append(out, r)
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetReach returns the Reach for a holderID (by HolderID, the stable key).
|
|
||||||
func (s *Store) GetReach(holderID string) (identitytypes.Reach, bool) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
r, ok := s.reaches[holderID]
|
|
||||||
return r, ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetStash returns the Stash for a holderID.
|
|
||||||
func (s *Store) GetStash(holderID string) (stashtypes.Stash, bool) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
st, ok := s.stashes[holderID]
|
|
||||||
return st, ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetStashActivity returns the StashActivity for a stashID.
|
|
||||||
func (s *Store) GetStashActivity(stashID string) (stashtypes.StashActivity, bool) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
a, ok := s.stashActivities[stashID]
|
|
||||||
return a, ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// OpenWindow creates a new Window in the Open status (REQ-042) with an initial
|
|
||||||
// AuditEntry. Returns the created Window. The Window is keyed by a generated
|
|
||||||
// windowID derived from the grantor + a counter (mock; not cryptographic).
|
|
||||||
func (s *Store) OpenWindow(grantorHolder, grantee string, scope windowtypes.Scope, start, end int64, rateLimit windowtypes.RateLimit) (windowtypes.Window, error) {
|
|
||||||
if grantorHolder == "" {
|
|
||||||
return windowtypes.Window{}, fmt.Errorf("grantor holder is required")
|
|
||||||
}
|
|
||||||
if grantee == "" {
|
|
||||||
return windowtypes.Window{}, fmt.Errorf("grantee is required")
|
|
||||||
}
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
windowID := fmt.Sprintf("window-%s-%d", grantorHolder, len(s.windows)+1)
|
|
||||||
now := time.Now().Unix()
|
|
||||||
w := windowtypes.Window{
|
|
||||||
WindowID: windowID,
|
|
||||||
GrantorHolder: grantorHolder,
|
|
||||||
Grantee: grantee,
|
|
||||||
Scope: scope,
|
|
||||||
Start: start,
|
|
||||||
End: end,
|
|
||||||
RateLimit: rateLimit,
|
|
||||||
Status: windowtypes.StatusOpen,
|
|
||||||
}
|
|
||||||
s.windows[windowID] = w
|
|
||||||
entry := windowtypes.AuditEntry{
|
|
||||||
EntryID: windowID + "-audit-1",
|
|
||||||
Timestamp: now,
|
|
||||||
Action: "open",
|
|
||||||
Result: "created",
|
|
||||||
GranterRef: grantorHolder,
|
|
||||||
}
|
|
||||||
s.auditLogs[windowID] = []windowtypes.AuditEntry{entry}
|
|
||||||
w.AuditLogRefs = []string{entry.EntryID}
|
|
||||||
s.windows[windowID] = w
|
|
||||||
return w, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ActivateWindow transitions a Window from Open to Active by calling the real
|
|
||||||
// x/window/types.Window.Activate() method (not a reimplementation). Appends an
|
|
||||||
// AuditEntry. Returns an error if the Window is not in the Open status.
|
|
||||||
func (s *Store) ActivateWindow(windowID string) error {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
w, ok := s.windows[windowID]
|
|
||||||
if !ok {
|
|
||||||
return fmt.Errorf("window %q not found", windowID)
|
|
||||||
}
|
|
||||||
if err := w.Activate(); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
s.windows[windowID] = w
|
|
||||||
s.appendAuditLocked(windowID, "activate", "active", w.GrantorHolder)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// RevokeWindow transitions a Window to Revoked by calling the real
|
|
||||||
// x/window/types.Window.Revoke() method. Idempotent on already-revoked;
|
|
||||||
// no-op on Expired (terminal state wins — v0.2 type contract). Appends an
|
|
||||||
// AuditEntry only if the status actually changed.
|
|
||||||
func (s *Store) RevokeWindow(windowID string) error {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
w, ok := s.windows[windowID]
|
|
||||||
if !ok {
|
|
||||||
return fmt.Errorf("window %q not found", windowID)
|
|
||||||
}
|
|
||||||
prevStatus := w.Status
|
|
||||||
if err := w.Revoke(); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
s.windows[windowID] = w
|
|
||||||
if w.Status != prevStatus {
|
|
||||||
s.appendAuditLocked(windowID, "revoke", "revoked", w.GrantorHolder)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ExpireWindow transitions a Window to Expired by calling the real
|
|
||||||
// x/window/types.Window.Expire() method. Appends an AuditEntry.
|
|
||||||
func (s *Store) ExpireWindow(windowID string) error {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
w, ok := s.windows[windowID]
|
|
||||||
if !ok {
|
|
||||||
return fmt.Errorf("window %q not found", windowID)
|
|
||||||
}
|
|
||||||
prevStatus := w.Status
|
|
||||||
w.Expire()
|
|
||||||
s.windows[windowID] = w
|
|
||||||
if w.Status != prevStatus {
|
|
||||||
s.appendAuditLocked(windowID, "expire", "expired", w.GrantorHolder)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListWindows returns all Windows for a grantor holder.
|
|
||||||
func (s *Store) ListWindows(grantorHolder string) []windowtypes.Window {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
out := []windowtypes.Window{}
|
|
||||||
for _, w := range s.windows {
|
|
||||||
if w.GrantorHolder == grantorHolder {
|
|
||||||
out = append(out, w)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetWindow returns the Window for a windowID.
|
|
||||||
func (s *Store) GetWindow(windowID string) (windowtypes.Window, bool) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
w, ok := s.windows[windowID]
|
|
||||||
return w, ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetAuditLog returns the audit-log entries for a windowID.
|
|
||||||
func (s *Store) GetAuditLog(windowID string) []windowtypes.AuditEntry {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
return s.auditLogs[windowID]
|
|
||||||
}
|
|
||||||
|
|
||||||
// appendAuditLocked appends an AuditEntry to the window's audit log. Caller
|
|
||||||
// MUST hold s.mu.
|
|
||||||
func (s *Store) appendAuditLocked(windowID, action, result, granterRef string) {
|
|
||||||
logs := s.auditLogs[windowID]
|
|
||||||
now := time.Now().Unix()
|
|
||||||
entry := windowtypes.AuditEntry{
|
|
||||||
EntryID: fmt.Sprintf("%s-audit-%d", windowID, len(logs)+1),
|
|
||||||
Timestamp: now,
|
|
||||||
Action: action,
|
|
||||||
Result: result,
|
|
||||||
GranterRef: granterRef,
|
|
||||||
}
|
|
||||||
s.auditLogs[windowID] = append(logs, entry)
|
|
||||||
w := s.windows[windowID]
|
|
||||||
w.AuditLogRefs = append(w.AuditLogRefs, entry.EntryID)
|
|
||||||
s.windows[windowID] = w
|
|
||||||
}
|
|
||||||
|
|
||||||
// validateReachInput enforces G-027: HolderID and PublicKey must be non-empty,
|
|
||||||
// <=128 bytes, and contain no path separators or template syntax. This is a
|
|
||||||
// prototype-robustness gate (the mock store uses holderID as a map key).
|
|
||||||
func validateReachInput(holderID, publicKey string) error {
|
|
||||||
if holderID == "" {
|
|
||||||
return fmt.Errorf("holder id is required")
|
|
||||||
}
|
|
||||||
if len(holderID) > 128 {
|
|
||||||
return fmt.Errorf("holder id too long (max 128)")
|
|
||||||
}
|
|
||||||
if strings.ContainsAny(holderID, "/\\") {
|
|
||||||
return fmt.Errorf("holder id must not contain path separators")
|
|
||||||
}
|
|
||||||
if strings.Contains(holderID, "{{") {
|
|
||||||
return fmt.Errorf("holder id must not contain template syntax")
|
|
||||||
}
|
|
||||||
if publicKey == "" {
|
|
||||||
return fmt.Errorf("public key is required")
|
|
||||||
}
|
|
||||||
if len(publicKey) > 128 {
|
|
||||||
return fmt.Errorf("public key too long (max 128)")
|
|
||||||
}
|
|
||||||
if strings.ContainsAny(publicKey, "/\\") {
|
|
||||||
return fmt.Errorf("public key must not contain path separators")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Standing + Freeholder signals (P4) ---
|
|
||||||
|
|
||||||
// ListRatings returns all Ratings for a ratee (per-Reach).
|
|
||||||
func (s *Store) ListRatings(rateeID string) []standingtypes.Rating {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
return s.ratings[rateeID]
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListVouches returns all Vouches for a vouchee.
|
|
||||||
func (s *Store) ListVouches(voucheeID string) []standingtypes.Vouch {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
return s.vouches[voucheeID]
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListSlashes returns all Slashes for a Reach.
|
|
||||||
func (s *Store) ListSlashes(reachID string) []standingtypes.Slash {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
return s.slashes[reachID]
|
|
||||||
}
|
|
||||||
|
|
||||||
// ComputeStandingScore computes a simplified standing score from the mock
|
|
||||||
// Ratings using the locked x/standing/types constants (PriorMean, PriorWeight,
|
|
||||||
// ComputeDiversityBonus, GetVoucherWeight, GetStandingBucket). This is a
|
|
||||||
// SIMPLIFIED computation (not the full Bayesian formula — sub-tables deferred
|
|
||||||
// per PROJECT.md Q2); the test asserts it uses the locked constants, not that
|
|
||||||
// it matches a full oracle.
|
|
||||||
func (s *Store) ComputeStandingScore(reachID string) (float64, standingtypes.StandingBucket) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
ratings := s.ratings[reachID]
|
|
||||||
slashes := s.slashes[reachID]
|
|
||||||
isSlashed := len(slashes) > 0
|
|
||||||
|
|
||||||
if len(ratings) == 0 {
|
|
||||||
// No ratings: return the prior mean, bucket New.
|
|
||||||
return standingtypes.PriorMean, standingtypes.GetStandingBucket(standingtypes.PriorMean, 0, isSlashed)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Simplified: weighted average of rating scores using GetVoucherWeight.
|
|
||||||
// The real formula uses the rater's standing to derive the weight; the
|
|
||||||
// mock uses the ratee's own score iteratively (simplified — P4 does not
|
|
||||||
// build a full rater-graph). Uses the locked PriorMean + PriorWeight as a
|
|
||||||
// Bayesian shrinkage: score = (prior*weight + sum(scores)) / (weight + n).
|
|
||||||
sum := 0.0
|
|
||||||
categories := map[string]bool{}
|
|
||||||
for _, r := range ratings {
|
|
||||||
w := standingtypes.GetVoucherWeight(false, r.Score, len(ratings))
|
|
||||||
sum += r.Score * w
|
|
||||||
categories[r.Category] = true
|
|
||||||
}
|
|
||||||
n := float64(len(ratings))
|
|
||||||
raw := (standingtypes.PriorMean*float64(standingtypes.PriorWeight) + sum) /
|
|
||||||
(float64(standingtypes.PriorWeight) + n)
|
|
||||||
// Apply diversity bonus (locked const).
|
|
||||||
raw += standingtypes.ComputeDiversityBonus(len(categories))
|
|
||||||
bucket := standingtypes.GetStandingBucket(raw, len(ratings), isSlashed)
|
|
||||||
return raw, bucket
|
|
||||||
}
|
|
||||||
|
|
||||||
// ComputeFreeholderSignals computes the four Freeholder signals (§9.1) from
|
|
||||||
// the mock data. StashMaturity from StashActivity.IsMature(); MultiDomainStanding
|
|
||||||
// from score >= FreeholderMinStandingScore in >= FreeholderMinCategories;
|
|
||||||
// CommittedCapital from Stash balance >= a threshold (mock); CommunityEndorsement
|
|
||||||
// from >= 1 Vouch. Returns the real standingtypes.FreeholderSignals struct.
|
|
||||||
func (s *Store) ComputeFreeholderSignals(reachID string) standingtypes.FreeholderSignals {
|
|
||||||
s.mu.Lock()
|
|
||||||
stash, hasStash := s.stashes[reachID]
|
|
||||||
ratings := s.ratings[reachID]
|
|
||||||
vouches := s.vouches[reachID]
|
|
||||||
s.mu.Unlock()
|
|
||||||
|
|
||||||
var signals standingtypes.FreeholderSignals
|
|
||||||
// StashMaturity: from StashActivity.IsMature() (the real method).
|
|
||||||
if hasStash {
|
|
||||||
if activity, ok := s.GetStashActivity(stash.StashID); ok {
|
|
||||||
signals.StashMaturity = activity.IsMature()
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// MultiDomainStanding: score >= 4.5 in >= 3 categories.
|
|
||||||
score, _ := s.ComputeStandingScore(reachID)
|
|
||||||
categories := map[string]bool{}
|
|
||||||
for _, r := range ratings {
|
|
||||||
categories[r.Category] = true
|
|
||||||
}
|
|
||||||
if score >= standingtypes.FreeholderMinStandingScore && len(categories) >= standingtypes.FreeholderMinCategories {
|
|
||||||
signals.MultiDomainStanding = true
|
|
||||||
}
|
|
||||||
// CommittedCapital: mock threshold — Stash balance >= 100000 Grain (10 Bread).
|
|
||||||
if hasStash && stash.BalanceGrain >= 100000 {
|
|
||||||
signals.CommittedCapital = true
|
|
||||||
}
|
|
||||||
// CommunityEndorsement: >= 1 Vouch.
|
|
||||||
if len(vouches) >= 1 {
|
|
||||||
signals.CommunityEndorsement = true
|
|
||||||
}
|
|
||||||
return signals
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Bloom accrual (P5) ---
|
|
||||||
|
|
||||||
// GetBloomRecord returns the BloomRecord for a stashID (REQ-044).
|
|
||||||
func (s *Store) GetBloomRecord(stashID string) (bloomtypes.BloomRecord, bool) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
r, ok := s.bloomRecords[stashID]
|
|
||||||
return r, ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListBloomRecords returns BloomRecords for all Stashes owned by a holder.
|
|
||||||
func (s *Store) ListBloomRecords(holderID string) []bloomtypes.BloomRecord {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
out := []bloomtypes.BloomRecord{}
|
|
||||||
for stashID, rec := range s.bloomRecords {
|
|
||||||
// Match by the holder prefix "stash-<holderID>".
|
|
||||||
if strings.HasPrefix(stashID, "stash-"+holderID) {
|
|
||||||
out = append(out, rec)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
@@ -1,576 +0,0 @@
|
|||||||
package store
|
|
||||||
|
|
||||||
import (
|
|
||||||
"sync"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
bloomtypes "github.com/oy/openyield/x/bloom/types"
|
|
||||||
identitytypes "github.com/oy/openyield/x/identity/types"
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
windowtypes "github.com/oy/openyield/x/window/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestNewStoreSeedsFixtures(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
reaches := s.ListReaches()
|
|
||||||
if len(reaches) < 2 {
|
|
||||||
t.Fatalf("NewStore seeded %d reaches, want >=2", len(reaches))
|
|
||||||
}
|
|
||||||
// Both seeded reaches must be Nomads (IsNomad=true).
|
|
||||||
for _, r := range reaches {
|
|
||||||
if !r.IsNomad {
|
|
||||||
t.Errorf("seeded reach %q: IsNomad=false, want true", r.HolderID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCreateReachAtomicReachAndStash(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
reach, stash, err := s.CreateReach("holder-test1", "pk-test1")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("CreateReach: %v", err)
|
|
||||||
}
|
|
||||||
// D-071: Reach must be IsNomad=true.
|
|
||||||
if !reach.IsNomad {
|
|
||||||
t.Errorf("reach.IsNomad = false, want true (D-071)")
|
|
||||||
}
|
|
||||||
if reach.HolderID != "holder-test1" {
|
|
||||||
t.Errorf("reach.HolderID = %q, want holder-test1", reach.HolderID)
|
|
||||||
}
|
|
||||||
// D-071: Stash must have matching HolderID + seeded BalanceGrain.
|
|
||||||
if stash.HolderID != reach.HolderID {
|
|
||||||
t.Errorf("stash.HolderID = %q, want %q (D-071 atomic)", stash.HolderID, reach.HolderID)
|
|
||||||
}
|
|
||||||
if stash.BalanceGrain != seedBalanceGrain {
|
|
||||||
t.Errorf("stash.BalanceGrain = %d, want %d", stash.BalanceGrain, seedBalanceGrain)
|
|
||||||
}
|
|
||||||
// Both must be retrievable after the atomic call.
|
|
||||||
if _, ok := s.GetReach("holder-test1"); !ok {
|
|
||||||
t.Errorf("GetReach miss after CreateReach (atomicity broken)")
|
|
||||||
}
|
|
||||||
if _, ok := s.GetStash("holder-test1"); !ok {
|
|
||||||
t.Errorf("GetStash miss after CreateReach (atomicity broken)")
|
|
||||||
}
|
|
||||||
if _, ok := s.GetStashActivity(stash.StashID); !ok {
|
|
||||||
t.Errorf("GetStashActivity miss after CreateReach (atomicity broken)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCreateReachDuplicateRejected(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if _, _, err := s.CreateReach("holder-alia", "pk-dupe"); err == nil {
|
|
||||||
t.Errorf("CreateReach duplicate holder-alia: expected error, got nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCreateReachValidationG027(t *testing.T) {
|
|
||||||
cases := []struct {
|
|
||||||
name string
|
|
||||||
holderID string
|
|
||||||
publicKey string
|
|
||||||
wantErr bool
|
|
||||||
}{
|
|
||||||
{"empty holder", "", "pk", true},
|
|
||||||
{"empty pubkey", "h", "", true},
|
|
||||||
{"holder too long", stringOf('x', 129), "pk", true},
|
|
||||||
{"pubkey too long", "h", stringOf('y', 129), true},
|
|
||||||
{"holder with slash", "h/x", "pk", true},
|
|
||||||
{"holder with backslash", "h\\x", "pk", true},
|
|
||||||
{"holder with template syntax", "h{{", "pk", true},
|
|
||||||
{"pubkey with slash", "h", "p/x", true},
|
|
||||||
{"valid minimal", "h", "p", false},
|
|
||||||
{"valid typical", "holder-oka", "pk-oka-7", false},
|
|
||||||
}
|
|
||||||
for _, c := range cases {
|
|
||||||
t.Run(c.name, func(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
_, _, err := s.CreateReach(c.holderID, c.publicKey)
|
|
||||||
if c.wantErr && err == nil {
|
|
||||||
t.Errorf("expected error, got nil")
|
|
||||||
}
|
|
||||||
if !c.wantErr && err != nil {
|
|
||||||
t.Errorf("unexpected error: %v", err)
|
|
||||||
}
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetReachHitMiss(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if _, ok := s.GetReach("holder-alia"); !ok {
|
|
||||||
t.Errorf("GetReach(holder-alia) miss, want hit (seeded)")
|
|
||||||
}
|
|
||||||
if _, ok := s.GetReach("nobody"); ok {
|
|
||||||
t.Errorf("GetReach(nobody) hit, want miss")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetStashHitMiss(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if _, ok := s.GetStash("holder-alia"); !ok {
|
|
||||||
t.Errorf("GetStash(holder-alia) miss, want hit (seeded)")
|
|
||||||
}
|
|
||||||
if _, ok := s.GetStash("nobody"); ok {
|
|
||||||
t.Errorf("GetStash(nobody) hit, want miss")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetStashActivityHitMiss(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
stash, ok := s.GetStash("holder-alia")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded stash holder-alia missing")
|
|
||||||
}
|
|
||||||
if _, ok := s.GetStashActivity(stash.StashID); !ok {
|
|
||||||
t.Errorf("GetStashActivity(%q) miss, want hit", stash.StashID)
|
|
||||||
}
|
|
||||||
if _, ok := s.GetStashActivity("stash-nobody"); ok {
|
|
||||||
t.Errorf("GetStashActivity(stash-nobody) hit, want miss")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCreateReachConcurrentNoRace(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
const n = 50
|
|
||||||
var wg sync.WaitGroup
|
|
||||||
wg.Add(n)
|
|
||||||
for i := 0; i < n; i++ {
|
|
||||||
go func(i int) {
|
|
||||||
defer wg.Done()
|
|
||||||
holder := "holder-concurrent-" + itoa(i)
|
|
||||||
_, _, _ = s.CreateReach(holder, "pk")
|
|
||||||
}(i)
|
|
||||||
}
|
|
||||||
wg.Wait()
|
|
||||||
// All n concurrent creates with distinct holder IDs must be present.
|
|
||||||
for i := 0; i < n; i++ {
|
|
||||||
if _, ok := s.GetReach("holder-concurrent-" + itoa(i)); !ok {
|
|
||||||
t.Errorf("concurrent reach %d missing after wg.Wait", i)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestSeededMatureVsImmature(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
// holder-alia: ActiveDays=92, MaxGapDays=10 -> mature.
|
|
||||||
aliaStash, ok := s.GetStash("holder-alia")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded holder-alia missing")
|
|
||||||
}
|
|
||||||
aliaAct, ok := s.GetStashActivity(aliaStash.StashID)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded alia activity missing")
|
|
||||||
}
|
|
||||||
if !aliaAct.IsMature() {
|
|
||||||
t.Errorf("holder-alia IsMature=false, want true (ActiveDays=%d, MaxGap=%d)",
|
|
||||||
aliaAct.ActiveDays, aliaAct.MaxGapDays)
|
|
||||||
}
|
|
||||||
// holder-bryn: ActiveDays=45, MaxGapDays=5 -> not mature.
|
|
||||||
brynStash, ok := s.GetStash("holder-bryn")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded holder-bryn missing")
|
|
||||||
}
|
|
||||||
brynAct, ok := s.GetStashActivity(brynStash.StashID)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded bryn activity missing")
|
|
||||||
}
|
|
||||||
if brynAct.IsMature() {
|
|
||||||
t.Errorf("holder-bryn IsMature=true, want false (ActiveDays=%d, MaxGap=%d)",
|
|
||||||
brynAct.ActiveDays, brynAct.MaxGapDays)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions that the types are the real x/*/types structs
|
|
||||||
// (D-067: the mock store grounds the UI in the real Go type definitions).
|
|
||||||
var _ identitytypes.Reach
|
|
||||||
var _ stashtypes.Stash
|
|
||||||
|
|
||||||
// itoa is provided by fixtures.go (shared with the production package).
|
|
||||||
|
|
||||||
func stringOf(r rune, n int) string {
|
|
||||||
b := make([]byte, n)
|
|
||||||
for i := range b {
|
|
||||||
b[i] = byte(r)
|
|
||||||
}
|
|
||||||
return string(b)
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Window tests (P3) ---
|
|
||||||
|
|
||||||
func TestOpenWindowCreatesStatusOpenWithInitialAudit(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-x"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 5, PerDurationSeconds: 3600}
|
|
||||||
w, err := s.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("OpenWindow: %v", err)
|
|
||||||
}
|
|
||||||
if w.Status != windowtypes.StatusOpen {
|
|
||||||
t.Errorf("OpenWindow status %q, want Open", w.Status)
|
|
||||||
}
|
|
||||||
if w.WindowID == "" {
|
|
||||||
t.Error("OpenWindow: empty WindowID")
|
|
||||||
}
|
|
||||||
audit := s.GetAuditLog(w.WindowID)
|
|
||||||
if len(audit) != 1 {
|
|
||||||
t.Errorf("OpenWindow: audit log len %d, want 1", len(audit))
|
|
||||||
}
|
|
||||||
if audit[0].Action != "open" {
|
|
||||||
t.Errorf("OpenWindow: audit[0].Action %q, want open", audit[0].Action)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestOpenWindowValidation(t *testing.T) {
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
cases := []struct {
|
|
||||||
name, grantor, grantee string
|
|
||||||
wantErr bool
|
|
||||||
}{
|
|
||||||
{"empty grantor", "", "g", true},
|
|
||||||
{"empty grantee", "h", "", true},
|
|
||||||
{"valid", "h", "g", false},
|
|
||||||
}
|
|
||||||
for _, c := range cases {
|
|
||||||
t.Run(c.name, func(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
_, err := s.OpenWindow(c.grantor, c.grantee, scope, 1, 2, rl)
|
|
||||||
if c.wantErr && err == nil {
|
|
||||||
t.Errorf("expected error, got nil")
|
|
||||||
}
|
|
||||||
if !c.wantErr && err != nil {
|
|
||||||
t.Errorf("unexpected error: %v", err)
|
|
||||||
}
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestActivateWindowTransitionsToActive(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
if err := s.ActivateWindow(w.WindowID); err != nil {
|
|
||||||
t.Fatalf("ActivateWindow: %v", err)
|
|
||||||
}
|
|
||||||
updated, _ := s.GetWindow(w.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusActive {
|
|
||||||
t.Errorf("after activate: %q, want Active", updated.Status)
|
|
||||||
}
|
|
||||||
audit := s.GetAuditLog(w.WindowID)
|
|
||||||
if len(audit) != 2 {
|
|
||||||
t.Errorf("after activate: audit len %d, want 2", len(audit))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestActivateWindowNotFound(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if err := s.ActivateWindow("window-nobody"); err == nil {
|
|
||||||
t.Error("ActivateWindow(nobody): expected error, got nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestActivateWindowOnActiveFails(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
_ = s.ActivateWindow(w.WindowID)
|
|
||||||
// Activate again should fail (can only activate Open windows).
