Compare commits
9 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 cloudinit-bot
|
fdf5bd71ff | ||
|
cloudinit-bot
|
a70d6faa59 | ||
|
cloudinit-bot
|
3c52aa1bb2 | ||
|
cloudinit-bot
|
be4c023340 | ||
|
cloudinit-bot
|
29c5947fa5 | ||
|
cloudinit-bot
|
68053238bd | ||
|
cloudinit-bot
|
c97e18fc1f | ||
|
cloudinit-bot
|
d42c624245 | ||
|
cloudinit-bot
|
155a618d91 |
@@ -1,14 +1,14 @@
|
|||||||
{
|
{
|
||||||
"phase": 6,
|
"phase": 1,
|
||||||
"stage": "complete",
|
"stage": "complete",
|
||||||
"milestone": "v0.6",
|
"milestone": "v0.5",
|
||||||
"milestone_type": "feature",
|
"milestone_type": "feature",
|
||||||
"tag_base": "v0.5.x",
|
"tag_base": "v0.4.x",
|
||||||
"phase_role": "final",
|
"phase_role": "execution",
|
||||||
"project": "oy",
|
"project": "oy",
|
||||||
"attempts": 0,
|
"attempts": 0,
|
||||||
"updated_at": "2026-08-18T15:00:00Z",
|
"updated_at": "2026-08-18T01:00:00Z",
|
||||||
"milestone_complete": true,
|
"phase_release_tag": "v0.4.1",
|
||||||
"milestone_release_tag": "v0.5.6",
|
"release_id": 754,
|
||||||
"requirements_covered": ["REQ-040", "REQ-041", "REQ-042", "REQ-043", "REQ-044", "REQ-045"]
|
"requirements_covered": ["REQ-033"]
|
||||||
}
|
}
|
||||||
@@ -6,9 +6,9 @@
|
|||||||
}
|
}
|
||||||
],
|
],
|
||||||
"active_project": "oy",
|
"active_project": "oy",
|
||||||
"milestone": "v0.6",
|
"milestone": "v0.5",
|
||||||
"milestone_type": "feature",
|
"milestone_type": "feature",
|
||||||
"tag_base": "v0.5.x",
|
"tag_base": "v0.4.x",
|
||||||
"autonomy": {
|
"autonomy": {
|
||||||
"level": "full",
|
"level": "full",
|
||||||
"escalation_hooks": ["deploy", "delete_data", "merge_to_main"],
|
"escalation_hooks": ["deploy", "delete_data", "merge_to_main"],
|
||||||
|
|||||||
+509
-28
@@ -1,34 +1,515 @@
|
|||||||
# v0.6 Audit (Nomad Web UI)
|
# Audit: OpenYield (oy) — v0.2 (The Mesh) Final Phase
|
||||||
|
|
||||||
## Reconstruction test
|
> **Auditor**: CIAgent security auditor (ci-auditor, read-only; critical-fix mode per run.md FINAL PHASE step 3)
|
||||||
- git log ↔ .ciagent/ files: each REQ-040..REQ-045 maps to a shipped UI screen / firewall.
|
> **Date**: 2026-08-17
|
||||||
- REQ-040 → P1 (web/handlers/reach.go + 3 Reach templates + POST /reach atomic create)
|
> **Scope**: v0.2 milestone state on `oy/milestone/v0.2-mesh` (HEAD = `oy/phase/05-final-review-ship`)
|
||||||
- REQ-041 → P2 (web/handlers/stash.go + stash.html + Bread-scale conversion)
|
> **Milestone**: v0.2 — The Mesh (feature; tag_base `v0.1.x`)
|
||||||
- REQ-042 → P3 (web/handlers/window.go + 3 Window templates + lifecycle)
|
> **Mode**: multi-project (slug `oy`)
|
||||||
- REQ-043 → P4 (web/handlers/standing.go + standing.html + Freeholder signals)
|
> **Autonomy**: full
|
||||||
- REQ-044 → P5 (web/handlers/bloom.go + bloom.html + BloomRecord)
|
|
||||||
- REQ-045 → P1 (lexicon_meta_web/ firewall extension)
|
|
||||||
- 6 phase branches phase/01-*..phase/06-* created, merged, 5 deleted (06 pending).
|
|
||||||
- 6 patch tags v0.5.0..v0.5.5 created (v0.5.6 pending = milestone release).
|
|
||||||
- D-072 ordering respected: firewall-first P1 (REQ-045) before content P2..P5.
|
|
||||||
|
|
||||||
## Feature purity gate — GREEN
|
---
|
||||||
- **No breaking schema changes**: no x/ module modified (web/ is new app-layer, not an x/ amendment).
|
|
||||||
- **Locked-const firewall intact**: all v0.1..v0.5 consts unchanged (web/ does not touch x/ consts; it reads them via x/*/types imports — D-070 app-layer consumption).
|
|
||||||
- **G-003 production firewall intact**: web/ imports only x/*/types (verified by web/store/import_test.go / G-025; no x/*/keeper, no x/*/module imports).
|
|
||||||
- **G-006 go.mod unchanged**: git diff v0.5.0..HEAD -- go.mod go.sum is EMPTY (G-028 baseline diff). HTMX is a vendored static asset, NOT a Go dep.
|
|
||||||
|
|
||||||
## Coverage
|
## 1. Per-Check Verdicts
|
||||||
- web/store: 98.1% (≥80% target met).
|
|
||||||
- web/handlers: 89.2% (≥80% target met).
|
|
||||||
- lexicon_meta_web: 100% (test-only firewall).
|
|
||||||
|
|
||||||
## Lexicon firewalls — all 3 GREEN
|
### 1.1 Reconstruction Test — **PASS** (fixed)
|
||||||
- lexicon_meta_test.go (v0.2, x/*.go) — green (no regression).
|
|
||||||
- lexicon_meta_docs_test.go (v0.3, README + docs/**) — green.
|
|
||||||
- lexicon_meta_web/ (v0.6, web/**/*.{html,js,go}) — green.
|
|
||||||
|
|
||||||
## Manual browser check (dynamic port)
|
**Git log matches `.ciagent/` files:**
|
||||||
- go run ./web on a dynamically-allocated port; all 5 screens reachable; happy path works end-to-end (Create a Reach → Stash dashboard → Open a Window → Standing progress → Bloom accrual). Smoke-tested on ports 47077 (P1) and 53907 (P5).
|
|
||||||
|
|
||||||
## Verdict: AUDIT PASS. Feature purity gate GREEN. Milestone ready to ship.
|
`git log main..oy/milestone/v0.2-mesh --oneline` returns 5 commits, one per phase, in order:
|
||||||
|
|
||||||
|
```
|
||||||
|
6304228 docs(P04): complete Bonds+Bearers+L2 phase → v0.1.4
|
||||||
|
c7f7391 docs(P03): complete Councils+Forex phase → v0.1.3
|
||||||
|
0fefd88 docs(P02): complete Pacts+Partners phase → v0.1.2
|
||||||
|
93a8a3b docs(P01): complete Orgs+Window foundation phase → v0.1.1
|
||||||
|
3e762f6 docs(P00): complete pre-execution phase → v0.1.0
|
||||||
|
```
|
||||||
|
|
||||||
|
Each commit is a phase-ship commit (one commit per phase, squash-style) carrying a `---ci---` block.
|
||||||
|
|
||||||
|
**Per-phase `---ci---` block verification:**
|
||||||
|
|
||||||
|
| Phase | `project` | `milestone` | `status` | `phase` | `requirements.covered` | Verdict |
|
||||||
|
|---|---|---|---|---|---|---|
|
||||||
|
| P0 (3e762f6) | `oy` ✓ | `v0.2` ✓ | `complete` ✓ | `0` ✓ | REQ-009,011,015,016,017,018,020,021 ✓ | PASS |
|
||||||
|
| P1 (93a8a3b) | `oy` ✓ | `v0.2` ✓ | `complete` ✓ | `1` ✓ | REQ-015,016,017,012 ✓ | PASS |
|
||||||
|
| P2 (0fefd88) | `oy` ✓ | `v0.2` ✓ | `complete` ✓ | `2` ✓ | REQ-020,018 ✓ | PASS |
|
||||||
|
| P3 (c7f7391) | `oy` ✓ | `v0.2` ✓ | `complete` ✓ | `3` ✓ | REQ-011 (partial REQ-009) ✓ | PASS |
|
||||||
|
| P4 (6304228) | `oy` ✓ | `v0.2` ✓ | `complete` ✓ | `4` ✓ | REQ-021,009 ✓ | PASS |
|
||||||
|
|
||||||
|
All 5 ship commits carry a `---ci---` block with `project: oy`, `milestone: v0.2`, `status: complete`, and the correct `phase` integer + `requirements.covered` list. Multi-project mode discipline observed.
|
||||||
|
|
||||||
|
**Tags exist and map to the correct phase-ship commits:**
|
||||||
|
|
||||||
|
```
|
||||||
|
v0.1.0 -> 3e762f6 (P00 ship) ✓
|
||||||
|
v0.1.1 -> 93a8a3b (P01 ship) ✓
|
||||||
|
v0.1.2 -> 0fefd88 (P02 ship) ✓
|
||||||
|
v0.1.3 -> c7f7391 (P03 ship) ✓
|
||||||
|
v0.1.4 -> 6304228 (P04 ship) ✓
|
||||||
|
v0.1.5 -> ABSENT (correct — final phase's job to create)
|
||||||
|
```
|
||||||
|
|
||||||
|
`git tag -l | grep v0.1` returns exactly `v0.1.0..v0.1.4`. The milestone release tag `v0.1.5` (= v0.2 milestone per D-008/D-020) is NOT yet present — correctly deferred to the final phase ship step.
|
||||||
|
|
||||||
|
**Milestone NOT yet released:** confirmed — no `v0.1.5` tag exists. The final phase (P5) is in progress (this audit is part of P5).
|
||||||
|
|
||||||
|
**Branch HEAD alignment:** `oy/milestone/v0.2-mesh` and `oy/phase/05-final-review-ship` both point at `63042285e8f27c0eb0dc5661d4d674b8244540fa` (the P04 ship commit) — the final-phase branch is correctly at the same HEAD as the milestone branch, ready for the P5 ship commit.
|
||||||
|
|
||||||
|
### 1.2 `.ciagent` File Discipline — **PASS**
|
||||||
|
|
||||||
|
**All 9 expected files present in `.ciagent/oy/`:**
|
||||||
|
|
||||||
|
```
|
||||||
|
ARCHITECTURE.md ✓
|
||||||
|
GRILL.md ✓
|
||||||
|
PERSONAS.md ✓
|
||||||
|
PROJECT.md ✓
|
||||||
|
REQUIREMENTS.md ✓
|
||||||
|
RESEARCH.md ✓
|
||||||
|
REVIEW.md ✓
|
||||||
|
ROADMAP.md ✓
|
||||||
|
PLANS.md ✓
|
||||||
|
```
|
||||||
|
|
||||||
|
(Also present: `P1_SHIP_VERIFICATION.md`..`P4_SHIP_VERIFICATION.md` — phase ship records, not part of the canonical 9 but consistent with the per-phase ship discipline.)
|
||||||
|
|
||||||
|
**CHECKPOINT.json — valid JSON, all required fields present:**
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"phase": 4,
|
||||||
|
"stage": "execute",
|
||||||
|
"milestone": "v0.2",
|
||||||
|
"milestone_type": "feature",
|
||||||
|
"tag_base": "v0.1.x",
|
||||||
|
"phase_role": "execution",
|
||||||
|
"project": "oy",
|
||||||
|
"attempts": 0,
|
||||||
|
"updated_at": "2026-08-17T21:50:00Z"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
All 8 required fields present: `phase`, `stage`, `milestone`, `milestone_type`, `tag_base`, `phase_role`, `project`, `updated_at` ✓. Valid JSON (`python3 -m json.tool` clean). Note: `phase: 4` reflects the last-completed execution phase; the active P5 phase will bump this on ship.
|
||||||
|
|
||||||
|
**config.json — valid JSON, all required settings correct:**
|
||||||
|
|
||||||
|
| Setting | Required | Actual | Verdict |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `milestone_type` | `feature` | `feature` ✓ | PASS |
|
||||||
|
| `tag_base` | `v0.1.x` | `v0.1.x` ✓ | PASS |
|
||||||
|
| `ship.per_phase` | `true` | `true` ✓ | PASS |
|
||||||
|
| `ship.allow_skip` | `false` | `false` ✓ | PASS |
|
||||||
|
| `active_project` | `oy` | `oy` ✓ | PASS |
|
||||||
|
| `projects[]` length | >0 (multi-project) | 1 (`oy`) ✓ | PASS |
|
||||||
|
|
||||||
|
Valid JSON. Multi-project mode active (projects[].length=1).
|
||||||
|
|
||||||
|
### 1.3 Branch Hygiene — **PASS**
|
||||||
|
|
||||||
|
| Check | Result | Verdict |
|
||||||
|
|---|---|---|
|
||||||
|
| `main` exists | `289c499a6d82e41498d335f6c732d0d133c85a4b` (pre-v0.2) ✓ | PASS |
|
||||||
|
| `main` is at v0.1 (pre-v0.2) | merge-base(main, milestone) == main ✓ | PASS |
|
||||||
|
| `oy/milestone/v0.2-mesh` exists | local + remote `origin/oy/milestone/v0.2-mesh` ✓ | PASS |
|
||||||
|
| `oy/milestone/v0.2-mesh` contains all P0-P4 work | 5 commits P0-P4 ✓ | PASS |
|
||||||
|
| `oy/phase/05-final-review-ship` exists (current) | checked out, HEAD == milestone HEAD ✓ | PASS |
|
||||||
|
| NO leftover execution phase branches | `git branch \| grep "oy/phase"` → only `oy/phase/05-final-review-ship` ✓ | PASS |
|
||||||
|
|
||||||
|
`git branch | grep "oy/phase"` returns exactly one line: `* oy/phase/05-final-review-ship`. The execution phase branches `oy/phase/01-orgs-window-foundation`, `oy/phase/02-pacts-partners`, `oy/phase/03-councils-forex`, `oy/phase/04-bonds-bearers-l2` are all correctly deleted after their respective phase ships. Only the final-phase branch remains (as expected — it is the active phase).
|
||||||
|
|
||||||
|
### 1.4 Commit Discipline — **PASS**
|
||||||
|
|
||||||
|
**Every commit on the milestone branch has a `---ci---` block with `project: oy`:**
|
||||||
|
|
||||||
|
All 5 commits (P0-P4) carry `---ci---` blocks. Verified `project: oy` present in each (see §1.1 table). Multi-project mode discipline observed.
|
||||||
|
|
||||||
|
**Phase ship commits have `status: complete` + `requirements: covered`:**
|
||||||
|
|
||||||
|
All 5 commits have `status: complete` ✓. All 5 have a `requirements:` block with a `covered:` list (see §1.1 table) ✓. P3 also honestly declares `partial: [REQ-009]` (Forex oracle is consumed by Piers — soft ordering note; REQ-009 is fully covered by P4's `x/satellite`). No phase falsely claims full coverage.
|
||||||
|
|
||||||
|
**Task commits have `plan:`/`task:`/`status: execute`:**
|
||||||
|
|
||||||
|
The milestone branch uses a **one-commit-per-phase** squash model (each `docs(PNN): complete ...` commit is the phase ship commit). There are no intermediate per-task commits on the milestone branch — per-task commits were made on the per-phase execution branches (`oy/phase/01-*`..`04-*`), then squashed into the single phase-ship commit on the milestone branch. This is a valid CIAgent ship pattern (vertical-slice integrity preserved at the phase granularity). The `---ci---` blocks correctly carry `phase: N`, `status: complete`, `phase_role: execution` (on P1-P4), and the covered REQ list. The final-phase branch (`oy/phase/05-final-review-ship`) is the active phase; its commit will carry `phase: 5`.