|
|
||||||
if err := s.ActivateWindow(w.WindowID); err == nil {
|
|
||||||
t.Error("activate on Active: expected error, got nil (Window.Activate rejects non-Open)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestRevokeWindowTransitionsToRevoked(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
if err := s.RevokeWindow(w.WindowID); err != nil {
|
|
||||||
t.Fatalf("RevokeWindow: %v", err)
|
|
||||||
}
|
|
||||||
updated, _ := s.GetWindow(w.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusRevoked {
|
|
||||||
t.Errorf("after revoke: %q, want Revoked", updated.Status)
|
|
||||||
}
|
|
||||||
if !updated.Revoked {
|
|
||||||
t.Error("after revoke: Revoked flag false, want true")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestRevokeWindowIdempotent(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
_ = s.RevokeWindow(w.WindowID)
|
|
||||||
before := len(s.GetAuditLog(w.WindowID))
|
|
||||||
_ = s.RevokeWindow(w.WindowID)
|
|
||||||
after := len(s.GetAuditLog(w.WindowID))
|
|
||||||
if after != before {
|
|
||||||
t.Errorf("idempotent revoke: audit grew %d -> %d", before, after)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestRevokeWindowOnExpiredIsNoOp(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
_ = s.ExpireWindow(w.WindowID)
|
|
||||||
before := len(s.GetAuditLog(w.WindowID))
|
|
||||||
_ = s.RevokeWindow(w.WindowID)
|
|
||||||
updated, _ := s.GetWindow(w.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusExpired {
|
|
||||||
t.Errorf("revoke-on-expired: %q, want Expired (terminal wins)", updated.Status)
|
|
||||||
}
|
|
||||||
after := len(s.GetAuditLog(w.WindowID))
|
|
||||||
if after != before {
|
|
||||||
t.Errorf("revoke-on-expired: audit grew %d -> %d (no-op)", before, after)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestRevokeWindowNotFound(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if err := s.RevokeWindow("window-nobody"); err == nil {
|
|
||||||
t.Error("RevokeWindow(nobody): expected error, got nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestExpireWindowTransitionsToExpired(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
if err := s.ExpireWindow(w.WindowID); err != nil {
|
|
||||||
t.Fatalf("ExpireWindow: %v", err)
|
|
||||||
}
|
|
||||||
updated, _ := s.GetWindow(w.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusExpired {
|
|
||||||
t.Errorf("after expire: %q, want Expired", updated.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestExpireWindowNotFound(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if err := s.ExpireWindow("window-nobody"); err == nil {
|
|
||||||
t.Error("ExpireWindow(nobody): expected error, got nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestExpireWindowIdempotent(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
_ = s.ExpireWindow(w.WindowID)
|
|
||||||
before := len(s.GetAuditLog(w.WindowID))
|
|
||||||
_ = s.ExpireWindow(w.WindowID)
|
|
||||||
after := len(s.GetAuditLog(w.WindowID))
|
|
||||||
if after != before {
|
|
||||||
t.Errorf("idempotent expire: audit grew %d -> %d", before, after)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestListWindowsFiltersByGrantor(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
_, _ = s.OpenWindow("holder-alia", "svc1", scope, 1, 2, rl)
|
|
||||||
_, _ = s.OpenWindow("holder-alia", "svc2", scope, 1, 2, rl)
|
|
||||||
_, _ = s.OpenWindow("holder-bryn", "svc3", scope, 1, 2, rl)
|
|
||||||
alia := s.ListWindows("holder-alia")
|
|
||||||
if len(alia) != 2 {
|
|
||||||
t.Errorf("ListWindows(holder-alia) = %d, want 2", len(alia))
|
|
||||||
}
|
|
||||||
bryn := s.ListWindows("holder-bryn")
|
|
||||||
if len(bryn) != 1 {
|
|
||||||
t.Errorf("ListWindows(holder-bryn) = %d, want 1", len(bryn))
|
|
||||||
}
|
|
||||||
nobody := s.ListWindows("nobody")
|
|
||||||
if len(nobody) != 0 {
|
|
||||||
t.Errorf("ListWindows(nobody) = %d, want 0", len(nobody))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetWindowHitMiss(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
if _, ok := s.GetWindow(w.WindowID); !ok {
|
|
||||||
t.Errorf("GetWindow(%q) miss, want hit", w.WindowID)
|
|
||||||
}
|
|
||||||
if _, ok := s.GetWindow("window-nobody"); ok {
|
|
||||||
t.Error("GetWindow(nobody) hit, want miss")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetAuditLogEmptyForMissing(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if logs := s.GetAuditLog("window-nobody"); logs != nil {
|
|
||||||
t.Errorf("GetAuditLog(nobody) = %v, want nil", logs)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Standing + Freeholder signals tests (P4) ---
|
|
||||||
|
|
||||||
func TestListRatingsSeeded(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
alia := s.ListRatings("holder-alia")
|
|
||||||
if len(alia) != 12 {
|
|
||||||
t.Errorf("ListRatings(holder-alia) = %d, want 12 (seeded)", len(alia))
|
|
||||||
}
|
|
||||||
bryn := s.ListRatings("holder-bryn")
|
|
||||||
if len(bryn) != 3 {
|
|
||||||
t.Errorf("ListRatings(holder-bryn) = %d, want 3 (seeded)", len(bryn))
|
|
||||||
}
|
|
||||||
nobody := s.ListRatings("nobody")
|
|
||||||
if len(nobody) != 0 {
|
|
||||||
t.Errorf("ListRatings(nobody) = %d, want 0", len(nobody))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestListVouchesSeeded(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
alia := s.ListVouches("holder-alia")
|
|
||||||
if len(alia) != 1 {
|
|
||||||
t.Errorf("ListVouches(holder-alia) = %d, want 1 (seeded)", len(alia))
|
|
||||||
}
|
|
||||||
bryn := s.ListVouches("holder-bryn")
|
|
||||||
if len(bryn) != 0 {
|
|
||||||
t.Errorf("ListVouches(holder-bryn) = %d, want 0 (seeded)", len(bryn))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestListSlashesEmptyByDefault(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if sl := s.ListSlashes("holder-alia"); len(sl) != 0 {
|
|
||||||
t.Errorf("ListSlashes(holder-alia) = %d, want 0 (no slashes seeded)", len(sl))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeStandingScoreNoRatingsReturnsPriorMean(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
score, bucket := s.ComputeStandingScore("nobody")
|
|
||||||
if score != standingtypes.PriorMean {
|
|
||||||
t.Errorf("ComputeStandingScore(nobody) score = %v, want PriorMean %v", score, standingtypes.PriorMean)
|
|
||||||
}
|
|
||||||
if bucket != standingtypes.BucketNew {
|
|
||||||
t.Errorf("ComputeStandingScore(nobody) bucket = %q, want New", bucket)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeStandingScoreAliaIsEligibleRange(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
score, bucket := s.ComputeStandingScore("holder-alia")
|
|
||||||
if score < 4.5 {
|
|
||||||
t.Errorf("holder-alia score = %.2f, want >= 4.5 (Freeholder-eligible range)", score)
|
|
||||||
}
|
|
||||||
if bucket != standingtypes.BucketPreferred && bucket != standingtypes.BucketTop {
|
|
||||||
t.Errorf("holder-alia bucket = %q, want Preferred or Top", bucket)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeStandingScoreBrynIsNew(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
_, bucket := s.ComputeStandingScore("holder-bryn")
|
|
||||||
// holder-bryn has 3 ratings (< 10) -> bucket New.
|
|
||||||
if bucket != standingtypes.BucketNew {
|
|
||||||
t.Errorf("holder-bryn bucket = %q, want New (< 10 ratings)", bucket)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeFreeholderSignalsAliaAllTrue(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
signals := s.ComputeFreeholderSignals("holder-alia")
|
|
||||||
// holder-alia: mature Stash (92 days), score >= 4.5 in 4 cats, balance
|
|
||||||
// 920000 >= 100000, 1 Vouch -> all 4 signals true.
|
|
||||||
if !signals.StashMaturity {
|
|
||||||
t.Errorf("StashMaturity = false, want true (mature Stash)")
|
|
||||||
}
|
|
||||||
if !signals.MultiDomainStanding {
|
|
||||||
t.Errorf("MultiDomainStanding = false, want true (score >= 4.5 in 4 cats)")
|
|
||||||
}
|
|
||||||
if !signals.CommittedCapital {
|
|
||||||
t.Errorf("CommittedCapital = false, want true (balance 920000 >= 100000)")
|
|
||||||
}
|
|
||||||
if !signals.CommunityEndorsement {
|
|
||||||
t.Errorf("CommunityEndorsement = false, want true (1 Vouch seeded)")
|
|
||||||
}
|
|
||||||
if !signals.IsFreeholderEligible() {
|
|
||||||
t.Errorf("holder-alia IsFreeholderEligible = false, want true (all 4 signals)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeFreeholderSignalsBrynNotEligible(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
signals := s.ComputeFreeholderSignals("holder-bryn")
|
|
||||||
// holder-bryn: immature Stash (45 days), 1 cat (< 3), no Vouch.
|
|
||||||
if signals.StashMaturity {
|
|
||||||
t.Errorf("StashMaturity = true, want false (immature 45 days)")
|
|
||||||
}
|
|
||||||
if signals.MultiDomainStanding {
|
|
||||||
t.Errorf("MultiDomainStanding = true, want false (1 cat < 3)")
|
|
||||||
}
|
|
||||||
if signals.CommunityEndorsement {
|
|
||||||
t.Errorf("CommunityEndorsement = true, want false (no Vouches)")
|
|
||||||
}
|
|
||||||
if signals.IsFreeholderEligible() {
|
|
||||||
t.Errorf("holder-bryn IsFreeholderEligible = true, want false")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeFreeholderSignalsNoStash(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
signals := s.ComputeFreeholderSignals("nobody")
|
|
||||||
// No Stash, no ratings, no Vouches -> all false.
|
|
||||||
if signals.IsFreeholderEligible() {
|
|
||||||
t.Errorf("nobody IsFreeholderEligible = true, want false (no Stash)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Bloom accrual tests (P5) ---
|
|
||||||
|
|
||||||
func TestGetBloomRecordSeeded(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
rec, ok := s.GetBloomRecord("stash-holder-alia")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("GetBloomRecord(stash-holder-alia) miss, want hit (seeded)")
|
|
||||||
}
|
|
||||||
// D-073: seeded at the code-constant target rate.
|
|
||||||
if rec.RateBasisPoints != bloomtypes.TargetBloomRateBasisPoints {
|
|
||||||
t.Errorf("seeded RateBasisPoints = %d, want %d (TargetBloomRateBasisPoints, D-073)", rec.RateBasisPoints, bloomtypes.TargetBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
if rec.AccruedGrain != 45000 {
|
|
||||||
t.Errorf("seeded AccruedGrain = %d, want 45000", rec.AccruedGrain)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetBloomRecordMiss(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if _, ok := s.GetBloomRecord("stash-nobody"); ok {
|
|
||||||
t.Error("GetBloomRecord(stash-nobody) hit, want miss")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestListBloomRecordsByHolder(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
alia := s.ListBloomRecords("holder-alia")
|
|
||||||
if len(alia) != 1 {
|
|
||||||
t.Errorf("ListBloomRecords(holder-alia) = %d, want 1", len(alia))
|
|
||||||
}
|
|
||||||
if alia[0].StashID != "stash-holder-alia" {
|
|
||||||
t.Errorf("ListBloomRecords(holder-alia)[0].StashID = %q, want stash-holder-alia", alia[0].StashID)
|
|
||||||
}
|
|
||||||
bryn := s.ListBloomRecords("holder-bryn")
|
|
||||||
if len(bryn) != 1 {
|
|
||||||
t.Errorf("ListBloomRecords(holder-bryn) = %d, want 1", len(bryn))
|
|
||||||
}
|
|
||||||
nobody := s.ListBloomRecords("nobody")
|
|
||||||
if len(nobody) != 0 {
|
|
||||||
t.Errorf("ListBloomRecords(nobody) = %d, want 0", len(nobody))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,29 +0,0 @@
|
|||||||
{{define "base.html"}}
|
|
||||||
<!DOCTYPE html>
|
|
||||||
<html lang="en">
|
|
||||||
<head>
|
|
||||||
<meta charset="utf-8">
|
|
||||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
||||||
<title>{{block "title" .}}OpenYield{{end}}</title>
|
|
||||||
<link rel="stylesheet" href="/static/style.css">
|
|
||||||
<script src="/static/htmx.min.js" defer></script>
|
|
||||||
</head>
|
|
||||||
<body>
|
|
||||||
<header class="nav">
|
|
||||||
<span class="brand">OpenYield</span>
|
|
||||||
<a href="/">Home</a>
|
|
||||||
<a href="/reach">Reach</a>
|
|
||||||
<a href="/stash">Stash</a>
|
|
||||||
<a href="/window">Window</a>
|
|
||||||
<a href="/standing">Standing</a>
|
|
||||||
<a href="/bloom">Bloom</a>
|
|
||||||
</header>
|
|
||||||
<main>
|
|
||||||
{{block "content" .}}{{end}}
|
|
||||||
</main>
|
|
||||||
<footer>
|
|
||||||
OpenYield — real production on the mesh. Reach, Stash, Window, Standing, Bloom.
|
|
||||||
</footer>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
{{define "title"}}Bloom — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Bloom</h1>
|
|
||||||
<p>Bloom is the real-production reward that accrues to every Grain in every
|
|
||||||
Stash. It originates only from real production — no synthetic Bloom, no
|
|
||||||
protocol-printed Bloom. This is a Mission Lock: no council can change it.</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Bloom record for {{.StashID}}</h2>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Stash ID</th><td>{{.StashID}}</td></tr>
|
|
||||||
<tr><th>Accrued Grain</th><td>{{.Record.AccruedGrain}}</td></tr>
|
|
||||||
<tr><th>Rate</th><td>{{printf "%.1f" .RatePct}}%</td></tr>
|
|
||||||
<tr><th>Last accrual block</th><td>{{.Record.LastAccrualBlock}}</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Target rate band</h2>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Target rate</th><td>{{printf "%.1f" .TargetRatePct}}%</td></tr>
|
|
||||||
<tr><th>Min rate</th><td>{{printf "%.1f" .MinRatePct}}%</td></tr>
|
|
||||||
<tr><th>Max rate</th><td>{{printf "%.1f" .MaxRatePct}}%</td></tr>
|
|
||||||
<tr><th>Accrual period</th><td>{{.AccrualPeriod}} blocks (daily, ~10min blocks)</td></tr>
|
|
||||||
</table>
|
|
||||||
<p><em>{{.MissionLockNote}}</em></p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<p><a href="/stash/{{slice .StashID 6}}">Back to Stash</a></p>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
{{define "title"}}OpenYield — real production on the mesh{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>OpenYield</h1>
|
|
||||||
<p>
|
|
||||||
OpenYield is a mesh-native system for real production. A Holder creates a
|
|
||||||
Reach to enter the mesh, holds a Stash of Grain, and authorizes Window
|
|
||||||
access to partners. Standing accrues through honest participation, and
|
|
||||||
Bloom rewards sustained contribution. No middleman holds your Stash.
|
|
||||||
</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>The five screens</h2>
|
|
||||||
<ul>
|
|
||||||
<li><a href="/reach">Reach</a> — create a Reach and view the mesh of Holders.</li>
|
|
||||||
<li><a href="/stash">Stash</a> — your sovereign Grain Stash (P2).</li>
|
|
||||||
<li><a href="/window">Window</a> — authorize partner access to your Stash (P3).</li>
|
|
||||||
<li><a href="/standing">Standing</a> — track progress toward Freeholder standing (P4).</li>
|
|
||||||
<li><a href="/bloom">Bloom</a> — accrued rewards for sustained contribution (P5).</li>
|
|
||||||
</ul>
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,31 +0,0 @@
|
|||||||
{{define "title"}}{{.Reach.ReachID}} — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>{{.Reach.ReachID}}</h1>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Reach ID</th><td>{{.Reach.ReachID}}</td></tr>
|
|
||||||
<tr><th>Holder ID</th><td>{{.Reach.HolderID}}</td></tr>
|
|
||||||
<tr><th>Public Key</th><td><code>{{.Reach.PublicKey}}</code></td></tr>
|
|
||||||
<tr><th>Created</th><td>{{.Reach.CreatedAt}}</td></tr>
|
|
||||||
<tr><th>Nomad</th><td>{{if .Reach.IsNomad}}yes{{else}}no{{end}}</td></tr>
|
|
||||||
<tr><th>Freeholder</th><td>{{if .Reach.IsFreeholder}}yes{{else}}no{{end}}</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
{{if .Stash.StashID}}
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Stash</h2>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Stash ID</th><td>{{.Stash.StashID}}</td></tr>
|
|
||||||
<tr><th>Balance</th><td>{{.Stash.BalanceGrain}} Grain</td></tr>
|
|
||||||
<tr><th>Created</th><td>{{.Stash.CreatedAt}}</td></tr>
|
|
||||||
<tr><th>Last active</th><td>{{.Stash.LastActive}}</td></tr>
|
|
||||||
<tr><th>Still</th><td>{{if .Stash.IsStill}}paused{{else}}active{{end}}</td></tr>
|
|
||||||
</table>
|
|
||||||
<p><a href="/stash/{{.Stash.HolderID}}">View Stash dashboard</a></p>
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
|
|
||||||
<p><a href="/reach">Back to Reach list</a></p>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
{{define "title"}}Reach — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Reach</h1>
|
|
||||||
<p>A Reach is the mesh-native identity a Holder uses to act on the mesh
|
|
||||||
without a custodian, a gatekeeper, or a legacy financial position. A Nomad
|
|
||||||
is a Holder who has a Reach and a Stash and is on the way to earning the
|
|
||||||
four Freeholder signals.</p>
|
|
||||||
<p><a href="/reach/new" class="btn">Create a Reach</a></p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Holders on the mesh</h2>
|
|
||||||
{{if .Reaches}}
|
|
||||||
<table>
|
|
||||||
<thead>
|
|
||||||
<tr><th>Reach ID</th><th>Holder ID</th><th>Nomad</th><th>Freeholder</th></tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .Reaches}}
|
|
||||||
<tr>
|
|
||||||
<td><a href="/reach/{{.HolderID}}">{{.ReachID}}</a></td>
|
|
||||||
<td>{{.HolderID}}</td>
|
|
||||||
<td>{{if .IsNomad}}yes{{else}}no{{end}}</td>
|
|
||||||
<td>{{if .IsFreeholder}}yes{{else}}no{{end}}</td>
|
|
||||||
</tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
{{else}}
|
|
||||||
<p>No Reaches yet. <a href="/reach/new">Create a Reach</a> to begin.</p>
|
|
||||||
{{end}}
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
{{define "title"}}Create a Reach — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Create a Reach</h1>
|
|
||||||
<p>A Reach is an identity, not a custodial position. The protocol does not
|
|
||||||
require KYC at the protocol layer; the Reach is the unit of self-service.
|
|
||||||
Creating a Reach also opens a Stash for you (the place a Nomad holds
|
|
||||||
Grain) — that pair is enough to begin on the mesh.</p>
|
|
||||||
|
|
||||||
<form method="POST" action="/reach" hx-post="/reach" hx-target="body">
|
|
||||||
<label for="holder_id">Holder ID</label>
|
|
||||||
<input type="text" id="holder_id" name="holder_id" required
|
|
||||||
maxlength="128" placeholder="a by-ID-string of your choosing">
|
|
||||||
<label for="public_key">Public Key</label>
|
|
||||||
<input type="text" id="public_key" name="public_key" required
|
|
||||||
maxlength="128" placeholder="a public key for your Reach">
|
|
||||||
<button type="submit">Create a Reach</button>
|
|
||||||
</form>
|
|
||||||
<p><a href="/reach">Back to Reach list</a></p>
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,89 +0,0 @@
|
|||||||
{{define "title"}}Standing — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Standing — {{.ReachID}}</h1>
|
|
||||||
<p>Standing is the Bayesian anti-gaming metric that accrues as a Nomad acts
|
|
||||||
on the mesh. It is not bought or transferred — it is earned through honest
|
|
||||||
participation, weighted by the standing of the raters, time-decayed, and
|
|
||||||
diversified across service categories.</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Score</h2>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Reach ID</th><td>{{.ReachID}}</td></tr>
|
|
||||||
<tr><th>Standing score</th><td>{{printf "%.1f" .Score}}</td></tr>
|
|
||||||
<tr><th>Bucket</th><td>
|
|
||||||
{{if eq (string .Bucket) "New"}}<span class="badge grey">New</span>{{end}}
|
|
||||||
{{if eq (string .Bucket) "Trusted"}}<span class="badge blue">Trusted</span>{{end}}
|
|
||||||
{{if eq (string .Bucket) "Preferred"}}<span class="badge green">Preferred</span>{{end}}
|
|
||||||
{{if eq (string .Bucket) "Top"}}<span class="badge green">Top</span>{{end}}
|
|
||||||
{{if eq (string .Bucket) "Slashed"}}<span class="badge red">Slashed</span>{{end}}
|
|
||||||
</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Freeholder signals</h2>
|
|
||||||
<p>The four signals (§9.1) — all four must be present to be Freeholder-eligible.
|
|
||||||
No application, no committee, no form.</p>
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Signal</th><th>Status</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
<tr><td>Stash maturity (90 days, gap ≤ 30)</td><td>{{if .Signals.StashMaturity}}<span class="badge green">earned</span>{{else}}<span class="badge grey">not yet</span>{{end}}</td></tr>
|
|
||||||
<tr><td>Multi-domain standing (≥ {{printf "%.1f" .MinScore}} in ≥ {{.MinCats}} cats)</td><td>{{if .Signals.MultiDomainStanding}}<span class="badge green">earned</span>{{else}}<span class="badge grey">not yet</span>{{end}}</td></tr>
|
|
||||||
<tr><td>Committed capital</td><td>{{if .Signals.CommittedCapital}}<span class="badge green">earned</span>{{else}}<span class="badge grey">not yet</span>{{end}}</td></tr>
|
|
||||||
<tr><td>Community endorsement (≥ 1 Vouch)</td><td>{{if .Signals.CommunityEndorsement}}<span class="badge green">earned</span>{{else}}<span class="badge grey">not yet</span>{{end}}</td></tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
<p>Freeholder-eligible:
|
|
||||||
{{if .Eligible}}<span class="badge green">yes</span>
|
|
||||||
{{else}}<span class="badge grey">not yet</span>{{end}}
|
|
||||||
</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Ratings ({{len .Ratings}})</h2>
|
|
||||||
{{if .Ratings}}
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Rater</th><th>Category</th><th>Score</th><th>Timestamp</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .Ratings}}
|
|
||||||
<tr><td>{{.RaterID}}</td><td>{{.Category}}</td><td>{{printf "%.1f" .Score}}</td><td>{{.Timestamp}}</td></tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
{{else}}<p>No ratings yet.</p>{{end}}
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Vouches ({{len .Vouches}})</h2>
|
|
||||||
{{if .Vouches}}
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Voucher</th><th>Category</th><th>Bond (Grain)</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .Vouches}}
|
|
||||||
<tr><td>{{.VoucherID}}</td><td>{{.Category}}</td><td>{{.BondAmount}}</td></tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
{{else}}<p>No Vouches yet.</p>{{end}}
|
|
||||||
</section>
|
|
||||||
|
|
||||||
{{if .Slashes}}
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Slashes ({{len .Slashes}})</h2>
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Reason</th><th>Amount</th><th>Attester</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .Slashes}}
|
|
||||||
<tr><td>{{.Reason}}</td><td>{{.Amount}}</td><td>{{.Attester}}</td></tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
|
|
||||||
<p><a href="/reach/{{.ReachID}}">Back to Reach</a></p>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,56 +0,0 @@
|
|||||||
{{define "title"}}Stash — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Stash</h1>
|
|
||||||
<p>A Stash is a Holder's personal storage — the place a Nomad holds Grain.
|
|
||||||
It is a storage layer, not a custodial position: the Holder owns it,
|
|
||||||
controls it, and can delegate a scoped, time-limited Window to a partner
|
|
||||||
without giving up custody.</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Balance</h2>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Stash ID</th><td>{{.Stash.StashID}}</td></tr>
|
|
||||||
<tr><th>Holder ID</th><td>{{.Stash.HolderID}}</td></tr>
|
|
||||||
<tr><th>Balance</th><td>{{.Stash.BalanceGrain}} Grain ({{.BalanceBread}} Bread)</td></tr>
|
|
||||||
<tr><th>Created</th><td>{{.Stash.CreatedAt}}</td></tr>
|
|
||||||
<tr><th>Last active</th><td>{{.Stash.LastActive}}</td></tr>
|
|
||||||
<tr><th>Still</th><td>{{if .Stash.IsStill}}paused{{else}}active{{end}}</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Bread scale</h2>
|
|
||||||
<p>1 Bread = 10,000 Grain. The full scale (from the protocol code constants):</p>
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Denomination</th><th>Grain value</th><th>Equivalent in this Stash</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .BreadScale}}
|
|
||||||
<tr>
|
|
||||||
<td>{{.Name}}</td>
|
|
||||||
<td>{{.GrainValue}}</td>
|
|
||||||
<td>{{if eq .Name "Grain"}}{{$.Stash.BalanceGrain}}{{else}}{{divGrain $.Stash.BalanceGrain .GrainValue}}{{end}}</td>
|
|
||||||
</tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Maturity progress</h2>
|
|
||||||
<p>Holding a Stash continuously for 90 days is the first of the four
|
|
||||||
Freeholder signals. The signal is about continuity, not size.</p>
|
|
||||||
<div class="progress-track">
|
|
||||||
<div class="progress-bar" style="width: {{.MaturityPct}}%">{{.MaturityPct}}%</div>
|
|
||||||
</div>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Active days</th><td>{{.Activity.ActiveDays}} / {{.ThresholdDays}}</td></tr>
|
|
||||||
<tr><th>Max gap days</th><td>{{.Activity.MaxGapDays}} / {{.MaxGapDays}} (max allowed)</td></tr>
|
|
||||||
<tr><th>Mature</th><td>{{if .Mature}}<span class="badge green">Mature</span>{{else}}<span class="badge amber">Not mature</span>{{end}}</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<p><a href="/reach/{{.Stash.HolderID}}">Back to Reach</a></p>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,68 +0,0 @@
|
|||||||
{{define "title"}}{{.Window.WindowID}} — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>{{.Window.WindowID}}</h1>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Window ID</th><td>{{.Window.WindowID}}</td></tr>
|
|
||||||
<tr><th>Grantor</th><td>{{.Window.GrantorHolder}}</td></tr>
|
|
||||||
<tr><th>Grantee</th><td>{{.Window.Grantee}}</td></tr>
|
|
||||||
<tr><th>Scope</th><td>{{.Window.Scope.Kind}} ({{.Window.Scope.ResourceID}})</td></tr>
|
|
||||||
<tr><th>Start</th><td>{{.Window.Start}}</td></tr>
|
|
||||||
<tr><th>End</th><td>{{.Window.End}}</td></tr>
|
|
||||||
<tr><th>Rate limit</th><td>{{.Window.RateLimit.ActionsConsumed}} / {{.Window.RateLimit.MaxActions}} per {{.Window.RateLimit.PerDurationSeconds}}s</td></tr>
|
|
||||||
<tr><th>Revoked</th><td>{{if .Window.Revoked}}yes{{else}}no{{end}}</td></tr>
|
|
||||||
<tr><th>Status</th><td>
|
|
||||||
{{if eq (string .Window.Status) "Open"}}<span class="badge amber">Open</span>{{end}}
|
|
||||||
{{if eq (string .Window.Status) "Active"}}<span class="badge green">Active</span>{{end}}
|
|
||||||
{{if eq (string .Window.Status) "Revoked"}}<span class="badge red">Revoked</span>{{end}}
|
|
||||||
{{if eq (string .Window.Status) "Expired"}}<span class="badge grey">Expired</span>{{end}}
|
|
||||||
</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Lifecycle actions</h2>
|
|
||||||
<p>
|
|
||||||
{{if eq (string .Window.Status) "Open"}}
|
|
||||||
<form method="POST" action="/window/{{.Window.WindowID}}/activate" style="display:inline">
|
|
||||||
<button type="submit">Activate</button>
|
|
||||||
</form>
|
|
||||||
{{end}}
|
|
||||||
{{if or (eq (string .Window.Status) "Open") (eq (string .Window.Status) "Active")}}
|
|
||||||
<form method="POST" action="/window/{{.Window.WindowID}}/revoke" style="display:inline">
|
|
||||||
<button type="submit">Revoke</button>
|
|
||||||
</form>
|
|
||||||
{{end}}
|
|
||||||
{{if or (eq (string .Window.Status) "Open") (eq (string .Window.Status) "Active")}}
|
|
||||||
<form method="POST" action="/window/{{.Window.WindowID}}/expire" style="display:inline">
|
|
||||||
<button type="submit">Expire</button>
|
|
||||||
</form>
|
|
||||||
{{end}}
|
|
||||||
</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Audit log</h2>
|
|
||||||
{{if .AuditLog}}
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Entry ID</th><th>Timestamp</th><th>Action</th><th>Result</th><th>Granter</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .AuditLog}}
|
|
||||||
<tr>
|
|
||||||
<td>{{.EntryID}}</td>
|
|
||||||
<td>{{.Timestamp}}</td>
|
|
||||||
<td>{{.Action}}</td>
|
|
||||||
<td>{{.Result}}</td>
|
|
||||||
<td>{{.GranterRef}}</td>
|
|
||||||
</tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
{{else}}
|
|
||||||
<p>No audit entries yet.</p>
|
|
||||||
{{end}}
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<p><a href="/window">Back to Window list</a></p>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
{{define "title"}}Window — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Window</h1>
|
|
||||||
<p>A Window is a Holder-authorized, scope-bounded, time-limited, revocable
|
|
||||||
delegation of access (REQ-015). The Holder opens a Window so a partner or
|
|
||||||
service can read a Stash or process a Pass-Act — without giving up custody.
|
|
||||||
The Window is revocable, rate-limited, and audited.</p>
|
|
||||||
<p><a href="/window/new" class="btn">Open a Window</a></p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Windows for {{.Grantor}}</h2>
|
|
||||||
{{if .Windows}}
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Window ID</th><th>Grantee</th><th>Scope</th><th>Status</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .Windows}}
|
|
||||||
<tr>
|
|
||||||
<td><a href="/window/{{.WindowID}}">{{.WindowID}}</a></td>
|
|
||||||
<td>{{.Grantee}}</td>
|
|
||||||
<td>{{.Scope.Kind}} ({{.Scope.ResourceID}})</td>
|
|
||||||
<td>{{.Status}}</td>
|
|
||||||
</tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
{{else}}
|
|
||||||
<p>No Windows yet for {{.Grantor}}. <a href="/window/new">Open a Window</a> to begin.</p>
|
|
||||||
{{end}}
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
{{define "title"}}Open a Window — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Open a Window</h1>
|
|
||||||
<p>A Window delegates scoped access to a partner or service without giving
|
|
||||||
up custody. The Holder sets the scope, the duration, and a rate-limit; the
|
|
||||||
Window is revocable at any time.</p>
|
|
||||||
|
|
||||||
<form method="POST" action="/window" hx-post="/window" hx-target="body">
|
|
||||||
<label for="grantor_holder">Grantor Holder ID</label>
|
|
||||||
<input type="text" id="grantor_holder" name="grantor_holder" required
|
|
||||||
maxlength="128" placeholder="the Holder opening the Window">
|
|
||||||
<label for="grantee">Grantee</label>
|
|
||||||
<input type="text" id="grantee" name="grantee" required
|
|
||||||
maxlength="128" placeholder="the partner or service receiving access">
|
|
||||||
<label for="scope_kind">Scope kind</label>
|
|
||||||
<select id="scope_kind" name="scope_kind">
|
|
||||||
<option value="ReadStash">ReadStash</option>
|
|
||||||
<option value="ReadStanding">ReadStanding</option>
|
|
||||||
<option value="ProcessPassActForStand">ProcessPassActForStand</option>
|
|
||||||
</select>
|
|
||||||
<label for="resource_id">Resource ID</label>
|
|
||||||
<input type="text" id="resource_id" name="resource_id"
|
|
||||||
maxlength="128" placeholder="the Stash or Stand this Window scopes to">
|
|
||||||
<label for="start_unix">Start (unix seconds, blank = now)</label>
|
|
||||||
<input type="number" id="start_unix" name="start_unix" placeholder="blank = now">
|
|
||||||
<label for="end_unix">End (unix seconds, blank = now+1h)</label>
|
|
||||||
<input type="number" id="end_unix" name="end_unix" placeholder="blank = now+1h">
|
|
||||||
<label for="max_actions">Max actions (rate-limit, blank = 10)</label>
|
|
||||||
<input type="number" id="max_actions" name="max_actions" placeholder="10">
|
|
||||||
<button type="submit">Open a Window</button>
|
|
||||||
</form>
|
|
||||||
<p><a href="/window">Back to Window list</a></p>
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,166 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bearers/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// keeper.go holds the store-backed Keeper for the bearers module (P2-02-01,
|
|
||||||
// REQ-034).
|
|
||||||
//
|
|
||||||
// The Keeper wraps an sdk.KVStore via a storeKey. It holds the Session
|
|
||||||
// records (by session-id) and the OYQRCode records (by qr-id). The Keeper
|
|
||||||
// also holds the expected-keeper shim (BreadKeeper for the OY-QR consume
|
|
||||||
// transfer effect). The shim is an interface (G-003 — no struct import of
|
|
||||||
// x/bread/types); the concrete x/bread keeper satisfies it structurally.
|
|
||||||
//
|
|
||||||
// State-machine ordering (vision §7, enforced in every handler):
|
|
||||||
// ValidateBasic → keeper authz → state mutation → ctx.EventManager().EmitEvent
|
|
||||||
//
|
|
||||||
// Surveillance-resistant invariant (A-522): the Keeper carries NO
|
|
||||||
// geolocation fields; the handlers emit NO geolocation in events.
|
|
||||||
|
|
||||||
// Keeper is the store-backed bearers keeper.
|
|
||||||
type Keeper struct {
|
|
||||||
cdc codec.Codec
|
|
||||||
storeKey storetypes.StoreKey
|
|
||||||
breadKeeper types.BreadKeeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewKeeper constructs a new store-backed bearers Keeper. The BreadKeeper
|
|
||||||
// expected-keeper shim is injected (nil-able for partial tests; the
|
|
||||||
// ConsumeOYQR handler guards a nil shim and skips the transfer effect,
|
|
||||||
// still flipping the consumed flag — the A-521 state-write-first invariant
|
|
||||||
// holds regardless).
|
|
||||||
func NewKeeper(cdc codec.Codec, storeKey storetypes.StoreKey, bk types.BreadKeeper) Keeper {
|
|
||||||
return Keeper{
|
|
||||||
cdc: cdc,
|
|
||||||
storeKey: storeKey,
|
|
||||||
breadKeeper: bk,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetBreadKeeper sets the BreadKeeper expected-keeper shim (for
|
|
||||||
// post-construction wiring, e.g., app wiring or test setup).
|
|
||||||
func (k *Keeper) SetBreadKeeper(bk types.BreadKeeper) { k.breadKeeper = bk }
|
|
||||||
|
|
||||||
// --- Session store -----------------------------------------------------------
|
|
||||||
|
|
||||||
var sessionKeyPrefix = []byte("session/")
|
|
||||||
|
|
||||||
func sessionKey(sessionID string) []byte {
|
|
||||||
return append(sessionKeyPrefix, []byte(sessionID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSession loads a Session by session-id. Returns the session and true
|
|
||||||
// if found, or zero value + false if not.
|
|
||||||
func (k Keeper) GetSession(ctx sdk.Context, sessionID string) (types.Session, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(sessionKey(sessionID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.Session{}, false
|
|
||||||
}
|
|
||||||
var s types.Session
|
|
||||||
if err := json.Unmarshal(bz, &s); err != nil {
|
|
||||||
return types.Session{}, false
|
|
||||||
}
|
|
||||||
return s, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetSession persists a Session by session-id.
|
|
||||||
func (k Keeper) SetSession(ctx sdk.Context, s types.Session) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(s)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("bearers: marshal session %q: %v", s.SessionID, err))
|
|
||||||
}
|
|
||||||
store.Set(sessionKey(s.SessionID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllSessions returns all persisted Session records (iteration helper).
|
|
||||||
func (k Keeper) AllSessions(ctx sdk.Context) []types.Session {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(sessionKeyPrefix, prefixEnd(sessionKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.Session{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var s types.Session
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &s); err == nil {
|
|
||||||
out = append(out, s)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- OYQRCode store ----------------------------------------------------------
|
|
||||||
|
|
||||||
var qrKeyPrefix = []byte("qr/")
|
|
||||||
|
|
||||||
func qrKey(qrID string) []byte {
|
|
||||||
return append(qrKeyPrefix, []byte(qrID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetOYQRCode loads an OYQRCode by qr-id. Returns the QR and true if found.
|
|
||||||
func (k Keeper) GetOYQRCode(ctx sdk.Context, qrID string) (types.OYQRCode, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(qrKey(qrID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.OYQRCode{}, false
|
|
||||||
}
|
|
||||||
var q types.OYQRCode
|
|
||||||
if err := json.Unmarshal(bz, &q); err != nil {
|
|
||||||
return types.OYQRCode{}, false
|
|
||||||
}
|
|
||||||
return q, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetOYQRCode persists an OYQRCode by qr-id.
|
|
||||||
func (k Keeper) SetOYQRCode(ctx sdk.Context, q types.OYQRCode) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(q)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("bearers: marshal qr %q: %v", q.QRID, err))
|
|
||||||
}
|
|
||||||
store.Set(qrKey(q.QRID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllOYQRCodes returns all persisted OYQRCode records (iteration helper).
|
|
||||||
func (k Keeper) AllOYQRCodes(ctx sdk.Context) []types.OYQRCode {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(qrKeyPrefix, prefixEnd(qrKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.OYQRCode{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var q types.OYQRCode
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &q); err == nil {
|
|
||||||
out = append(out, q)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// prefixEnd returns the key that sorts immediately after all keys sharing the
|
|
||||||
// given prefix (the standard prefix-iteration end key: increment the last
|
|
||||||
// byte, drop overflow). Used for store.Iterator(start, prefixEnd(start))
|
|
||||||
// prefix scans.
|
|
||||||
func prefixEnd(prefix []byte) []byte {
|
|
||||||
if len(prefix) == 0 {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
end := make([]byte, len(prefix))
|
|
||||||
copy(end, prefix)
|
|
||||||
for i := len(end) - 1; i >= 0; i-- {
|
|
||||||
end[i]++
|
|
||||||
if end[i] != 0 {
|
|
||||||
return end
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// All bytes were 0xFF; return nil (iterate to end of store).
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@@ -1,387 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bearers/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// msg_server.go implements the bearers module's MsgServer (G-023 ownership
|
|
||||||
// split: cosmos-engineer scaffolds the file structure + method signatures;
|
|
||||||
// mesh-engineer/backend-engineer implements the handler logic bodies). The
|
|
||||||
// MsgServer wraps the Keeper + the BreadKeeper expected-keeper shim (already
|
|
||||||
// on the Keeper).
|
|
||||||
//
|
|
||||||
// Each method returns a (*Response, error). Handler state-machine ordering
|
|
||||||
// is enforced: ValidateBasic → keeper authz → state mutation →
|
|
||||||
// ctx.EventManager().EmitEvent.
|
|
||||||
//
|
|
||||||
// Surveillance-resistant invariant (A-522): NO handler emits geolocation or
|
|
||||||
// sender physical location. The surveillance-resistant locked const on
|
|
||||||
// OYSATLink/OYLRLink is a runtime invariant — a handler that emits
|
|
||||||
// geolocation violates it. A negative simtest asserts the event set
|
|
||||||
// contains NO geolocation fields.
|
|
||||||
//
|
|
||||||
// One-shot OY-QR (A-521): the MsgConsumeOYQR handler flips consumed BEFORE
|
|
||||||
// the transfer effect (state write FIRST, then the BreadKeeper shim call).
|
|
||||||
// A replay finds consumed==true and returns an error (idempotent reject,
|
|
||||||
// NOT double-effect). The SDK store is atomic per tx — a panic in the
|
|
||||||
// transfer rolls back the whole tx, so the order is safe; the order
|
|
||||||
// documents intent and matches the ibc-go delete-before-mint convention.
|
|
||||||
|
|
||||||
// msgServer is the concrete MsgServer implementation wrapping the Keeper.
|
|
||||||
type msgServer struct {
|
|
||||||
Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewMsgServerImpl returns the bearers MsgServer for the provided Keeper.
|
|
||||||
func NewMsgServerImpl(k Keeper) types.MsgServer {
|
|
||||||
return &msgServer{Keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
var _ types.MsgServer = msgServer{}
|
|
||||||
|
|
||||||
// unwrapCtx extracts the sdk.Context from the interface-typed ctx.
|
|
||||||
func unwrapCtx(ctx interface{}) sdk.Context {
|
|
||||||
if c, ok := ctx.(sdk.Context); ok {
|
|
||||||
return c
|
|
||||||
}
|
|
||||||
panic(fmt.Sprintf("bearers: expected sdk.Context, got %T", ctx))
|
|
||||||
}
|
|
||||||
|
|
||||||
// nowUnix returns the current block time as unix seconds from the ctx.
|
|
||||||
func nowUnix(ctx sdk.Context) int64 {
|
|
||||||
return ctx.BlockTime().Unix()
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- OpenSession (creates Session status=Open) -------------------------------
|
|
||||||
|
|
||||||
// OpenSession creates a new Session with status=Open. ValidateBasic is
|
|
||||||
// stateless; the handler enforces idempotency (session-id must not already
|
|
||||||
// exist).
|
|
||||||
func (s msgServer) OpenSession(ctx interface{}, msg *types.MsgOpenSession) (*types.MsgOpenSessionResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Idempotency: session-id must not already exist.
|
|
||||||
if _, ok := s.Keeper.GetSession(sdkCtx, msg.SessionID); ok {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q already exists", msg.SessionID)
|
|
||||||
}
|
|
||||||
|
|
||||||
session := types.Session{
|
|
||||||
SessionID: msg.SessionID,
|
|
||||||
BearerType: msg.BearerType,
|
|
||||||
InitiatorReach: msg.InitiatorReach,
|
|
||||||
PeerReach: msg.PeerReach,
|
|
||||||
Status: types.SessionOpen,
|
|
||||||
Frames: []types.Frame{},
|
|
||||||
TTL: msg.TTL,
|
|
||||||
OpenedAt: nowUnix(sdkCtx),
|
|
||||||
}
|
|
||||||
s.Keeper.SetSession(sdkCtx, session)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.session_opened",
|
|
||||||
sdk.NewAttribute("session_id", msg.SessionID),
|
|
||||||
sdk.NewAttribute("bearer_type", string(msg.BearerType)),
|
|
||||||
sdk.NewAttribute("initiator_reach", msg.InitiatorReach),
|
|
||||||
sdk.NewAttribute("peer_reach", msg.PeerReach),
|
|
||||||
sdk.NewAttribute("status", string(types.SessionOpen)),
|
|
||||||
// NO geolocation (A-522 surveillance-resistant invariant).
|
|
||||||
))
|
|
||||||
return &types.MsgOpenSessionResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- CloseSession (Active → Closed) ------------------------------------------
|
|
||||||
|
|
||||||
// CloseSession transitions an Active session to Closed. The handler
|
|
||||||
// enforces the stateful source-status check (must be Open or Active; an
|
|
||||||
// Open session with no frames can close directly).
|
|
||||||
func (s msgServer) CloseSession(ctx interface{}, msg *types.MsgCloseSession) (*types.MsgCloseSessionResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
session, ok := s.Keeper.GetSession(sdkCtx, msg.SessionID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q not found", msg.SessionID)
|
|
||||||
}
|
|
||||||
if session.IsTerminal() {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q is terminal (%s), cannot close", msg.SessionID, session.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
session.Status = types.SessionClosed
|
|
||||||
session.ClosedAt = nowUnix(sdkCtx)
|
|
||||||
s.Keeper.SetSession(sdkCtx, session)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.session_closed",
|
|
||||||
sdk.NewAttribute("session_id", msg.SessionID),
|
|
||||||
sdk.NewAttribute("status", string(types.SessionClosed)),
|
|
||||||
))
|
|
||||||
return &types.MsgCloseSessionResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- RevokeSession (out-of-band → Revoked) -----------------------------------
|
|
||||||
|
|
||||||
// RevokeSession transitions a session to Revoked (out-of-band termination).
|
|
||||||
// A revoked session rejects further Receive. The handler enforces the
|
|
||||||
// stateful source-status check (must not already be terminal).
|
|
||||||
func (s msgServer) RevokeSession(ctx interface{}, msg *types.MsgRevokeSession) (*types.MsgRevokeSessionResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
session, ok := s.Keeper.GetSession(sdkCtx, msg.SessionID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q not found", msg.SessionID)
|
|
||||||
}
|
|
||||||
if session.IsTerminal() {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q is terminal (%s), cannot revoke", msg.SessionID, session.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
session.Status = types.SessionRevoked
|
|
||||||
session.ClosedAt = nowUnix(sdkCtx)
|
|
||||||
s.Keeper.SetSession(sdkCtx, session)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.session_revoked",
|
|
||||||
sdk.NewAttribute("session_id", msg.SessionID),
|
|
||||||
sdk.NewAttribute("status", string(types.SessionRevoked)),
|
|
||||||
))
|
|
||||||
return &types.MsgRevokeSessionResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- SendOYSATFrame (send a frame on an Open/Active session) ------------------
|
|
||||||
|
|
||||||
// SendOYSATFrame sends a frame on an OY-SAT session. The handler enforces
|
|
||||||
// the stateful session-status check: the session must be Open or Active
|
|
||||||
// (frames on Closed/Revoked are REJECTED — the rejected-frame case).
|
|
||||||
func (s msgServer) SendOYSATFrame(ctx interface{}, msg *types.MsgSendOYSATFrame) (*types.MsgSendOYSATFrameResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
session, ok := s.Keeper.GetSession(sdkCtx, msg.SessionID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q not found", msg.SessionID)
|
|
||||||
}
|
|
||||||
if session.IsTerminal() {
|
|
||||||
// Rejected-frame case: a frame received on a Closed/Revoked
|
|
||||||
// session MUST be rejected (A-523 session state machine).
|
|
||||||
return nil, fmt.Errorf("bearers: session %q is terminal (%s), rejects frame", msg.SessionID, session.Status)
|
|
||||||
}
|
|
||||||
if session.IsExpired(nowUnix(sdkCtx)) {
|
|
||||||
// TTL expiry transitions the session to Closed (the handler
|
|
||||||
// enforces expiry on Send/Receive checks).
|
|
||||||
session.Status = types.SessionClosed
|
|
||||||
session.ClosedAt = nowUnix(sdkCtx)
|
|
||||||
s.Keeper.SetSession(sdkCtx, session)
|
|
||||||
return nil, fmt.Errorf("bearers: session %q expired (ttl %d), rejects frame", msg.SessionID, session.TTL)
|
|
||||||
}
|
|
||||||
|
|
||||||
frame := types.Frame{
|
|
||||||
FrameID: msg.FrameID,
|
|
||||||
SenderReach: msg.Signer,
|
|
||||||
PayloadBytes: msg.PayloadBytes,
|
|
||||||
SentAt: nowUnix(sdkCtx),
|
|
||||||
}
|
|
||||||
session.Frames = append(session.Frames, frame)
|
|
||||||
s.Keeper.SetSession(sdkCtx, session)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.frame_sent",
|
|
||||||
sdk.NewAttribute("session_id", msg.SessionID),
|
|
||||||
sdk.NewAttribute("frame_id", msg.FrameID),
|
|
||||||
sdk.NewAttribute("sender_reach", msg.Signer),
|
|
||||||
// NO geolocation (A-522 surveillance-resistant invariant).
|
|
||||||
))
|
|
||||||
return &types.MsgSendOYSATFrameResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- ReceiveOYSATFrame (ack a frame; Open → Active on first ack) -------------
|
|
||||||
|
|
||||||
// ReceiveOYSATFrame acknowledges receipt of an OY-SAT frame. The handler
|
|
||||||
// transitions the session Open → Active on the first ack. The handler
|
|
||||||
// enforces the stateful session-status check: the session must be Open or
|
|
||||||
// Active (acks on Closed/Revoked are REJECTED — the rejected-frame case).
|
|
||||||
func (s msgServer) ReceiveOYSATFrame(ctx interface{}, msg *types.MsgReceiveOYSATFrame) (*types.MsgReceiveOYSATFrameResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
session, ok := s.Keeper.GetSession(sdkCtx, msg.SessionID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q not found", msg.SessionID)
|
|
||||||
}
|
|
||||||
if session.IsTerminal() {
|
|
||||||
// Rejected-frame case: an ack received on a Closed/Revoked
|
|
||||||
// session MUST be rejected (A-523 session state machine).
|
|
||||||
return nil, fmt.Errorf("bearers: session %q is terminal (%s), rejects ack", msg.SessionID, session.Status)
|
|
||||||
}
|
|
||||||
if session.IsExpired(nowUnix(sdkCtx)) {
|
|
||||||
session.Status = types.SessionClosed
|
|
||||||
session.ClosedAt = nowUnix(sdkCtx)
|
|
||||||
s.Keeper.SetSession(sdkCtx, session)
|
|
||||||
return nil, fmt.Errorf("bearers: session %q expired (ttl %d), rejects ack", msg.SessionID, session.TTL)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Find the named frame; mark it received.
|
|
||||||
found := false
|
|
||||||
for i := range session.Frames {
|
|
||||||
if session.Frames[i].FrameID == msg.FrameID {
|
|
||||||
session.Frames[i].Received = true
|
|
||||||
found = true
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if !found {
|
|
||||||
return nil, fmt.Errorf("bearers: frame %q not found on session %q", msg.FrameID, msg.SessionID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Open → Active on the first ack.
|
|
||||||
if session.Status == types.SessionOpen {
|
|
||||||
session.Status = types.SessionActive
|
|
||||||
}
|
|
||||||
s.Keeper.SetSession(sdkCtx, session)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.frame_received",
|
|
||||||
sdk.NewAttribute("session_id", msg.SessionID),
|
|
||||||
sdk.NewAttribute("frame_id", msg.FrameID),
|
|
||||||
sdk.NewAttribute("status", string(session.Status)),
|
|
||||||
// NO geolocation (A-522 surveillance-resistant invariant).
|
|
||||||
))
|
|
||||||
return &types.MsgReceiveOYSATFrameResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- IssueOYQR (issue a one-shot OY-QR, consumed=false) ----------------------
|
|
||||||
|
|
||||||
// IssueOYQR issues a one-shot OY-QR (consumed=false). The handler enforces
|
|
||||||
// idempotency (qr-id must not already exist).
|
|
||||||
func (s msgServer) IssueOYQR(ctx interface{}, msg *types.MsgIssueOYQR) (*types.MsgIssueOYQRResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Idempotency: qr-id must not already exist.
|
|
||||||
if _, ok := s.Keeper.GetOYQRCode(sdkCtx, msg.QRID); ok {
|
|
||||||
return nil, fmt.Errorf("bearers: qr %q already exists", msg.QRID)
|
|
||||||
}
|
|
||||||
|
|
||||||
qr := types.OYQRCode{
|
|
||||||
QRID: msg.QRID,
|
|
||||||
PayloadBytes: msg.PayloadBytes,
|
|
||||||
Consumed: false,
|
|
||||||
IssuerReachID: msg.IssuerReachID,
|
|
||||||
AmountGrain: msg.AmountGrain,
|
|
||||||
ExpiresAt: msg.ExpiresAt,
|
|
||||||
}
|
|
||||||
s.Keeper.SetOYQRCode(sdkCtx, qr)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.qr_issued",
|
|
||||||
sdk.NewAttribute("qr_id", msg.QRID),
|
|
||||||
sdk.NewAttribute("issuer_reach", msg.IssuerReachID),
|
|
||||||
sdk.NewAttribute("amount_grain", fmt.Sprintf("%d", msg.AmountGrain)),
|
|
||||||
sdk.NewAttribute("consumed", "false"),
|
|
||||||
// NO geolocation (A-522 surveillance-resistant invariant).
|
|
||||||
))
|
|
||||||
return &types.MsgIssueOYQRResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- ConsumeOYQR (one-shot; A-521 consumed-flip-before-effect) ---------------
|
|
||||||
|
|
||||||
// ConsumeOYQR is the canonical one-shot handler (A-521). The ordering is:
|
|
||||||
// 1. load QR
|
|
||||||
// 2. assert !consumed (replay firewall — a replay finds consumed==true
|
|
||||||
// and returns an error; idempotent reject, NOT double-effect)
|
|
||||||
// 3. assert expires-at > now (the QR is still valid)
|
|
||||||
// 4. FLIP consumed=true (state write FIRST — A-521)
|
|
||||||
// 5. emit transfer effect via BreadKeeper shim (the SDK store is atomic
|
|
||||||
// per tx — a panic in the transfer rolls back the whole tx, so the
|
|
||||||
// order is safe; the order documents intent and matches the ibc-go
|
|
||||||
// delete-before-mint convention)
|
|
||||||
// 6. emit event
|
|
||||||
// 7. return
|
|
||||||
//
|
|
||||||
// A nil BreadKeeper shim is permitted (the handler still flips consumed —
|
|
||||||
// the A-521 state-write-first invariant holds regardless; the transfer
|
|
||||||
// effect is skipped, which is the simtest behavior when the shim is not
|
|
||||||
// wired). This keeps the one-shot replay firewall intact even without the
|
|
||||||
// x/bread keeper wired.
|
|
||||||
func (s msgServer) ConsumeOYQR(ctx interface{}, msg *types.MsgConsumeOYQR) (*types.MsgConsumeOYQRResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// 1. Load QR.
|
|
||||||
qr, ok := s.Keeper.GetOYQRCode(sdkCtx, msg.QRID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bearers: qr %q not found", msg.QRID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// 2. Replay firewall: a consumed QR rejects further consumes
|
|
||||||
// (idempotent reject, NOT double-effect — A-521).
|
|
||||||
if qr.Consumed {
|
|
||||||
return nil, fmt.Errorf("bearers: qr %q already consumed (one-shot — A-521)", msg.QRID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// 3. Expiry check: the QR must still be valid (expires-at > now).
|
|
||||||
now := nowUnix(sdkCtx)
|
|
||||||
if qr.ExpiresAt <= now {
|
|
||||||
// Flip consumed to prevent a late replay (the QR is expired,
|
|
||||||
// but we mark it consumed to lock the one-shot semantics; the
|
|
||||||
// consume itself fails).
|
|
||||||
qr.Consumed = true
|
|
||||||
s.Keeper.SetOYQRCode(sdkCtx, qr)
|
|
||||||
return nil, fmt.Errorf("bearers: qr %q expired (expires-at %d <= now %d)", msg.QRID, qr.ExpiresAt, now)
|
|
||||||
}
|
|
||||||
|
|
||||||
// 4. FLIP consumed=true (state write FIRST — A-521). This is the
|
|
||||||
// replay firewall: any subsequent consume finds consumed==true
|
|
||||||
// and returns the error above (idempotent reject).
|
|
||||||
qr.Consumed = true
|
|
||||||
s.Keeper.SetOYQRCode(sdkCtx, qr)
|
|
||||||
|
|
||||||
// 5. Emit transfer effect via BreadKeeper shim. A nil shim is
|
|
||||||
// permitted (the consumed flip already happened — the A-521
|
|
||||||
// invariant holds; the transfer is skipped in the unwired case).
|
|
||||||
var transferErr error
|
|
||||||
if s.Keeper.breadKeeper != nil {
|
|
||||||
transferErr = s.Keeper.breadKeeper.TransferGrain(qr.IssuerReachID, msg.ConsumerReachID, qr.AmountGrain)
|
|
||||||
}
|
|
||||||
if transferErr != nil {
|
|
||||||
// The transfer failed AFTER the consumed flip. The SDK store
|
|
||||||
// is atomic per tx — returning the error rolls back the
|
|
||||||
// consumed flip too (the QR is restored to consumed=false).
|
|
||||||
// This is the correct behavior: a failed transfer does NOT
|
|
||||||
// burn the one-shot QR. The order (flip first, transfer
|
|
||||||
// second) documents intent and matches the ibc-go
|
|
||||||
// delete-before-mint convention; the atomicity guarantee
|
|
||||||
// makes the order safe.
|
|
||||||
return nil, fmt.Errorf("bearers: qr %q transfer effect failed: %w", msg.QRID, transferErr)
|
|
||||||
}
|
|
||||||
|
|
||||||
// 6. Emit event.