|
||||||
|
|
||||||
|
### 1.5 Build / Test / Cover Sanity — **PASS**
|
||||||
|
|
||||||
|
| Check | Command | Result | Verdict |
|
||||||
|
|---|---|---|---|
|
||||||
|
| Build | `go build ./...` | exit 0, GREEN | PASS |
|
||||||
|
| Tests | `go test ./...` | exit 0, all 25 packages GREEN (15 v0.1 + 10 v0.2) | PASS |
|
||||||
|
| v0.1 baseline regression | v0.1 packages in `go test ./...` | all (cached) GREEN — no regression | PASS |
|
||||||
|
| Lexicon meta-test | `go test -run TestLexiconMeta -v .` | 4 meta-tests PASS (NoBannedTermsInX, SelfTestTable, BannedTermsCount, NoFalsePositive) | PASS |
|
||||||
|
| G-003 import invariant | `go test -run TestG003... ./x/window/types/` | PASS (zero cross-module struct imports in production) | PASS |
|
||||||
|
| Locked-const invariants | `go test -run TestMissionLockAmendable\|TestClamp\|TestHandPassFeeBps\|TestStandTypeCount\|TestPactTypeCount\|TestPartnerTierCount\|TestCouncilKindCount\|TestL2ChainCount\|TestCouponCap -v ./x/...` | ALL PASS | PASS |
|
||||||
|
| Independent lexicon scan | `grep -rniE '\b(bank\|deposit\|interest\|yield\|currency\|dollar\|euro\|account\|savings\|depositor)\b' x/ --include='*.go'` | exit 1 (zero hits) | PASS |
|
||||||
|
| `go.mod` unchanged | `git diff main..oy/milestone/v0.2-mesh -- go.mod` | EMPTY (G-006 verified) | PASS |
|
||||||
|
|
||||||
|
**Coverage on all 10 new/extended packages (≥80% required, D-033):**
|
||||||
|
|
||||||
|
| Package | Phase | Coverage | Verdict |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `x/window/types` | P1 | 100.0% | PASS |
|
||||||
|
| `x/stand/types` | P1 | 100.0% | PASS |
|
||||||
|
| `x/guild/types` | P1 | 100.0% | PASS |
|
||||||
|
| `x/pact/types` | P2 | 95.9% | PASS |
|
||||||
|
| `x/partner/types` | P2 | 100.0% | PASS |
|
||||||
|
| `x/council/types` | P3 | 96.4% | PASS |
|
||||||
|
| `x/forex/types` | P3 | 100.0% | PASS |
|
||||||
|
| `x/bond/types` | P4 | 96.8% | PASS |
|
||||||
|
| `x/bearers/types` | P4 (ext) | 100.0% | PASS |
|
||||||
|
| `x/satellite/types` | P4 | 100.0% | PASS |
|
||||||
|
|
||||||
|
Floor = 95.9% (`x/pact/types`); 8 of 10 at 100%. All exceed the 80% target. D-033 satisfied with margin.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 2. Critical Issues Found (MUST fix before milestone ship)
|
||||||
|
|
||||||
|
**Initial critical issue count: 2** — both from the P5-01-03 deliverable (REQ-coverage audit + ROADMAP tag-line reconciliation), which is part of the P5 must-haves but had NOT been executed at audit time (HEAD was still the P04 ship commit; P5 doc work was pending).
|
||||||
|
|
||||||
|
### Critical-1: REQUIREMENTS.md status column NOT updated (P5-01-03 obligation)
|
||||||
|
|
||||||
|
- **Spec**: PLANS.md P5-01-03 — "update REQUIREMENTS.md status column (Pending → Skeleton)" for all v0.2 REQs.
|
||||||
|
- **Pre-fix state**: all 8 v0.2-scope REQs (REQ-009, REQ-011, REQ-015, REQ-016, REQ-017, REQ-018, REQ-020, REQ-021) still showed `Pending | Future`. Two v0.2 components beyond the REQ list (Bearers OY-LR/Beacon per D-029, Forex v1 per D-030) were not represented at all.
|
||||||
|
- **Impact**: the milestone's own requirement-coverage audit deliverable was unmet. A reader of REQUIREMENTS.md would conclude v0.2 shipped nothing, contradicting the 5 phase-ship commits and the 10 new/extended packages in the codebase.
|
||||||
|
- **Disposition**: FIXED in this final phase. Status column updated: all 8 v0.2 REQs → `Skeleton` with `v0.2/PN` phase tags; Bearers OY-LR/Beacon and Forex v1 added as explicit rows; v0.1 summary test count corrected to 53 (G-001); a v0.2 Milestone Summary block added documenting the 10 packages, locked-const invariants, coverage, tag chain, and the G-010 tag-line note.
|
||||||
|
|
||||||
|
### Critical-2: ROADMAP.md tag-line reconciliation (G-010) NOT done; Phase 2 not marked complete
|
||||||
|
|
||||||
|
- **Spec**: PLANS.md P5-01-03 + GRILL.md G-010 — "reconcile ROADMAP.md's v0.0.x → v0.1.x tag-line note so the milestone release (`v0.1.5`) is not confused with the v0.0.x pre-MVP line"; PLANS.md P5-02-01 — "update ROADMAP.md Phase 2 checkbox".
|
||||||
|
- **Pre-fix state**: ROADMAP.md Phase 2 section had no skeleton-status note, no module mapping, no tag-line reconciliation note, and no completion marker. The v0.0.x (pre-MVP) vs v0.1.x (Mesh) patch-line distinction existed only implicitly (line 15 mentions a deferred "v0.1.0 MVP" tag, which collides with v0.2's P0 tag `v0.1.0` — exactly the confusion G-010 was raised to prevent).
|
||||||
|
- **Impact**: a reader could confuse the v0.2 P0 tag `v0.1.0` with the ROADMAP's deferred "v0.1.0 MVP" tag (line 15), and could not see from ROADMAP.md that v0.2 had shipped any skeleton work.
|
||||||
|
- **Disposition**: FIXED in this final phase. Phase 2 header marked `— v0.2 SKELETON COMPLETE`; the deliverable table extended with `v0.2 Skeleton Module` and `Phase` columns mapping each Year-2 deliverable to its shipped `x/<module>`; a G-010 tag-line reconciliation note added explicitly distinguishing the `v0.0.x` pre-MVP line (lines 4-13) from the `v0.1.x` Mesh line, listing the full tag chain `v0.1.0..v0.1.5`, and stating that `v0.1.5` is the milestone release (not the deferred MVP tag).
|
||||||
|
|
||||||
|
**Post-fix verification**: `go test ./...` re-run after the doc edits — still GREEN (exit 0). The fixes are documentation-only in `.ciagent/oy/`; no source code under `x/` was touched (auditor is read-only w.r.t. source; the critical fixes are `.ciagent` doc updates, which is the P5-01-03 deliverable surface).
|
||||||
|
|
||||||
|
**Remaining critical issue count after fixes: 0.**
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 3. Non-Critical Observations (P1+ flags, not blocking)
|
||||||
|
|
||||||
|
These are design-shape divergences in a single module's non-must-have lifecycle types, carried over from REVIEW.md §3. They do NOT block the milestone ship. They are flagged for post-hoc review by the orchestrator / a future v0.3 PLAN phase.
|
||||||
|
|
||||||
|
### P1-1: Council module — Proposal/VoteOption lifecycle enums absent
|
||||||
|
- **File**: `x/council/types/types.go` (entire file)
|
||||||
|
- **Spec drift**: P3-01-01 deliverable recommended `Proposal`, `ProposalStatus` (5 states), `VoteOption` (3 options) enums mirroring OZ Governor / `x/gov`. Implemented: `Council`, `CouncilMember`, `Voice`, `SignalKind`, `TallyResult` — no Proposal/VoteOption lifecycle.
|
||||||
|
- **Must-have impact**: NONE. P3 must-haves (3 councils, Mission Lock, TallyResult x/gov shape, no veto) all met.
|
||||||
|
- **Recommendation**: add `Proposal`/`ProposalStatus`/`VoteOption` in v0.3 when wiring the council keeper to a live governance runtime.
|
||||||
|
- **Severity**: P1 (spec drift from deliverable text, not a must-have, not blocking).
|
||||||
|
|
||||||
|
### P1-2: Council VoiceSource → SignalKind (4 sources, not 5)
|
||||||
|
- **File**: `x/council/types/types.go` (`SignalKind` enum)
|
||||||
|
- **Spec drift**: P3-01-01 deliverable specified `VoiceSource` (Stash/Standing/Vouch/Freeholder/Guild — 5 sources). Implemented: `SignalKind` (Stash/Standing/Vouch/Capital — 4 sources; Freeholder + Guild dropped, Capital added).
|
||||||
|
- **Code rationale**: Freeholder is an eligibility property (upstream in `x/standing`), Guild is a council tier — neither is a voice signal. Capital is committed-capital (vision §9.1). Defensible design refinement, but diverges from deliverable text.
|
||||||
|
- **Must-have impact**: NONE. P3 must-haves did not enumerate VoiceSource coverage.
|
||||||
|
- **Recommendation**: confirm intended v0.2 shape, or restore 5-source `VoiceSource` for v0.3 wiring. The `SignalKindCount=4` locked-const test currently locks the 4-source shape; changing it is a deliberate locked-const update.
|
||||||
|
- **Severity**: P1 (design-choice divergence, tested and self-consistent, not blocking).
|
||||||
|
|
||||||
|
### P2 (nit): Bearers ValidateGenesis remains a no-op
|
||||||
|
- **File**: `x/bearers/types/types.go:108`
|
||||||
|
- **Note**: CORRECT per spec — P4-02-01 said "DefaultParams/GenesisState unchanged" (bearers is an EXTENSION, not a new module; the A-212 ValidateGenesis upgrade was scoped to NEW modules only). Recording for completeness, not a defect. No action.
|
||||||
|
|
||||||
|
### Observation: CHECKPOINT.json `phase: 4` (not 5)
|
||||||
|
- **Note**: CHECKPOINT.json reflects the last-completed execution phase (P4). The active P5 phase will bump `phase: 5` and `stage` on the P5 ship commit. This is the expected state mid-P5 (audit in progress, ship not yet committed). Not a defect.
|
||||||
|
|
||||||
|
### Observation: P3 commit lists REQ-009 as `partial`
|
||||||
|
- **Note**: P3's `---ci---` block declares `partial: [REQ-009]`. This is honest soft-ordering accounting (Forex oracle is consumed by Piers; P3 ships the Forex half, P4 ships the L2 satellite half). REQ-009 is fully covered by P4's `x/satellite`. The `partial` flag is informational, not a coverage gap. Not a defect.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 4. Overall Audit Verdict
|
||||||
|
|
||||||
|
### **PASS** (after critical fixes applied)
|
||||||
|
|
||||||
|
The v0.2 (The Mesh) milestone is **shippable**.
|
||||||
|
|
||||||
|
**Per-check summary:**
|
||||||
|
|
||||||
|
| # | Check | Verdict |
|
||||||
|
|---|---|---|
|
||||||
|
| 1.1 | Reconstruction test (git log ↔ .ciagent, tags, milestone-not-released) | PASS |
|
||||||
|
| 1.2 | .ciagent file discipline (9 files, CHECKPOINT.json, config.json) | PASS |
|
||||||
|
| 1.3 | Branch hygiene (main, milestone, final-phase, no leftover branches) | PASS |
|
||||||
|
| 1.4 | Commit discipline (`---ci---` blocks, project: oy, status, requirements) | PASS |
|
||||||
|
| 1.5 | Build / test / cover sanity (build, test, ≥80% coverage, lexicon, invariants) | PASS |
|
||||||
|
|
||||||
|
**Critical issues: 2 found → 2 fixed → 0 remaining.**
|
||||||
|
- Critical-1 (REQUIREMENTS.md status column): FIXED.
|
||||||
|
- Critical-2 (ROADMAP.md G-010 tag-line reconciliation + Phase 2 completion): FIXED.
|
||||||
|
|
||||||
|
**Non-critical observations: 3** (2× P1 council spec drift + 1× P2 nit) — flagged for post-hoc review, do not block ship.
|
||||||
|
|
||||||
|
**STRIDE security summary** (per ci-auditor role, read-only):
|
||||||
|
|
||||||
|
| Category | Finding | Severity | Disposition |
|
||||||
|
|---|---|---|---|
|
||||||
|
| Spoofing | No auth surface (skeleton-only, zero deps); Reach IDs are opaque strings, no identity assertion logic | Low | Accept |
|
||||||
|
| Tampering | Locked consts are compile-time `const` (Mission Lock, Bond cap/floor, Guild fee 0); `ValidateGenesis` rejects dup IDs + out-of-bounds bond coupons at genesis load | Low | Accept |
|
||||||
|
| Repudiation | Append-only audit log (Window) with non-decreasing timestamp + entry-id uniqueness enforced; no tx log in skeleton (deferred Phase 3) | Low | Accept |
|
||||||
|
| Info Disclosure | Zero secrets in code; lexicon firewall prevents leaking banned financial terms into the codebase (REQ-012); no PII handling in skeleton | Low | Accept |
|
||||||
|
| Denial of Service | Rate-limit primitive (Window) is a simple counter (A-206); no network surface (zero deps, no relayer, no live oracle); DoS surface is Phase 3+ | Low | Accept |
|
||||||
|
| Elevation of Privilege | Mission Lock (`const false`) prevents governance amending the covenant; Bond clamp prevents coupon above 8% cap; G-003 invariant prevents import-cycle privilege escalation via struct imports | Low | Accept |
|
||||||
|
|
||||||
|
No threat exceeds the low/accept threshold. No escalations. The skeleton+tests scope (D-020) intentionally has no runtime attack surface; all security-relevant invariants are compile-time consts + tested firewalls.
|
||||||
|
|
||||||
|
**Confidence in overall verdict: 0.90**
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 5. Ship Readiness Confirmation
|
||||||
|
|
||||||
|
The milestone is ready for the final ship step (P5-02-01):
|
||||||
|
1. `go build ./...` GREEN ✓
|
||||||
|
2. `go test ./...` GREEN (25 packages, no regression) ✓
|
||||||
|
3. Coverage ≥80% on all 10 new/extended packages (floor 95.9%) ✓
|
||||||
|
4. Lexicon firewall green (zero banned terms; meta-test + self-test table pass) ✓
|
||||||
|
5. All locked-const invariants green ✓
|
||||||
|
6. G-003 by-ID-string import invariant green ✓
|
||||||
|
7. go.mod unchanged (G-006) ✓
|
||||||
|
8. Tags v0.1.0..v0.1.4 exist and map to correct commits ✓
|
||||||
|
9. v0.1.5 NOT yet present (correct — final phase creates it) ✓
|
||||||
|
10. REQUIREMENTS.md + ROADMAP.md reconciled (Critical-1, Critical-2 fixed) ✓
|
||||||
|
|
||||||
|
**Remaining P5 ship actions** (for the orchestrator, not the auditor):
|
||||||
|
- Commit the P5 final-phase work (this AUDIT.md + the REQUIREMENTS.md/ROADMAP.md fixes + REVIEW.md).
|
||||||
|
- Create the `v0.1.5` tag (= v0.2 milestone release per D-008/D-020).
|
||||||
|
- (Optional) Update CHECKPOINT.json `phase: 5`, `stage: ship` on the P5 commit.