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.qr_consumed",
|
|
||||||
sdk.NewAttribute("qr_id", msg.QRID),
|
|
||||||
sdk.NewAttribute("issuer_reach", qr.IssuerReachID),
|
|
||||||
sdk.NewAttribute("consumer_reach", msg.ConsumerReachID),
|
|
||||||
sdk.NewAttribute("amount_grain", fmt.Sprintf("%d", qr.AmountGrain)),
|
|
||||||
sdk.NewAttribute("consumed", "true"),
|
|
||||||
// NO geolocation (A-522 surveillance-resistant invariant).
|
|
||||||
))
|
|
||||||
return &types.MsgConsumeOYQRResponse{}, nil
|
|
||||||
}
|
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -1,130 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bearers/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// transport.go holds the store-backed BearerTransport impl (P2-02-01,
|
|
||||||
// REQ-034, A-522). The v0.2 BearerTransport Go interface (Send, Receive,
|
|
||||||
// Status) gains a store-backed runtime impl: the keeper IS the transport
|
|
||||||
// for simtest purposes — no hardware/RF Go libraries (D-054).
|
|
||||||
//
|
|
||||||
// The transport wraps the keeper's session store. Send appends a frame to
|
|
||||||
// the session's Frames slice. Receive marks the frame received (and
|
|
||||||
// transitions the session Open → Active on first ack). Status reports
|
|
||||||
// whether the session is Open or Active (i.e., still carrying traffic).
|
|
||||||
//
|
|
||||||
// Surveillance-resistant invariant (A-522): the transport carries NO
|
|
||||||
// geolocation / sender physical location fields. The surveillance-resistant
|
|
||||||
// locked const on OYSATLink/OYLRLink is a runtime invariant — the transport
|
|
||||||
// MUST NOT emit geolocation in events. A negative simtest asserts the event
|
|
||||||
// set contains NO geolocation fields.
|
|
||||||
|
|
||||||
// StoreTransport is the store-backed BearerTransport impl. It wraps a
|
|
||||||
// Keeper + the sdk.Context (bound at construction so the BearerTransport
|
|
||||||
// interface methods can stay parameterless per the v0.2 interface contract).
|
|
||||||
// The transport operates on a single session-id (a transport instance is
|
|
||||||
// scoped to one session — the bearer is a per-session handle in the simtest
|
|
||||||
// runtime).
|
|
||||||
type StoreTransport struct {
|
|
||||||
keeper Keeper
|
|
||||||
ctx sdk.Context
|
|
||||||
sessionID string
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewStoreTransport constructs a store-backed BearerTransport scoped to the
|
|
||||||
// named session. The session must already exist (Open or Active). The
|
|
||||||
// transport reads/writes the session's Frames slice via the keeper store.
|
|
||||||
func NewStoreTransport(k Keeper, ctx sdk.Context, sessionID string) *StoreTransport {
|
|
||||||
return &StoreTransport{keeper: k, ctx: ctx, sessionID: sessionID}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertion: StoreTransport satisfies the v0.2 BearerTransport
|
|
||||||
// interface (D-029, REQ-034). The interface contract is Send/Receive/Status
|
|
||||||
// (parameterless except Send takes a payload).
|
|
||||||
var _ types.BearerTransport = (*StoreTransport)(nil)
|
|
||||||
|
|
||||||
// Send dispatches a payload via the bearer. The store-backed impl appends
|
|
||||||
// the payload as a new Frame on the session's Frames slice. Returns an
|
|
||||||
// error if the session is not found or is terminal (Closed/Revoked) — a
|
|
||||||
// terminal session rejects further Send calls.
|
|
||||||
func (t *StoreTransport) Send(payload []byte) error {
|
|
||||||
s, ok := t.keeper.GetSession(t.ctx, t.sessionID)
|
|
||||||
if !ok {
|
|
||||||
return fmt.Errorf("bearers: session %q not found", t.sessionID)
|
|
||||||
}
|
|
||||||
if s.IsTerminal() {
|
|
||||||
return fmt.Errorf("bearers: session %q is terminal (%s), rejects Send", t.sessionID, s.Status)
|
|
||||||
}
|
|
||||||
frame := types.Frame{
|
|
||||||
FrameID: fmt.Sprintf("%s-frame-%d", t.sessionID, len(s.Frames)+1),
|
|
||||||
SenderReach: s.InitiatorReach,
|
|
||||||
PayloadBytes: payload,
|
|
||||||
SentAt: t.ctx.BlockTime().Unix(),
|
|
||||||
}
|
|
||||||
s.Frames = append(s.Frames, frame)
|
|
||||||
t.keeper.SetSession(t.ctx, s)
|
|
||||||
t.ctx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.frame_sent",
|
|
||||||
sdk.NewAttribute("session_id", t.sessionID),
|
|
||||||
sdk.NewAttribute("frame_id", frame.FrameID),
|
|
||||||
sdk.NewAttribute("sender_reach", frame.SenderReach),
|
|
||||||
// NO geolocation (A-522 surveillance-resistant invariant).
|
|
||||||
))
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Receive accepts an inbound payload from the bearer. The store-backed impl
|
|
||||||
// marks the first unreceived frame as Received and transitions the session
|
|
||||||
// Open → Active on the first ack. Returns the payload and an error if the
|
|
||||||
// bearer has no inbound (unreceived) payload or the session is terminal.
|
|
||||||
func (t *StoreTransport) Receive() ([]byte, error) {
|
|
||||||
s, ok := t.keeper.GetSession(t.ctx, t.sessionID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q not found", t.sessionID)
|
|
||||||
}
|
|
||||||
if s.IsTerminal() {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q is terminal (%s), rejects Receive", t.sessionID, s.Status)
|
|
||||||
}
|
|
||||||
// Find the first unreceived frame.
|
|
||||||
var received *types.Frame
|
|
||||||
for i := range s.Frames {
|
|
||||||
if !s.Frames[i].Received {
|
|
||||||
s.Frames[i].Received = true
|
|
||||||
received = &s.Frames[i]
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if received == nil {
|
|
||||||
return nil, fmt.Errorf("bearers: no inbound frame on session %q", t.sessionID)
|
|
||||||
}
|
|
||||||
// Open → Active on the first ack.
|
|
||||||
if s.Status == types.SessionOpen {
|
|
||||||
s.Status = types.SessionActive
|
|
||||||
}
|
|
||||||
t.keeper.SetSession(t.ctx, s)
|
|
||||||
t.ctx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.frame_received",
|
|
||||||
sdk.NewAttribute("session_id", t.sessionID),
|
|
||||||
sdk.NewAttribute("frame_id", received.FrameID),
|
|
||||||
sdk.NewAttribute("status", string(s.Status)),
|
|
||||||
// NO geolocation (A-522 surveillance-resistant invariant).
|
|
||||||
))
|
|
||||||
return received.PayloadBytes, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Status reports the bearer's current reachability (true = reachable). The
|
|
||||||
// store-backed impl reports true iff the session exists and is Open or
|
|
||||||
// Active (still carrying traffic). A terminal or missing session is
|
|
||||||
// unreachable.
|
|
||||||
func (t *StoreTransport) Status() bool {
|
|
||||||
s, ok := t.keeper.GetSession(t.ctx, t.sessionID)
|
|
||||||
if !ok {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
return s.Status == types.SessionOpen || s.Status == types.SessionActive
|
|
||||||
}
|
|
||||||
@@ -1,79 +0,0 @@
|
|||||||
package bearers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/types/module"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bearers/keeper"
|
|
||||||
"github.com/oy/openyield/x/bearers/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// module.go holds the bearers module's AppModule + RegisterServices
|
|
||||||
// (P2-02-01, REQ-034).
|
|
||||||
//
|
|
||||||
// The AppModule wraps the Keeper and registers the MsgServer via
|
|
||||||
// RegisterServices. This is the simtest-grade AppModule (D-054): the
|
|
||||||
// RegisterServices wires the hand-rolled MsgServer (no protobuf codegen per
|
|
||||||
// the skeleton's zero-codegen style). The MsgServer is constructed directly
|
|
||||||
// and exposed via the module for test wiring.
|
|
||||||
|
|
||||||
// ConsensusVersion is the bearers module's consensus version (AppModule).
|
|
||||||
const ConsensusVersion = 1
|
|
||||||
|
|
||||||
// AppModule is the bearers application module (simtest-grade — D-054).
|
|
||||||
type AppModule struct {
|
|
||||||
keeper keeper.Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewAppModule constructs a new bearers AppModule. The BreadKeeper
|
|
||||||
// expected-keeper shim is injected (nil-able for partial tests).
|
|
||||||
func NewAppModule(cdc codec.Codec, storeKey storetypes.StoreKey, bk types.BreadKeeper) AppModule {
|
|
||||||
k := keeper.NewKeeper(cdc, storeKey, bk)
|
|
||||||
return AppModule{keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
// RegisterServices registers the bearers MsgServer. Simtest-grade wiring:
|
|
||||||
// the MsgServer is constructed from the keeper and exposed via the module's
|
|
||||||
// MsgServer method (tests use NewMsgServerImpl directly).
|
|
||||||
func (am AppModule) RegisterServices(cfg module.Configurator) {
|
|
||||||
_ = cfg
|
|
||||||
}
|
|
||||||
|
|
||||||
// MsgServer returns the bearers MsgServer for this module's keeper.
|
|
||||||
func (am AppModule) MsgServer() types.MsgServer {
|
|
||||||
return keeper.NewMsgServerImpl(am.keeper)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Name returns the module name.
|
|
||||||
func (AppModule) Name() string { return types.ModuleName }
|
|
||||||
|
|
||||||
// ConsensusVersion implements AppModule.ConsensusVersion.
|
|
||||||
func (AppModule) ConsensusVersion() uint64 { return ConsensusVersion }
|
|
||||||
|
|
||||||
// InitGenesis performs genesis initialization for the bearers module.
|
|
||||||
func (am AppModule) InitGenesis(ctx sdk.Context, cdc codec.JSONCodec, data json.RawMessage) {
|
|
||||||
var gs types.GenesisState
|
|
||||||
cdc.MustUnmarshalJSON(data, &gs)
|
|
||||||
for _, s := range gs.Sessions {
|
|
||||||
am.keeper.SetSession(ctx, s)
|
|
||||||
}
|
|
||||||
for _, q := range gs.QRs {
|
|
||||||
am.keeper.SetOYQRCode(ctx, q)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ExportGenesis returns the exported genesis state as raw bytes.
|
|
||||||
func (am AppModule) ExportGenesis(ctx sdk.Context, cdc codec.JSONCodec) json.RawMessage {
|
|
||||||
sessions := am.keeper.AllSessions(ctx)
|
|
||||||
qrs := am.keeper.AllOYQRCodes(ctx)
|
|
||||||
gs := types.GenesisState{Sessions: sessions, QRs: qrs}
|
|
||||||
return cdc.MustMarshalJSON(&gs)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions: AppModule implements the module interface stubs.
|
|
||||||
var _ module.HasName = AppModule{}
|
|
||||||
var _ module.HasConsensusVersion = AppModule{}
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
// expected_keepers.go holds the Go INTERFACE for the cross-module keeper
|
|
||||||
// x/bearers depends on (G-003 firewall — ibc-go expected-keepers convention).
|
|
||||||
//
|
|
||||||
// x/bearers's MsgConsumeOYQR handler drives a one-shot grain transfer via
|
|
||||||
// the x/bread keeper (by-ID-string on the reach-ids — the issuer-reach-id
|
|
||||||
// and consumer-reach-id). The dependency is expressed as an INTERFACE
|
|
||||||
// defined HERE (in x/bearers/types), NOT as a struct import of
|
|
||||||
// x/bread/types. The x/bread keeper satisfies this interface structurally;
|
|
||||||
// the handler depends on the interface, preserving G-003's intent (no
|
|
||||||
// cross-module struct coupling, no import cycles).
|
|
||||||
//
|
|
||||||
// Test-only cross-package imports (the G-003 test exemption) remain exempt:
|
|
||||||
// a simtest may import both x/bearers/keeper and x/bread/keeper to wire the
|
|
||||||
// BreadKeeper shim in a test setup.
|
|
||||||
|
|
||||||
// BreadKeeper is the expected-keeper interface for x/bread (G-003). The
|
|
||||||
// bearers MsgConsumeOYQR handler calls it for the OY-QR one-shot transfer
|
|
||||||
// effect: TransferGrain moves grain from the issuer-reach to the
|
|
||||||
// consumer-reach (by-ID-string — the lexicon-clean holder identifier, NOT
|
|
||||||
// a banned financial-holder lexicon; use Holder/Reach).
|
|
||||||
//
|
|
||||||
// The reach-ids are by-ID-string at the type level (G-003) and stay
|
|
||||||
// by-ID-string at the runtime level (this interface takes strings, not a
|
|
||||||
// x/bread struct). No struct import of x/bread/types.
|
|
||||||
type BreadKeeper interface {
|
|
||||||
// TransferGrain moves grain from the from-reach to the to-reach (by
|
|
||||||
// reach-id string). Returns an error if the transfer fails (e.g.,
|
|
||||||
// insufficient grain, unknown reach-id). The bearers handler flips
|
|
||||||
// the OY-QR consumed flag FIRST (state write — A-521), THEN invokes
|
|
||||||
// this transfer effect; a panic in the transfer rolls back the whole
|
|
||||||
// tx (SDK store is atomic per tx — the order documents intent and
|
|
||||||
// matches the ibc-go delete-before-mint convention).
|
|
||||||
TransferGrain(fromReach, toReach string, amount int64) error
|
|
||||||
}
|
|
||||||
@@ -1,473 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// msg_bearer.go holds the bearers module's Msg* types implementing sdk.Msg
|
|
||||||
// (G-006 controlled exception: types/ gains the cosmos-sdk import for
|
|
||||||
// sdk.Msg — D-055; the invariant/lexicon tests in *_test.go stay stdlib-only
|
|
||||||
// per G-024, isolated from this msg_*.go file). Each Msg carries a
|
|
||||||
// ValidateBasic (stateless) and GetSigners.
|
|
||||||
//
|
|
||||||
// The seven bearer Msg types drive the OY-SAT frame transport + OY-QR
|
|
||||||
// one-shot consume + session lifecycle (REQ-034):
|
|
||||||
// - MsgSendOYSATFrame: send a frame on an OY-SAT session.
|
|
||||||
// - MsgReceiveOYSATFrame: acknowledge receipt of a frame (transitions the
|
|
||||||
// session Open → Active on first ack).
|
|
||||||
// - MsgIssueOYQR: issue a one-shot OY-QR (consumed=false).
|
|
||||||
// - MsgConsumeOYQR: consume a one-shot OY-QR — flips consumed BEFORE the
|
|
||||||
// transfer effect (A-521); replay finds consumed==true and errors.
|
|
||||||
// - MsgOpenSession: open a new session (status=Open).
|
|
||||||
// - MsgCloseSession: close a session (Active → Closed).
|
|
||||||
// - MsgRevokeSession: revoke a session (out-of-band → Revoked).
|
|
||||||
//
|
|
||||||
// All cross-module refs are by-ID-string (G-003): session-id is this
|
|
||||||
// session's ID; qr-id is this QR's ID; reach-ids are by-ID-string user
|
|
||||||
// identifiers. GetSigners returns the signer reach-ids encoded as
|
|
||||||
// sdk.AccAddress bytes. The reach-id is the lexicon-clean holder
|
|
||||||
// identifier (G-003 — NOT a banned financial-holder lexicon; use
|
|
||||||
// Holder/Reach).
|
|
||||||
//
|
|
||||||
// Surveillance-resistant invariant (A-522): NO Msg carries geolocation or
|
|
||||||
// sender physical location fields. The handler MUST NOT emit geolocation
|
|
||||||
// in events. A negative simtest asserts the event set contains NO
|
|
||||||
// geolocation fields.
|
|
||||||
|
|
||||||
// --- MsgSendOYSATFrame --------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgSendOYSATFrame sends a frame on an OY-SAT session. ValidateBasic is
|
|
||||||
// stateless: non-empty session-id, non-empty frame payload, non-empty
|
|
||||||
// signer. The handler enforces the stateful session-status check (the
|
|
||||||
// session must be Open or Active — frames on Closed/Revoked are rejected).
|
|
||||||
type MsgSendOYSATFrame struct {
|
|
||||||
SessionID string `json:"session_id" yaml:"session_id"`
|
|
||||||
FrameID string `json:"frame_id" yaml:"frame_id"`
|
|
||||||
PayloadBytes []byte `json:"payload_bytes" yaml:"payload_bytes"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message (sdk.Msg = proto.Message).
|
|
||||||
func (m *MsgSendOYSATFrame) Reset() { *m = MsgSendOYSATFrame{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgSendOYSATFrame) String() string {
|
|
||||||
return fmt.Sprintf("MsgSendOYSATFrame{SessionID:%s FrameID:%s Signer:%s}",
|
|
||||||
m.SessionID, m.FrameID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgSendOYSATFrame) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty session-id, non-empty
|
|
||||||
// frame payload, non-empty signer.
|
|
||||||
func (m *MsgSendOYSATFrame) ValidateBasic() error {
|
|
||||||
if m.SessionID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty session-id")
|
|
||||||
}
|
|
||||||
if len(m.PayloadBytes) == 0 {
|
|
||||||
return fmt.Errorf("bearers: empty frame payload")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bearers: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgSendOYSATFrame) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgReceiveOYSATFrame -----------------------------------------------------
|
|
||||||
|
|
||||||
// MsgReceiveOYSATFrame acknowledges receipt of an OY-SAT frame. The handler
|
|
||||||
// transitions the session Open → Active on the first ack. ValidateBasic is
|
|
||||||
// stateless: non-empty session-id, non-empty frame-id, non-empty signer.
|
|
||||||
type MsgReceiveOYSATFrame struct {
|
|
||||||
SessionID string `json:"session_id" yaml:"session_id"`
|
|
||||||
FrameID string `json:"frame_id" yaml:"frame_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgReceiveOYSATFrame) Reset() { *m = MsgReceiveOYSATFrame{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgReceiveOYSATFrame) String() string {
|
|
||||||
return fmt.Sprintf("MsgReceiveOYSATFrame{SessionID:%s FrameID:%s Signer:%s}",
|
|
||||||
m.SessionID, m.FrameID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgReceiveOYSATFrame) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty session-id, non-empty
|
|
||||||
// frame-id, non-empty signer.
|
|
||||||
func (m *MsgReceiveOYSATFrame) ValidateBasic() error {
|
|
||||||
if m.SessionID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty session-id")
|
|
||||||
}
|
|
||||||
if m.FrameID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty frame-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bearers: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgReceiveOYSATFrame) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgIssueOYQR -------------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgIssueOYQR issues a one-shot OY-QR (consumed=false). ValidateBasic is
|
|
||||||
// stateless: non-empty qr-id, non-empty issuer-reach-id, non-empty payload,
|
|
||||||
// expires-at > 0 (the handler asserts expires-at > now at consume time, not
|
|
||||||
// issue time — but a zero/negative expires-at is rejected as malformed).
|
|
||||||
type MsgIssueOYQR struct {
|
|
||||||
QRID string `json:"qr_id" yaml:"qr_id"`
|
|
||||||
IssuerReachID string `json:"issuer_reach_id" yaml:"issuer_reach_id"`
|
|
||||||
PayloadBytes []byte `json:"payload_bytes" yaml:"payload_bytes"`
|
|
||||||
AmountGrain int64 `json:"amount_grain" yaml:"amount_grain"`
|
|
||||||
ExpiresAt int64 `json:"expires_at" yaml:"expires_at"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgIssueOYQR) Reset() { *m = MsgIssueOYQR{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgIssueOYQR) String() string {
|
|
||||||
return fmt.Sprintf("MsgIssueOYQR{QRID:%s IssuerReachID:%s AmountGrain:%d ExpiresAt:%d Signer:%s}",
|
|
||||||
m.QRID, m.IssuerReachID, m.AmountGrain, m.ExpiresAt, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgIssueOYQR) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty qr-id, non-empty
|
|
||||||
// issuer-reach-id, non-empty payload, amount > 0, expires-at > 0, non-empty
|
|
||||||
// signer. The handler asserts expires-at > now at consume time (the
|
|
||||||
// stateful check); a zero/negative expires-at is rejected as malformed here.
|
|
||||||
func (m *MsgIssueOYQR) ValidateBasic() error {
|
|
||||||
if m.QRID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty qr-id")
|
|
||||||
}
|
|
||||||
if m.IssuerReachID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty issuer-reach-id")
|
|
||||||
}
|
|
||||||
if len(m.PayloadBytes) == 0 {
|
|
||||||
return fmt.Errorf("bearers: empty qr payload")
|
|
||||||
}
|
|
||||||
if m.AmountGrain <= 0 {
|
|
||||||
return fmt.Errorf("bearers: amount-grain must be > 0")
|
|
||||||
}
|
|
||||||
if m.ExpiresAt <= 0 {
|
|
||||||
return fmt.Errorf("bearers: expires-at must be > 0")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bearers: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgIssueOYQR) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgConsumeOYQR ----------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgConsumeOYQR consumes a one-shot OY-QR. The handler is the canonical
|
|
||||||
// one-shot handler (A-521): load QR → assert !consumed → assert expires-at
|
|
||||||
// > now → FLIP consumed=true (state write FIRST) → emit transfer effect
|
|
||||||
// via BreadKeeper shim → emit event → return. A replay finds consumed==true
|
|
||||||
// and returns an error (idempotent reject, NOT double-effect).
|
|
||||||
//
|
|
||||||
// ValidateBasic is stateless: non-empty qr-id, non-empty consumer-reach-id,
|
|
||||||
// non-empty signer.
|
|
||||||
type MsgConsumeOYQR struct {
|
|
||||||
QRID string `json:"qr_id" yaml:"qr_id"`
|
|
||||||
ConsumerReachID string `json:"consumer_reach_id" yaml:"consumer_reach_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgConsumeOYQR) Reset() { *m = MsgConsumeOYQR{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgConsumeOYQR) String() string {
|
|
||||||
return fmt.Sprintf("MsgConsumeOYQR{QRID:%s ConsumerReachID:%s Signer:%s}",
|
|
||||||
m.QRID, m.ConsumerReachID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgConsumeOYQR) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty qr-id, non-empty
|
|
||||||
// consumer-reach-id, non-empty signer.
|
|
||||||
func (m *MsgConsumeOYQR) ValidateBasic() error {
|
|
||||||
if m.QRID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty qr-id")
|
|
||||||
}
|
|
||||||
if m.ConsumerReachID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty consumer-reach-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bearers: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgConsumeOYQR) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgOpenSession ----------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgOpenSession opens a new bearer session (status=Open). ValidateBasic is
|
|
||||||
// stateless: non-empty session-id, valid bearer-type, non-empty
|
|
||||||
// initiator-reach, non-empty peer-reach, non-empty signer.
|
|
||||||
type MsgOpenSession struct {
|
|
||||||
SessionID string `json:"session_id" yaml:"session_id"`
|
|
||||||
BearerType BearerType `json:"bearer_type" yaml:"bearer_type"`
|
|
||||||
InitiatorReach string `json:"initiator_reach" yaml:"initiator_reach"`
|
|
||||||
PeerReach string `json:"peer_reach" yaml:"peer_reach"`
|
|
||||||
TTL int64 `json:"ttl" yaml:"ttl"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgOpenSession) Reset() { *m = MsgOpenSession{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgOpenSession) String() string {
|
|
||||||
return fmt.Sprintf("MsgOpenSession{SessionID:%s BearerType:%s InitiatorReach:%s PeerReach:%s TTL:%d Signer:%s}",
|
|
||||||
m.SessionID, m.BearerType, m.InitiatorReach, m.PeerReach, m.TTL, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgOpenSession) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty session-id, known
|
|
||||||
// bearer-type, non-empty initiator-reach, non-empty peer-reach, non-empty
|
|
||||||
// signer. ttl may be 0 (never expires).
|
|
||||||
func (m *MsgOpenSession) ValidateBasic() error {
|
|
||||||
if m.SessionID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty session-id")
|
|
||||||
}
|
|
||||||
if !knownBearerType(m.BearerType) {
|
|
||||||
return fmt.Errorf("bearers: unknown bearer-type %q", m.BearerType)
|
|
||||||
}
|
|
||||||
if m.InitiatorReach == "" {
|
|
||||||
return fmt.Errorf("bearers: empty initiator-reach")
|
|
||||||
}
|
|
||||||
if m.PeerReach == "" {
|
|
||||||
return fmt.Errorf("bearers: empty peer-reach")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bearers: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgOpenSession) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgCloseSession ---------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgCloseSession closes a session (Active → Closed). ValidateBasic is
|
|
||||||
// stateless: non-empty session-id, non-empty signer.
|
|
||||||
type MsgCloseSession struct {
|
|
||||||
SessionID string `json:"session_id" yaml:"session_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgCloseSession) Reset() { *m = MsgCloseSession{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgCloseSession) String() string {
|
|
||||||
return fmt.Sprintf("MsgCloseSession{SessionID:%s Signer:%s}", m.SessionID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgCloseSession) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty session-id and signer.
|
|
||||||
func (m *MsgCloseSession) ValidateBasic() error {
|
|
||||||
if m.SessionID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty session-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bearers: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgCloseSession) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgRevokeSession --------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgRevokeSession revokes a session (out-of-band → Revoked). A revoked
|
|
||||||
// session rejects further Receive. ValidateBasic is stateless: non-empty
|
|
||||||
// session-id, non-empty signer.
|
|
||||||
type MsgRevokeSession struct {
|
|
||||||
SessionID string `json:"session_id" yaml:"session_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgRevokeSession) Reset() { *m = MsgRevokeSession{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgRevokeSession) String() string {
|
|
||||||
return fmt.Sprintf("MsgRevokeSession{SessionID:%s Signer:%s}", m.SessionID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgRevokeSession) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty session-id and signer.
|
|
||||||
func (m *MsgRevokeSession) ValidateBasic() error {
|
|
||||||
if m.SessionID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty session-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bearers: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgRevokeSession) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgServer interface + Response types -----------------------------------
|
|
||||||
|
|
||||||
// MsgServer is the bearers module's message server interface (one method per
|
|
||||||
// Msg*). The keeper's msg_server.go implements this; module.go's
|
|
||||||
// RegisterServices wires the implementation. This is the hand-rolled
|
|
||||||
// equivalent of the protobuf-generated MsgServer interface (no codegen per
|
|
||||||
// the skeleton's zero-codegen style).
|
|
||||||
type MsgServer interface {
|
|
||||||
SendOYSATFrame(ctx interface{}, msg *MsgSendOYSATFrame) (*MsgSendOYSATFrameResponse, error)
|
|
||||||
ReceiveOYSATFrame(ctx interface{}, msg *MsgReceiveOYSATFrame) (*MsgReceiveOYSATFrameResponse, error)
|
|
||||||
IssueOYQR(ctx interface{}, msg *MsgIssueOYQR) (*MsgIssueOYQRResponse, error)
|
|
||||||
ConsumeOYQR(ctx interface{}, msg *MsgConsumeOYQR) (*MsgConsumeOYQRResponse, error)
|
|
||||||
OpenSession(ctx interface{}, msg *MsgOpenSession) (*MsgOpenSessionResponse, error)
|
|
||||||
CloseSession(ctx interface{}, msg *MsgCloseSession) (*MsgCloseSessionResponse, error)
|
|
||||||
RevokeSession(ctx interface{}, msg *MsgRevokeSession) (*MsgRevokeSessionResponse, error)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Response types (hand-rolled equivalents of the protobuf-generated response
|
|
||||||
// wrappers; empty bodies — the response is the state mutation + event).
|
|
||||||
|
|
||||||
// MsgSendOYSATFrameResponse is the response to MsgSendOYSATFrame.
|
|
||||||
type MsgSendOYSATFrameResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgSendOYSATFrameResponse) Reset() { *m = MsgSendOYSATFrameResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgSendOYSATFrameResponse) String() string { return "MsgSendOYSATFrameResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgSendOYSATFrameResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgReceiveOYSATFrameResponse is the response to MsgReceiveOYSATFrame.
|
|
||||||
type MsgReceiveOYSATFrameResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgReceiveOYSATFrameResponse) Reset() { *m = MsgReceiveOYSATFrameResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgReceiveOYSATFrameResponse) String() string { return "MsgReceiveOYSATFrameResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgReceiveOYSATFrameResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgIssueOYQRResponse is the response to MsgIssueOYQR.
|
|
||||||
type MsgIssueOYQRResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgIssueOYQRResponse) Reset() { *m = MsgIssueOYQRResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgIssueOYQRResponse) String() string { return "MsgIssueOYQRResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgIssueOYQRResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgConsumeOYQRResponse is the response to MsgConsumeOYQR.
|
|
||||||
type MsgConsumeOYQRResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgConsumeOYQRResponse) Reset() { *m = MsgConsumeOYQRResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgConsumeOYQRResponse) String() string { return "MsgConsumeOYQRResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgConsumeOYQRResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgOpenSessionResponse is the response to MsgOpenSession.
|
|
||||||
type MsgOpenSessionResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgOpenSessionResponse) Reset() { *m = MsgOpenSessionResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgOpenSessionResponse) String() string { return "MsgOpenSessionResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgOpenSessionResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgCloseSessionResponse is the response to MsgCloseSession.
|
|
||||||
type MsgCloseSessionResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgCloseSessionResponse) Reset() { *m = MsgCloseSessionResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgCloseSessionResponse) String() string { return "MsgCloseSessionResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgCloseSessionResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgRevokeSessionResponse is the response to MsgRevokeSession.
|
|
||||||
type MsgRevokeSessionResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgRevokeSessionResponse) Reset() { *m = MsgRevokeSessionResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgRevokeSessionResponse) String() string { return "MsgRevokeSessionResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgRevokeSessionResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// --- Helpers ----------------------------------------------------------------
|
|
||||||
|
|
||||||
// knownBearerType reports whether bt is one of the six BearerType values.
|
|
||||||
func knownBearerType(bt BearerType) bool {
|
|
||||||
for _, b := range AllBearers() {
|
|
||||||
if b.Type == bt {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
@@ -1,121 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
// session.go holds the bearers runtime Session struct + lifecycle enum
|
|
||||||
// (P2-01-01, REQ-034). The Session is the runtime state object for a bearer
|
|
||||||
// transport conversation: a sequence of frames bound by a session-id, with
|
|
||||||
// Open/Active/Closed/Revoked lifecycle (mirrors the v0.2 Window primitive's
|
|
||||||
// lifecycle per A-523).
|
|
||||||
//
|
|
||||||
// All cross-module references are by-ID-string (G-003): initiator-reach and
|
|
||||||
// peer-reach are reach-id strings (the lexicon-clean holder identifier — NOT
|
|
||||||
// a banned financial-holder lexicon; use Holder/Reach). bearer-type is a
|
|
||||||
// BearerType enum value defined in types.go (same package — no cross-module
|
|
||||||
// import).
|
|
||||||
//
|
|
||||||
// Surveillance-resistant invariant (vision §14, A-522): the Session carries
|
|
||||||
// NO geolocation / sender physical location fields. The surveillance-
|
|
||||||
// resistant locked const on OYSATLink/OYLRLink is a runtime invariant —
|
|
||||||
// the handler MUST NOT emit geolocation in events. A negative simtest
|
|
||||||
// asserts the event set contains NO geolocation fields.
|
|
||||||
|
|
||||||
// SessionStatus is the session lifecycle (A-523 — mirrors Window's
|
|
||||||
// Open/Active/Closed/Revoked shape for consistency with the v0.2 Window
|
|
||||||
// primitive).
|
|
||||||
type SessionStatus string
|
|
||||||
|
|
||||||
const (
|
|
||||||
// SessionOpen is the initial state: a session has been declared but no
|
|
||||||
// frame has been acknowledged yet.
|
|
||||||
SessionOpen SessionStatus = "Open"
|
|
||||||
// SessionActive is the state after the first frame is acknowledged
|
|
||||||
// (received). The session is carrying traffic.
|
|
||||||
SessionActive SessionStatus = "Active"
|
|
||||||
// SessionClosed is the terminal success state: the last frame was
|
|
||||||
// delivered or the ttl expired.
|
|
||||||
SessionClosed SessionStatus = "Closed"
|
|
||||||
// SessionRevoked is the out-of-band termination state: a RevokeSession
|
|
||||||
// handler flipped the status. A revoked session rejects further Receive.
|
|
||||||
SessionRevoked SessionStatus = "Revoked"
|
|
||||||
)
|
|
||||||
|
|
||||||
// AllSessionStatuses returns all four SessionStatus values in lifecycle
|
|
||||||
// order. Locked-const test asserts exactly 4 entries.
|
|
||||||
func AllSessionStatuses() []SessionStatus {
|
|
||||||
return []SessionStatus{
|
|
||||||
SessionOpen,
|
|
||||||
SessionActive,
|
|
||||||
SessionClosed,
|
|
||||||
SessionRevoked,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// SessionStatusCount is the locked count of SessionStatus enum values.
|
|
||||||
// A regression firewall: adding/removing/renaming a status breaks this
|
|
||||||
// const's test.
|
|
||||||
const SessionStatusCount = 4
|
|
||||||
|
|
||||||
// Frame is a single bearer transport frame within a Session (REQ-034). A
|
|
||||||
// frame is a unit of payload sent via the bearer transport (OY-SAT satellite
|
|
||||||
// frame, OY-QR paper QR, etc.). The frame carries the payload-bytes and the
|
|
||||||
// sender-reach-id (the lexicon-clean holder identifier — NOT a geolocation
|
|
||||||
// or physical location; surveillance-resistant invariant A-522).
|
|
||||||
type Frame struct {
|
|
||||||
FrameID string `json:"frame_id" yaml:"frame_id"`
|
|
||||||
SenderReach string `json:"sender_reach" yaml:"sender_reach"`
|
|
||||||
PayloadBytes []byte `json:"payload_bytes" yaml:"payload_bytes"`
|
|
||||||
SentAt int64 `json:"sent_at" yaml:"sent_at"`
|
|
||||||
Received bool `json:"received" yaml:"received"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Session is the runtime state object for a bearer transport conversation
|
|
||||||
// (REQ-034, A-523). A session is a sequence of frames bound by a session-id,
|
|
||||||
// with Open/Active/Closed/Revoked lifecycle (mirrors the v0.2 Window
|
|
||||||
// primitive's lifecycle). The session is stored under the bearers keeper
|
|
||||||
// (by session-id).
|
|
||||||
//
|
|
||||||
// - session-id is this session's unique identifier.
|
|
||||||
// - bearer-type is the BearerType enum value (BearerOYSAT, BearerOYQR,
|
|
||||||
// etc.) — same package, no cross-module import.
|
|
||||||
// - initiator-reach is the reach-id of the session initiator (the holder
|
|
||||||
// who opened the session). Reach-id is the lexicon-clean identifier
|
|
||||||
// (G-003 — NOT a banned financial-holder lexicon).
|
|
||||||
// - peer-reach is the reach-id of the session peer (the other endpoint).
|
|
||||||
// - status is the SessionStatus lifecycle (Open/Active/Closed/Revoked).
|
|
||||||
// - frames is the ordered list of Frames in the session.
|
|
||||||
// - ttl is the time-to-live in seconds (a session with ttl=0 never
|
|
||||||
// expires; ttl > 0 expires at opened-at + ttl).
|
|
||||||
// - opened-at is the block time the session was opened (unix seconds).
|
|
||||||
// - closed-at is the block time the session was closed/revoked (0 while
|
|
||||||
// Open/Active).
|
|
||||||
//
|
|
||||||
// Surveillance-resistant invariant (A-522): the Session carries NO
|
|
||||||
// geolocation / sender physical location fields. The surveillance-resistant
|
|
||||||
// locked const on OYSATLink/OYLRLink is a runtime invariant — the handler
|
|
||||||
// MUST NOT emit geolocation in events.
|
|
||||||
type Session struct {
|
|
||||||
SessionID string `json:"session_id" yaml:"session_id"`
|
|
||||||
BearerType BearerType `json:"bearer_type" yaml:"bearer_type"`
|
|
||||||
InitiatorReach string `json:"initiator_reach" yaml:"initiator_reach"`
|
|
||||||
PeerReach string `json:"peer_reach" yaml:"peer_reach"`
|
|
||||||
Status SessionStatus `json:"status" yaml:"status"`
|
|
||||||
Frames []Frame `json:"frames" yaml:"frames"`
|
|
||||||
TTL int64 `json:"ttl" yaml:"ttl"`
|
|
||||||
OpenedAt int64 `json:"opened_at" yaml:"opened_at"`
|
|
||||||
ClosedAt int64 `json:"closed_at" yaml:"closed_at"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// IsTerminal reports whether the session status is terminal (Closed or
|
|
||||||
// Revoked). A terminal session rejects further Receive calls.
|
|
||||||
func (s Session) IsTerminal() bool {
|
|
||||||
return s.Status == SessionClosed || s.Status == SessionRevoked
|
|
||||||
}
|
|
||||||
|
|
||||||
// IsExpired reports whether the session has expired at the given block time
|
|
||||||
// (unix seconds). A session with TTL=0 never expires. Expiry transitions the
|
|
||||||
// session to Closed (the handler enforces this on Receive/Status checks).
|
|
||||||
func (s Session) IsExpired(now int64) bool {
|
|
||||||
if s.TTL == 0 {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
return now >= s.OpenedAt+s.TTL
|
|
||||||
}
|
|
||||||
+4
-191
@@ -1,9 +1,6 @@
|
|||||||
package types
|
package types
|
||||||
|
|
||||||
import (
|
import "encoding/json"
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
)
|
|
||||||
|
|
||||||
const (
|
const (
|
||||||
ModuleName = "bearers"
|
ModuleName = "bearers"
|
||||||
@@ -51,200 +48,16 @@ type UnifiedBearerLayer struct {
|
|||||||
FirstToDeliver bool `json:"first_to_deliver" yaml:"first_to_deliver"`
|
FirstToDeliver bool `json:"first_to_deliver" yaml:"first_to_deliver"`
|
||||||
}
|
}
|
||||||
|
|
||||||
// BearerTransport is the transport interface for a bearer (D-029, vision
|
|
||||||
// §14). A bearer implementation provides Send (dispatch a payload), Receive
|
|
||||||
// (accept an inbound payload), and Status (report the bearer's current
|
|
||||||
// reachability). This is a Go interface stub — no implementation is provided
|
|
||||||
// in v0.2; the OY-LR and Beacon transports are typed stubs only (no
|
|
||||||
// hardware/RF integration per D-029). The interface is the v0.2 hook for the
|
|
||||||
// Phase 3 processing-mesh runtime.
|
|
||||||
type BearerTransport interface {
|
|
||||||
// Send dispatches a payload via the bearer. Returns an error if the
|
|
||||||
// bearer cannot accept the payload. The stub implementations do not
|
|
||||||
// actually transmit; the interface contract is the v0.2 deliverable.
|
|
||||||
Send(payload []byte) error
|
|
||||||
// Receive accepts an inbound payload from the bearer. Returns the
|
|
||||||
// payload and an error if the bearer has no inbound payload.
|
|
||||||
Receive() ([]byte, error)
|
|
||||||
// Status reports the bearer's current reachability (true = reachable).
|
|
||||||
Status() bool
|
|
||||||
}
|
|
||||||
|
|
||||||
// OYLRLink is the OY-LR (LoRa, long-range 2-10km) transport link stub (D-029,
|
|
||||||
// vision §14). OY-LR is surveillance-resistant (vision §14: differs from
|
|
||||||
// Helium's public-coverage model). gateway-id is the LoRa gateway
|
|
||||||
// identifier; range-meters is the link range (2-10km); frequency-mhz is the
|
|
||||||
// operating frequency; surveillance-resistant is LOCKED true for OY-LR (the
|
|
||||||
// bearer is designed to resist surveillance).
|
|
||||||
type OYLRLink struct {
|
|
||||||
GatewayID string `json:"gateway_id" yaml:"gateway_id"`
|
|
||||||
RangeMeters int32 `json:"range_meters" yaml:"range_meters"`
|
|
||||||
FrequencyMHz uint32 `json:"frequency_mhz" yaml:"frequency_mhz"`
|
|
||||||
SurveillanceResistant bool `json:"surveillance_resistant" yaml:"surveillance_resistant"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// BeaconFrame is the OY-Beacon transport-mode beacon frame stub (D-029,
|
|
||||||
// vision §14). A beacon is a transport-mode beacon (presence + small
|
|
||||||
// payload), closest to Eddystone-EID (ephemeral identifier). beacon-id is
|
|
||||||
// the beacon identifier; ephemeral-id is the rotating ephemeral identifier;
|
|
||||||
// payload-bytes is the small payload; ttl is the time-to-live in seconds
|
|
||||||
// (must be > 0 for a valid frame).
|
|
||||||
type BeaconFrame struct {
|
|
||||||
BeaconID string `json:"beacon_id" yaml:"beacon_id"`
|
|
||||||
EphemeralID string `json:"ephemeral_id" yaml:"ephemeral_id"`
|
|
||||||
PayloadBytes []byte `json:"payload_bytes" yaml:"payload_bytes"`
|
|
||||||
TTL int64 `json:"ttl" yaml:"ttl"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// OYSATLink is the OY-SAT (satellite bearer) transport link stub (D-037,
|
|
||||||
// vision §14). OY-SAT is global, surveillance-resistant (vision §14: the
|
|
||||||
// bearer is designed to resist surveillance, matching OY-LR). The struct
|
|
||||||
// mirrors the v0.2 OYLRLink shape (gateway-id, range, frequency, surveillance-
|
|
||||||
// resistant flag). It is a transport-shape stub (a typed data struct, not a
|
|
||||||
// BearerTransport interface impl — matching the v0.2 OYLRLink/BeaconFrame
|
|
||||||
// approach per D-029).
|
|
||||||
//
|
|
||||||
// - satellite-id is the satellite gateway/constellation identifier.
|
|
||||||
// - surveillance-resistant is LOCKED true for OY-SAT (A-311: OY-SAT is
|
|
||||||
// designed to resist surveillance, matching OY-LR from v0.2). The
|
|
||||||
// NewOYSATLink constructor enforces this invariant; the field is
|
|
||||||
// exported for JSON marshalling but the LOCKED-true invariant is
|
|
||||||
// asserted by the constructor and the regression test.
|
|
||||||
// - range-meters is the link range (0 for global satellite coverage).
|
|
||||||
type OYSATLink struct {
|
|
||||||
SatelliteID string `json:"satellite_id" yaml:"satellite_id"`
|
|
||||||
SurveillanceResistant bool `json:"surveillance_resistant" yaml:"surveillance_resistant"`
|
|
||||||
RangeMeters int32 `json:"range_meters" yaml:"range_meters"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// OYSATSurveillanceResistant is the LOCKED invariant for OY-SAT (A-311):
|
|
||||||
// OY-SAT is surveillance-resistant by design (vision §14). The const is
|
|
||||||
// the authoritative value; the NewOYSATLink constructor sets the struct
|
|
||||||
// field from this const so the invariant is enforced at construction time.
|
|
||||||
// A regression test asserts this const is true.
|
|
||||||
const OYSATSurveillanceResistant = true
|
|
||||||
|
|
||||||
// NewOYSATLink constructs an OYSATLink with the surveillance-resistant
|
|
||||||
// flag LOCKED true (A-311). The caller cannot clear the flag via the
|
|
||||||
// constructor; the invariant is enforced at construction time. range-meters
|
|
||||||
// defaults to 0 (global satellite coverage) if not specified.
|
|
||||||
func NewOYSATLink(satelliteID string, rangeMeters int32) OYSATLink {
|
|
||||||
return OYSATLink{
|
|
||||||
SatelliteID: satelliteID,
|
|
||||||
SurveillanceResistant: OYSATSurveillanceResistant, // LOCKED true (A-311)
|
|
||||||
RangeMeters: rangeMeters,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// OYQRCode is the OY-QR (paper/QR-code bearer) transport stub (D-037,
|
|
||||||
// vision §14). OY-QR is 0-range (vision §14: the bearer list has OY-QR at
|
|
||||||
// "0 range"); a QR encodes a signed transfer that the recipient scans and
|
|
||||||
// submits. The struct mirrors the v0.2 BeaconFrame shape (a payload + a
|
|
||||||
// lifecycle flag), but for QR the flag is a one-shot consumed flag (A-311)
|
|
||||||
// instead of a ttl. It is a transport-shape stub (a typed data struct, not a
|
|
||||||
// BearerTransport interface impl — matching D-029).
|
|
||||||
//
|
|
||||||
// - qr-id is the QR code identifier.
|
|
||||||
// - payload-bytes is the signed transfer payload encoded in the QR.
|
|
||||||
// - consumed is the one-shot flag (A-311): a QR is single-use; once
|
|
||||||
// scanned/submitted, MarkConsumed flips it to true. Double-consume is
|
|
||||||
// idempotent (a no-op, not an error).
|
|
||||||
// - issuer-reach-id is the reach-id of the QR issuer (the holder who
|
|
||||||
// issued the QR; the MsgConsumeOYQR handler transfers grain FROM this
|
|
||||||
// reach-id to the consumer-reach-id via the BreadKeeper shim). Reach-id
|
|
||||||
// is the lexicon-clean holder identifier (G-003 — NOT a banned financial
|
|
||||||
// lexicon). Added in v0.5 P2 to support the MsgConsumeOYQR transfer
|
|
||||||
// effect (REQ-034, A-521).
|
|
||||||
// - amount-grain is the grain amount encoded in the QR (the transfer
|
|
||||||
// value the recipient receives on consume). Added in v0.5 P2.
|
|
||||||
// - expires-at is the unix-second expiry timestamp (the QR is valid until
|
|
||||||
// this time; the MsgConsumeOYQR handler asserts expires-at > now before
|
|
||||||
// flipping consumed). Added in v0.5 P2.
|
|
||||||
type OYQRCode struct {
|
|
||||||
QRID string `json:"qr_id" yaml:"qr_id"`
|
|
||||||
PayloadBytes []byte `json:"payload_bytes" yaml:"payload_bytes"`
|
|
||||||
Consumed bool `json:"consumed" yaml:"consumed"`
|
|
||||||
IssuerReachID string `json:"issuer_reach_id" yaml:"issuer_reach_id"`
|
|
||||||
AmountGrain int64 `json:"amount_grain" yaml:"amount_grain"`
|
|
||||||
ExpiresAt int64 `json:"expires_at" yaml:"expires_at"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// MarkConsumed marks the QR as consumed (one-shot, A-311). Idempotent:
|
|
||||||
// calling MarkConsumed on an already-consumed QR is a no-op (no error, no
|
|
||||||
// state change beyond setting consumed=true which is already true). This
|
|
||||||
// locks the one-shot semantics: a QR cannot be unconsumed.
|
|
||||||
func (q *OYQRCode) MarkConsumed() {
|
|
||||||
q.Consumed = true
|
|
||||||
}
|
|
||||||
|
|
||||||
type Params struct{}
|
type Params struct{}
|
||||||
|
|
||||||
func DefaultParams() Params { return Params{} }
|
func DefaultParams() Params { return Params{} }
|
||||||
|
|
||||||
// GenesisState defines the bearers module genesis state. v0.1 had only
|
|
||||||
// Params; v0.5 P2 (REQ-034) adds Sessions + QRs so the runtime keeper can
|
|
||||||
// load/export its state via AppModule.InitGenesis/ExportGenesis. The
|
|
||||||
// Sessions and QRs slices are validated for ID-uniqueness (A-212 pattern).
|
|
||||||
type GenesisState struct {
|
type GenesisState struct {
|
||||||
Params Params `json:"params" yaml:"params"`
|
Params Params `json:"params" yaml:"params"`
|
||||||
Sessions []Session `json:"sessions" yaml:"sessions"`
|
|
||||||
QRs []OYQRCode `json:"qrs" yaml:"qrs"`
|
|
||||||
}
|
}
|
||||||
|
|
||||||
func DefaultGenesisState() *GenesisState {
|
func DefaultGenesisState() *GenesisState {
|
||||||
return &GenesisState{
|
return &GenesisState{Params: DefaultParams()}
|
||||||
Params: DefaultParams(),
|
|
||||||
Sessions: []Session{},
|
|
||||||
QRs: []OYQRCode{},
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Reset implements proto.Message (codec.JSONCodec.MustMarshalJSON /
|
func ValidateGenesis(bz json.RawMessage) error { return nil }
|
||||||
// MustUnmarshalJSON require proto.Message; the GenesisState is the JSON
|
|
||||||
// genesis payload and gains the gogoproto proto.Message methods here so the
|
|
||||||
// AppModule's InitGenesis/ExportGenesis compile without protobuf codegen).
|
|
||||||
func (m *GenesisState) Reset() { *m = GenesisState{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *GenesisState) String() string {
|
|
||||||
return fmt.Sprintf("GenesisState{Sessions:%d QRs:%d}", len(m.Sessions), len(m.QRs))
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*GenesisState) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
|
||||||
// no-op): rejects duplicate session-ids and duplicate qr-ids. A nil/empty
|
|
||||||
// input is accepted (equivalent to the default empty genesis — preserves
|
|
||||||
// the v0.1 no-op behavior for the TestValidateGenesisUnchanged regression
|
|
||||||
// test).
|
|
||||||
func ValidateGenesis(bz json.RawMessage) error {
|
|
||||||
if len(bz) == 0 {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
var gs GenesisState
|
|
||||||
if err := json.Unmarshal(bz, &gs); err != nil {
|
|
||||||
return fmt.Errorf("bearers: invalid genesis: %w", err)
|
|
||||||
}
|
|
||||||
seenSessions := make(map[string]bool, len(gs.Sessions))
|
|
||||||
for i, s := range gs.Sessions {
|
|
||||||
if s.SessionID == "" {
|
|
||||||
return fmt.Errorf("bearers: session [%d]: empty session-id", i)
|
|
||||||
}
|
|
||||||
if seenSessions[s.SessionID] {
|
|
||||||
return fmt.Errorf("bearers: duplicate session-id %q", s.SessionID)
|
|
||||||
}
|
|
||||||
seenSessions[s.SessionID] = true
|
|
||||||
}
|
|
||||||
seenQRs := make(map[string]bool, len(gs.QRs))
|
|
||||||
for i, q := range gs.QRs {
|
|
||||||
if q.QRID == "" {
|
|
||||||
return fmt.Errorf("bearers: qr [%d]: empty qr-id", i)
|
|
||||||
}
|
|
||||||
if seenQRs[q.QRID] {
|
|
||||||
return fmt.Errorf("bearers: duplicate qr-id %q", q.QRID)
|
|
||||||
}
|
|
||||||
seenQRs[q.QRID] = true
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|||||||
@@ -1,13 +1,8 @@
|
|||||||
package types_test
|
package types_test
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"os"
|
|
||||||
"path/filepath"
|
|
||||||
"runtime"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
"testing"
|
||||||
|
|
||||||
"github.com/oy/openyield/lexicon"
|
|
||||||
btypes "github.com/oy/openyield/x/bearers/types"
|
btypes "github.com/oy/openyield/x/bearers/types"
|
||||||
ptypes "github.com/oy/openyield/x/processing/types"
|
ptypes "github.com/oy/openyield/x/processing/types"
|
||||||
)
|
)
|
||||||
@@ -61,424 +56,3 @@ func TestEmptyProcessorSelection(t *testing.T) {
|
|||||||
t.Error("Empty processor list should return nil")
|
t.Error("Empty processor list should return nil")
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// --- v0.2 Bearers extension (P4-02-02, D-029) -----------------------------------
|
|
||||||
// The following tests extend the existing v0.1 bearers tests with the v0.2
|
|
||||||
// BearerTransport interface, OYLRLink, and BeaconFrame stubs (D-029). The
|
|
||||||
// existing v0.1 tests above (TestBearerCount, TestSurveillanceResistantBearers,
|
|
||||||
// TestProcessingModeFCFS, TestLightClientSize, TestProcessorSelectionByProximity,
|
|
||||||
// TestEmptyProcessorSelection) MUST remain green — no regression.
|
|
||||||
|
|
||||||
// TestOYLRStillInAllBearers is the REGRESSION test (D-029): OY-LR must still
|
|
||||||
// be in AllBearers() (the 6-bearer count is unchanged by the v0.2 extension).
|
|
||||||
func TestOYLRStillInAllBearers(t *testing.T) {
|
|
||||||
bearers := btypes.AllBearers()
|
|
||||||
if len(bearers) != 6 {
|
|
||||||
t.Errorf("AllBearers() len = %d, expected 6 (no regression — D-029)", len(bearers))
|
|
||||||
}
|
|
||||||
found := false
|
|
||||||
for _, b := range bearers {
|
|
||||||
if b.Type == btypes.BearerOYLR {
|
|
||||||
found = true
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if !found {
|
|
||||||
t.Error("OY-LR must still be in AllBearers() (no regression — D-029)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestBearerTransportInterfaceSignature asserts the BearerTransport
|
|
||||||
// interface is satisfiable by a stub implementation (D-029). The interface
|
|
||||||
// has three methods: Send, Receive, Status — no implementation is provided
|
|
||||||
// in v0.2; this test verifies the interface compiles and a stub satisfies it.
|
|
||||||
func TestBearerTransportInterfaceSignature(t *testing.T) {
|
|
||||||
// stubTransport is a minimal stub that satisfies BearerTransport.
|
|
||||||
var _ btypes.BearerTransport = stubTransport{}
|
|
||||||
}
|
|
||||||
|
|
||||||
// stubTransport is a minimal stub implementation of BearerTransport for the
|
|
||||||
// interface-signature test. It does not actually transmit (no hardware/RF
|
|
||||||
// integration per D-029); it exists only to verify the interface compiles.
|
|
||||||
type stubTransport struct{}
|
|
||||||
|
|
||||||
func (stubTransport) Send(payload []byte) error { return nil }
|
|
||||||
func (stubTransport) Receive() ([]byte, error) { return nil, nil }
|
|
||||||
func (stubTransport) Status() bool { return true }
|
|
||||||
|
|
||||||
// TestBearerTransportInterfaceMethods asserts the interface methods have the
|
|
||||||
// expected signatures by invoking them on the stub.
|
|
||||||
func TestBearerTransportInterfaceMethods(t *testing.T) {
|
|
||||||
s := stubTransport{}
|
|
||||||
if err := s.Send([]byte("hi")); err != nil {
|
|
||||||
t.Errorf("Send returned error: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := s.Receive(); err != nil {
|
|
||||||
t.Errorf("Receive returned error: %v", err)
|
|
||||||
}
|
|
||||||
if !s.Status() {
|
|
||||||
t.Error("Status should return true for the stub")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOYLRLinkStructNonEmpty asserts the OYLRLink struct is non-empty when
|
|
||||||
// populated, and that surveillance-resistant is true (OY-LR is designed to
|
|
||||||
// resist surveillance — vision §14).
|
|
||||||
func TestOYLRLinkStructNonEmpty(t *testing.T) {
|
|
||||||
link := btypes.OYLRLink{
|
|
||||||
GatewayID: "gw-1",
|
|
||||||
RangeMeters: 10000,
|
|
||||||
FrequencyMHz: 915,
|
|
||||||
SurveillanceResistant: true,
|
|
||||||
}
|
|
||||||
if link.GatewayID != "gw-1" {
|
|
||||||
t.Errorf("GatewayID = %q", link.GatewayID)
|
|
||||||
}
|
|
||||||
if link.RangeMeters != 10000 {
|
|
||||||
t.Errorf("RangeMeters = %d", link.RangeMeters)
|
|
||||||
}
|
|
||||||
if link.FrequencyMHz != 915 {
|
|
||||||
t.Errorf("FrequencyMHz = %d", link.FrequencyMHz)
|
|
||||||
}
|
|
||||||
if !link.SurveillanceResistant {
|
|
||||||
t.Error("SurveillanceResistant must be true for OY-LR (vision §14)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOYLRLinkSurveillanceResistantTrue asserts the OYLRLink's surveillance-
|
|
||||||
// resistant flag is the locked design property (OY-LR is surveillance-
|
|
||||||
// resistant per vision §14). The zero-value is false; the constructor pattern
|
|
||||||
// must set it true. This test asserts a populated link has it true.
|
|
||||||
func TestOYLRLinkSurveillanceResistantTrue(t *testing.T) {
|
|
||||||
link := btypes.OYLRLink{SurveillanceResistant: true}
|
|
||||||
if !link.SurveillanceResistant {
|
|
||||||
t.Error("OYLRLink.SurveillanceResistant must be true for OY-LR (§14)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestBeaconFrameStructNonEmpty asserts the BeaconFrame struct is non-empty
|
|
||||||
// when populated, and that ttl > 0 for a valid frame.
|
|
||||||
func TestBeaconFrameStructNonEmpty(t *testing.T) {
|
|
||||||
frame := btypes.BeaconFrame{
|
|
||||||
BeaconID: "beacon-1",
|
|
||||||
EphemeralID: "eph-abc",
|
|
||||||
PayloadBytes: []byte{0x01, 0x02},
|
|
||||||
TTL: 300,
|
|
||||||
}
|
|
||||||
if frame.BeaconID != "beacon-1" {
|
|
||||||
t.Errorf("BeaconID = %q", frame.BeaconID)
|
|
||||||
}
|
|
||||||
if frame.EphemeralID != "eph-abc" {
|
|
||||||
t.Errorf("EphemeralID = %q", frame.EphemeralID)
|
|
||||||
}
|
|
||||||
if len(frame.PayloadBytes) != 2 {
|
|
||||||
t.Errorf("PayloadBytes len = %d", len(frame.PayloadBytes))
|
|
||||||
}
|
|
||||||
if frame.TTL <= 0 {
|
|
||||||
t.Errorf("TTL = %d, must be > 0 for a valid frame", frame.TTL)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestBeaconFrameTTLPositive asserts a valid BeaconFrame has TTL > 0.
|
|
||||||
func TestBeaconFrameTTLPositive(t *testing.T) {
|
|
||||||
cases := []int64{1, 60, 300, 3600}
|
|
||||||
for _, ttl := range cases {
|
|
||||||
f := btypes.BeaconFrame{TTL: ttl}
|
|
||||||
if f.TTL <= 0 {
|
|
||||||
t.Errorf("TTL = %d, must be > 0", f.TTL)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestDefaultGenesisStateUnchanged asserts DefaultGenesisState is unchanged
|
|
||||||
// by the v0.2 extension (no regression — the v0.1 GenesisState shape is
|
|
||||||
// preserved).
|
|
||||||
func TestDefaultGenesisStateUnchanged(t *testing.T) {
|
|
||||||
gs := btypes.DefaultGenesisState()
|
|
||||||
if gs == nil {
|
|
||||||
t.Fatal("DefaultGenesisState returned nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisUnchanged asserts ValidateGenesis is unchanged (no
|
|
||||||
// regression — v0.1 returned nil unconditionally; the extension preserves
|
|
||||||
// this).
|
|
||||||
func TestValidateGenesisUnchanged(t *testing.T) {
|
|
||||||
if err := btypes.ValidateGenesis(nil); err != nil {
|
|
||||||
t.Errorf("ValidateGenesis should return nil (no regression); got: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Lexicon assertion (REQ-012) -------------------------------------------------
|
|
||||||
// The bearers extension must not introduce banned terms. The lexicon helpers
|
|
||||||
// are used here — no banned literals are inlined in this test file.
|
|
||||||
|
|
||||||
// TestLexiconNoBannedTermsInBearersPackage scans every non-test .go file in
|
|
||||||
// the bearers/types package directory for the banned terms (case-insensitive).
|
|
||||||
// Production files only — the test file references banned terms via the
|
|
||||||
// lexicon package helpers (standard lexicon-test bootstrapping pattern).
|
|
||||||
func TestLexiconNoBannedTermsInBearersPackage(t *testing.T) {
|
|
||||||
pkgDir := packageDir(t, "github.com/oy/openyield/x/bearers/types")
|
|
||||||
files, err := filepath.Glob(filepath.Join(pkgDir, "*.go"))
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("glob: %v", err)
|
|
||||||
}
|
|
||||||
prodFiles := []string{}
|
|
||||||
for _, f := range files {
|
|
||||||
if strings.HasSuffix(f, "_test.go") {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
prodFiles = append(prodFiles, f)
|
|
||||||
}
|
|
||||||
if len(prodFiles) == 0 {
|
|
||||||
t.Fatal("no production .go files found in bearers/types")
|
|
||||||
}
|
|
||||||
for _, f := range prodFiles {
|
|
||||||
bz, err := os.ReadFile(f)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("read %s: %v", f, err)
|
|
||||||
}
|
|
||||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
|
||||||
t.Errorf("%s: banned term %q (REQ-012 lexicon firewall — D-029 extension)", filepath.Base(f), found)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconNoBannedTermsInBearersTestFile asserts this test file itself does
|
|
||||||
// not contain any banned term as a literal (the firewall scans test files
|
|
||||||
// too; the lexicon helpers must be used rather than inlining banned terms).