|
||||||
|
- (If release_blocking were true) push tags to remote. config.json `ship.release_blocking: false`, so local tag is sufficient; remote push is at orchestrator discretion.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Summary Block
|
||||||
|
|
||||||
|
```
|
||||||
|
Per-check verdicts:
|
||||||
|
1.1 Reconstruction test — PASS (5 phase commits; tags v0.1.0..v0.1.4; v0.1.5 absent)
|
||||||
|
1.2 .ciagent discipline — PASS (9 files; CHECKPOINT.json + config.json valid)
|
||||||
|
1.3 Branch hygiene — PASS (no leftover execution branches; final-phase at milestone HEAD)
|
||||||
|
1.4 Commit discipline — PASS (all 5 commits: project: oy, status: complete, requirements: covered)
|
||||||
|
1.5 Build/test/cover — PASS (build GREEN; test GREEN; coverage floor 95.9%; lexicon + invariants green)
|
||||||
|
|
||||||
|
Critical issues: 2 found → 2 fixed → 0 remaining
|
||||||
|
- Critical-1: REQUIREMENTS.md status column → FIXED (P5-01-03 obligation)
|
||||||
|
- Critical-2: ROADMAP.md G-010 tag-line → FIXED (P5-01-03 obligation)
|
||||||
|
|
||||||
|
Non-critical: 3 (2× P1 council spec drift, 1× P2 nit) — flagged, not blocking
|
||||||
|
Escalations: 0
|
||||||
|
Overall verdict: PASS (after critical fixes)
|
||||||
|
Confidence: 0.90
|
||||||
|
AUDIT.md written: /root/oy/.ciagent/oy/AUDIT.md ✓
|
||||||
|
```
|
||||||
|
---
|
||||||
|
|
||||||
|
# Audit: OpenYield (oy) — v0.3 (Bearers & Documentation) Final Phase (P6)
|
||||||
|
|
||||||
|
> **Auditor**: CIAgent doc verifier (final-audit mode, full autonomy)
|
||||||
|
> **Date**: 2026-08-17
|
||||||
|
> **Scope**: v0.3 milestone state on `oy/milestone/v0.3-bearers-docs` (HEAD = `oy/phase/06-final-review-ship`)
|
||||||
|
> **Milestone**: v0.3 — Bearers & Documentation (feature type; tag_base `v0.2.x`)
|
||||||
|
> **Mode**: multi-project (slug `oy`)
|
||||||
|
> **Autonomy**: full
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## v0.3 Final Audit (P6)
|
||||||
|
|
||||||
|
### Reconstruction Test — **PASS**
|
||||||
|
|
||||||
|
**Git log matches `.ciagent/` files.** `git log v0.1.5..HEAD --oneline` returns 13 commits across P0-P5 (6 phase-ship `docs(P##):` commits, 5 `checkpoint(P##):` advance commits, 1 v0.2 milestone marker inherited via v0.1.5). The 6 `docs(P##): complete ...` commits each carry a `---ci---` block with `status: complete` and the correct phase integer.
|
||||||
|
|
||||||
|
**Per-phase `---ci---` block verification:**
|
||||||
|
|
||||||
|
| Phase | Commit | Tag | `status` | `requirements.covered` | `requirements.partial` | Verdict |
|
||||||
|
|---|---|---|---|---|---|---|
|
||||||
|
| P0 | 23de3c5 | v0.2.0 | complete | [] (pre-execution) | [] | PASS |
|
||||||
|
| P1 | a780884 | v0.2.1 | complete | [REQ-028] | [REQ-027] | PASS |
|
||||||
|
| P2 | d09c613 | v0.2.2 | complete | [] (nomads docs) | [REQ-027] | PASS |
|
||||||
|
| P3 | 2ef3f2e | v0.2.3 | complete | [REQ-027] | [] | PASS |
|
||||||
|
| P4 | ab43bef | v0.2.4 | complete | [REQ-010, REQ-022, REQ-023] | [] | PASS |
|
||||||
|
| P5 | c1aa274 | v0.2.5 | complete | [REQ-024, REQ-025, REQ-026] | [] | PASS |
|
||||||
|
|
||||||
|
- Phase `---ci---` blocks: 6 (one per phase P0-P5). Each phase's final block shows `status: complete`. ✓
|
||||||
|
- Tag count: 6 (v0.2.0..v0.2.5). Each tag exists and points at the matching `docs(P##): complete ...` commit. ✓
|
||||||
|
- REQ coverage vs. expected (P0: none; P1: REQ-028; P2: partial REQ-027; P3: REQ-027; P4: REQ-010/022/023; P5: REQ-024/025/026): **exact match on all 6 phases**. ✓
|
||||||
|
- IDEATE traceability (REQUIREMENTS.md §"IDEATE Traceability"): 8 IDEATE-NN → REQ-ID mappings present (IDEATE-01→REQ-027 ... IDEATE-08→REQ-026). ✓
|
||||||
|
- CHECKPOINT.json matches state: `phase: 5`, `stage: complete`, `milestone: v0.3`, `tag_base: v0.2.x`, `milestone_complete: false`, `phase_release_tag: v0.2.5` — consistent with "P5 complete, advancing to P6 final review/audit/ship". ✓
|
||||||
|
|
||||||
|
**Reconstruction test verdict: PASS** (6/6 phase blocks well-formed; 6/6 tags present; 6/6 REQ-coverage sets match; CHECKPOINT current).
|
||||||
|
|
||||||
|
### File Discipline — **PASS** (after fix)
|
||||||
|
|
||||||
|
`.ciagent/oy/` contains: PROJECT.md, ROADMAP.md, REQUIREMENTS.md, ARCHITECTURE.md, RESEARCH.md, PERSONAS.md, PLANS.md, GRILL.md, REVIEW.md, AUDIT.md. Plus historical P1_SHIP_VERIFICATION.md..P4_SHIP_VERIFICATION.md (v0.2 audit artifacts; not orphan — referenced by v0.2 AUDIT.md).
|
||||||
|
|
||||||
|
`.ciagent/` (root, multi-project) contains: CHECKPOINT.json, config.json, oy/ (slug subdir). ✓ config.json valid (`projects[]` length 1, `active_project: oy`, `milestone: v0.3`, `tag_base: v0.2.x`, `autonomy.level: full`). ✓
|
||||||
|
|
||||||
|
**Stale-content fixes applied during this audit:**
|
||||||
|
- REQUIREMENTS.md v0.3 table: all 8 REQs were marked `Pending` despite P1-P5 shipping them. Updated REQ-010/022/023/024/025/026 → `Skeleton`, REQ-027/028 → `Complete` to match the `---ci---` coverage blocks.
|
||||||
|
- ROADMAP.md v0.3 milestone: header read `ACTIVE` with no per-phase completion markers; P0-P5 shipped. Added `[x]` markers for P0-P5 and `[ ]` for P6-in-progress, plus a status line.
|
||||||
|
|
||||||
|
No orphan files detected. REVIEW.md exists (v0.2 content; review agent may append v0.3 section concurrently — tracked as pending, non-blocking).
|
||||||
|
|
||||||
|
**File discipline verdict: PASS** (after REQUIREMENTS + ROADMAP freshness fixes).
|
||||||
|
|
||||||
|
### Branch Hygiene — **PASS**
|
||||||
|
|
||||||
|
- `git branch -a` lists: `main`, `oy/milestone/v0.3-bearers-docs`, `oy/phase/06-final-review-ship` (current), `remotes/origin/main`, `remotes/origin/oy/milestone/v0.3-bearers-docs`.
|
||||||
|
- No leftover execution phase branches (`oy/phase/01-05`): grep for `phase/0[1-5]` returned zero. ✓ Phase branches deleted after merge.
|
||||||
|
- Milestone branch `oy/milestone/v0.3-bearers-docs` exists and is at the P5-checkpoint commit (62ff0d7), matching the final-phase branch HEAD. ✓
|
||||||
|
- Final-phase branch `oy/phase/06-final-review-ship` exists and tracks milestone HEAD. ✓
|
||||||
|
|
||||||
|
**Branch hygiene verdict: PASS.**
|
||||||
|
|
||||||
|
### Commit Discipline — **PASS**
|
||||||
|
|
||||||
|
- 6 phase-ship commits follow `docs(P##): complete ...` convention (P00..P05). ✓
|
||||||
|
- 5 checkpoint commits follow `checkpoint(P##): ...` convention. ✓
|
||||||
|
- All 6 `---ci---` blocks well-formed (opening `---ci---`, closing `---/ci---`, YAML keys `project: oy`, `phase: N`, `milestone: v0.3`, `status: complete`, `tag_base: v0.2.x`, `phase_role`, `requirements.covered`, `requirements.partial`). ✓
|
||||||
|
- Multi-project `project: oy` field present in every `---ci---` block. ✓
|
||||||
|
- No malformed blocks, no missing closing tags, no orphan phase markers.
|
||||||
|
|
||||||
|
**Commit discipline verdict: PASS.**
|
||||||
|
|
||||||
|
### Build/Test Sanity — **PASS**
|
||||||
|
|
||||||
|
- `go build ./...` → GREEN (exit 0). ✓
|
||||||
|
- `go test ./...` → 26 packages GREEN, 4 packages `[no test files]` (identity/processing/rootpool/vault — pre-existing v0.1 layout), zero FAIL. ✓
|
||||||
|
- New v0.3 packages present and green: x/exit, x/bridge, x/hub, x/services (plus x/bearers, x/partner, x/bond extended; lexicon_meta_docs at root). ✓
|
||||||
|
|
||||||
|
### Fixes Applied
|
||||||
|
|
||||||
|
| Fix | File | Change | Severity |
|
||||||
|
|---|---|---|---|
|
||||||
|
| 1 | `.ciagent/oy/REQUIREMENTS.md` | v0.3 REQ table statuses: 8 REQs Pending → 6 Skeleton + 2 Complete (matches `---ci---` coverage) | critical (stale docs) |
|
||||||
|
| 2 | `.ciagent/oy/ROADMAP.md` | v0.3 milestone: added P0-P5 `[x]` completion markers + P6 `[ ]` + status line | critical (stale docs) |
|
||||||
|
|
||||||
|
Both fixes are committed under `fix(P06-audit):` per the final-audit protocol (see commit below).
|
||||||
|
|
||||||
|
### Overall Audit Verdict — **PASS**
|
||||||
|
|
||||||
|
```
|
||||||
|
Per-check verdicts (v0.3 final):
|
||||||
|
1. Reconstruction test — PASS (6 phase blocks; 6 tags v0.2.0..v0.2.5; REQ coverage exact on all 6 phases; CHECKPOINT current)
|
||||||
|
2. File discipline — PASS (after fix; 10 .ciagent/oy/ files + CHECKPOINT.json + config.json; no orphans)
|
||||||
|
3. Branch hygiene — PASS (no phase/01-05 branches; milestone + final-phase present)
|
||||||
|
4. Commit discipline — PASS (6 docs(P##) + 5 checkpoint(P##); all ---ci--- well-formed; project: oy present)
|
||||||
|
5. Build/test sanity — PASS (build GREEN; 26 pkgs GREEN; new v0.3 packages green)
|
||||||
|
|
||||||
|
Critical issues: 2 found → 2 fixed → 0 remaining
|
||||||
|
- Critical-1: REQUIREMENTS.md v0.3 statuses stale (Pending vs Skeleton/Complete) → FIXED
|
||||||
|
- Critical-2: ROADMAP.md v0.3 P0-P5 completion markers missing → FIXED
|
||||||
|
|
||||||
|
Non-critical: 1 (REVIEW.md v0.3 section pending concurrent review agent — non-blocking)
|
||||||
|
Escalations: 0
|
||||||
|
Overall verdict: PASS (after critical fixes)
|
||||||
|
Confidence: 0.92
|
||||||
|
AUDIT.md appended: /root/oy/.ciagent/oy/AUDIT.md ✓ (v0.3 section appended; v0.2 content preserved)
|
||||||
|
```
|
||||||
|
|
||||||
|
AUDIT.md
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# Audit: OpenYield (oy) — v0.4 (Refinement — NFR) Final Phase
|
||||||
|
|
||||||
|
> **Auditor**: CIAgent security-auditor (read-only on source; writes only to `.ciagent/`)
|
||||||
|
> **Date**: 2026-08-17
|
||||||
|
> **Target**: v0.4 milestone (main..oy/milestone/v0.4-refinement) + `.ciagent/oy/` files
|
||||||
|
> **Milestone**: v0.4 — Refinement (NFR)
|
||||||
|
> **Autonomy**: full
|
||||||
|
|
||||||
|
## 1. Reconstruction Test (git log ↔ `.ciagent/` files)
|
||||||
|
|
||||||
|
### 1.1 Phase progression
|
||||||
|
|
||||||
|
The v0.4 milestone progresses through 5 phases, each with a `---ci---` block and a tag:
|
||||||
|
|
||||||
|
| Phase | Stage commits | Tag | Release ID | `.ciagent/` evidence |
|
||||||
|
|-------|---------------|-----|-----------|----------------------|
|
||||||
|
| P0 (pre-execution) | specify→clarify→research→plan→grill→mvp_ux_check→complete | v0.3.0 | 748 | PROJECT.md v0.4 section, REQUIREMENTS.md v0.4 table, ARCHITECTURE.md v0.4 section, PERSONAS.md v0.4, PLANS.md v0.4 plan, GRILL.md v0.4 section |
|
||||||
|
| P1 (lexicon+const) | execute→verify→complete | v0.3.1 | 749 | REVIEW.md (P1), `lexicon/lexicon.go` helper, `x/hub/types/cross_const_test.go` |
|
||||||
|
| P2 (lifecycle docs) | execute→verify→complete | v0.3.2 | 750 | ARCHITECTURE.md divergence section, `x/council/types/types_test.go` intent test |
|
||||||
|
| P3 (docs CI) | execute→verify→complete | v0.3.3 | 751 | `.gitea/workflows/docs-build.yml`, `.gitignore` site/ |
|
||||||
|
| P4 (final review+ship) | in progress | v0.3.4 (pending) | — | this AUDIT.md section + REVIEW.md v0.4 section |
|
||||||
|
|
||||||
|
Reconstruction: the git log subject lines match the `.ciagent/` file state. Each phase's `---ci---` block is present in the commit messages. Tags v0.3.0..v0.3.3 exist. **PASS.**
|
||||||
|
|
||||||
|
### 1.2 `.ciagent/` file discipline
|
||||||
|
|
||||||
|
14 files in `.ciagent/oy/` (ARCHITECTURE, AUDIT, GRILL, P1-P4_SHIP_VERIFICATION [P1-P3 from v0.2/v0.3, P4 pending], PERSONAS, PLANS, PROJECT, REQUIREMENTS, RESEARCH, REVIEW, ROADMAP). All present and updated for v0.4. CHECKPOINT.json reflects the current phase. config.json has `milestone: v0.4`, `milestone_type: nfr`, `tag_base: v0.3.x`. **PASS.**
|
||||||
|
|
||||||
|
### 1.3 Branch hygiene
|
||||||
|
|
||||||
|
Local: `main`, `oy/milestone/v0.4-refinement`, `oy/phase/04-final-review-ship` (current). Remote: `origin/main`, `origin/oy/milestone/v0.4-refinement`. All merged execution phase branches (P1, P2, P3) deleted locally. No leftover phase branches. The P4 final phase branch will be deleted at milestone ship. **PASS.**
|
||||||
|
|
||||||
|
### 1.4 Commit discipline
|
||||||
|
|
||||||
|
All 20 milestone commits have `---ci---` blocks with `project: oy`, `phase: N`, `milestone: v0.4`, `status: <stage>`, `tag_base: v0.3.x`, `milestone_type: nfr`. Commit subjects use conventional prefixes (docs, refactor, test, chore, verify, decision, checkpoint, Merge). No `feat:` subjects. **PASS.**
|
||||||
|
|
||||||
|
### 1.5 Build / test / coverage sanity
|
||||||
|
|
||||||
|
- `go build ./...`: clean.
|
||||||
|
- `go test ./...`: green (26 packages, all ok).
|
||||||
|
- `go vet ./...`: clean on touched packages.
|
||||||
|
- Coverage: `x/hub/types` 93.3% (v0.3 floor preserved; new cross-const test adds coverage). `x/council/types` 96.4% (improved from v0.3). Both above the 80% target (D-033). `go.mod` unchanged (zero deps, G-006). **PASS.**
|
||||||
|
|
||||||
|
## 2. NFR Purity Gate (v0.4 mandatory)
|
||||||
|
|
||||||
|
The NFR purity gate (D-047, D-001 filter) requires zero `feat:` commits in the v0.4 milestone range. The gate is checked on COMMIT SUBJECTS (not bodies), because `git log --grep` over-matches commit bodies that mention "feat:" in prose (e.g., the verify commits say "zero feat: commits in P2" in the body).
|
||||||
|
|
||||||
|
**Gate command**: `git log --format="%s" main..HEAD | grep -E "^feat:"`
|
||||||
|
|
||||||
|
**Result**: exit 1 (zero matches). The 20 commit subjects are: `docs(init)`, `docs(P00)` ×3, `docs(P00)` grill, `decision(P00)`, `Merge` ×3, `refactor(lexicon)`, `verify(P1)`, `checkpoint(p1)` ×3, `docs(arch)`, `verify(P2)`, `checkpoint(p2)`, `chore(ci)`, `verify(P3)`, `checkpoint(p3)`. None start with `feat:`.
|
||||||
|
|
||||||
|
**NFR purity gate: GREEN.** ✓
|
||||||
|
|
||||||
|
## 3. Non-Critical Observations (P1+ flags, not blocking)
|
||||||
|
|
||||||
|
### P2-1: mkdocs build warnings (pre-existing v0.3 docs links)
|
||||||
|
- **Files**: `docs/index.md`, `docs/shared/vision.md` (link to `../README.md` / `../../README.md`)
|
||||||
|
- **Note**: `mkdocs build` produces 2 warnings about README.md not being in the docs tree. The build SUCCEEDS (warnings, not errors). These are pre-existing v0.3 docs content links, NOT introduced by v0.4. v0.4's REQ-032 is the CI workflow (which runs `mkdocs build` and succeeds despite the warnings), not the docs content.
|
||||||
|
- **Recommendation**: post-hoc fix in v0.5+ (either include README.md in mkdocs nav, or fix the relative links). Not a v0.4 ship blocker.
|
||||||
|
|
||||||
|
### P2-2: Gitea Actions `actions/upload-artifact@v4` compatibility
|
||||||
|
- **File**: `.gitea/workflows/docs-build.yml`
|
||||||
|
- **Note**: the workflow uses `actions/upload-artifact@v4`. Gitea Actions (which reimplements GitHub Actions) supports most `actions/*` but v4 of upload-artifact has had compatibility quirks. If the upload step fails, the `mkdocs build` step (the higher-priority check) would still have succeeded.
|
||||||
|
- **Recommendation**: post-hoc verify on the first real CI run; downgrade to v3 or use Gitea-native upload if needed. Not a ship blocker (the build is the gate, the artifact is a bonus).
|
||||||
|
|
||||||
|
### P2-3: NFR purity gate precision (documented in REVIEW.md P1+ #3)
|
||||||
|
- **Note**: `git log --grep "^feat:"` over-matches commit bodies. The audit uses the subject-only gate (`--format="%s" | grep -E "^feat:"`). This is documented for future milestones.
|
||||||
|
- **Recommendation**: bake the subject-only gate into the next milestone's PLAN. Not a ship blocker.
|
||||||
|
|
||||||
|
## 4. Overall Audit Verdict
|
||||||
|
|
||||||
|
### **PASS**
|
||||||
|
|
||||||
|
The v0.4 (Refinement — NFR) milestone is **shippable**.
|
||||||
|
|
||||||
|
**Per-check summary:**
|
||||||
|
|
||||||
|
| # | Check | Verdict |
|
||||||
|
|---|-------|---------|
|
||||||
|
| 1.1 | Reconstruction (phase progression, tags, `.ciagent` evidence) | PASS |
|
||||||
|
| 1.2 | `.ciagent` file discipline (14 files, CHECKPOINT, config.json) | PASS |
|
||||||
|
| 1.3 | Branch hygiene (no leftover phase branches; P4 final pending) | PASS |
|
||||||
|
| 1.4 | Commit discipline (`---ci---` blocks; conventional subjects; no feat:) | PASS |
|
||||||
|
| 1.5 | Build / test / coverage sanity (build, test, ≥80%, lexicon, G-006) | PASS |
|
||||||
|
| 2 | **NFR purity gate** (zero `feat:` commit subjects) | **GREEN** |
|
||||||
|
|
||||||
|
**Critical issues: 0.**
|
||||||
|
**Non-critical observations: 3** (all P2, post-hoc, non-blocking).
|
||||||
|
**Confidence in overall verdict: 0.90.**
|
||||||
|
|
||||||
|
## STRIDE security summary (per ci-auditor role, read-only)
|
||||||
|
|
||||||
|
| Category | Finding | Severity | Disposition |
|
||||||
|
|---|---|---|---|
|
||||||
|
| Spoofing | No auth surface added (v0.4 is refactor+test+docs+CI; no new identity logic) | Low | Accept |
|
||||||
|
| Tampering | The cross-const test (REQ-030) HARDENS tamper-resistance: a future change to `x/bond.CouponCapBps` or `x/hub.LendingCouponCapBps` is now detected by an automated test (was comment-only before v0.4). The absolute-value assertion (G-015) catches paired drift. Mission Lock (8%/0%) is MORE defended after v0.4. | Low (improved) | Accept |
|
||||||
|
| Repudiation | No audit-log changes in v0.4 | Low | Accept |
|
||||||
|
| Info Disclosure | The CI workflow (REQ-032) does NOT publish (build+artifact only, D-051); no secret exposure in the workflow YAML; `GITEA_TOKEN` is resolved via `resolveSecret()` from `.ciagent/.env.secrets` for release creation, never via shell-env `curl` | Low | Accept |
|
||||||
|
| Denial of Service | No network surface added; the CI workflow runs on push but does not expose a service | Low | Accept |
|
||||||
|
| Elevation of Privilege | No privilege surface added; the lexicon helper is a pure function; the regression guard only asserts existing consts | Low | Accept |
|
||||||
|
|
||||||
|
No threat exceeds the low/accept threshold. No escalations. v0.4 hardens the mission-locked const firewall (REQ-030) and the lexicon firewall (REQ-029) without introducing any new attack surface.
|
||||||
|
|||||||
@@ -1093,441 +1093,3 @@ fixes:
|
|||||||
escalations: []
|
escalations: []
|
||||||
---/ci---
|
---/ci---
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## v0.6 Grill (Nomad Web UI)
|
|
||||||
|
|
||||||
> **Reviewer**: CIAgent adversarial grill (red-team, full autonomy)
|
|
||||||
> **Date**: 2026-08-18
|
|
||||||
> **Target**: v0.6 Phase 0 artifacts (PROJECT.md D-066..D-073, REQUIREMENTS.md REQ-040..REQ-045 + IDEATE traceability, ROADMAP.md v0.6 phase table, PLANS.md v0.6 plan lines 1692-2152 incl. MVP/UX 3 sections, RESEARCH.md, PERSONAS.md frontend-engineer activation) + v0.1..v0.5 codebase baseline
|
|
||||||
> **Milestone**: v0.6 — Nomad Web UI (feature type; tags run on the v0.5.x patch line)
|
|
||||||
> **Autonomy**: full (decision_confidence_threshold = 0.60)
|
|
||||||
> **Mode**: multi-project (slug `oy`)
|
|
||||||
> **G-NNN sequence**: continues from G-024 (highest prior grill id). New fixes G-025..
|
|
||||||
> **D-NNN sequence**: continues from D-073 (highest prior clarify id). New decisions D-078..
|
|
||||||
|
|
||||||
### Methodology
|
|
||||||
|
|
||||||
v0.6 is the project's first UI milestone. The grill assumes the plan is
|
|
||||||
over-scoped, too costly, and quietly breaks G-006 (zero-dep) or G-003
|
|
||||||
(production firewall) until evidence forces otherwise. Each of the nine
|
|
||||||
review axes was scored against concrete evidence (commit hash, file:line,
|
|
||||||
REQ-ID, D-decision, verified codebase state). Missing or contradictory
|
|
||||||
evidence is itself a finding.
|
|
||||||
|
|
||||||
### Evidence baseline (verified against the actual repo, not the docs)
|
|
||||||
|
|
||||||
- `go.mod`: `module github.com/oy/openyield`, `go 1.22`, **cosmos-sdk v0.50.8
|
|
||||||
+ ibc-go v8.2.1 already present** (the v0.5 D-055 controlled exception
|
|
||||||
landed). v0.6 "go.mod unchanged" therefore means **zero NEW require lines
|
|
||||||
on top of the v0.5 baseline**, NOT "go.mod is empty". This is a subtle but
|
|
||||||
material audit-surface distinction — a naive "no new lines added in
|
|
||||||
P1..P5" check would pass even if an indirect dep was bumped (a `go mod
|
|
||||||
tidy` side-effect). **G-028** (below) forces the P6 audit to diff go.mod
|
|
||||||
against the `v0.5.0` tag (the v0.6 P0 baseline), not just check "no new
|
|
||||||
direct require lines".
|
|
||||||
- `web/` directory: **does NOT exist** (verified — `ls web/` fails). v0.6 is
|
|
||||||
greenfield UI; the plan's "new top-level `web/` dir" is accurate.
|
|
||||||
- `lexicon_meta_web/`: **does NOT exist** (verified). The new firewall is
|
|
||||||
net-new work, mirroring `lexicon_meta_docs/` (which exists and has the
|
|
||||||
G-009 self-test + G-013 walk-coverage + self-exclusion via
|
|
||||||
`runtime.Caller(0)` — all verified present).
|
|
||||||
- `lexicon/lexicon.go`: `BannedTerms()`, `FindBannedTerm()`, and
|
|
||||||
`SyntheticBannedStrings()` ALL exist (verified at lines 49, 73, 111). The
|
|
||||||
G-014 shared helper from v0.4 REQ-029 landed. The new `lexicon_meta_web/`
|
|
||||||
firewall has a proven template to mirror — no detection reimplementation
|
|
||||||
risk.
|
|
||||||
- `x/bread/types/types.go:13`: `GrainsPerBread = 10000` (verified). The docs
|
|
||||||
table `docs/shared/bread-scale.md` says "each 1,000× the previous" (Crumb =
|
|
||||||
1,000 Grain; Bread = 1,000 Crumb). **The code says Grain→Bread is 10,000×
|
|
||||||
(GrainsPerBread=10000), NOT 1,000×.** D-073 (code constants are the source
|
|
||||||
of truth, NOT docs) is CONFIRMED CORRECT — the docs are genuinely outdated.
|
|
||||||
This is not a judgment call; it is a verified numeric contradiction. The
|
|
||||||
doc-fix is correctly deferred (P1+ follow-up, not v0.6 scope — docs were a
|
|
||||||
v0.3 deliverable).
|
|
||||||
- `x/bloom/types/types.go:13-19`: `TargetBloomRateBasisPoints=450`,
|
|
||||||
`MinBloomRateBasisPoints=400`, `MaxBloomRateBasisPoints=500`,
|
|
||||||
`AccrualPeriodBlocks=144` — ALL exist (verified). P5's Bloom screen has
|
|
||||||
real code constants to read.
|
|
||||||
- `x/standing/types/types.go:12-13,39-40,94,99,112,129`: `PriorMean=4.0`,
|
|
||||||
`PriorWeight=10`, `FreeholderMinStandingScore=4.5`,
|
|
||||||
`FreeholderMinCategories=3`, `IsFreeholderEligible()`,
|
|
||||||
`ComputeDiversityBonus()`, `GetVoucherWeight()`, `GetStandingBucket()` —
|
|
||||||
ALL exist (verified). P4's Standing screen has the real locked-formula
|
|
||||||
surface. The plan's "computed from locked constants, NOT hardcoded" claim
|
|
||||||
is grounded.
|
|
||||||
- `x/stash/types/types.go:19,23,32,35,38-39`: `BalanceGrain`, `StashActivity`,
|
|
||||||
`MaturityThresholdDays=90`, `MaxGapForMaturity=30`, `IsMature()` — ALL
|
|
||||||
exist (verified). P2's Stash dashboard has real maturity logic.
|
|
||||||
- `x/window/types/types.go:19,22-24,36,56,100,117,123`: `ScopeKind` enum
|
|
||||||
(ReadStash/ReadStanding/ProcessPassActForStand), `RateLimit`,
|
|
||||||
`AuditEntry`, `Revoke()`, `Expire()`, `Activate()` — ALL exist (verified).
|
|
||||||
P3's Window screen has the real lifecycle methods. The plan's "call
|
|
||||||
`Window.Activate/Revoke/Expire`, NOT a reimplementation" is enforceable.
|
|
||||||
- `x/identity/types/types.go:14-19`: `Reach` struct with `ReachID`,
|
|
||||||
`HolderID`, `IsNomad` — exists (verified). P1's "Create a Reach" form has a
|
|
||||||
real type to instantiate.
|
|
||||||
- **G-003 import-invariant test** exists at `x/window/types/types_test.go`
|
|
||||||
(uses `go/parser` ImportsOnly, scans `x/**/*.go`, prefix
|
|
||||||
`github.com/oy/openyield/x/`). **Confirmed: `web/` is OUTSIDE `x/` so this
|
|
||||||
test does NOT scan `web/`** — the plan's new `web/store/import_test.go`
|
|
||||||
(P1-03-03) is the correct complement. BUT the plan's test only forbids
|
|
||||||
`x/*/keeper` imports; `x/*/module` (the Cosmos runtime wiring) is also a
|
|
||||||
production surface that `web/` must not reach into. **G-025** extends the
|
|
||||||
forbidden-import set.
|
|
||||||
- **No `app.go`, no `cmd/oyd`, no `main.go`** exists in the repo (verified
|
|
||||||
— the plan's "no chain runtime exists" is accurate). v0.6's `web/main.go`
|
|
||||||
is the project's first `main.go`. This is a genuine greenfield.
|
|
||||||
|
|
||||||
These baseline facts confirm the v0.6 plan's architecture claims against the
|
|
||||||
actual codebase. The plan is well-grounded; the binding decisions below are
|
|
||||||
correctness and verification hardening, not scope rework.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## 1. Per-Axis Adversarial Assessment
|
|
||||||
|
|
||||||
### Axis 1 — Feasibility (Go html/template + HTMX + stdlib ServeMux, no node) — **PASS** (confidence 0.85)
|
|
||||||
|
|
||||||
The stack is genuinely achievable with zero new Go deps. Go 1.22
|
|
||||||
`net/http.ServeMux` supports method-pattern routing (`mux.HandleFunc("GET
|
|
||||||
/reach", ...)` — verified Go 1.22 feature). `html/template` is stdlib with
|
|
||||||
auto-escaping (XSS protection by default). HTMX 1.x minified is ~14KB
|
|
||||||
served as a static asset via `http.FileServer` — no `go get`, no node, no
|
|
||||||
build step. The mock-server-over-real-Go-types approach (D-067) is sound:
|
|
||||||
all six referenced `x/*/types` packages exist and export the structs the UI
|
|
||||||
surfaces (verified — Reach, Stash, StashActivity, Window, FreeholderSignals,
|
|
||||||
BloomRecord all present with the methods the plan calls). No hidden blocker
|
|
||||||
reaches the escalation threshold. The one feasibility risk is **HTMX
|
|
||||||
version drift** (the vendored file has no version-pinned provenance in the
|
|
||||||
plan beyond "HTMX 1.x") — minor, addressed by P1-02-02's "pin the version in
|
|
||||||
a comment in the file header" mitigation.
|
|
||||||
|
|
||||||
### Axis 2 — Scope (5 screens + firewall + mock server in 5 execution phases) — **PASS** (confidence 0.80)
|
|
||||||
|
|
||||||
5 screens + 1 firewall + 1 mock server across 5 execution phases (P1..P5) +
|
|
||||||
1 final phase (P6) is proportionate, not over-scoped. Each screen is a
|
|
||||||
vertical slice (store extension + handler + template + tests) following the
|
|
||||||
proven v0.2..v0.5 pattern. The Nomad happy path (Reach → Stash → Window →
|
|
||||||
Standing → Bloom) is the correct ordering — each screen depends on the
|
|
||||||
prior's data existing. No screen is gratuitous: all 5 map to a user-
|
|
||||||
validated `--ideate` request and a REQ. The "working prototype" depth (mock
|
|
||||||
data, no persistence, no auth) is the right scope for a first UI milestone
|
|
||||||
— deferring auth/persistence to v0.7+ is correct (a UI with mock auth is a
|
|
||||||
real prototype; a UI with broken half-auth is a worse prototype). Reject
|
|
||||||
the "defer a screen" hypothesis — all 5 are on the Nomad critical path and
|
|
||||||
each is one phase of work.
|
|
||||||
|
|
||||||
### Axis 3 — Cost (6 phases: P1..P5 + P6 final) — **PASS** (confidence 0.82)
|
|
||||||
|
|
||||||
33 tasks across 6 phases is proportionate. P1 is the largest (9 tasks —
|
|
||||||
foundation + Reach + firewall, three parallel waves) because it lands the
|
|
||||||
shared substrate; P2..P5 are uniform (5 tasks each — one screen per phase);
|
|
||||||
P6 is light (4 tasks — review/audit/ship). Bundling P2+P3 (Stash + Window)
|
|
||||||
into one phase would save one ship cycle but would couple two independent
|
|
||||||
screens and break the vertical-slice shippability property (each phase
|
|
||||||
ships a patch tag). The 6-phase structure is the right granularity — fewer
|
|
||||||
phases would couple unrelated screens; more would be ceremony. No bloat:
|
|
||||||
every task produces a concrete `.go`/`.html`/`.js` file or a verifiable
|
|
||||||
gate. Reject the "too many phases" hypothesis.