|
|
||||||
func TestLexiconNoBannedTermsInBearersTestFile(t *testing.T) {
|
|
||||||
_, thisFile, _, ok := runtime.Caller(0)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("runtime.Caller failed")
|
|
||||||
}
|
|
||||||
bz, err := os.ReadFile(thisFile)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("read self: %v", err)
|
|
||||||
}
|
|
||||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
|
||||||
t.Fatalf("bearers test file contains banned term %q — use lexicon helpers, not literals", found)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- v0.3 Bearers extension (P4-03, D-037, A-311) — OYSATLink + OYQRCode -------
|
|
||||||
//
|
|
||||||
// The following tests extend the v0.2 bearers tests with the v0.3 OY-SAT
|
|
||||||
// and OY-QR transport stubs (D-037). The existing v0.1/v0.2 tests above
|
|
||||||
// MUST remain green — no regression. The BearerType enum (6 bearers,
|
|
||||||
// including BearerOYSAT + BearerOYQR) is locked since v0.1; v0.3 adds the
|
|
||||||
// transport STRUCTS only (no enum change).
|
|
||||||
|
|
||||||
// TestOYSATLinkStructFields asserts the OYSATLink struct carries all
|
|
||||||
// required fields (satellite-id, surveillance-resistant, range-meters).
|
|
||||||
func TestOYSATLinkStructFields(t *testing.T) {
|
|
||||||
link := btypes.OYSATLink{
|
|
||||||
SatelliteID: "sat-1",
|
|
||||||
SurveillanceResistant: true,
|
|
||||||
RangeMeters: 0, // 0 for global satellite coverage
|
|
||||||
}
|
|
||||||
if link.SatelliteID != "sat-1" {
|
|
||||||
t.Errorf("SatelliteID = %q", link.SatelliteID)
|
|
||||||
}
|
|
||||||
if !link.SurveillanceResistant {
|
|
||||||
t.Error("SurveillanceResistant must be true for OY-SAT (vision §14)")
|
|
||||||
}
|
|
||||||
if link.RangeMeters != 0 {
|
|
||||||
t.Errorf("RangeMeters = %d, want 0 (global)", link.RangeMeters)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOYSATLinkSurveillanceResistantLockedTrue asserts the OY-SAT
|
|
||||||
// surveillance-resistant invariant is LOCKED true (A-311: OY-SAT is
|
|
||||||
// surveillance-resistant by design, matching OY-LR). The
|
|
||||||
// NewOYSATLink constructor sets the field from the locked const; this
|
|
||||||
// test asserts the constructor always produces a link with
|
|
||||||
// surveillance-resistant == true regardless of inputs.
|
|
||||||
func TestOYSATLinkSurveillanceResistantLockedTrue(t *testing.T) {
|
|
||||||
// The LOCKED const must be true (A-311).
|
|
||||||
if !btypes.OYSATSurveillanceResistant {
|
|
||||||
t.Fatal("OYSATSurveillanceResistant const must be true (A-311 LOCKED)")
|
|
||||||
}
|
|
||||||
// The constructor must set surveillance-resistant true regardless of
|
|
||||||
// the other inputs.
|
|
||||||
cases := []struct {
|
|
||||||
satID string
|
|
||||||
rng int32
|
|
||||||
}{
|
|
||||||
{"sat-1", 0},
|
|
||||||
{"sat-2", 5000},
|
|
||||||
{"", 0},
|
|
||||||
{"global-constellation", 0},
|
|
||||||
}
|
|
||||||
for _, c := range cases {
|
|
||||||
link := btypes.NewOYSATLink(c.satID, c.rng)
|
|
||||||
if !link.SurveillanceResistant {
|
|
||||||
t.Errorf("NewOYSATLink(%q,%d): SurveillanceResistant = false, want true (A-311 LOCKED)", c.satID, c.rng)
|
|
||||||
}
|
|
||||||
if link.SurveillanceResistant != btypes.OYSATSurveillanceResistant {
|
|
||||||
t.Errorf("NewOYSATLink(%q,%d): field != locked const (A-311)", c.satID, c.rng)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOYSATLinkConstructorSetsFields asserts NewOYSATLink sets the
|
|
||||||
// satellite-id and range-meters fields from the constructor args.
|
|
||||||
func TestOYSATLinkConstructorSetsFields(t *testing.T) {
|
|
||||||
link := btypes.NewOYSATLink("iridium-1", 0)
|
|
||||||
if link.SatelliteID != "iridium-1" {
|
|
||||||
t.Errorf("SatelliteID = %q, want %q", link.SatelliteID, "iridium-1")
|
|
||||||
}
|
|
||||||
if link.RangeMeters != 0 {
|
|
||||||
t.Errorf("RangeMeters = %d, want 0", link.RangeMeters)
|
|
||||||
}
|
|
||||||
link2 := btypes.NewOYSATLink("starlink-2", 5000)
|
|
||||||
if link2.SatelliteID != "starlink-2" {
|
|
||||||
t.Errorf("SatelliteID = %q, want %q", link2.SatelliteID, "starlink-2")
|
|
||||||
}
|
|
||||||
if link2.RangeMeters != 5000 {
|
|
||||||
t.Errorf("RangeMeters = %d, want 5000", link2.RangeMeters)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOYSATStillInAllBearers is the v0.3 REGRESSION test: OY-SAT must
|
|
||||||
// still be in AllBearers() (the 6-bearer count is unchanged by the v0.3
|
|
||||||
// extension — the BearerType enum is locked since v0.1).
|
|
||||||
func TestOYSATStillInAllBearers(t *testing.T) {
|
|
||||||
bearers := btypes.AllBearers()
|
|
||||||
if len(bearers) != 6 {
|
|
||||||
t.Errorf("AllBearers() len = %d, expected 6 (no regression — D-037)", len(bearers))
|
|
||||||
}
|
|
||||||
found := false
|
|
||||||
for _, b := range bearers {
|
|
||||||
if b.Type == btypes.BearerOYSAT {
|
|
||||||
found = true
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if !found {
|
|
||||||
t.Error("OY-SAT must be in AllBearers() (no regression — D-037)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOYQRStillInAllBearers is the v0.3 REGRESSION test: OY-QR must still
|
|
||||||
// be in AllBearers() (the 6-bearer count is unchanged).
|
|
||||||
func TestOYQRStillInAllBearers(t *testing.T) {
|
|
||||||
bearers := btypes.AllBearers()
|
|
||||||
if len(bearers) != 6 {
|
|
||||||
t.Errorf("AllBearers() len = %d, expected 6 (no regression — D-037)", len(bearers))
|
|
||||||
}
|
|
||||||
found := false
|
|
||||||
for _, b := range bearers {
|
|
||||||
if b.Type == btypes.BearerOYQR {
|
|
||||||
found = true
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if !found {
|
|
||||||
t.Error("OY-QR must be in AllBearers() (no regression — D-037)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOYQRCodeStructFields asserts the OYQRCode struct carries all required
|
|
||||||
// fields (qr-id, payload-bytes, consumed).
|
|
||||||
func TestOYQRCodeStructFields(t *testing.T) {
|
|
||||||
q := btypes.OYQRCode{
|
|
||||||
QRID: "qr-1",
|
|
||||||
PayloadBytes: []byte{0x01, 0x02, 0x03},
|
|
||||||
Consumed: false,
|
|
||||||
}
|
|
||||||
if q.QRID != "qr-1" {
|
|
||||||
t.Errorf("QRID = %q", q.QRID)
|
|
||||||
}
|
|
||||||
if len(q.PayloadBytes) != 3 {
|
|
||||||
t.Errorf("PayloadBytes len = %d, want 3", len(q.PayloadBytes))
|
|
||||||
}
|
|
||||||
if q.Consumed {
|
|
||||||
t.Error("Consumed should be false for a fresh QR")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOYQRCodeMarkConsumedFlipsFlag asserts MarkConsumed sets the consumed
|
|
||||||
// flag to true (A-311: OY-QR is one-shot).
|
|
||||||
func TestOYQRCodeMarkConsumedFlipsFlag(t *testing.T) {
|
|
||||||
q := btypes.OYQRCode{QRID: "qr-1", PayloadBytes: []byte{0x01}, Consumed: false}
|
|
||||||
if q.Consumed {
|
|
||||||
t.Fatal("fresh QR should have Consumed == false")
|
|
||||||
}
|
|
||||||
q.MarkConsumed()
|
|
||||||
if !q.Consumed {
|
|
||||||
t.Error("MarkConsumed should set Consumed = true (A-311 one-shot)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOYQRCodeMarkConsumedIdempotent asserts double-consume is idempotent
|
|
||||||
// (A-311: calling MarkConsumed on an already-consumed QR is a no-op, not an
|
|
||||||
// error). This locks the one-shot semantics: a QR cannot be unconsumed, and
|
|
||||||
// double-marking is safe.
|
|
||||||
func TestOYQRCodeMarkConsumedIdempotent(t *testing.T) {
|
|
||||||
q := btypes.OYQRCode{QRID: "qr-1", PayloadBytes: []byte{0x01}, Consumed: false}
|
|
||||||
// First consume: false -> true.
|
|
||||||
q.MarkConsumed()
|
|
||||||
if !q.Consumed {
|
|
||||||
t.Fatal("first MarkConsumed failed: Consumed still false")
|
|
||||||
}
|
|
||||||
// Second consume: idempotent no-op (stays true, no error, no panic).
|
|
||||||
q.MarkConsumed()
|
|
||||||
if !q.Consumed {
|
|
||||||
t.Error("second MarkConsumed should be idempotent; Consumed must stay true (A-311)")
|
|
||||||
}
|
|
||||||
// Third consume: still idempotent.
|
|
||||||
q.MarkConsumed()
|
|
||||||
if !q.Consumed {
|
|
||||||
t.Error("third MarkConsumed should be idempotent; Consumed must stay true (A-311)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOYQRCodeConsumedCannotBeCleared asserts the one-shot semantics: once
|
|
||||||
// consumed is true, there is no method to clear it (the struct field can be
|
|
||||||
// set directly, but the API provides no Unmark/Reset — A-311 locks the
|
|
||||||
// one-shot invariant). This test verifies no Unmark/Reset method exists by
|
|
||||||
// confirming MarkConsumed is the only state-mutating method (the struct is
|
|
||||||
// a plain data type; the invariant is enforced by the API surface, not a
|
|
||||||
// private field — matching the v0.2 OYLRLink/BeaconFrame shape approach).
|
|
||||||
func TestOYQRCodeConsumedCannotBeCleared(t *testing.T) {
|
|
||||||
q := btypes.OYQRCode{QRID: "qr-1", Consumed: false}
|
|
||||||
q.MarkConsumed()
|
|
||||||
if !q.Consumed {
|
|
||||||
t.Fatal("MarkConsumed failed")
|
|
||||||
}
|
|
||||||
// The one-shot invariant: there is no UnmarkConsumed/Reset method on
|
|
||||||
// OYQRCode. The struct is a plain data type; the API surface (only
|
|
||||||
// MarkConsumed) enforces the one-way transition. We assert the method
|
|
||||||
// set by confirming MarkConsumed does not flip back to false.
|
|
||||||
q.MarkConsumed() // idempotent
|
|
||||||
if !q.Consumed {
|
|
||||||
t.Error("Consumed flipped back to false — one-shot invariant broken (A-311)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOYQRCodeZeroValue asserts the zero-value OYQRCode has Consumed ==
|
|
||||||
// false (a fresh QR is unconsumed).
|
|
||||||
func TestOYQRCodeZeroValue(t *testing.T) {
|
|
||||||
var q btypes.OYQRCode
|
|
||||||
if q.Consumed {
|
|
||||||
t.Error("zero-value OYQRCode should have Consumed == false")
|
|
||||||
}
|
|
||||||
if q.QRID != "" {
|
|
||||||
t.Errorf("zero-value QRID = %q, want empty", q.QRID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// packageDir resolves a Go import path to its filesystem directory by
|
|
||||||
// walking up from this test file (v0.2 skeleton has zero external deps).
|
|
||||||
func packageDir(t *testing.T, importPath string) string {
|
|
||||||
t.Helper()
|
|
||||||
_, file, _, ok := runtime.Caller(0)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("runtime.Caller failed")
|
|
||||||
}
|
|
||||||
// file = .../oy/x/bearers/types/types_test.go -> repoRoot = .../oy (4 dirs up)
|
|
||||||
repoRoot := filepath.Dir(filepath.Dir(filepath.Dir(filepath.Dir(file))))
|
|
||||||
rel := strings.TrimPrefix(importPath, "github.com/oy/openyield/")
|
|
||||||
return filepath.Join(repoRoot, rel)
|
|
||||||
}
|
|
||||||
|
|||||||
@@ -1,286 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
// clob.go holds the CLOB (central-limit order book) matching engine for the
|
|
||||||
// bond secondary market (P6-02-01, REQ-038, D-057 — price-time priority FCFS
|
|
||||||
// per REQ-007; NO AMM — D-057/A-564).
|
|
||||||
//
|
|
||||||
// The CLOB engine is PER-TX matching (dYdX-v4-shaped, no batch end-of-block
|
|
||||||
// matching in v0.5 simtest — D-054). The handler loads the resting book for
|
|
||||||
// the bond, sorts by (price, sequence) for price-time priority, and matches
|
|
||||||
// the incoming taker against the best opposing price until filled or the
|
|
||||||
// book is empty.
|
|
||||||
//
|
|
||||||
// G-019 BINDING: this file defines the SINGLE ImpliedCoupon(priceBps,
|
|
||||||
// principal) helper used by BOTH the CLOB match and the per-match clamp
|
|
||||||
// check (D-063). The "implied coupon" derivation from trade price (fraction
|
|
||||||
// of principal in bps) is the unstated precondition of the D-063 REJECT
|
|
||||||
// threshold; a single helper + boundary unit test (800/801/799 bps) closes
|
|
||||||
// the formula ambiguity.
|
|
||||||
//
|
|
||||||
// D-063/A-562: a match whose ImpliedCoupon EXCEEDS 800 bps is REJECTED
|
|
||||||
// (fails closed — the resting order stays, the incoming order rests or is
|
|
||||||
// cancelled; no refund path). The 8% cap is a Mission-Lock invariant (D-028),
|
|
||||||
// not a soft cap. Matches within [0, 800] use Clamp (in-band, no refund
|
|
||||||
// needed).
|
|
||||||
//
|
|
||||||
// The 8%/0% consts (CouponCapBps=800 / CouponFloorBps=0, D-028) are
|
|
||||||
// referenced DIRECTLY from x/bond/types (same package — NOT a local copy;
|
|
||||||
// A-563). The REQ-030 cross-const test stays green.
|
|
||||||
//
|
|
||||||
// Lexicon (REQ-012, A-210): the coupon vocabulary is used EXCLUSIVELY. The
|
|
||||||
// banned coupon-synonyms are NEVER used.
|
|
||||||
//
|
|
||||||
// FEATURE PURITY GATE: the v0.3 types.SecondaryOrder struct is FROZEN (it
|
|
||||||
// has PriceGrain int64, no PriceBps or QuantityGrain). To avoid amending the
|
|
||||||
// v0.3 types/ contract, the CLOB book uses a keeper-internal restingOrder
|
|
||||||
// struct carrying the price-bps + remaining quantity (the runtime book
|
|
||||||
// state). The restingOrder embeds the public SecondaryOrder (the v0.3
|
|
||||||
// contract is preserved) PLUS the keeper-internal book fields. This is the
|
|
||||||
// "runtime adds behavior on top, not changes to the contract" pattern.
|
|
||||||
|
|
||||||
import (
|
|
||||||
"sort"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bond/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// restingOrder is the in-keeper book entry for a resting secondary-market
|
|
||||||
// order. It carries the public SecondaryOrder (the v0.3 type — frozen, not
|
|
||||||
// amended, per the feature purity gate) PLUS the keeper-internal price-bps
|
|
||||||
// and remaining-quantity and sequence for price-time priority FCFS
|
|
||||||
// (REQ-007). The price-bps, remaining-quantity, and sequence are keeper-
|
|
||||||
// internal concerns (NOT types/ contract fields); adding them here keeps
|
|
||||||
// the v0.3 types/ contract unchanged (feature purity gate — no breaking
|
|
||||||
// schema changes).
|
|
||||||
type restingOrder struct {
|
|
||||||
// Order is the public v0.3 SecondaryOrder (frozen contract). Carries
|
|
||||||
// OrderID, BondID, Side, PriceGrain, HolderReachID, Status, CreatedAt.
|
|
||||||
Order types.SecondaryOrder `json:"order" yaml:"order"`
|
|
||||||
// PriceBps is the order price in basis points (the price as a fraction
|
|
||||||
// of principal in bps — this is the implied coupon of a match at this
|
|
||||||
// price; the CLOB matching engine's ImpliedCoupon helper derives the
|
|
||||||
// per-match implied coupon from the resting order's price-bps, G-019).
|
|
||||||
// Keeper-internal (the v0.3 SecondaryOrder has PriceGrain int64, not
|
|
||||||
// PriceBps; the runtime uses PriceBps for the CLOB match).
|
|
||||||
PriceBps uint32 `json:"price_bps" yaml:"price_bps"`
|
|
||||||
// Sequence is the price-time-priority ordering key (monotonic; lower
|
|
||||||
// sequence = earlier resting order = fills first at the same price —
|
|
||||||
// REQ-007 FCFS).
|
|
||||||
Sequence uint64 `json:"sequence" yaml:"sequence"`
|
|
||||||
// RemainingQuantityGrain is the unfilled quantity of the order (a
|
|
||||||
// resting order may be partially filled by an earlier match; the
|
|
||||||
// remaining quantity is what later takers can match against).
|
|
||||||
RemainingQuantityGrain int64 `json:"remaining_quantity_grain" yaml:"remaining_quantity_grain"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// ImpliedCoupon is the G-019 BINDING helper: it derives the implied coupon
|
|
||||||
// (in basis points) of a trade at the given price-bps against the principal.
|
|
||||||
// The implied coupon is the fraction of principal the trade price represents,
|
|
||||||
// expressed in bps: a price of 10000 bps (100% of principal) implies a 0-bps
|
|
||||||
// coupon (par); a price of 9500 bps (95% of principal, a discount) implies a
|
|
||||||
// 500-bps coupon (the buyer pays 95% of principal and receives the full
|
|
||||||
// principal at maturity, earning a 500-bps coupon).
|
|
||||||
//
|
|
||||||
// The formula: impliedCouponBps = max(0, 10000 - priceBps).
|
|
||||||
// - priceBps == 10000 (par) -> impliedCoupon 0 (no discount, no coupon).
|
|
||||||
// - priceBps < 10000 (discount) -> impliedCoupon = 10000 - priceBps (the
|
|
||||||
// discount is the implied coupon).
|
|
||||||
// - priceBps > 10000 (premium) -> the discount is negative; the implied
|
|
||||||
// coupon is floored at 0 (a premium bond has a 0 implied coupon — the
|
|
||||||
// buyer pays MORE than principal, so the implied coupon is 0, not
|
|
||||||
// negative).
|
|
||||||
//
|
|
||||||
// The principal argument is accepted for signature compatibility with the
|
|
||||||
// plan text (G-019: "ImpliedCoupon(priceBps, principal)") but does not
|
|
||||||
// affect the implied-coupon derivation for a fixed-coupon bond (the coupon
|
|
||||||
// is the discount-from-par in bps, independent of the principal amount).
|
|
||||||
// It is retained so a future v0.6+ amortization model can use it.
|
|
||||||
//
|
|
||||||
// G-019 boundary: the D-063 REJECT threshold is 800 bps. A match whose
|
|
||||||
// ImpliedCoupon exceeds 800 (price-bps < 9200 — a discount greater than
|
|
||||||
// 800 bps) is REJECTED (fails closed). The boundary unit test in
|
|
||||||
// msg_server_simtest_test.go covers:
|
|
||||||
// - price-bps 9200 -> ImpliedCoupon 800 (== cap, in-band, clears via Clamp).
|
|
||||||
// - price-bps 9199 -> ImpliedCoupon 801 (> cap, REJECTED — D-063).
|
|
||||||
// - price-bps 9201 -> ImpliedCoupon 799 (< cap, in-band, clears).
|
|
||||||
func ImpliedCoupon(priceBps uint32, principalGrain int64) uint32 {
|
|
||||||
_ = principalGrain // retained for G-019 signature compatibility; unused
|
|
||||||
// at v0.5 (fixed-coupon bond — coupon is discount-from-par in bps).
|
|
||||||
if priceBps >= 10000 {
|
|
||||||
return 0 // par or premium -> 0 implied coupon (floored at 0)
|
|
||||||
}
|
|
||||||
return 10000 - priceBps // discount -> the discount is the implied coupon
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- CLOB matching engine ----------------------------------------------------
|
|
||||||
//
|
|
||||||
// matchTaker attempts to match an incoming taker order against the resting
|
|
||||||
// book for the given bond. Price-time priority FCFS per REQ-007:
|
|
||||||
// - Buy taker matches against Sell resting orders with price-bps <= the
|
|
||||||
// taker's price-bps, best (lowest) price first, then earliest sequence.
|
|
||||||
// - Sell taker matches against Buy resting orders with price-bps >= the
|
|
||||||
// taker's price-bps, best (highest) price first, then earliest sequence.
|
|
||||||
//
|
|
||||||
// Per D-063/A-562: every match's ImpliedCoupon is computed from the resting
|
|
||||||
// order's price-bps; a match whose ImpliedCoupon EXCEEDS 800 bps is REJECTED
|
|
||||||
// (fails closed). The rejection is PER-MATCH (not per-taker): if the best
|
|
||||||
// resting order is above cap, that match is rejected, the resting order
|
|
||||||
// stays on the book, and the taker does NOT advance to the next resting order
|
|
||||||
// (fails closed — the taker is rejected; the resting book above cap is
|
|
||||||
// unreachable). This is the mission-lock-true choice: the 8% cap is a hard
|
|
||||||
// invariant, not a soft cap.
|
|
||||||
//
|
|
||||||
// Returns the total filled quantity, the list of filled order-ids (for
|
|
||||||
// event emission), and a boolean indicating whether a per-match REJECT
|
|
||||||
// occurred (D-063 — when true, no match occurred for the offending resting
|
|
||||||
// order; the resting book is unchanged; the caller reports the reject).
|
|
||||||
func (k Keeper) matchTaker(
|
|
||||||
ctx sdk.Context,
|
|
||||||
bondID string,
|
|
||||||
takerSide types.OrderSide,
|
|
||||||
takerPriceBps uint32,
|
|
||||||
takerQuantityGrain int64,
|
|
||||||
) (filledQuantityGrain int64, filledOrderIDs []string, rejected bool) {
|
|
||||||
// Load the resting book for the bond.
|
|
||||||
resting := k.restingBookForBond(ctx, bondID)
|
|
||||||
// Sort for price-time priority.
|
|
||||||
sortRestingBook(resting, takerSide)
|
|
||||||
|
|
||||||
remaining := takerQuantityGrain
|
|
||||||
filledOrderIDs = []string{}
|
|
||||||
|
|
||||||
for i := range resting {
|
|
||||||
if remaining <= 0 {
|
|
||||||
break
|
|
||||||
}
|
|
||||||
ro := &resting[i]
|
|
||||||
if ro.Order.Status != types.OrderOpen {
|
|
||||||
continue // skip non-resting (defensive — the book holds Open only)
|
|
||||||
}
|
|
||||||
// Price check: does this resting order's price satisfy the taker?
|
|
||||||
if !priceCrosses(takerSide, takerPriceBps, ro.PriceBps) {
|
|
||||||
// The book is sorted best-price-first; once the price does not
|
|
||||||
// cross, no later (worse-price) resting order will cross. Stop.
|
|
||||||
break
|
|
||||||
}
|
|
||||||
// D-063 per-match coupon clamp (G-019 ImpliedCoupon helper). The
|
|
||||||
// implied coupon is derived from the RESTING order's price-bps
|
|
||||||
// (the price at which the match executes). A match above 800 bps
|
|
||||||
// is REJECTED (fails closed — the resting order stays, the taker
|
|
||||||
// does not advance).
|
|
||||||
implied := ImpliedCoupon(ro.PriceBps, 0)
|
|
||||||
if implied > types.CouponCapBps {
|
|
||||||
// D-063 REJECT: the resting order stays on the book; the taker
|
|
||||||
// is rejected (fails closed — no refund path, no advance to
|
|
||||||
// the next resting order).
|
|
||||||
return filledQuantityGrain, filledOrderIDs, true
|
|
||||||
}
|
|
||||||
// In-band match (implied coupon within [0, 800]). Clamp it (the
|
|
||||||
// 8% cap is the firewall; Clamp is the helper — defense in depth,
|
|
||||||
// though ImpliedCoupon <= 800 here so Clamp is a no-op).
|
|
||||||
clampedCoupon := types.Clamp(implied)
|
|
||||||
// Determine the fill quantity (the smaller of the taker's
|
|
||||||
// remaining quantity and the resting order's remaining quantity).
|
|
||||||
fill := remaining
|
|
||||||
if ro.RemainingQuantityGrain < fill {
|
|
||||||
fill = ro.RemainingQuantityGrain
|
|
||||||
}
|
|
||||||
// Update the resting order's remaining quantity.
|
|
||||||
ro.RemainingQuantityGrain -= fill
|
|
||||||
remaining -= fill
|
|
||||||
filledQuantityGrain += fill
|
|
||||||
filledOrderIDs = append(filledOrderIDs, ro.Order.OrderID)
|
|
||||||
// If the resting order is fully filled, mark it Filled and delete
|
|
||||||
// it from the book; otherwise persist the updated remaining.
|
|
||||||
if ro.RemainingQuantityGrain <= 0 {
|
|
||||||
ro.Order.Status = types.OrderFilled
|
|
||||||
k.deleteRestingOrder(ctx, ro.Order.OrderID)
|
|
||||||
} else {
|
|
||||||
k.setRestingOrder(ctx, *ro)
|
|
||||||
}
|
|
||||||
// Emit a match event with the clamped coupon for simtest assertion.
|
|
||||||
emitMatchEvent(ctx, ro.Order.OrderID, bondID, clampedCoupon, fill)
|
|
||||||
}
|
|
||||||
return filledQuantityGrain, filledOrderIDs, false
|
|
||||||
}
|
|
||||||
|
|
||||||
// restingBookForBond loads all resting orders for a given bond-id (the CLOB
|
|
||||||
// book for that bond). The book is unordered here; matchTaker sorts it for
|
|
||||||
// price-time priority.
|
|
||||||
func (k Keeper) restingBookForBond(ctx sdk.Context, bondID string) []restingOrder {
|
|
||||||
all := k.AllRestingOrders(ctx)
|
|
||||||
out := make([]restingOrder, 0, len(all))
|
|
||||||
for _, ro := range all {
|
|
||||||
if ro.Order.BondID == bondID && ro.Order.Status == types.OrderOpen {
|
|
||||||
out = append(out, ro)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// sortRestingBook sorts the resting book for price-time priority FCFS
|
|
||||||
// (REQ-007). For a Buy taker (matching against Sell resting orders), the
|
|
||||||
// best price is the LOWEST Sell price (cheapest to buy); for a Sell taker
|
|
||||||
// (matching against Buy resting orders), the best price is the HIGHEST Buy
|
|
||||||
// price (most expensive to sell to). Ties at the same price are broken by
|
|
||||||
// sequence (earlier sequence fills first — FCFS).
|
|
||||||
func sortRestingBook(book []restingOrder, takerSide types.OrderSide) {
|
|
||||||
if takerSide == types.OrderBuy {
|
|
||||||
// Buy taker: sort Sell resting orders by ascending price, then
|
|
||||||
// ascending sequence (best price = lowest; FCFS at same price).
|
|
||||||
sort.SliceStable(book, func(i, j int) bool {
|
|
||||||
if book[i].PriceBps != book[j].PriceBps {
|
|
||||||
return book[i].PriceBps < book[j].PriceBps
|
|
||||||
}
|
|
||||||
return book[i].Sequence < book[j].Sequence
|
|
||||||
})
|
|
||||||
} else {
|
|
||||||
// Sell taker: sort Buy resting orders by descending price, then
|
|
||||||
// ascending sequence (best price = highest; FCFS at same price).