|
|
||||||
|
|
||||||
### Axis 4 — G-006 (zero-dep): HTMX as vendored static asset — **PASS** (confidence 0.92)
|
|
||||||
|
|
||||||
A vendored JS file served over `http.FileServer` is NOT a Go module
|
|
||||||
dependency — it is a static asset, exactly like `docs/images/` or the
|
|
||||||
vendored CSS. The boundary is unambiguous: **`go.mod` require lines = Go
|
|
||||||
deps; static files under `web/static/` = not Go deps.** HTMX has no Go
|
|
||||||
import path; `go build ./web` does not resolve it; it is served byte-for-
|
|
||||||
byte to the browser. G-006's intent (durability of the Go build, no
|
|
||||||
external Go module tree) is fully preserved. The risk is not "HTMX is a
|
|
||||||
dep" but "a future `go mod tidy` accidentally adds a Go dep" — **G-028**
|
|
||||||
makes the P6 audit verify `go.mod` is byte-identical to the `v0.5.0` tag
|
|
||||||
baseline (diff, not just "no new direct require lines"). Confidence holds.
|
|
||||||
|
|
||||||
### Axis 5 — G-003 (production firewall): web/ importing x/*/types — **CONDITIONAL** (confidence 0.78) → fixed by G-025
|
|
||||||
|
|
||||||
`web/` is NOT an `x/` module — it is the application layer (D-070), exactly
|
|
||||||
as a future `cmd/oyd` would be. `web/store` importing `x/identity/types`
|
|
||||||
is app-layer consumption of protocol types, the intended consumption
|
|
||||||
direction. G-003's intent (no cross-module struct coupling INSIDE the
|
|
||||||
protocol layer) is intact: no `x/` module gains a production import of
|
|
||||||
another `x/` module's types via `web/`. The existing G-003 test
|
|
||||||
(`x/window/types/types_test.go`) scans `x/**/*.go` and correctly does NOT
|
|
||||||
scan `web/` (web/ is outside x/). The plan's new `web/store/import_test.go`
|
|
||||||
(P1-03-03) is the right complement. **BUT** the plan's test only forbids
|
|
||||||
`x/*/keeper` imports; `x/*/module` (the Cosmos `module.go` runtime wiring)
|
|
||||||
is ALSO a production surface that `web/` must not reach into — importing
|
|
||||||
`x/bond/module` would couple the UI to the runtime app-module graph,
|
|
||||||
violating the "no keeper, no Cosmos runtime" boundary (D-067). **G-025**
|
|
||||||
extends the forbidden-import set to `x/*/keeper` AND `x/*/module` (and
|
|
||||||
any `x/*/` subpackage other than `types`). Confidence holds after the fix.
|
|
||||||
|
|
||||||
### Axis 6 — REQ-012 (lexicon firewall extension to web/) — **CONDITIONAL** (confidence 0.80) → fixed by G-026
|
|
||||||
|
|
||||||
The firewall extension is sound in structure: a new sibling
|
|
||||||
`lexicon_meta_web/` mirroring `lexicon_meta_docs/` (same
|
|
||||||
`lexicon.FindBannedTerm` + word-boundary, G-009 self-test via
|
|
||||||
`SyntheticBannedStrings()`, G-013 walk-coverage, self-exclusion via
|
|
||||||
`runtime.Caller(0)`). The firewall-first ordering (P1 before P2..P5
|
|
||||||
content) is the proven D-044 pattern. "Create a Reach" (not "Sign up for
|
|
||||||
an account") is the correct label — "account" is banned (REQ-012). The
|
|
||||||
file-scan firewall catches banned terms in `web/templates/**`,
|
|
||||||
`web/static/**`, and `web/**/*.go`. **BUT** the plan's `web/**/*.go` scan
|
|
||||||
does not explicitly state whether it covers **string literals** (error
|
|
||||||
messages, template-fragment strings) or only comments/identifiers. A banned
|
|
||||||
term in a Go string literal (e.g., `errors.New("account not found")`) is
|
|
||||||
user-facing if it surfaces in an error response — the file-scan catches it
|
|
||||||
(the walk reads the file content, not just the AST), but the plan should
|
|
||||||
make this explicit. The deeper gap: the **per-handler rendered-HTML lexicon
|
|
||||||
check** (each phase's handler test scans the HTTP response body) covers the
|
|
||||||
happy-path response, but **error responses** (400/500 pages) are a drift
|
|
||||||
vector — a banned term in an error template or a dynamically-generated
|
|
||||||
error message would not be caught by the happy-path rendered-HTML check.
|
|
||||||
**G-026** requires the rendered-HTML lexicon check to cover at least one
|
|
||||||
error response per handler (e.g., `POST /reach` with empty HolderID → 400
|
|
||||||
response body scanned for banned terms). Confidence holds after the fix.
|
|
||||||
|
|
||||||
### Axis 7 — Bread-scale discrepancy (D-073) — **PASS** (confidence 0.90)
|
|
||||||
|
|
||||||
D-073 is CONFIRMED CORRECT against the actual codebase. The code
|
|
||||||
(`x/bread/types/types.go:13` `GrainsPerBread = 10000`) and the docs
|
|
||||||
(`docs/shared/bread-scale.md` "each 1,000× the previous") are in verified
|
|
||||||
numeric contradiction: the docs say Grain→Crumb is 1,000× and Crumb→Bread
|
|
||||||
is 1,000× (so Grain→Bread is 1,000,000×), while the code says
|
|
||||||
Grain→Bread is 10,000×. The code constants are tested
|
|
||||||
(`x/bread/types/types_test.go` asserts them); the docs are not. Using the
|
|
||||||
code as the source of truth keeps the UI consistent with the protocol
|
|
||||||
layer. The doc-fix is correctly deferred to a P1+ follow-up (not v0.6
|
|
||||||
scope — docs were a v0.3 deliverable; this is a doc-drift fix, not a UI
|
|
||||||
feature). The regression-guard test (P2-03-01 "Bread-scale conversion
|
|
||||||
correctness test — would FAIL if the outdated docs values were used") is
|
|
||||||
the right enforcement. No binding change — D-073 is ratified as-is.
|
|
||||||
|
|
||||||
### Axis 8 — Security (no auth, no sessions, in-memory store, XSS, injection) — **CONDITIONAL** (confidence 0.75) → fixed by G-027
|
|
||||||
|
|
||||||
For a "working prototype" milestone, no auth / no sessions / in-memory
|
|
||||||
store is acceptable — it is explicitly out of scope (PROJECT.md v0.6 OOS)
|
|
||||||
and documented. The XSS risk is LOW: `html/template` auto-escapes by
|
|
||||||
default; the Reach form inputs (HolderID, PublicKey) are rendered through
|
|
||||||
template actions (`{{.HolderID}}`) which escape HTML. The one injection
|
|
||||||
risk the plan does not address: **ReachID/HolderID used as map keys in the
|
|
||||||
mock store without validation.** The plan's P1-04-03 tests "POST /reach
|
|
||||||
with empty HolderID returns 400" (good), but does not specify validation
|
|
||||||
of the map key itself — a HolderID containing path separators (`/`),
|
|
||||||
template syntax (`{{`), or very long strings could cause route confusion,
|
|
||||||
template injection (if unescaped in a URL path), or memory exhaustion.
|
|
||||||
`html/template` escapes on OUTPUT, but the map key is also used in URL
|
|
||||||
construction (`GET /reach/{id}`) and route matching. **G-027** requires
|
|
||||||
`CreateReach` to validate HolderID/PublicKey (non-empty, length-bounded,
|
|
||||||
no path separators, no template syntax) before using them as map keys /
|
|
||||||
URL path segments. This is not a production security gate (the mock store
|
|
||||||
resets on restart); it is a prototype-robustness gate that prevents the
|
|
||||||
happy path from breaking on adversarial input. Confidence holds after the
|
|
||||||
fix.
|
|
||||||
|
|
||||||
### Axis 9 — Testability (≥80% on web/, HTMX fragment rendering, MVP/UX criteria) — **PASS** (confidence 0.82)
|
|
||||||
|
|
||||||
≥80% coverage on `web/store` + `web/handlers` is realistic with
|
|
||||||
`httptest.NewRecorder` + `httptest.NewRequest` (stdlib — no external test
|
|
||||||
deps, G-006 preserved). The handlers are thin (load from store → render
|
|
||||||
template → write response), so coverage is achievable with table-driven
|
|
||||||
tests per route + per lifecycle transition. HTMX fragment rendering is
|
|
||||||
tested WITHOUT a browser: the handler tests assert the response body
|
|
||||||
contains the expected HTML fragments (e.g., the Bread-scale conversion
|
|
||||||
table, the maturity progress bar width) — the HTMX swap is a client-side
|
|
||||||
concern, but the SERVER-SIDE fragment is testable via response-body
|
|
||||||
assertions. The 8 MVP/UX acceptance criteria (PLANS.md lines 2143-2151)
|
|
||||||
are all auto-verifiable EXCEPT criterion 2's "manual browser check at
|
|
||||||
http://localhost:8080" and the happy-path end-to-end (PLANS.md Happy Path
|
|
||||||
section) — these are manual checks, not auto-tests. This is acceptable for
|
|
||||||
a UI milestone (the auto-tests verify the routes return 200 + correct
|
|
||||||
HTML; the manual check verifies the browser renders them correctly), but
|
|
||||||
the P6 audit must record the manual check as a separate verification
|
|
||||||
step, not conflate it with the auto-test green. No binding change — the
|
|
||||||
plan already distinguishes "handler tests" from "manual browser check"
|
|
||||||
throughout.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## 2. Binding Decisions (D-078..D-081)
|
|
||||||
|
|
||||||
These are **binding** — the orchestrator MUST apply them before EXECUTE
|
|
||||||
begins. Numbered D-078..D-081 (continuing from D-073).
|
|
||||||
|
|
||||||
| ID | Decision | Rationale | Confidence | Binding fix (if any) |
|
|
||||||
|----|----------|-----------|------------|----------------------|
|
|
||||||
| **D-078** | **RATIFY G-006 boundary: HTMX vendored as `web/static/htmx.min.js` is G-006-compliant (static asset, not a Go dep); `go.mod` MUST stay unchanged across the v0.6 milestone range (zero new require lines on top of the v0.5 baseline).** The boundary is: `go.mod` require lines = Go deps; static files under `web/static/` = not Go deps. HTMX has no Go import path; `go build ./web` does not resolve it. | A vendored JS file served over `http.FileServer` is a static asset (like `docs/images/`), not a Go module dependency. Verified: `go.mod` already has cosmos-sdk from v0.5; v0.6 adds nothing. G-006 intent (durability of the Go build, no new external Go module tree) is fully preserved. | 0.92 | **G-028** — the P6 audit MUST diff `go.mod` against the `v0.5.0` tag (the v0.6 P0 baseline), not just check "no new direct require lines were added in P1..P5". A `go mod tidy` side-effect could bump an indirect dep without adding a direct require line. The diff must be EMPTY (or only the expected `// indirect` reordering with no version changes). | None — RATIFIED (with G-028 enforcement) |
|
|
||||||
| **D-079** | **RATIFY G-003 boundary: `web/` importing `x/*/types` is app-layer consumption (D-070), NOT a cross-`x/` production import. The G-003 production firewall stays intact: no `x/` module gains a production import of another `x/` module's types via `web/`.** The existing G-003 test (`x/window/types/types_test.go`) scans `x/**/*.go` and correctly does NOT scan `web/` (web/ is outside x/). The new `web/store/import_test.go` (P1-03-03) is the correct `web/`-scoped complement. | `web/` is the application layer (like a future `cmd/oyd`), not an `x/` module. Consuming protocol types is the intended direction. Verified: the G-003 test prefix is `github.com/oy/openyield/x/` so `web/` imports are outside its scope by construction. | 0.85 | **G-025** — `web/store/import_test.go` MUST forbid imports of `x/*/keeper` AND `x/*/module` (and any `x/*/` subpackage other than `types`), not just `x/*/keeper`. The plan only mentions `keeper`; `module.go` is also a Cosmos runtime surface that `web/` must not reach into (D-067 "no keeper, no Cosmos runtime"). | None — RATIFIED (with G-025 enforcement) |
|
|
||||||
| **D-080** | **RATIFY D-073: Bread-scale source of truth = `x/bread/types` code constants (`GrainsPerBread=10000`, `BreadScaleAll()`), NOT `docs/shared/bread-scale.md`.** The doc is verified outdated (docs say 1,000× ratios; code says 10,000× Grain→Bread). The doc-fix is a P1+ follow-up, NOT v0.6 scope (docs were a v0.3 deliverable; this is a doc-drift fix, not a UI feature). The P2-03-01 Bread-scale conversion correctness test (would FAIL if docs values were used) is the regression guard. | Verified numeric contradiction: `x/bread/types/types.go:13` `GrainsPerBread = 10000` vs `docs/shared/bread-scale.md` "each 1,000× the previous". Code constants are tested (`types_test.go`); docs are not. Using code keeps the UI consistent with the protocol layer. | 0.90 | None — the P2-03-01 regression-guard test is already in the plan. The doc-fix deferral is correct (P1+ follow-up, not v0.6). | None — RATIFIED |
|
|
||||||
| **D-081** | **RATIFY the lexicon firewall extension to `web/` (REQ-045): new sibling `lexicon_meta_web/` mirroring `lexicon_meta_docs/` (same `lexicon.FindBannedTerm` + word-boundary + G-009 self-test via `SyntheticBannedStrings()` + G-013 walk-coverage + self-exclusion via `runtime.Caller(0)`). Firewall-first (P1 before P2..P5 content). "Create a Reach" is the correct label (not "Sign up for an account" — "account" is banned).** The file-scan firewall + per-handler rendered-HTML lexicon checks are the dual firewall (file-scan catches static content; rendered-HTML catches dynamic content). | REQ-012 is `All` phases and UI strings are user-facing. Verified: `lexicon.SyntheticBannedStrings()` exists (G-014 helper); `lexicon_meta_docs/` has the proven template (self-test + walk-coverage + self-exclusion). Firewall-first (D-044 pattern) catches drift at build time, not at P6 audit. | 0.88 | **G-026** — the per-handler rendered-HTML lexicon check MUST cover at least one ERROR response per handler (e.g., `POST /reach` with empty HolderID → 400 response body scanned for banned terms), not just the happy-path 200 response. Error messages and error templates are a drift vector the happy-path check misses. | None — RATIFIED (with G-026 enforcement) |
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## 3. Binding Fixes (G-025..G-028)
|
|
||||||
|
|
||||||
These are **binding** — the orchestrator MUST apply them before the
|
|
||||||
affected phase ships. Numbered G-025..G-028 (continuing from G-024).