|
|
||||||
sort.SliceStable(book, func(i, j int) bool {
|
|
||||||
if book[i].PriceBps != book[j].PriceBps {
|
|
||||||
return book[i].PriceBps > book[j].PriceBps
|
|
||||||
}
|
|
||||||
return book[i].Sequence < book[j].Sequence
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// priceCrosses reports whether the taker's price satisfies the resting
|
|
||||||
// order's price (a match can execute). For a Buy taker, the taker's price-
|
|
||||||
// bps must be >= the resting Sell's price-bps (the buyer will pay up to
|
|
||||||
// takerPriceBps; the seller asked for restingPriceBps; if taker >= resting,
|
|
||||||
// the price crosses). For a Sell taker, the taker's price-bps must be <=
|
|
||||||
// the resting Buy's price-bps (the seller will accept as low as
|
|
||||||
// takerPriceBps; the buyer bid restingPriceBps; if taker <= resting, the
|
|
||||||
// price crosses).
|
|
||||||
func priceCrosses(takerSide types.OrderSide, takerPriceBps, restingPriceBps uint32) bool {
|
|
||||||
if takerSide == types.OrderBuy {
|
|
||||||
return takerPriceBps >= restingPriceBps
|
|
||||||
}
|
|
||||||
return takerPriceBps <= restingPriceBps
|
|
||||||
}
|
|
||||||
|
|
||||||
// emitMatchEvent emits a per-match event for simtest assertion. The event
|
|
||||||
// carries the resting order-id, the bond-id, the clamped matched coupon
|
|
||||||
// (within [0, 800] bps — D-063 in-band), and the fill quantity.
|
|
||||||
//
|
|
||||||
// NOTE: emitMatchEvent is called from matchTaker, which is a Keeper method
|
|
||||||
// (not on msgServer). The ctx is the sdk.Context passed to matchTaker. This
|
|
||||||
// helper is defined here (not in msg_server.go) so the CLOB engine is
|
|
||||||
// self-contained.
|
|
||||||
func emitMatchEvent(ctx sdk.Context, restingOrderID, bondID string, matchedCouponBps uint32, fillQuantityGrain int64) {
|
|
||||||
// Avoid importing sdk event helpers in clob.go to keep the import list
|
|
||||||
// lean; delegate to the msg_server.go helper via a function variable.
|
|
||||||
// (The simtest asserts events via ctx.EventManager().Events().)
|
|
||||||
if emitMatchEventHook != nil {
|
|
||||||
emitMatchEventHook(ctx, restingOrderID, bondID, matchedCouponBps, fillQuantityGrain)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// emitMatchEventHook is set by msg_server.go (which imports sdk event
|
|
||||||
// helpers). This indirection keeps clob.go's import list minimal (sort +
|
|
||||||
// types only) and avoids a circular dependency on the sdk event package.
|
|
||||||
var emitMatchEventHook func(ctx sdk.Context, restingOrderID, bondID string, matchedCouponBps uint32, fillQuantityGrain int64)
|
|
||||||
@@ -1,261 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
// keeper.go holds the store-backed Keeper for the bond module's market
|
|
||||||
// runtime (P6-02-01, REQ-038, D-057 — CLOB price-time priority FCFS per
|
|
||||||
// REQ-007; NO AMM — D-057/A-564).
|
|
||||||
//
|
|
||||||
// The Keeper wraps an sdk.KVStore via a storeKey. It holds:
|
|
||||||
// - the issued bonds (bond-id → Bond);
|
|
||||||
// - the issued GrowthBonds (bond-id → GrowthBond);
|
|
||||||
// - the resting secondary-market orders (the CLOB book — order-id →
|
|
||||||
// restingOrder, plus a per-bond price-time-priority sequence index in
|
|
||||||
// clob.go).
|
|
||||||
//
|
|
||||||
// The Keeper also holds the StandKeeper expected-keeper shim (G-003 —
|
|
||||||
// interface, NOT a struct import of x/stand/types; the concrete stand
|
|
||||||
// keeper satisfies it structurally; the P6 simtest wires a stub).
|
|
||||||
//
|
|
||||||
// The 8%/0% consts (CouponCapBps=800 / CouponFloorBps=0, D-028) are
|
|
||||||
// referenced DIRECTLY from x/bond/types (same package — NOT a local copy;
|
|
||||||
// A-563). The REQ-030 cross-const test (x/hub LendingCouponCapBps ==
|
|
||||||
// x/bond CouponCapBps) stays green because the consts are unchanged.
|
|
||||||
//
|
|
||||||
// State-machine ordering (vision §7, enforced in every handler):
|
|
||||||
// ValidateBasic → keeper authz → state mutation → ctx.EventManager().EmitEvent
|
|
||||||
//
|
|
||||||
// D-054: simtest-grade — in-memory sdk.Context + dbm in-memory store, no
|
|
||||||
// real IBC light clients, no real Stand keeper (the StandKeeper shim is a
|
|
||||||
// stub), no real DEX venues. The handler is documented as NOT front-running-
|
|
||||||
// safe for mainnet (a Year-3+ concern; the simtest does NOT assert front-
|
|
||||||
// running safety).
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bond/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Keeper is the store-backed bond market keeper.
|
|
||||||
type Keeper struct {
|
|
||||||
cdc codec.Codec
|
|
||||||
storeKey storetypes.StoreKey
|
|
||||||
standKeeper types.StandKeeper
|
|
||||||
seq uint64 // monotonic sequence for price-time priority (CLOB)
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewKeeper constructs a new store-backed bond Keeper. The StandKeeper
|
|
||||||
// expected-keeper shim is injected (nil-able for partial tests; the
|
|
||||||
// IssueBond / IssueGrowthBond handlers guard a nil shim and skip the
|
|
||||||
// StandExists check, still mutating state — the simtest wiring documents
|
|
||||||
// this).
|
|
||||||
func NewKeeper(cdc codec.Codec, storeKey storetypes.StoreKey, sk types.StandKeeper) Keeper {
|
|
||||||
return Keeper{
|
|
||||||
cdc: cdc,
|
|
||||||
storeKey: storeKey,
|
|
||||||
standKeeper: sk,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetStandKeeper sets the StandKeeper expected-keeper shim (for post-
|
|
||||||
// construction wiring, e.g., app wiring or test setup).
|
|
||||||
func (k *Keeper) SetStandKeeper(sk types.StandKeeper) { k.standKeeper = sk }
|
|
||||||
|
|
||||||
// StoreKey returns the keeper's store key (exported for simtest access to
|
|
||||||
// the raw KVStore for corrupt-byte injection in marshal-error coverage
|
|
||||||
// paths).
|
|
||||||
func (k Keeper) StoreKey() storetypes.StoreKey { return k.storeKey }
|
|
||||||
|
|
||||||
// nextSequence returns the next monotonic sequence number for price-time
|
|
||||||
// priority ordering on the CLOB book (REQ-007 FCFS — earlier resting orders
|
|
||||||
// have lower sequence numbers and fill first at the same price). The
|
|
||||||
// sequence is monotonically increasing across all orders in the keeper's
|
|
||||||
// lifetime (simtest grade — not persisted across restarts; a live chain would
|
|
||||||
// persist the sequence in the store).
|
|
||||||
func (k *Keeper) nextSequence() uint64 {
|
|
||||||
k.seq++
|
|
||||||
return k.seq
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Bond store --------------------------------------------------------------
|
|
||||||
|
|
||||||
var bondKeyPrefix = []byte("bond/")
|
|
||||||
|
|
||||||
func bondKey(bondID string) []byte {
|
|
||||||
return append(bondKeyPrefix, []byte(bondID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetBond loads an issued Bond by bond-id. Returns the Bond and true if
|
|
||||||
// found, or zero value + false if not.
|
|
||||||
func (k Keeper) GetBond(ctx sdk.Context, bondID string) (types.Bond, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(bondKey(bondID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.Bond{}, false
|
|
||||||
}
|
|
||||||
var b types.Bond
|
|
||||||
if err := json.Unmarshal(bz, &b); err != nil {
|
|
||||||
return types.Bond{}, false
|
|
||||||
}
|
|
||||||
return b, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetBond persists an issued Bond by bond-id.
|
|
||||||
func (k Keeper) SetBond(ctx sdk.Context, b types.Bond) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(b)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("bond: marshal bond %q: %v", b.BondID, err))
|
|
||||||
}
|
|
||||||
store.Set(bondKey(b.BondID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllBonds returns all issued Bonds (iteration helper, unordered).
|
|
||||||
func (k Keeper) AllBonds(ctx sdk.Context) []types.Bond {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(bondKeyPrefix, prefixEnd(bondKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.Bond{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var b types.Bond
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &b); err == nil {
|
|
||||||
out = append(out, b)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- GrowthBond store --------------------------------------------------------
|
|
||||||
|
|
||||||
var growthBondKeyPrefix = []byte("growth/")
|
|
||||||
|
|
||||||
func growthBondKey(bondID string) []byte {
|
|
||||||
return append(growthBondKeyPrefix, []byte(bondID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetGrowthBond loads an issued GrowthBond by bond-id. Returns the GrowthBond
|
|
||||||
// and true if found, or zero value + false if not.
|
|
||||||
func (k Keeper) GetGrowthBond(ctx sdk.Context, bondID string) (types.GrowthBond, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(growthBondKey(bondID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.GrowthBond{}, false
|
|
||||||
}
|
|
||||||
var gb types.GrowthBond
|
|
||||||
if err := json.Unmarshal(bz, &gb); err != nil {
|
|
||||||
return types.GrowthBond{}, false
|
|
||||||
}
|
|
||||||
return gb, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetGrowthBond persists an issued GrowthBond by bond-id.
|
|
||||||
func (k Keeper) SetGrowthBond(ctx sdk.Context, gb types.GrowthBond) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(gb)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("bond: marshal growth bond %q: %v", gb.BondID, err))
|
|
||||||
}
|
|
||||||
store.Set(growthBondKey(gb.BondID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllGrowthBonds returns all issued GrowthBonds (iteration helper, unordered).
|
|
||||||
func (k Keeper) AllGrowthBonds(ctx sdk.Context) []types.GrowthBond {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(growthBondKeyPrefix, prefixEnd(growthBondKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.GrowthBond{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var gb types.GrowthBond
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &gb); err == nil {
|
|
||||||
out = append(out, gb)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Order store (CLOB resting book) -----------------------------------------
|
|
||||||
//
|
|
||||||
// The resting book is keyed by order-id → restingOrder (the in-keeper book
|
|
||||||
// entry carrying the order + its price-time-priority sequence). The CLOB
|
|
||||||
// matching engine (clob.go) loads all resting orders for a bond, sorts them
|
|
||||||
// by (price, sequence) for price-time priority FCFS, and matches the
|
|
||||||
// incoming taker against the best opposing price until filled or the book
|
|
||||||
// is empty.
|
|
||||||
|
|
||||||
var orderKeyPrefix = []byte("order/")
|
|
||||||
|
|
||||||
func orderKey(orderID string) []byte {
|
|
||||||
return append(orderKeyPrefix, []byte(orderID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetRestingOrder loads a resting order by order-id. Returns the order and
|
|
||||||
// true if found, or zero value + false if not.
|
|
||||||
func (k Keeper) GetRestingOrder(ctx sdk.Context, orderID string) (restingOrder, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(orderKey(orderID))
|
|
||||||
if bz == nil {
|
|
||||||
return restingOrder{}, false
|
|
||||||
}
|
|
||||||
var o restingOrder
|
|
||||||
if err := json.Unmarshal(bz, &o); err != nil {
|
|
||||||
return restingOrder{}, false
|
|
||||||
}
|
|
||||||
return o, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// setRestingOrder persists a resting order by order-id.
|
|
||||||
func (k Keeper) setRestingOrder(ctx sdk.Context, o restingOrder) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(o)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("bond: marshal order %q: %v", o.Order.OrderID, err))
|
|
||||||
}
|
|
||||||
store.Set(orderKey(o.Order.OrderID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// deleteRestingOrder removes a resting order by order-id.
|
|
||||||
func (k Keeper) deleteRestingOrder(ctx sdk.Context, orderID string) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
store.Delete(orderKey(orderID))
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllRestingOrders returns all resting orders (iteration helper, unordered).
|
|
||||||
// Exported for simtest assertion.
|
|
||||||
func (k Keeper) AllRestingOrders(ctx sdk.Context) []restingOrder {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(orderKeyPrefix, prefixEnd(orderKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []restingOrder{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var o restingOrder
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &o); err == nil {
|
|
||||||
out = append(out, o)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- prefixEnd helper --------------------------------------------------------
|
|
||||||
|
|
||||||
// prefixEnd returns the key that sorts immediately after all keys sharing
|
|
||||||
// the given prefix (the standard prefix-iteration end key: increment the
|
|
||||||
// last byte, drop overflow). Mirrors x/hub/keeper/keeper.go.
|
|
||||||
func prefixEnd(prefix []byte) []byte {
|
|
||||||
if len(prefix) == 0 {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
end := make([]byte, len(prefix))
|
|
||||||
copy(end, prefix)
|
|
||||||
for i := len(end) - 1; i >= 0; i-- {
|
|
||||||
end[i]++
|
|
||||||
if end[i] != 0 {
|
|
||||||
return end
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// All bytes were 0xFF; return nil (iterate to end of store).
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@@ -1,428 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
// msg_server.go implements the bond module's MsgServer (P6-02-01, REQ-038;
|
|
||||||
// G-023 ownership split: cosmos-engineer scaffolds the file structure +
|
|
||||||
// method signatures; backend-engineer implements the handler logic bodies;
|
|
||||||
// security-engineer reviews the CLOB per-match clamp D-063 + the 8%/0%
|
|
||||||
// const firewall A-563). The MsgServer wraps the Keeper + the StandKeeper
|
|
||||||
// expected-keeper shim (already on the Keeper).
|
|
||||||
//
|
|
||||||
// Each method returns a (*Response, error). Handler state-machine ordering
|
|
||||||
// is enforced: ValidateBasic → keeper authz → state mutation →
|
|
||||||
// ctx.EventManager().EmitEvent.
|
|
||||||
//
|
|
||||||
// Handler set (REQ-038):
|
|
||||||
// - IssueBond: invokes v0.3 Clamp on the coupon at issuance (the clamped
|
|
||||||
// value is recorded, NOT the original). StandKeeper shim validates the
|
|
||||||
// issuer-stand-id exists (P1-02-01 stand-id-ref edge).
|
|
||||||
// - IssueGrowthBond: invokes Clamp on the coupon + ClampGrowth on the
|
|
||||||
// growth-rate (post-growth coupon <= cap, G-012).
|
|
||||||
// - TickGrowthBond: applies one growth tick (coupon += growth-rate, then
|
|
||||||
// clamped so post-growth <= cap via ClampGrowth with currentBps = the
|
|
||||||
// current coupon).
|
|
||||||
// - PlaceSecondaryOrder: rests a secondary-market order on the CLOB book
|
|
||||||
// (price-time priority FCFS per REQ-007; NO AMM — D-057).
|
|
||||||
// - CancelSecondaryOrder: removes a resting order (status -> Cancelled).
|
|
||||||
// - MatchSecondaryOrder: CLOB match against the resting book (per-tx
|
|
||||||
// matching, dYdX-v4-shaped); per-match coupon clamp via the G-019
|
|
||||||
// ImpliedCoupon helper; D-063 REJECT above 800 (fails closed).
|
|
||||||
//
|
|
||||||
// Nil-shim behavior (simtest wiring): a nil StandKeeper shim skips the
|
|
||||||
// StandExists check (the handler still mutates state — the simtest documents
|
|
||||||
// the wiring contract). The 8%/0% consts are referenced directly from
|
|
||||||
// x/bond/types (same package — NOT a local copy; A-563); the REQ-030
|
|
||||||
// cross-const test stays green.
|
|
||||||
//
|
|
||||||
// The handler is documented as NOT front-running-safe for mainnet (a
|
|
||||||
// Year-3+ concern; the simtest does NOT assert front-running safety — D-054).
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bond/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// init wires the emitMatchEventHook so the CLOB engine (clob.go) emits
|
|
||||||
// sdk events via the keeper's ctx without importing the sdk event helpers
|
|
||||||
// in clob.go (keeps clob.go's import list minimal).
|
|
||||||
func init() {
|
|
||||||
emitMatchEventHook = func(ctx sdk.Context, restingOrderID, bondID string, matchedCouponBps uint32, fillQuantityGrain int64) {
|
|
||||||
ctx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.match",
|
|
||||||
sdk.NewAttribute("resting_order_id", restingOrderID),
|
|
||||||
sdk.NewAttribute("bond_id", bondID),
|
|
||||||
sdk.NewAttribute("matched_coupon_bps", fmt.Sprintf("%d", matchedCouponBps)),
|
|
||||||
sdk.NewAttribute("fill_quantity_grain", fmt.Sprintf("%d", fillQuantityGrain)),
|
|
||||||
))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// msgServer is the concrete MsgServer implementation wrapping the Keeper.
|
|
||||||
type msgServer struct {
|
|
||||||
Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewMsgServerImpl returns the bond MsgServer for the provided Keeper.
|
|
||||||
func NewMsgServerImpl(k Keeper) types.MsgServer {
|
|
||||||
return &msgServer{Keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
var _ types.MsgServer = msgServer{}
|
|
||||||
|
|
||||||
// unwrapCtx extracts the sdk.Context from the interface-typed ctx.
|
|
||||||
func unwrapCtx(ctx interface{}) sdk.Context {
|
|
||||||
if c, ok := ctx.(sdk.Context); ok {
|
|
||||||
return c
|
|
||||||
}
|
|
||||||
panic(fmt.Sprintf("bond: expected sdk.Context, got %T", ctx))
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- IssueBond ---------------------------------------------------------------
|
|
||||||
|
|
||||||
// IssueBond issues a fixed-coupon Bond (REQ-038). The handler enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. Idempotency: bond-id must not already exist.
|
|
||||||
// 3. StandKeeper shim: the issuer-stand-id must reference an existing
|
|
||||||
// Stand (P1-02-01 stand-id-ref edge). A nil shim skips this check
|
|
||||||
// (simtest wiring); a non-nil shim that returns false REJECTS the
|
|
||||||
// issuance (the bond is not created).
|
|
||||||
// 4. Coupon clamp: the coupon-bps is CLAMPED to [CouponFloorBps=0,
|
|
||||||
// CouponCapBps=800] at runtime via the v0.3 Clamp helper (A-563 —
|
|
||||||
// defense in depth; ValidateBasic already rejected out-of-band, but the
|
|
||||||
// handler re-clamps to defend against any future cap change).
|
|
||||||
//
|
|
||||||
// On success the Bond is persisted with the clamped coupon and an event is
|
|
||||||
// emitted.
|
|
||||||
func (s msgServer) IssueBond(ctx interface{}, msg *types.MsgIssueBond) (*types.MsgIssueBondResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Idempotency: bond-id must not already exist.
|
|
||||||
if _, ok := s.Keeper.GetBond(sdkCtx, msg.BondID); ok {
|
|
||||||
return nil, fmt.Errorf("bond: bond-id %q already exists", msg.BondID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// StandKeeper: issuer-stand-id must reference an existing Stand (P1-02-01
|
|
||||||
// edge). A nil shim skips the check (simtest wiring); a non-nil shim that
|
|
||||||
// returns false REJECTS the issuance.
|
|
||||||
if s.Keeper.standKeeper != nil {
|
|
||||||
if !s.Keeper.standKeeper.StandExists(msg.IssuerStandID) {
|
|
||||||
return nil, fmt.Errorf("bond: issuer-stand-id %q does not exist (IssueBond rejected)", msg.IssuerStandID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// A-563: coupon clamp at runtime. The clamped value (NOT the original)
|
|
||||||
// is recorded. ValidateBasic already rejected out-of-band, so Clamp is
|
|
||||||
// a no-op here; the re-clamp is defense in depth against any future cap
|
|
||||||
// change.
|
|
||||||
clamped := types.Clamp(msg.CouponBps)
|
|
||||||
b := types.Issue(msg.BondID, msg.IssuerStandID, msg.PrincipalGrain, clamped, msg.TermDays, msg.IssuedAt, msg.Maturity)
|
|
||||||
s.Keeper.SetBond(sdkCtx, b)
|
|
||||||
|
|
||||||
if clamped != msg.CouponBps {
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.coupon_clamped",
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("original_coupon_bps", fmt.Sprintf("%d", msg.CouponBps)),
|
|
||||||
sdk.NewAttribute("clamped_coupon_bps", fmt.Sprintf("%d", clamped)),
|
|
||||||
))
|
|
||||||
}
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.issued",
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("issuer_stand_id", msg.IssuerStandID),
|
|
||||||
sdk.NewAttribute("coupon_bps", fmt.Sprintf("%d", clamped)),
|
|
||||||
))
|
|
||||||
return &types.MsgIssueBondResponse{ClampedCouponBps: clamped}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- IssueGrowthBond ---------------------------------------------------------
|
|
||||||
|
|
||||||
// IssueGrowthBond issues a GrowthBond (REQ-038). The handler enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. Idempotency: bond-id must not already exist (as a Bond or GrowthBond).
|
|
||||||
// 3. StandKeeper shim: the issuer-stand-id must reference an existing
|
|
||||||
// Stand (P1-02-01 edge). A nil shim skips (simtest wiring).
|
|
||||||
// 4. Coupon clamp + growth clamp: the coupon is CLAMPED to [0, 800] via
|
|
||||||
// Clamp, and the growth-rate is CLAMPED via ClampGrowth so post-growth
|
|
||||||
// coupon <= cap (G-012).
|
|
||||||
//
|
|
||||||
// On success the GrowthBond is persisted with the clamped coupon + clamped
|
|
||||||
// growth-rate and an event is emitted.
|
|
||||||
func (s msgServer) IssueGrowthBond(ctx interface{}, msg *types.MsgIssueGrowthBond) (*types.MsgIssueGrowthBondResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Idempotency: bond-id must not already exist (as Bond or GrowthBond).
|
|
||||||
if _, ok := s.Keeper.GetBond(sdkCtx, msg.BondID); ok {
|
|
||||||
return nil, fmt.Errorf("bond: bond-id %q already exists (as a Bond)", msg.BondID)
|
|
||||||
}
|
|
||||||
if _, ok := s.Keeper.GetGrowthBond(sdkCtx, msg.BondID); ok {
|
|
||||||
return nil, fmt.Errorf("bond: bond-id %q already exists (as a GrowthBond)", msg.BondID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// StandKeeper: issuer-stand-id must reference an existing Stand.
|
|
||||||
if s.Keeper.standKeeper != nil {
|
|
||||||
if !s.Keeper.standKeeper.StandExists(msg.IssuerStandID) {
|
|
||||||
return nil, fmt.Errorf("bond: issuer-stand-id %q does not exist (IssueGrowthBond rejected)", msg.IssuerStandID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Coupon clamp + growth clamp. The v0.3 IssueGrowth helper clamps the
|
|
||||||
// coupon via Clamp and the growth-rate via ClampGrowth (G-012).
|
|
||||||
clampedCoupon := types.Clamp(msg.CouponBps)
|
|
||||||
clampedGrowth := types.ClampGrowth(clampedCoupon, msg.GrowthRateBps)
|
|
||||||
gb := types.IssueGrowth(msg.BondID, msg.IssuerStandID, msg.PrincipalGrain, clampedCoupon, clampedGrowth, msg.TermDays, msg.IssuedAt, msg.Maturity)
|
|
||||||
s.Keeper.SetGrowthBond(sdkCtx, gb)
|
|
||||||
|
|
||||||
if clampedCoupon != msg.CouponBps || clampedGrowth != msg.GrowthRateBps {
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.growth_coupon_clamped",
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("original_coupon_bps", fmt.Sprintf("%d", msg.CouponBps)),
|
|
||||||
sdk.NewAttribute("clamped_coupon_bps", fmt.Sprintf("%d", clampedCoupon)),
|
|
||||||
sdk.NewAttribute("original_growth_rate_bps", fmt.Sprintf("%d", msg.GrowthRateBps)),
|
|
||||||
sdk.NewAttribute("clamped_growth_rate_bps", fmt.Sprintf("%d", clampedGrowth)),
|
|
||||||
))
|
|
||||||
}
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.growth_issued",
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("issuer_stand_id", msg.IssuerStandID),
|
|
||||||
sdk.NewAttribute("coupon_bps", fmt.Sprintf("%d", clampedCoupon)),
|
|
||||||
sdk.NewAttribute("growth_rate_bps", fmt.Sprintf("%d", clampedGrowth)),
|
|
||||||
))
|
|
||||||
return &types.MsgIssueGrowthBondResponse{
|
|
||||||
ClampedCouponBps: clampedCoupon,
|
|
||||||
ClampedGrowthRateBps: clampedGrowth,
|
|
||||||
}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- TickGrowthBond ----------------------------------------------------------
|
|
||||||
|
|
||||||
// TickGrowthBond applies one growth tick to a GrowthBond (REQ-038). The
|
|
||||||
// handler enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. The GrowthBond must exist.
|
|
||||||
// 3. Growth tick: the coupon grows by the growth-rate, clamped so post-
|
|
||||||
// growth coupon <= CouponCapBps via ClampGrowth (with currentBps = the
|
|
||||||
// current coupon). The growth-rate is NOT changed (it persists across
|
|
||||||
// ticks).
|
|
||||||
//
|
|
||||||
// On success the GrowthBond's coupon is updated to the post-growth (clamped)
|
|
||||||
// value and an event is emitted.
|
|
||||||
func (s msgServer) TickGrowthBond(ctx interface{}, msg *types.MsgTickGrowthBond) (*types.MsgTickGrowthBondResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
gb, ok := s.Keeper.GetGrowthBond(sdkCtx, msg.BondID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bond: growth-bond %q not found (TickGrowthBond rejected)", msg.BondID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Growth tick: coupon += growth-rate, clamped so post-growth <= cap.
|
|
||||||
// ClampGrowth(currentBps=current coupon, growthBps=growth-rate) returns
|
|
||||||
// the additional bps the coupon can grow; post-growth coupon = current +
|
|
||||||
// additional, which is <= cap by ClampGrowth's G-012 guard.
|
|
||||||
additional := types.ClampGrowth(gb.CouponBps, gb.GrowthRateBps)
|
|
||||||
postGrowth := gb.CouponBps + additional
|
|
||||||
gb.CouponBps = postGrowth
|
|
||||||
s.Keeper.SetGrowthBond(sdkCtx, gb)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.growth_ticked",
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("post_growth_coupon_bps", fmt.Sprintf("%d", postGrowth)),
|
|
||||||
sdk.NewAttribute("growth_rate_bps", fmt.Sprintf("%d", gb.GrowthRateBps)),
|
|
||||||
))
|
|
||||||
return &types.MsgTickGrowthBondResponse{PostGrowthCouponBps: postGrowth}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- PlaceSecondaryOrder -----------------------------------------------------
|
|
||||||
|
|
||||||
// PlaceSecondaryOrder rests a secondary-market order on the CLOB book
|
|
||||||
// (REQ-038, D-057 — price-time priority FCFS per REQ-007; NO AMM). The
|
|
||||||
// handler enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. Idempotency: order-id must not already exist.
|
|
||||||
// 3. The referenced bond must exist (the order rests on an issued bond).
|
|
||||||
// 4. The order is rested on the book with a monotonic sequence for price-
|
|
||||||
// time priority (REQ-007 FCFS — earlier resting orders fill first at
|
|
||||||
// the same price).
|
|
||||||
//
|
|
||||||
// On success the order is persisted as Open (resting) and an event is
|
|
||||||
// emitted.
|
|
||||||
func (s msgServer) PlaceSecondaryOrder(ctx interface{}, msg *types.MsgPlaceSecondaryOrder) (*types.MsgPlaceSecondaryOrderResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Idempotency: order-id must not already exist.
|
|
||||||
if _, ok := s.Keeper.GetRestingOrder(sdkCtx, msg.OrderID); ok {
|
|
||||||
return nil, fmt.Errorf("bond: order-id %q already exists (PlaceSecondaryOrder rejected)", msg.OrderID)
|
|
||||||
}
|
|
||||||
// The referenced bond must exist (the order rests on an issued bond).
|
|
||||||
if _, ok := s.Keeper.GetBond(sdkCtx, msg.BondID); !ok {
|
|
||||||
if _, ok := s.Keeper.GetGrowthBond(sdkCtx, msg.BondID); !ok {
|
|
||||||
return nil, fmt.Errorf("bond: bond-id %q does not exist (PlaceSecondaryOrder rejected)", msg.BondID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Construct the public v0.3 SecondaryOrder (the frozen contract). The
|
|
||||||
// price-bps is stored on the keeper-internal restingOrder (NOT on the
|
|
||||||
// public SecondaryOrder, which has PriceGrain int64 — feature purity
|
|
||||||
// gate: the v0.3 contract is not amended). PriceGrain is seeded from
|
|
||||||
// PriceBps for cross-reference (the v0.3 field retains a value for
|
|
||||||
// genesis round-trip; the CLOB match uses PriceBps).
|
|
||||||
so := types.SecondaryOrder{
|
|
||||||
OrderID: msg.OrderID,
|
|
||||||
BondID: msg.BondID,
|
|
||||||
Side: msg.Side,
|
|
||||||
PriceGrain: int64(msg.PriceBps),
|
|
||||||
HolderReachID: msg.HolderReachID,
|
|
||||||
Status: types.OrderOpen,
|
|
||||||
CreatedAt: sdkCtx.BlockTime().Unix(),
|
|
||||||
}
|
|
||||||
ro := restingOrder{
|
|
||||||
Order: so,
|
|
||||||
PriceBps: msg.PriceBps,
|
|
||||||
Sequence: s.Keeper.nextSequence(),
|
|
||||||
RemainingQuantityGrain: msg.QuantityGrain,
|
|
||||||
}
|
|
||||||
s.Keeper.setRestingOrder(sdkCtx, ro)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.order_placed",
|
|
||||||
sdk.NewAttribute("order_id", msg.OrderID),
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("side", string(msg.Side)),
|
|
||||||
sdk.NewAttribute("price_bps", fmt.Sprintf("%d", msg.PriceBps)),
|
|
||||||
sdk.NewAttribute("quantity_grain", fmt.Sprintf("%d", msg.QuantityGrain)),
|
|
||||||
))
|
|
||||||
return &types.MsgPlaceSecondaryOrderResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- CancelSecondaryOrder ----------------------------------------------------
|
|
||||||
|
|
||||||
// CancelSecondaryOrder cancels a resting order (REQ-038). The handler
|
|
||||||
// enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. The order must exist and be Open (resting).
|
|
||||||
// 3. The order is removed from the book (status -> Cancelled; the resting
|
|
||||||
// entry is deleted).
|
|
||||||
//
|
|
||||||
// On success the order is cancelled and an event is emitted.
|
|
||||||
func (s msgServer) CancelSecondaryOrder(ctx interface{}, msg *types.MsgCancelSecondaryOrder) (*types.MsgCancelSecondaryOrderResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
ro, ok := s.Keeper.GetRestingOrder(sdkCtx, msg.OrderID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bond: order %q not found (CancelSecondaryOrder rejected)", msg.OrderID)
|
|
||||||
}
|
|
||||||
if ro.Order.Status != types.OrderOpen {
|
|
||||||
return nil, fmt.Errorf("bond: order %q is not Open (status %q — CancelSecondaryOrder rejected)", msg.OrderID, ro.Order.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
ro.Order.Status = types.OrderCancelled
|
|
||||||
// Persist the cancelled status (retain for audit) then delete the
|
|
||||||
// resting entry so it leaves the CLOB book. The Cancelled status is
|
|
||||||
// observable via the v0.3 SecondaryOrder.Status field on the persisted
|
|
||||||
// entry (the restingOrder embeds it). We delete the resting book entry
|
|
||||||
// (the CLOB book holds Open orders only); the cancel event carries the
|
|
||||||
// status for audit.
|
|
||||||
s.Keeper.deleteRestingOrder(sdkCtx, msg.OrderID)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.order_cancelled",
|
|
||||||
sdk.NewAttribute("order_id", msg.OrderID),
|
|
||||||
sdk.NewAttribute("status", string(types.OrderCancelled)),
|
|
||||||
))
|
|
||||||
return &types.MsgCancelSecondaryOrderResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MatchSecondaryOrder (D-057 CLOB, D-063 per-match REJECT) ---------------
|
|
||||||
|
|
||||||
// MatchSecondaryOrder matches an incoming taker order against the resting
|
|
||||||
// book (REQ-038, D-057 — CLOB price-time priority FCFS per REQ-007; per-tx
|
|
||||||
// matching, dYdX-v4-shaped). The handler enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. The referenced bond must exist.
|
|
||||||
// 3. The CLOB match (clob.go matchTaker): the incoming taker matches
|
|
||||||
// against the best opposing resting price until filled or the book is
|
|
||||||
// empty. Per D-063/A-562: a match whose ImpliedCoupon EXCEEDS 800 bps
|
|
||||||
// is REJECTED (fails closed — the resting order stays, the incoming
|
|
||||||
// order rests or is cancelled; no refund path).
|
|
||||||
//
|
|
||||||
// On success the matched resting orders are Filled (fully) or partially
|
|
||||||
// filled (remaining quantity updated), a match event is emitted per match
|
|
||||||
// (with the clamped matched coupon in [0, 800] bps), and the response reports
|
|
||||||
// the total filled quantity + whether a per-match REJECT occurred.
|
|
||||||
//
|
|
||||||
// The handler is documented as NOT front-running-safe for mainnet (a
|
|
||||||
// Year-3+ concern; the simtest does NOT assert front-running safety — D-054).
|
|
||||||
func (s msgServer) MatchSecondaryOrder(ctx interface{}, msg *types.MsgMatchSecondaryOrder) (*types.MsgMatchSecondaryOrderResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// The referenced bond must exist.
|
|
||||||
if _, ok := s.Keeper.GetBond(sdkCtx, msg.BondID); !ok {
|
|
||||||
if _, ok := s.Keeper.GetGrowthBond(sdkCtx, msg.BondID); !ok {
|
|
||||||
return nil, fmt.Errorf("bond: bond-id %q does not exist (MatchSecondaryOrder rejected)", msg.BondID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// CLOB match (clob.go). The taker's side is the OPPOSITE of the resting
|
|
||||||
// orders it matches against: a Buy taker matches against Sell resting
|
|
||||||
// orders; a Sell taker matches against Buy resting orders.
|
|
||||||
filled, _, rejected := s.Keeper.matchTaker(
|
|
||||||
sdkCtx,
|
|
||||||
msg.BondID,
|
|
||||||
msg.Side,
|
|
||||||
msg.PriceBps,
|
|
||||||
msg.QuantityGrain,
|
|
||||||
)
|
|
||||||
|
|
||||||
if rejected {
|
|
||||||
// D-063 REJECT: a match above 800 bps was attempted. The resting
|
|
||||||
// order stays on the book; the incoming taker is rejected (fails
|
|
||||||
// closed — no refund path, no advance to the next resting order).
|
|
||||||
// Emit a reject event for simtest assertion.
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.match_rejected_above_cap",
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("incoming_order_id", msg.IncomingOrderID),
|
|
||||||
sdk.NewAttribute("cap_bps", fmt.Sprintf("%d", types.CouponCapBps)),
|
|
||||||
))
|
|
||||||
return &types.MsgMatchSecondaryOrderResponse{
|
|
||||||
FilledQuantityGrain: filled,
|
|
||||||
Rejected: true,
|
|
||||||
}, fmt.Errorf("bond: match rejected (implied coupon above %d bps — D-063 fails closed; resting order stays)", types.CouponCapBps)
|
|
||||||
}
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.match_completed",
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("incoming_order_id", msg.IncomingOrderID),
|
|
||||||
sdk.NewAttribute("filled_quantity_grain", fmt.Sprintf("%d", filled)),
|
|
||||||
))
|
|
||||||
return &types.MsgMatchSecondaryOrderResponse{
|
|
||||||
FilledQuantityGrain: filled,
|
|
||||||
Rejected: false,
|
|
||||||
}, nil
|
|
||||||
}
|
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -1,89 +0,0 @@
|
|||||||
package bond
|
|
||||||
|
|
||||||
// module.go holds the bond module's AppModule + RegisterServices
|
|
||||||
// (P6-02-01, REQ-038).
|
|
||||||
//
|
|
||||||
// The AppModule wraps the bond Keeper and registers the MsgServer via
|
|
||||||
// RegisterServices. This is the simtest-grade AppModule (D-054): the
|
|
||||||
// RegisterServices wires the hand-rolled MsgServer (no protobuf codegen
|
|
||||||
// per the skeleton's zero-codegen style). The MsgServer is constructed
|
|
||||||
// directly and exposed via the module for test wiring.
|
|
||||||
//
|
|
||||||
// The StandKeeper expected-keeper shim is injected at construction
|
|
||||||
// (nil-able for partial tests — a nil StandKeeper skips the StandExists
|
|
||||||
// check on issuance).
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/types/module"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bond/keeper"
|
|
||||||
"github.com/oy/openyield/x/bond/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// ConsensusVersion is the bond module's consensus version (AppModule).
|
|
||||||
const ConsensusVersion = 1
|
|
||||||
|
|
||||||
// AppModule is the bond application module (simtest-grade — D-054).
|
|
||||||
type AppModule struct {
|
|
||||||
keeper keeper.Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewAppModule constructs a new bond AppModule. The StandKeeper expected-
|
|
||||||
// keeper shim is injected (nil-able for partial tests — a nil shim skips
|
|
||||||
// the StandExists check on issuance).
|
|
||||||
func NewAppModule(cdc codec.Codec, storeKey storetypes.StoreKey, sk types.StandKeeper) AppModule {
|
|
||||||
k := keeper.NewKeeper(cdc, storeKey, sk)
|
|
||||||
return AppModule{keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
// RegisterServices registers the bond MsgServer. Simtest-grade wiring: the
|
|
||||||
// MsgServer is constructed from the keeper and exposed via the module's
|
|
||||||
// MsgServer method (tests use NewMsgServerImpl directly).
|
|
||||||
func (am AppModule) RegisterServices(cfg module.Configurator) {
|
|
||||||
_ = cfg
|
|
||||||
}
|
|
||||||
|
|
||||||
// MsgServer returns the bond MsgServer for this module's keeper.
|
|
||||||
func (am AppModule) MsgServer() types.MsgServer {
|
|
||||||
return keeper.NewMsgServerImpl(am.keeper)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Keeper returns the underlying keeper (for test wiring of the
|
|
||||||
// StandKeeper shim post-construction).
|
|
||||||
func (am AppModule) Keeper() keeper.Keeper { return am.keeper }
|
|
||||||
|
|
||||||
// Name returns the module name.
|
|
||||||
func (AppModule) Name() string { return types.ModuleName }
|
|
||||||
|
|
||||||
// ConsensusVersion implements AppModule.ConsensusVersion.
|
|
||||||
func (AppModule) ConsensusVersion() uint64 { return ConsensusVersion }
|
|
||||||
|
|
||||||
// InitGenesis performs genesis initialization for the bond module (simtest-
|
|
||||||
// grade no-op — the runtime stores are created at handler time; genesis
|
|
||||||
// init of runtime-promoted stores is deferred to the live chain v0.6+).
|
|
||||||
// Uses encoding/json directly (the bond GenesisState is the v0.2/v0.3
|
|
||||||
// JSON-shaped struct; it does not implement proto.Message, so the codec
|
|
||||||
// JSONCodec is not used — matching types.ValidateGenesis which uses
|
|
||||||
// encoding/json).
|
|
||||||
func (am AppModule) InitGenesis(ctx sdk.Context, cdc codec.JSONCodec, data json.RawMessage) {
|
|
||||||
var gs types.GenesisState
|
|
||||||
_ = json.Unmarshal(data, &gs)
|
|
||||||
_ = gs
|
|
||||||
}
|
|
||||||
|
|
||||||
// ExportGenesis returns the exported genesis state as raw bytes (simtest-
|
|
||||||
// grade: returns an empty genesis; live chain export deferred to v0.6+).
|
|
||||||
func (am AppModule) ExportGenesis(ctx sdk.Context, cdc codec.JSONCodec) json.RawMessage {
|
|
||||||
gs := types.DefaultGenesisState()
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
return bz
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions: AppModule implements the module interface stubs.
|
|
||||||
var _ module.HasName = AppModule{}
|
|
||||||
var _ module.HasConsensusVersion = AppModule{}
|
|
||||||
@@ -1,50 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
// expected_keepers.go holds the Go INTERFACES for the cross-module keepers
|
|
||||||
// x/bond depends on (G-003 firewall — ibc-go expected-keepers convention).
|
|
||||||
//
|
|
||||||
// The bond runtime (REQ-038) depends on ONE cross-module keeper:
|
|
||||||
//
|
|
||||||
// 1. x/stand (StandKeeper) — the MsgIssueBond and MsgIssueGrowthBond
|
|
||||||
// handlers assert the issuer-stand-id references an existing Stand
|
|
||||||
// BEFORE issuing the bond. This is the v0.2 P1-02-01 stand-id-ref edge:
|
|
||||||
// the bond module references a Stand by ID-string (G-003 — no struct
|
|
||||||
// import of x/stand/types). The handler consults StandExists(standID)
|
|
||||||
// via the shim; a non-existent Stand REJECTS the issuance.
|
|
||||||
//
|
|
||||||
// The dependency is expressed as an INTERFACE defined HERE (in
|
|
||||||
// x/bond/types), NOT as a struct import of x/stand/types. The concrete
|
|
||||||
// stand keeper satisfies this interface structurally (the P6 simtest wires
|
|
||||||
// a stub — G-003 test exemption); the handler depends on the interface,
|
|
||||||
// preserving G-003's intent (no cross-module struct coupling, no import
|
|
||||||
// cycles).
|
|
||||||
//
|
|
||||||
// Test-only cross-package imports (the G-003 test exemption) remain exempt:
|
|
||||||
// the simtest may import both x/bond/keeper and x/stand/keeper to wire the
|
|
||||||
// shim in test setup (the real x/stand keeper satisfies StandKeeper
|
|
||||||
// structurally — NOT a production struct import).
|
|
||||||
//
|
|
||||||
// Lexicon note (REQ-012): "Stand", "issuer", "bond", "coupon", "growth",
|
|
||||||
// "order", "match" are all lexicon-clean. The coupon vocabulary is used
|
|
||||||
// EXCLUSIVELY (A-210 — the banned coupon-synonyms are NEVER used).
|
|
||||||
|
|
||||||
// StandKeeper is the expected-keeper interface for x/stand (G-003). The
|
|
||||||
// bond handler calls it for:
|
|
||||||
// - MsgIssueBond: the handler asserts the issuer-stand-id references an
|
|
||||||
// existing Stand BEFORE issuing the bond. This is the v0.2 P1-02-01
|
|
||||||
// stand-id-ref edge: the bond module references a Stand by ID-string.
|
|
||||||
// A non-existent Stand REJECTS the issuance (the bond is not created).
|
|
||||||
// - MsgIssueGrowthBond: same — the GrowthBond issuer-stand-id must
|
|
||||||
// reference an existing Stand.
|
|
||||||
//
|
|
||||||
// No struct import of x/stand/types — the interface is the by-ID-string
|
|
||||||
// boundary (G-003). The standID is an opaque string (the Stand's ID, by-
|
|
||||||
// ID-string ref to x/stand).
|
|
||||||
type StandKeeper interface {
|
|
||||||
// StandExists reports whether the named Stand (by-ID-string) exists.
|
|
||||||
// The IssueBond / IssueGrowthBond handlers consult this BEFORE issuing
|
|
||||||
// the bond; a non-existent Stand REJECTS the issuance (the bond is not
|
|
||||||
// created). A nil shim skips this check (simtest wiring — documented in
|
|
||||||
// the handler).
|
|
||||||
StandExists(standID string) bool
|
|
||||||
}
|
|
||||||
@@ -1,144 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
import "fmt"
|
|
||||||
|
|
||||||
// genesis.go holds the data-engineer's genesis schema helpers for the bond
|
|
||||||
// module (G-008 split). ValidateGenesis in types.go composes these helpers;
|
|
||||||
// the security-engineer's test assertions live in types_test.go.
|
|
||||||
//
|
|
||||||
// The Bond genesis schema has one top-level set: Bonds (the issued bonds).
|
|
||||||
// The invariants enforced at genesis load are (1) bond-id uniqueness, and
|
|
||||||
// (2) the coupon clamp — each genesis bond's coupon-bps must be within
|
|
||||||
// [CouponFloorBps, CouponCapBps]. The clamp invariant is the highest-severity
|
|
||||||
// bond firewall (D-028): a genesis bond with a coupon above the cap or below
|
|
||||||
// the floor is rejected at genesis load.
|
|
||||||
|
|
||||||
// ValidateBonds asserts bond-ids are present and unique, that each bond's
|
|
||||||
// status is a known BondStatus, and that each bond's coupon-bps is within
|
|
||||||
// the LOCKED bounds [CouponFloorBps, CouponCapBps] (the genesis-side clamp
|
|
||||||
// enforcement — D-028). ValidateBonds is the data-engineer's schema
|
|
||||||
// validator, composed by ValidateGenesis in types.go.
|
|
||||||
func ValidateBonds(bonds []Bond) error {
|
|
||||||
seen := make(map[string]bool, len(bonds))
|
|
||||||
for i, b := range bonds {
|
|
||||||
if b.BondID == "" {
|
|
||||||
return fmt.Errorf("bond [%d]: empty bond-id", i)
|
|
||||||
}
|
|
||||||
if seen[b.BondID] {
|
|
||||||
return fmt.Errorf("bond: duplicate bond-id %q", b.BondID)
|
|
||||||
}
|
|
||||||
seen[b.BondID] = true
|
|
||||||
if !knownBondStatus(b.Status) {
|
|
||||||
return fmt.Errorf("bond %q: unknown bond status %q", b.BondID, b.Status)
|
|
||||||
}
|
|
||||||
// Genesis-side clamp enforcement (D-028): a genesis bond's coupon
|
|
||||||
// must be within the LOCKED [floor, cap] bounds. A bond with an
|
|
||||||
// out-of-bounds coupon is rejected at genesis load rather than
|
|
||||||
// silently clamped — the genesis schema is authoritative.
|
|
||||||
if b.CouponBps < CouponFloorBps || b.CouponBps > CouponCapBps {
|
|
||||||
return fmt.Errorf("bond %q: coupon-bps %d outside [%d, %d] (D-028 clamp at genesis load)",
|
|
||||||
b.BondID, b.CouponBps, CouponFloorBps, CouponCapBps)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// knownBondStatus reports whether s is one of the five BondStatus values.
|
|
||||||
func knownBondStatus(s BondStatus) bool {
|
|
||||||
for _, ss := range AllBondStatuses() {
|
|
||||||
if s == ss {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- v0.3 extension: GrowthBond + Order genesis helpers (REQ-026, G-008) --------
|
|
||||||
//
|
|
||||||
// genesis.go also holds the data-engineer's genesis schema helpers for the
|
|
||||||
// v0.3 GrowthBond + SecondaryOrder sets (G-008). ValidateGenesis in types.go
|
|
||||||
// composes ValidateGrowthBonds + ValidateOrders; the security-engineer's test
|
|
||||||
// assertions live in types_test.go / genesis_test.go.
|
|
||||||
|
|
||||||
// ValidateGrowthBonds asserts growth-bond-ids are present and unique, that
|
|
||||||
// each embedded Bond's coupon-bps is within the LOCKED [floor, cap] bounds
|
|
||||||
// (D-028), and that each growth-bond's growth-rate-bps would not push the
|
|
||||||
// coupon above the cap (ClampGrowth(currentBps=coupon, growth) == growth —
|
|
||||||
// i.e. the post-growth coupon stays <= cap). The genesis-side clamp is the
|
|
||||||
// authoritative check (a genesis growth-bond with an out-of-bounds coupon or
|
|
||||||
// growth rate is rejected rather than silently clamped).
|
|
||||||
func ValidateGrowthBonds(gbs []GrowthBond) error {
|
|
||||||
seen := make(map[string]bool, len(gbs))
|
|
||||||
for i, gb := range gbs {
|
|
||||||
if gb.BondID == "" {
|
|
||||||
return fmt.Errorf("growth bond [%d]: empty bond-id", i)
|
|
||||||
}
|
|
||||||
if seen[gb.BondID] {
|
|
||||||
return fmt.Errorf("growth bond: duplicate bond-id %q", gb.BondID)
|
|
||||||
}
|
|
||||||
seen[gb.BondID] = true
|
|
||||||
if !knownBondStatus(gb.Status) {
|
|
||||||
return fmt.Errorf("growth bond %q: unknown bond status %q", gb.BondID, gb.Status)
|
|
||||||
}
|
|
||||||
// D-028 clamp on the embedded Bond's coupon.
|
|
||||||
if gb.CouponBps < CouponFloorBps || gb.CouponBps > CouponCapBps {
|
|
||||||
return fmt.Errorf("growth bond %q: coupon-bps %d outside [%d, %d] (D-028 clamp at genesis load)",
|
|
||||||
gb.BondID, gb.CouponBps, CouponFloorBps, CouponCapBps)
|
|
||||||
}
|
|
||||||
// G-012 / A-306: the growth-rate must not push the coupon above the
|
|
||||||
// cap. ClampGrowth(coupon, growth) must equal growth (i.e. the
|
|
||||||
// requested growth fits within the room-to-cap); otherwise the
|
|
||||||
// genesis growth-bond is rejected as out-of-bounds.
|
|
||||||
if ClampGrowth(gb.CouponBps, gb.GrowthRateBps) != gb.GrowthRateBps {
|
|
||||||
return fmt.Errorf("growth bond %q: growth-rate-bps %d would push coupon-bps %d above cap %d (G-012/A-306 clamp at genesis load)",
|
|
||||||
gb.BondID, gb.GrowthRateBps, gb.CouponBps, CouponCapBps)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ValidateOrders asserts order-ids are present and unique, that each order's
|
|
||||||
// bond-id is present, that the side is a known OrderSide, and that the status
|
|
||||||
// is a known OrderStatus (A-212, A-313).
|
|
||||||
func ValidateOrders(orders []SecondaryOrder) error {
|
|
||||||
seen := make(map[string]bool, len(orders))
|
|
||||||
for i, o := range orders {
|
|
||||||
if o.OrderID == "" {
|
|
||||||
return fmt.Errorf("order [%d]: empty order-id", i)
|
|
||||||
}
|
|
||||||
if seen[o.OrderID] {
|
|
||||||
return fmt.Errorf("order: duplicate order-id %q", o.OrderID)
|
|
||||||
}
|
|
||||||
seen[o.OrderID] = true
|
|
||||||
if o.BondID == "" {
|
|
||||||
return fmt.Errorf("order %q: empty bond-id", o.OrderID)
|
|
||||||
}
|
|
||||||
if !knownOrderSide(o.Side) {
|
|
||||||
return fmt.Errorf("order %q: unknown order side %q", o.OrderID, o.Side)
|
|
||||||
}
|
|
||||||
if !knownOrderStatus(o.Status) {
|
|
||||||
return fmt.Errorf("order %q: unknown order status %q", o.OrderID, o.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// knownOrderSide reports whether s is one of the two OrderSide values.
|
|
||||||
func knownOrderSide(s OrderSide) bool {
|
|
||||||
for _, ss := range AllOrderSides() {
|
|
||||||
if s == ss {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
|
|
||||||
// knownOrderStatus reports whether s is one of the three OrderStatus values.
|
|
||||||
func knownOrderStatus(s OrderStatus) bool {
|
|
||||||
for _, ss := range AllOrderStatuses() {
|
|
||||||
if s == ss {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
@@ -1,97 +0,0 @@
|
|||||||
package types_test
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
btypes "github.com/oy/openyield/x/bond/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// genesis_test.go holds the security-engineer's genesis-clamp test assertions
|
|
||||||
// for the bond module (G-008 — security-engineer owns ALL *_test.go files,
|
|
||||||
// including genesis_test.go). These tests focus on the data-engineer's
|
|
||||||
// genesis schema clamp enforcement (P4-01-03): ValidateGenesis rejects any
|
|
||||||
// genesis bond whose coupon-bps is outside the LOCKED [floor, cap] bounds.
|
|
||||||
// The clamp invariant (D-028) is the highest-severity bond firewall; the
|
|
||||||
// genesis load is the first enforcement point.
|
|
||||||
|
|
||||||
// TestGenesisClampRejectsAboveCapForManyBonds asserts that multiple bonds,
|
|
||||||
// each with a coupon above the cap, are all rejected. The genesis clamp
|
|
||||||
// applies per-bond (not just the first).
|
|
||||||
func TestGenesisClampRejectsAboveCapForManyBonds(t *testing.T) {
|
|
||||||
gs := btypes.GenesisState{
|
|
||||||
Bonds: []btypes.Bond{
|
|
||||||
{BondID: "b1", IssuerStandID: "s1", CouponBps: 801, Status: btypes.BondIssued},
|
|
||||||
{BondID: "b2", IssuerStandID: "s1", CouponBps: 900, Status: btypes.BondActive},
|
|
||||||
{BondID: "b3", IssuerStandID: "s1", CouponBps: 5000, Status: btypes.BondMatured},
|
|
||||||
},
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := btypes.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject bonds with coupon-bps above cap")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestGenesisClampAcceptsAtBounds asserts bonds at the floor (0) and cap (800)
|
|
||||||
// are accepted at genesis load (boundary inclusive).
|
|
||||||
func TestGenesisClampAcceptsAtBounds(t *testing.T) {
|
|
||||||
gs := btypes.GenesisState{
|
|
||||||
Bonds: []btypes.Bond{
|
|
||||||
{BondID: "b-floor", IssuerStandID: "s1", CouponBps: 0, Status: btypes.BondIssued},
|
|
||||||
{BondID: "b-cap", IssuerStandID: "s1", CouponBps: 800, Status: btypes.BondIssued},
|
|
||||||
},
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := btypes.ValidateGenesis(bz); err != nil {
|
|
||||||
t.Errorf("ValidateGenesis should accept bonds at floor (0) and cap (800); got: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestGenesisClampRejectsJustAboveCap asserts a coupon 1 bps above the cap is
|
|
||||||
// rejected (off-by-one regression firewall).
|
|
||||||
func TestGenesisClampRejectsJustAboveCap(t *testing.T) {
|
|
||||||
gs := btypes.GenesisState{
|
|
||||||
Bonds: []btypes.Bond{{BondID: "b1", IssuerStandID: "s1", CouponBps: 801, Status: btypes.BondIssued}},
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := btypes.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject coupon-bps == 801 (just above cap 800)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestGenesisClampAcceptsJustBelowCap asserts a coupon 1 bps below the cap is
|
|
||||||
// accepted.
|
|
||||||
func TestGenesisClampAcceptsJustBelowCap(t *testing.T) {
|
|
||||||
gs := btypes.GenesisState{
|
|
||||||
Bonds: []btypes.Bond{{BondID: "b1", IssuerStandID: "s1", CouponBps: 799, Status: btypes.BondIssued}},
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := btypes.ValidateGenesis(bz); err != nil {
|
|
||||||
t.Errorf("ValidateGenesis should accept coupon-bps == 799 (just below cap); got: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestGenesisValidateBondsRejectsDup asserts the data-engineer's ValidateBonds
|
|
||||||
// helper rejects duplicate bond-ids.
|
|
||||||
func TestGenesisValidateBondsRejectsDup(t *testing.T) {
|
|
||||||
bonds := []btypes.Bond{
|
|
||||||
{BondID: "b1", IssuerStandID: "s1", CouponBps: 100, Status: btypes.BondIssued},
|
|
||||||
{BondID: "b1", IssuerStandID: "s2", CouponBps: 200, Status: btypes.BondActive},
|
|
||||||
}
|
|
||||||
if err := btypes.ValidateBonds(bonds); err == nil {
|
|
||||||
t.Error("ValidateBonds should reject duplicate bond-ids")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestGenesisValidateBondsAcceptsClean asserts ValidateBonds accepts a clean
|
|
||||||
// set of bonds.
|
|
||||||
func TestGenesisValidateBondsAcceptsClean(t *testing.T) {
|
|
||||||
bonds := []btypes.Bond{
|
|
||||||
{BondID: "b1", IssuerStandID: "s1", CouponBps: 0, Status: btypes.BondIssued},
|
|
||||||
{BondID: "b2", IssuerStandID: "s1", CouponBps: 500, Status: btypes.BondActive},
|
|
||||||
{BondID: "b3", IssuerStandID: "s2", CouponBps: 800, Status: btypes.BondMatured},
|
|
||||||
}
|
|
||||||
if err := btypes.ValidateBonds(bonds); err != nil {
|
|
||||||
t.Errorf("ValidateBonds should accept clean bonds; got: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user