|
|
||||||
|
|
||||||
| ID | Binding Fix | Rationale | Confidence | Affects (phase / task) |
|
|
||||||
|----|-------------|-----------|------------|------------------------|
|
|
||||||
| **G-025** | **`web/store/import_test.go` (P1-03-03) MUST forbid imports of `x/*/keeper` AND `x/*/module` (and any `x/*/` subpackage other than `types`), not just `x/*/keeper`.** The plan's P1-03-03 only mentions `x/*/keeper`. `x/*/module` (the Cosmos `module.go` runtime wiring) is also a production surface that `web/` must not reach into — importing `x/bond/module` would couple the UI to the runtime app-module graph, violating D-067 ("no keeper, no Cosmos runtime, no `app.go`"). The import-invariant test should assert that every `github.com/oy/openyield/x/<module>/` import path in a `web/` production `.go` file ends in `/types` (i.e., only `x/<module>/types` is allowed; `x/<module>/keeper`, `x/<module>/module`, `x/<module>/simtest`, etc. are forbidden). | The plan's `web/store/import_test.go` only forbids `x/*/keeper`, leaving `x/*/module` (and other runtime subpackages) as an unguarded import path. D-067's "no Cosmos runtime" boundary is broader than just "no keeper". A single test asserting "only `x/*/types` imports from `web/`" closes the full boundary. | 0.82 | **P1-03-03** (`web/store/import_test.go`). Must land before P1 ships; carries through P2..P5. |
|
|
||||||
| **G-026** | **The per-handler rendered-HTML lexicon check (P1-04-03, P2-03-01, P3-03-01, P4-03-01, P5-03-01) MUST scan at least one ERROR response body per handler, not just the happy-path 200 response.** For each handler, the test must include a case that triggers an error response (e.g., `POST /reach` with empty HolderID → 400; `GET /stash/{nonexistent}` → 404; `POST /window` with invalid scope → 400) and assert the error response body contains no banned terms via `lexicon.FindBannedTerm`. Error messages and error templates are a drift vector: a banned term in an error string (e.g., `"account not found"`, `"deposit failed"`) would not be caught by the happy-path rendered-HTML check. The file-scan firewall catches banned terms in template FILES, but a dynamically-generated error message (constructed in Go code, not a template file) is only caught by scanning the error response body. | The plan's rendered-HTML lexicon checks scan the happy-path 200 response. Error responses are a separate code path (different template, or a Go-constructed error string) that the happy-path check does not exercise. A banned term in an error message is user-facing and would pass the file-scan firewall (the term is in a Go string literal, not a template file) while failing the lexicon intent. Scanning one error response per handler closes this gap. | 0.80 | **P1-04-03, P2-03-01, P3-03-01, P4-03-01, P5-03-01** (rendered-HTML lexicon checks). Must land before each phase ships. |
|
|
||||||
| **G-027** | **`web/store/store.go` `CreateReach` (P1-03-01) MUST validate `holderID` and `publicKey` before using them as map keys / URL path segments.** Validation: non-empty (already tested in P1-04-03), length-bounded (e.g., `len(holderID) <= 128`, `len(publicKey) <= 256`), no path separators (`/`, `\`), no template syntax (`{{`, `}}`). The handler test (P1-04-03) MUST include cases for each validation failure (empty → 400; too long → 400; contains `/` → 400; contains `{{` → 400). This is a prototype-robustness gate, not a production security gate — the mock store resets on restart, but an adversarial input should not break the happy path or cause route confusion (`GET /reach/{id}` with `id` containing `/` would mismatch the route). | The plan tests "empty HolderID returns 400" but does not specify validation of the map key / URL path segment beyond emptiness. `html/template` escapes on OUTPUT, but the HolderID is also used in URL construction (`GET /reach/{id}`) and route matching — a HolderID containing `/` would cause route confusion; a very long string would cause memory exhaustion in the in-memory map. Validation before map-key use is the standard prototype-robustness pattern. | 0.75 | **P1-03-01** (`web/store/store.go` `CreateReach` validation); **P1-04-03** (handler test cases for each validation failure). Must land before P1 ships. |
|
|
||||||
| **G-028** | **The P6 audit (P6-02-01) MUST verify `go.mod` is byte-identical (or diff-empty) against the `v0.5.0` tag (the v0.6 P0 baseline), NOT just check "no new direct require lines were added in P1..P5".** The verification: `git diff v0.5.0..HEAD -- go.mod` must be EMPTY (or contain only `// indirect` reordering with no version changes). A `go mod tidy` side-effect in P1..P5 could bump an indirect dep version (e.g., `github.com/cosmos/cosmos-sdk` stays v0.50.8 but an indirect dep bumps from v1.2.3 to v1.2.4) without adding a direct require line — a naive "no new direct require lines" check would pass while `go.mod` changed. The diff-against-baseline check closes this. | `go.mod` already has the v0.5 cosmos-sdk + ibc-go deps (verified). v0.6 "go.mod unchanged" means unchanged FROM the v0.5 baseline, not "empty". The plan's P6-02-01 says "G-006 go.mod unchanged (HTMX is a vendored static asset, NOT a `go get` — zero new require lines in v0.6)" — "zero new require lines" is necessary but not sufficient; an indirect dep bump is a `go.mod` change that "zero new require lines" would miss. The diff-against-`v0.5.0` check is the complete enforcement. | 0.85 | **P6-02-01** (audit feature purity gate — G-006 verification). Must land before P6 ships (milestone release). |
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## 4. Escalations
|
|
||||||
|
|
||||||
**None.** All nine axes resolved at confidence ≥ 0.60 after the binding
|
|
||||||
fixes G-025..G-028 are applied. No axis required escalation to the human.
|
|
||||||
At full autonomy, the orchestrator applies the binding decisions (D-078..
|
|
||||||
D-081) and binding fixes (G-025..G-028) and proceeds to EXECUTE.
|
|
||||||
|
|
||||||
The single most material finding is **G-028** (the go.mod audit surface):
|
|
||||||
because v0.5 already added cosmos-sdk, the v0.6 "go.mod unchanged" gate is
|
|
||||||
subtler than "no new deps" — it must verify no indirect dep was bumped
|
|
||||||
either. This is not an escalation (the fix is mechanical: diff go.mod
|
|
||||||
against the v0.5.0 tag), but it is the finding most likely to cause a
|
|
||||||
false-green P6 audit if not surfaced now.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## 5. Overall Verdict
|
|
||||||
|
|
||||||
### **SHIP Phase 0 WITH FIXES** (confidence 0.82)
|
|
||||||
|
|
||||||
The v0.6 Phase 0 plan is fundamentally sound and well-grounded: the
|
|
||||||
Go `html/template` + HTMX + stdlib `ServeMux` stack is genuinely zero-new-
|
|
||||||
dep (HTMX is a vendored static asset, not a Go dep — D-078); the mock-
|
|
||||||
server-over-real-Go-types approach (D-067) is grounded in verified
|
|
||||||
codebase facts (all six `x/*/types` packages exist with the structs and
|
|
||||||
methods the UI surfaces); the 5-screen scope is proportionate (not over-
|
|
||||||
scoped for a first UI milestone); the firewall-first ordering (D-069,
|
|
||||||
P1 before content) is the proven D-044 pattern; D-073 (code constants
|
|
||||||
over outdated docs) is verified correct against the actual numeric
|
|
||||||
contradiction (`GrainsPerBread=10000` vs docs "1,000×").
|
|
||||||
|
|
||||||
The 4 decision ratifications (D-078..D-081) are all **RATIFIED**:
|
|
||||||
- **D-078** (G-006 boundary — HTMX is a static asset) — RATIFY with G-028
|
|
||||||
audit enforcement.
|
|
||||||
- **D-079** (G-003 boundary — web/ is app-layer) — RATIFY with G-025
|
|
||||||
import-invariant enforcement.
|
|
||||||
- **D-080** (D-073 — code constants over docs) — RATIFY as-is (regression-
|
|
||||||
guard test already in the plan).
|
|
||||||
- **D-081** (lexicon firewall extension to web/) — RATIFY with G-026
|
|
||||||
error-response lexicon enforcement.
|
|
||||||
|
|
||||||
The 4 binding fixes (G-025..G-028) are **correctness and verification
|
|
||||||
hardening**, not scope rework:
|
|
||||||
- **G-025** (import-invariant forbids `x/*/module` too) — closes the
|
|
||||||
"no keeper but maybe module" gap in the plan's `web/store/import_test.go`.
|
|
||||||
- **G-026** (rendered-HTML lexicon check covers error responses) — closes
|
|
||||||
the error-message drift vector the happy-path check misses.
|
|
||||||
- **G-027** (ReachID/HolderID validation before map-key use) — prototype-
|
|
||||||
robustness gate; prevents route confusion and memory exhaustion on
|
|
||||||
adversarial input.
|
|
||||||
- **G-028** (go.mod diff against v0.5.0 baseline, not just "no new
|
|
||||||
require lines") — closes the indirect-dep-bump false-green in the P6
|
|
||||||
audit.
|
|
||||||
|
|
||||||
None of these rise to "RETHINK" or "REDUCE SCOPE" — the architecture,
|
|
||||||
scope, ordering, and persona assignments are correct. The security posture
|
|
||||||
(no auth, no sessions, in-memory store) is acceptable for a "working
|
|
||||||
prototype" milestone and explicitly out of scope. Apply the 4 binding
|
|
||||||
fixes and proceed to EXECUTE (P1).
|
|
||||||
|
|
||||||
**Confidence in overall verdict: 0.82**
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## 6. Summary Block
|
|
||||||
|
|
||||||
```
|
|
||||||
Decision ratifications:
|
|
||||||
D-078 (G-006 boundary — HTMX vendored static asset) — RATIFY (0.92)
|
|
||||||
D-079 (G-003 boundary — web/ is app-layer, not x/) — RATIFY (0.85)
|
|
||||||
D-080 (D-073 — code constants over outdated docs) — RATIFY (0.90)
|
|
||||||
D-081 (lexicon firewall extension to web/) — RATIFY (0.88)
|
|
||||||
|
|
||||||
Nine-axis scorecard:
|
|
||||||
1. Feasibility (html/template + HTMX + stdlib) — PASS (0.85)
|
|
||||||
2. Scope (5 screens + firewall + mock, 5 phases) — PASS (0.80)
|
|
||||||
3. Cost (6 phases, 33 tasks) — PASS (0.82)
|
|
||||||
4. G-006 (HTMX vendored, not a Go dep) — PASS (0.92) → enforced by G-028
|
|
||||||
5. G-003 (web/ app-layer consumption) — CONDITIONAL (0.78) → fixed by G-025
|
|
||||||
6. REQ-012 (lexicon firewall extension to web/) — CONDITIONAL (0.80) → fixed by G-026
|
|
||||||
7. Bread-scale (D-073 code constants) — PASS (0.90)
|
|
||||||
8. Security (no auth, XSS, injection) — CONDITIONAL (0.75) → fixed by G-027
|
|
||||||
9. Testability (≥80% web/, HTMX fragments, MVP) — PASS (0.82)
|
|
||||||
|
|
||||||
Feature purity gate: PASS WITH FIXES (G-025, G-028)
|
|
||||||
|
|
||||||
Binding fixes: 4 (G-025..G-028)
|
|
||||||
G-025 — web/store/import_test.go forbids x/*/keeper AND x/*/module — before P1
|
|
||||||
G-026 — rendered-HTML lexicon check covers error responses — before each phase
|
|
||||||
G-027 — CreateReach validates HolderID/PublicKey before map-key — before P1
|
|
||||||
G-028 — P6 audit diffs go.mod against v0.5.0 tag (not just no-new-lines) — before P6
|
|
||||||
|
|
||||||
Escalations: 0
|
|
||||||
Overall: SHIP Phase 0 WITH FIXES (confidence 0.82)
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## 7. CI Commit Block (for the orchestrator)
|
|
||||||
|
|
||||||
```
|
|
||||||
docs(P00): grill — v0.6 adversarial review (D-078+, G-025+)
|
|
||||||
|
|
||||||
---ci---
|
|
||||||
project: oy
|
|
||||||
phase: 0
|
|
||||||
milestone: v0.6
|
|
||||||
status: grill
|
|
||||||
decisions:
|
|
||||||
- id: D-078
|
|
||||||
decision: RATIFY G-006 boundary — HTMX vendored as web/static/htmx.min.js is G-006-compliant (static asset, not Go dep); go.mod unchanged across v0.6
|
|
||||||
rationale: vendored JS served over http.FileServer is not a Go module dep (no import path); go.mod already has cosmos-sdk from v0.5; v0.6 adds nothing; G-028 enforces diff-against-v0.5.0
|
|
||||||
confidence: 0.92
|
|
||||||
alternatives: [HTMX via go get (breaks G-006); node toolchain + React (breaks Go-only convention)]
|
|
||||||
- id: D-079
|
|
||||||
decision: RATIFY G-003 boundary — web/ importing x/*/types is app-layer consumption (D-070), not cross-x/ production import; G-003 firewall intact
|
|
||||||
rationale: web/ is not an x/ module; existing G-003 test scans x/**/*.go (web/ outside scope by construction); new web/store/import_test.go is the web/-scoped complement; G-025 extends forbidden set to x/*/module
|
|
||||||
confidence: 0.85
|
|
||||||
alternatives: [treat web/ as x/ module (wrong — not protocol); forbid web/ from importing x/*/types (would force TS/JSON fixtures, losing locked-constant grounding)]
|
|
||||||
- id: D-080
|
|
||||||
decision: RATIFY D-073 — Bread-scale source of truth = x/bread/types code constants (GrainsPerBread=10000, BreadScaleAll()), NOT docs/shared/bread-scale.md (outdated: 1,000× vs code 10,000×)
|
|
||||||
rationale: verified numeric contradiction (types.go:13 GrainsPerBread=10000 vs docs "1,000×"); code constants tested, docs not; doc-fix deferred to P1+ follow-up (not v0.6 scope); P2-03-01 regression-guard test enforces
|
|
||||||
confidence: 0.90
|
|
||||||
alternatives: [use docs values (wrong — not tested, disagrees with code); fix docs in v0.6 (out of scope — doc-drift fix, not UI feature)]
|
|
||||||
- id: D-081
|
|
||||||
decision: RATIFY lexicon firewall extension to web/ (REQ-045) — new sibling lexicon_meta_web/ mirroring lexicon_meta_docs/; firewall-first (P1 before content); "Create a Reach" label (not "account")
|
|
||||||
rationale: REQ-012 is All phases; UI strings user-facing; SyntheticBannedStrings() helper exists (G-014); lexicon_meta_docs/ has proven template; G-026 extends rendered-HTML check to error responses
|
|
||||||
confidence: 0.88
|
|
||||||
alternatives: [skip firewall (REQ-012 is All phases); single combined meta-test (loses isolation)]
|
|
||||||
fixes:
|
|
||||||
- id: G-025
|
|
||||||
fix: web/store/import_test.go MUST forbid x/*/keeper AND x/*/module (only x/*/types allowed from web/)
|
|
||||||
affects: P1-03-03
|
|
||||||
before_phase: P1
|
|
||||||
confidence: 0.82
|
|
||||||
- id: G-026
|
|
||||||
fix: per-handler rendered-HTML lexicon check MUST scan at least one ERROR response body (not just happy-path 200)
|
|
||||||
affects: P1-04-03, P2-03-01, P3-03-01, P4-03-01, P5-03-01
|
|
||||||
before_phase: P1 (carries through P2..P5)
|
|
||||||
confidence: 0.80
|
|
||||||
- id: G-027
|
|
||||||
fix: CreateReach MUST validate HolderID/PublicKey (non-empty, length-bounded, no path separators, no template syntax) before map-key use; handler test covers each validation failure
|
|
||||||
affects: P1-03-01, P1-04-03
|
|
||||||
before_phase: P1
|
|
||||||
confidence: 0.75
|
|
||||||
- id: G-028
|
|
||||||
fix: P6 audit MUST diff go.mod against v0.5.0 tag (not just check "no new direct require lines") — catches indirect dep bumps
|
|
||||||
affects: P6-02-01
|
|
||||||
before_phase: P6
|
|
||||||
confidence: 0.85
|
|
||||||
escalations: []
|
|
||||||
---/ci---
|
|
||||||
```
|
|
||||||
|
|||||||
+1
-465
@@ -1685,468 +1685,4 @@ The v0.5 deliverable MUST meet these explicit criteria (verified in P8 audit):
|
|||||||
7. **REQ-039**: `x/council` has `keeper/msg_server.go` + `types/msg_*.go`; `Proposal`/`ProposalKind`(4)/`ProposalStatus`(5)/`VoteOption`(4) enums added (D-060); `MissionLockAmendment-Rejected` rejected at `ValidateBasic` (D-064/A-572); Watcher Veto quorum default 6 (D-065/A-574); single-Veto-no-block (anti-greed); `MissionLockAmendable=false` unchanged (v0.2 regression green); `SignalKindCount=4` unchanged (v0.4 regression green); `CouncilKindCount=3` unchanged; no proposal auto-execution.
|
7. **REQ-039**: `x/council` has `keeper/msg_server.go` + `types/msg_*.go`; `Proposal`/`ProposalKind`(4)/`ProposalStatus`(5)/`VoteOption`(4) enums added (D-060); `MissionLockAmendment-Rejected` rejected at `ValidateBasic` (D-064/A-572); Watcher Veto quorum default 6 (D-065/A-574); single-Veto-no-block (anti-greed); `MissionLockAmendable=false` unchanged (v0.2 regression green); `SignalKindCount=4` unchanged (v0.4 regression green); `CouncilKindCount=3` unchanged; no proposal auto-execution.
|
||||||
8. **Feature purity gate (P8)**: no breaking schema changes (v0.3 `types/` contracts NOT amended); locked-const firewall intact (all v0.1..v0.4 consts unchanged; new P7 enums per D-060); G-003 production firewall intact (`expected_keepers.go` are interfaces); G-006 controlled exception GRILL-ratified (D-055/D-062).
|
8. **Feature purity gate (P8)**: no breaking schema changes (v0.3 `types/` contracts NOT amended); locked-const firewall intact (all v0.1..v0.4 consts unchanged; new P7 enums per D-060); G-003 production firewall intact (`expected_keepers.go` are interfaces); G-006 controlled exception GRILL-ratified (D-055/D-062).
|
||||||
9. **No regression**: `go test ./...` green; v0.4 coverage floor (93.3% on `x/hub/types`, 96.4% on `x/council/types`) not reduced on the `types/` packages; v0.1..v0.4 baseline tests green.
|
9. **No regression**: `go test ./...` green; v0.4 coverage floor (93.3% on `x/hub/types`, 96.4% on `x/council/types`) not reduced on the `types/` packages; v0.1..v0.4 baseline tests green.
|
||||||
10. **D-055/D-062 dep**: `go.mod` has cosmos-sdk v0.50.x + ibc-go v8.x (GRILL-ratified); `types/` packages gain `sdk.Msg` imports for `Msg*` (isolated in `types/msg_*.go`); invariant/lexicon tests stay stdlib-only and green.
|
10. **D-055/D-062 dep**: `go.mod` has cosmos-sdk v0.50.x + ibc-go v8.x (GRILL-ratified); `types/` packages gain `sdk.Msg` imports for `Msg*` (isolated in `types/msg_*.go`); invariant/lexicon tests stay stdlib-only and green.
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## v0.6 Plan (Nomad Web UI)
|
|
||||||
|
|
||||||
> This section APPENDS the v0.6 milestone plan to the v0.1..v0.5 plans above.
|
|
||||||
> It does NOT rewrite or supersede the earlier content. v0.6 is the project's
|
|
||||||
> first **UI** milestone: a working prototype Web UI where a person can sign up
|
|
||||||
> to be a Nomad (create a Reach + open a Stash) and exercise basic functionality
|
|
||||||
> around (Reach, Stash) plus Window authorization, Standing progress, and Bloom
|
|
||||||
> accrual. All data is generated test fixtures — no real blockchain (D-020
|
|
||||||
> continues). Stack: Go `html/template` + HTMX (vendored, no node) + Go 1.22
|
|
||||||
> `net/http.ServeMux` mock HTTP server in a new `web/` dir that instantiates the
|
|
||||||
> real `x/*/types` structs from in-memory fixtures (D-067). No keeper, no
|
|
||||||
> Cosmos runtime, no `app.go` (none exists in the repo). Tags run on the
|
|
||||||
> `v0.5.x` patch line (config.json `tag_base: v0.5.x`): P0 → `v0.5.0`;
|
|
||||||
> execution phases P1..P5 → `v0.5.1..v0.5.5`; final phase P6 → `v0.5.6` IS the
|
|
||||||
> v0.6 milestone release (D-008 — final phase patch IS the milestone release;
|
|
||||||
> no separate minor tag). Branch names use NO `oy/` prefix (single-project mode:
|
|
||||||
> only `oy` exists; the slug prefix would be redundant — config `projects[]`
|
|
||||||
> length is 1, matching the v0.5 convention).
|
|
||||||
|
|
||||||
### Milestone Summary
|
|
||||||
|
|
||||||
- **Milestone**: v0.6 — Nomad Web UI
|
|
||||||
- **Type**: Feature (P1..P5 are `feat`; REQ-045 is `test` co-shipped in P1; P6 is `final`)
|
|
||||||
- **Tag base**: `v0.5.x` patch line (P0 → `v0.5.0`; execution P1..P5 → `v0.5.1..v0.5.5`; final P6 → `v0.5.6` IS the v0.6 milestone release)
|
|
||||||
- **Phases**: 7 — P1..P5 (execution) + P6 (final review/audit/ship). Phase 0 (this PLAN) is in progress.
|
|
||||||
- **Depth**: UI prototype — Go `html/template` server-rendered HTML + HTMX progressive enhancement; in-memory mock store seeded from fixtures; instantiates real `x/*/types` structs (Reach, Stash, Window, FreeholderSignals, BloomRecord). No keeper, no Cosmos runtime, no `app.go`, no persistence (resets on restart).
|
|
||||||
- **Coverage target**: ≥80% on each new `web/` package (D-033 carries forward); the mock store + handlers have Go tests (`go test ./web/...`), not just manual browser checks. Lexicon firewall (REQ-012) extended to `web/` via a new sibling meta-test (REQ-045).
|
|
||||||
- **New dirs**: `web/` (top-level; `main.go`, `handlers/`, `store/`, `templates/`, `static/`); `lexicon_meta_web/` (sibling firewall test dir, mirrors `lexicon_meta_docs/`). **Extended**: none (`x/` is NOT modified — `web/` imports `x/*/types` as app-layer consumption per D-070, not a production cross-`x/` import).
|
|
||||||
- **G-006 (zero Go deps)**: preserved. HTMX is a vendored static asset (`web/static/htmx.min.js`), NOT a `go get`. Go 1.22 `net/http.ServeMux` is stdlib. `html/template` is stdlib. `go.mod` is unchanged (no new require lines; the v0.5 cosmos-sdk/ibc-go deps stay but v0.6 adds nothing).
|
|
||||||
- **G-003 (production firewall)**: intact. `web/` importing `x/*/types` is app-layer consumption (D-070), NOT a cross-`x/` production import. No `x/` module gains a production import of another `x/` module's types via `web/`. The v0.2 G-003 import-invariant test scans `x/**/*.go` (unchanged scope); `web/` is outside `x/` so it is not scanned by that test — a NEW `web/`-scoped test confirms `web/` only imports `x/*/types` (not `x/*/keeper`).
|
|
||||||
- **Phase ordering** (D-072, finalized here): P1 web foundation + Reach signup + lexicon firewall (REQ-040 + REQ-045 — same `web/` territory, vertical slice, firewall-first) → P2 Stash dashboard (REQ-041) → P3 Window authorization (REQ-042) → P4 Standing + Freeholder signals (REQ-043) → P5 Bloom accrual (REQ-044) → P6 final review/audit/ship. Each phase independently shippable (vertical slice); P1 lands the foundation + firewall first (lexicon-clean by construction — D-044 pattern).
|
|
||||||
- **Personas** (from PERSONAS.md, reactivated for v0.6): **frontend-engineer** owns `web/**` (templates, static, handlers, `main.go`) — REACTIVATED for the first time (territory `web/**`); **backend-engineer** co-owns `web/store/` (the mock store that imports `x/*/types`) + owns the lexicon firewall extension (REQ-045, `lexicon_meta_web/` — mirrors `lexicon_meta_docs/`); **lead-developer** owns P0 + P6 + coordination. The v0.5 cosmos-engineer/security-engineer/mesh-engineer personas are NOT reactivated (no keeper/MsgServer/simtest work in v0.6 — UI mock only). ci-security-auditor activated in P6.
|
|
||||||
|
|
||||||
### Cross-Phase Dependency Map (v0.6)
|
|
||||||
|
|
||||||
```
|
|
||||||
P1 (web foundation + Reach signup + lexicon firewall)
|
|
||||||
│ web/main.go + web/store/ + web/handlers/reach.go + web/templates/reach.html
|
|
||||||
│ lexicon_meta_web/lexicon_meta_web_test.go [firewall-first; scans web/ as content lands]
|
|
||||||
▼
|
|
||||||
P2 (Stash dashboard) [depends on Reach existing (signup creates Stash atomically, D-071)]
|
|
||||||
▼
|
|
||||||
P3 (Window authorization) [depends on Stash existing (Window scope references a Stash)]
|
|
||||||
▼
|
|
||||||
P4 (Standing + Freeholder signals) [depends on Reach existing (Standing is per-Reach)]
|
|
||||||
▼
|
|
||||||
P5 (Bloom accrual) [depends on Stash existing (BloomRecord is per-Stash)]
|
|
||||||
▼
|
|
||||||
P6 (final review/audit/ship)
|
|
||||||
```
|
|
||||||
|
|
||||||
Hard cross-phase blockers:
|
|
||||||
- **P1 lexicon firewall (`lexicon_meta_web/`)** → blocks P2..P5 content (firewall-first: a banned term slipped into a P2..P5 template/JS/Go file fails the build, not the P6 review — D-044/D-069 pattern).
|
|
||||||
- **P1 web foundation (`web/main.go` + `web/store/` + base templates)** → blocks P2..P5 (each screen extends the base layout + uses the mock store).
|
|
||||||
- **P1 Reach signup (REQ-040)** → blocks P2 (Stash dashboard needs a Stash, created atomically at signup per D-071), P4 (Standing is per-Reach).
|
|
||||||
- **P2 Stash dashboard (REQ-041)** → blocks P3 (Window scope references a Stash), P5 (BloomRecord is per-Stash).
|
|
||||||
- All P(N) phase-ship tasks block P(N+1) Wave 1 tasks (soft ordering for branch hygiene).
|
|
||||||
|
|
||||||
All other refs are app-layer consumption of `x/*/types` (D-070): `web/store/` imports `x/identity/types`, `x/stash/types`, `x/window/types`, `x/standing/types`, `x/bread/types`, `x/bloom/types`. No `x/` module is modified.
|
|
||||||
|
|
||||||
### D-070 / G-003 Boundary (app-layer consumption, NOT a cross-`x/` import)
|
|
||||||
|
|
||||||
`web/` is NOT an `x/` module — it is the application layer (exactly as a future `cmd/oyd` would be). `web/store/` importing `x/identity/types.Reach` is app-layer consumption of protocol types, the intended consumption direction. The G-003 firewall (no production struct imports across `x/<module>/types`) is intact: no `x/` module gains a production import of another `x/` module's types via `web/`. A new `web/`-scoped test (`web/store/import_test.go`) asserts `web/` only imports `x/*/types` packages (NOT `x/*/keeper` — there is no keeper in v0.6; the mock store IS the data source).
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Phase P1 — Web Foundation + Reach Signup + Lexicon Firewall (REQ-040, REQ-045) → v0.5.1
|
|
||||||
|
|
||||||
- **Slug**: `web-foundation-reach-firewall`
|
|
||||||
- **Branch**: `phase/01-web-foundation-reach-firewall`
|
|
||||||
- **REQs covered**: REQ-040 (Nomad Reach signup Web UI), REQ-045 (lexicon firewall extension to `web/`)
|
|
||||||
- **Tag**: `v0.5.1`
|
|
||||||
- **Type**: `feat+test`
|
|
||||||
- **Goal**: Ship the web foundation (Go 1.22 `net/http.ServeMux` mock server in `web/`, base templates, vendored HTMX, in-memory mock store importing `x/*/types`) + the "Create a Reach" signup form (POST) that atomically creates a Reach (`IsNomad=true`) + a Stash (D-071) + Reach list/detail views + the `lexicon_meta_web/` firewall extension (REQ-045, firewall-first). After P1, the UI is runnable via `go run ./web` and a visitor can create a Reach.
|
|
||||||
|
|
||||||
### Wave 1 — Lexicon firewall FIRST (parallel with Wave 2 foundation; no internal deps)
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P1-01-01 | REQ-045, D-069 | backend-engineer | `lexicon_meta_web/lexicon_meta_web_test.go` (NEW; package `lexicon_meta_web`) | **NEW sibling meta-test** mirroring `lexicon_meta_docs/lexicon_meta_docs_test.go` (D-069). Uses the SAME `lexicon.FindBannedTerm` (word-boundary, case-insensitive) — NO detection reimplementation. Walks the repo root; targets `web/templates/**/*.html` + `web/static/**/*.js` + `web/**/*.go` (production + test). Excludes `.ciagent/` (firewall meta-files), `.git/` (VCS), the meta-test file itself (self-exclusion via `runtime.Caller(0)`), and non-`.{html,js,go}` files under `web/`. Includes the G-009 self-test table (consumes `lexicon.SyntheticBannedStrings()` — G-014 shared helper from REQ-029), `TestLexiconMetaWebBannedTermsCount` (exactly 10), `TestLexiconMetaWebNoFalsePositiveOnOpenYield` (word-boundary does not match "openyield"/"european"), and `TestLexiconMetaWebWalkCoverage` (G-013 — injects a synthetic banned-term file into `web/templates/.lexicon_fixture/` and asserts the walk FINDS it). The firewall PASSES at P1 Wave 1 with zero `web/` content (a walk that scans nothing reports green on zero hits — closed by the walk-coverage test). **"Sign up" maps to "Create a Reach"** — the word "account" is banned (REQ-012); the firewall enforces this on all UI strings. | `go test ./lexicon_meta_web/...` green (invoked as `go test -run TestLexiconMetaWeb ./...`); self-test table passes for all 10 banned terms; `TestLexiconMetaWebNoFalsePositiveOnOpenYield` green; `TestLexiconMetaWebWalkCoverage` finds the fixture; a deliberately-injected banned term in a `web/templates/*.html` file fails the test | — |
|
|
||||||
|
|
||||||
### Wave 2 — Web foundation: main.go + mock store + base templates + HTMX (parallel with Wave 1; no internal deps)
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P1-02-01 | REQ-040, D-066, D-067, D-068 | frontend-engineer | `web/main.go`, `web/server.go` | `web/main.go`: `package main; func main()` calling `server.go`'s `runServer()`. `web/server.go`: Go 1.22 `net/http.ServeMux` (`mux := http.NewServeMux()`; Go 1.22 method-pattern routing `mux.HandleFunc("GET /", ...)`); serves `web/static/` via `http.FileServer` (HTMX vendored); loads templates via `html/template` (`template.ParseGlob("web/templates/*.html")`); constructs the mock store (`store.NewStore()` from P1-03-01) and injects it into handlers. Listens on `:8080` (env-overridable `PORT`). No external deps (stdlib only — G-006). No `app.go`, no Cosmos runtime. | `go build ./web` succeeds; `go run ./web` starts a server on `:8080` (manual check: `curl -s http://localhost:8080/` returns the home page); `go.mod` unchanged (zero new require lines); lexicon firewall green on `web/main.go` + `web/server.go` | — |
|
|
||||||
| P1-02-02 | REQ-040, D-066 | frontend-engineer | `web/static/htmx.min.js` (vendored), `web/static/style.css` | Vendored HTMX 1.x minified JS (a single static asset — NOT a `go get`; G-006 preserved). `style.css`: minimal lexicon-clean CSS for the 5 screens (no banned terms in comments/class names). HTMX attributes used for progressive enhancement (form POST → swap). | `web/static/htmx.min.js` exists (vendored, not a go.mod entry); `go build ./web` succeeds; `go run ./web` serves `/static/htmx.min.js` (manual check: `curl -s http://localhost:8080/static/htmx.min.js` returns the JS); lexicon firewall green on `web/static/**` | — |
|
|
||||||
| P1-02-03 | REQ-040 | frontend-engineer | `web/templates/base.html`, `web/templates/home.html` | `base.html`: the shared layout (head, nav, `{{block "content" .}}{{end}}`, HTMX script tag, footer). Nav links to all 5 screens (Reach signup, Stash dashboard, Window authorization, Standing progress, Bloom accrual) — P2..P5 screens link to placeholder routes that P2..P5 fill in. `home.html`: site home with a one-paragraph OpenYield overview (lexicon-clean — "real production"/"Holder"/"Reach"/"Stash"; NOT "yield"/"account"/"bank") + links to the 5 screens. Lexicon-clean by construction (the P1-01-01 firewall scans these as they land). | `web/templates/base.html` + `web/templates/home.html` exist; `go run ./web` serves `/` (home renders); nav has 5 links; lexicon firewall green | P1-01-01, P1-02-01 |
|
|
||||||
|
|
||||||
### Wave 3 — Mock store (imports x/*/types) + import-invariant test (blocked-by Wave 2)
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P1-03-01 | REQ-040, D-067, D-070, D-071 | backend-engineer | `web/store/store.go`, `web/store/fixtures.go` | `web/store/store.go`: in-memory mock store (`type Store struct { mu sync.Mutex; reaches map[string]identitytypes.Reach; stashes map[string]stashtypes.Stash; ... }`). `NewStore()` seeds from `fixtures.go`. Methods: `CreateReach(holderID, publicKey string) (identitytypes.Reach, stashtypes.Stash, error)` — **atomic Reach + Stash creation per D-071**: creates a `Reach` with `IsNomad=true` + a `Stash` with `HolderID` matching the Reach's `HolderID` and `BalanceGrain` seeded to a test value (e.g., 500000 Grain = 50 Bread per D-071 example); `ListReaches() []identitytypes.Reach`; `GetReach(reachID string) (identitytypes.Reach, bool)`; `GetStash(holderID string) (stashtypes.Stash, bool)`. Imports `x/identity/types`, `x/stash/types` (app-layer consumption — D-070; NOT a cross-`x/` import). `fixtures.go`: seed data (a few pre-existing Reach/Stash pairs for the list view). All strings lexicon-clean ("Holder"/"Reach"/"Stash"; NOT "account"/"bank"/"deposit"). | `go build ./web/store` succeeds; `go test ./web/store` passes (P1-03-02); `CreateReach` returns a Reach with `IsNomad=true` AND a Stash with matching `HolderID` (atomic — D-071); `web/store` imports only `x/identity/types` + `x/stash/types` (no `x/*/keeper` — verified by P1-03-03); lexicon firewall green | P1-02-01 |
|
|
||||||
| P1-03-02 | REQ-040, D-033 | backend-engineer | `web/store/store_test.go` | Table-driven tests: `CreateReach` atomicity (Reach `IsNomad=true` + Stash `HolderID` matches + `BalanceGrain` seeded); `ListReaches` returns seeded + created; `GetReach` hit/miss; `GetStash` hit/miss; concurrent `CreateReach` (mutex safety — two goroutines, distinct holder IDs, no race). Coverage ≥80% on `web/store`. | `go test ./web/store` passes; coverage ≥80% on `web/store`; atomic-create test asserts both Reach + Stash exist after one call; lexicon firewall green | P1-03-01 |
|
|
||||||
| P1-03-03 | REQ-040, D-070, G-003 | backend-engineer | `web/store/import_test.go` | **G-003 boundary test for `web/`**: scans all non-test `.go` files under `web/` using `go/parser` (or `go/build` import list) and asserts `web/` imports ONLY `x/*/types` packages (NOT `x/*/keeper` — there is no keeper in v0.6). This is the app-layer-consumption invariant (D-070): `web/` may consume protocol types but must not reach into keeper/state machinery. The existing v0.2 G-003 import-invariant test (scanning `x/**/*.go`) is UNCHANGED — `web/` is outside `x/` so it is not in that test's scope; this NEW test covers the `web/` scope. | `go test ./web/store` passes; the import-invariant test asserts no `x/*/keeper` import in any `web/` production file; `x/*/types` imports are allowed (D-070) | P1-03-01 |
|
|
||||||
|
|
||||||
### Wave 4 — Reach signup handler + templates + tests (blocked-by Wave 3 store)
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P1-04-01 | REQ-040, D-071 | frontend-engineer | `web/handlers/reach.go`, `web/handlers/server.go` (handler wiring) | `web/handlers/reach.go`: `ReachHandler` struct holding `*store.Store` + `*template.Template`. Routes (Go 1.22 method patterns, wired in `web/server.go`): `GET /reach` → list view (`ListReaches`); `GET /reach/{id}` → detail view (`GetReach` + `GetStash`); `GET /reach/new` → "Create a Reach" form (lexicon-clean: "Create a Reach", NOT "Sign up for an account" — "account" is banned); `POST /reach` → form handler calling `store.CreateReach` (atomic Reach + Stash per D-071), redirect to the new Reach detail. HTMX: the form POST can be progressive-enhanced (`hx-post="/reach"` → swap). `web/handlers/server.go`: handler constructor + route registration helper. | `go build ./web` succeeds; `go run ./web` serves `GET /reach` (list), `GET /reach/new` (form), `POST /reach` (creates + redirects); manual browser check: fill the form → a Reach + Stash appear; lexicon firewall green on `web/handlers/reach.go` | P1-03-01, P1-02-03 |
|
|
||||||
| P1-04-02 | REQ-040 | frontend-engineer | `web/templates/reach_list.html`, `web/templates/reach_detail.html`, `web/templates/reach_new.html` | `reach_list.html`: table of Reaches (ReachID, HolderID, IsNomad, IsFreeholder) + "Create a Reach" link. `reach_detail.html`: Reach fields + the associated Stash (BalanceGrain). `reach_new.html`: the "Create a Reach" form (HolderID + PublicKey inputs; submit POST `/reach`). All lexicon-clean ("Holder"/"Reach"/"Stash"; NOT "account"/"bank"/"deposit"). Extends `base.html`. | `go run ./web` renders all 3 Reach templates; manual browser check: form submission creates a Reach visible in the list; lexicon firewall green on all 3 templates | P1-04-01, P1-02-03 |
|
|
||||||
| P1-04-03 | REQ-040, D-033 | frontend-engineer + backend-engineer | `web/handlers/reach_test.go` | Handler tests using `httptest.NewRecorder` + `httptest.NewRequest` (stdlib — no external test deps): `GET /reach` returns 200 + list HTML; `GET /reach/{id}` returns 200 + detail HTML for a seeded Reach; `GET /reach/new` returns 200 + form HTML; `POST /reach` with valid form creates a Reach + Stash atomically (assert both in the store) + redirects (302) to the detail; `POST /reach` with empty HolderID returns 400; the rendered HTML contains NO banned terms (assert via `lexicon.FindBannedTerm` on the response body — a per-handler lexicon check, complementing the file-scan firewall). Coverage ≥80% on `web/handlers` (P1 scope). | `go test ./web/handlers` passes; coverage ≥80% on `web/handlers` (P1 subset); atomic-create asserted via the store after POST; rendered-HTML lexicon check green | P1-04-01, P1-04-02 |
|
|
||||||
|
|
||||||
### Wave 5 — Phase verification + ship
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P1-99-01 | REQ-012, REQ-040, REQ-045 | lead-developer | (cross-cutting) | `go build ./...` + `go test ./...` green (incl. all v0.1..v0.5 baseline + P1 web + the new `lexicon_meta_web/` firewall); coverage ≥80% on `web/store` + `web/handlers` (P1 subset); `lexicon_meta_web/` firewall green; `lexicon_meta_test.go` (v0.2, x/*.go) + `lexicon_meta_docs_test.go` (v0.3, docs) green (no regression); `go.mod` unchanged (G-006 — zero new require lines); `go run ./web` starts on `:8080` (manual check); tag `v0.5.1`. | `go test ./...` green; coverage ≥80% on `web/store` + `web/handlers`; all 3 lexicon firewalls green; `go.mod` unchanged; `go run ./web` serves the home + Reach screens; git tag `v0.5.1` created | P1-01-01, P1-04-03, P1-03-02, P1-03-03 |
|
|
||||||
|
|
||||||
### P1 Must-Haves
|
|
||||||
- [ ] `lexicon_meta_web/lexicon_meta_web_test.go` exists (package `lexicon_meta_web`); mirrors `lexicon_meta_docs/` detection (same `lexicon.FindBannedTerm` + word-boundary + G-009 self-test via `lexicon.SyntheticBannedStrings()` + G-013 walk-coverage + self-exclusion); scans `web/templates/**/*.html` + `web/static/**/*.js` + `web/**/*.go`; excludes `.ciagent/` + `.git/` + itself.
|
|
||||||
- [ ] `go test ./lexicon_meta_web/...` green (firewall passes with P1 web content).
|
|
||||||
- [ ] `go test ./...` green across the whole repo (no regression; v0.2/v0.3 lexicon firewalls unchanged).
|
|
||||||
- [ ] `web/main.go` + `web/server.go` exist; Go 1.22 `net/http.ServeMux` + `html/template`; `go run ./web` starts on `:8080` with no external deps.
|
|
||||||
- [ ] `web/static/htmx.min.js` vendored (NOT a `go get`); `go.mod` unchanged (G-006).
|
|
||||||
- [ ] `web/store/store.go` imports `x/identity/types` + `x/stash/types` (D-070 app-layer consumption); `CreateReach` atomically creates a Reach (`IsNomad=true`) + a Stash (D-071); `web/store/import_test.go` asserts no `x/*/keeper` imports.
|
|
||||||
- [ ] `web/handlers/reach.go` + 3 Reach templates exist; `GET /reach` (list), `GET /reach/{id}` (detail), `GET /reach/new` (form), `POST /reach` (atomic create + redirect).
|
|
||||||
- [ ] "Create a Reach" labels used (NOT "Sign up for an account" — "account" is banned per REQ-012).
|
|
||||||
- [ ] ≥80% coverage on `web/store` + `web/handlers` (P1 subset).
|
|
||||||
- [ ] Rendered-HTML lexicon check green (per-handler test asserts no banned terms in response body).
|
|
||||||
- [ ] Git tag `v0.5.1`.
|
|
||||||
|
|
||||||
### P1 Risks & Mitigations
|
|
||||||
- **"account" lexicon drift in signup form** (highest P1 risk) → "Create a Reach" labels; the `lexicon_meta_web/` firewall scans `web/templates/reach_new.html`; the per-handler rendered-HTML lexicon check (P1-04-03) catches a banned term in dynamic content. Mitigation: firewall-first (P1-01-01 lands before content).
|
|
||||||
- **HTMX vendored asset size / version** → HTMX 1.x minified is ~14KB; vendored as a static file, not a go.mod entry. Pin the version in a comment in `web/static/htmx.min.js` header.
|
|
||||||
- **Atomic Reach + Stash creation race (D-071)** → `CreateReach` holds the store mutex across both map writes; the concurrent-create test (P1-03-02) asserts no race.
|
|
||||||
- **G-003 boundary confusion** → `web/` importing `x/*/types` is app-layer consumption (D-070), NOT a cross-`x/` import; the NEW `web/store/import_test.go` (P1-03-03) documents and enforces the boundary (only `x/*/types`, never `x/*/keeper`).
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Phase P2 — Stash Dashboard (REQ-041) → v0.5.2
|
|
||||||
|
|
||||||
- **Slug**: `stash-dashboard`
|
|
||||||
- **Branch**: `phase/02-stash-dashboard`
|
|
||||||
- **REQs covered**: REQ-041 (Stash dashboard — balance in Grain + Bread-scale conversion + 90-day maturity progress)
|
|
||||||
- **Tag**: `v0.5.2`
|
|
||||||
- **Type**: `feat`
|
|
||||||
- **Goal**: Ship the Stash dashboard screen: balance in Grain + Bread-scale conversion (using `x/bread/types.BreadScaleAll()` + `GrainsPerBread=10000` per D-073 — code constants are the source of truth, NOT docs) + 90-day maturity progress bar (`x/stash/types.StashActivity.IsMature`, `MaturityThresholdDays=90`). Depends on P1 (a Stash exists, created atomically at signup per D-071).
|
|
||||||
|
|
||||||
### Wave 1 — Store extensions + handler + template (parallel where possible; blocked-by P1 ship)
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P2-01-01 | REQ-041, D-073 | backend-engineer | `web/store/store.go` (EXTEND), `web/store/fixtures.go` (EXTEND) | Extend the mock store: add `GetStashActivity(stashID string) (stashtypes.StashActivity, bool)` + seed `StashActivity` fixtures (some mature, some not — `ActiveDays` varying around `MaturityThresholdDays=90`; `MaxGapDays` varying around `MaxGapForMaturity=30`). Import `x/stash/types` (already imported in P1). The Bread-scale conversion is computed in the handler/template from `x/bread/types.BreadScaleAll()` + `GrainsPerBread=10000` (D-073 — code constants, NOT `docs/shared/bread-scale.md` which is outdated). | `go build ./web/store` succeeds; `GetStashActivity` returns seeded activities; `web/store` still imports only `x/*/types` (P1-03-03 import-invariant green); lexicon firewall green | P1-99-01 |
|
|
||||||
| P2-02-01 | REQ-041, D-073 | frontend-engineer | `web/handlers/stash.go`, `web/handlers/server.go` (EXTEND route wiring) | `StashHandler` struct. Route: `GET /stash/{holderID}` → dashboard. Loads `Stash` (balance `BalanceGrain` in Grain) + `StashActivity` from the store; computes Bread-scale conversion by calling `x/bread/types.BreadScaleAll()` (returns the 11-denomination table) and `x/bread/types.GrainsPerBread` (10000) to convert the Grain balance into Bread (and display the full scale table for context). Computes 90-day maturity progress: `ActiveDays / MaturityThresholdDays` (as a percentage; capped at 100%) + `IsMature()` boolean (`stashtypes.StashActivity.IsMature()` — `ActiveDays >= 90 && MaxGapDays <= 30`). Passes all to the template. | `go build ./web` succeeds; `go run ./web` serves `GET /stash/{holderID}` (200 + dashboard HTML); Bread-scale conversion uses `BreadScaleAll()` + `GrainsPerBread=10000` (D-073 — verified by a test asserting the conversion matches the code constants); lexicon firewall green | P2-01-01, P1-02-03 |
|
|
||||||
| P2-02-02 | REQ-041 | frontend-engineer | `web/templates/stash.html` | Stash dashboard template: balance in Grain + Bread-scale conversion table (all 11 denominations from `BreadScaleAll()` — Grain, Crumb, Bread, Loaf, Batch, Cake, Bakery, Granary, Mill, Harvest, Earth) + 90-day maturity progress bar (CSS width = `ActiveDays/90 * 100%`) + `IsMature` badge (green if mature, amber if not). Extends `base.html`. Lexicon-clean ("Stash"/"Grain"/"Bread"/"maturity"; NOT "bank"/"deposit"/"savings"/"interest"). | `go run ./web` renders the Stash dashboard; manual check: balance shows in Grain + Bread scale; progress bar reflects `ActiveDays`; lexicon firewall green on `web/templates/stash.html` | P2-02-01, P1-02-03 |
|
|
||||||
|
|
||||||
### Wave 2 — Tests (blocked-by Wave 1)
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P2-03-01 | REQ-041, D-073, D-033 | frontend-engineer + backend-engineer | `web/handlers/stash_test.go`, `web/store/store_test.go` (EXTEND) | Handler test (`httptest`): `GET /stash/{holderID}` returns 200 + dashboard HTML; the rendered HTML shows the Grain balance + the Bread-scale conversion table (all 11 denominations) + the maturity progress bar. **Bread-scale conversion correctness test**: asserts the handler's conversion matches `x/bread/types.BreadScaleAll()` + `GrainsPerBread=10000` (D-073 — e.g., 500000 Grain = 50 Bread; 100 Grain = 1 Crumb); a test that would FAIL if the handler used the outdated `docs/shared/bread-scale.md` values (1,000× ratios) instead of the code constants. **Maturity progress test**: a mature fixture (`ActiveDays=90, MaxGapDays=10` → `IsMature()==true`, progress 100%) vs an immature fixture (`ActiveDays=45, MaxGapDays=10` → `IsMature()==false`, progress 50%). Store test: `GetStashActivity` hit/miss. Rendered-HTML lexicon check (no banned terms in response body). Coverage ≥80% on `web/handlers` (P1+P2 cumulative). | `go test ./web/...` passes; Bread-scale conversion matches code constants (D-073); maturity progress matches `IsMature()`; coverage ≥80% on `web/handlers` (cumulative); rendered-HTML lexicon check green | P2-02-02, P2-01-01 |
|
|
||||||
|
|
||||||
### Wave 3 — Phase verification + ship
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P2-99-01 | REQ-012, REQ-041 | lead-developer | (cross-cutting) | `go build ./...` + `go test ./...` green; coverage ≥80% on `web/store` + `web/handlers` (cumulative); `lexicon_meta_web/` firewall green (now scans `web/templates/stash.html` + `web/handlers/stash.go`); `go.mod` unchanged; `go run ./web` serves the Stash dashboard; tag `v0.5.2`. | `go test ./...` green; coverage ≥80% (cumulative); `lexicon_meta_web/` green; `go.mod` unchanged; Stash dashboard reachable from home; git tag `v0.5.2` | P2-03-01 |
|
|
||||||
|
|
||||||
### P2 Must-Haves
|
|
||||||
- [ ] `web/handlers/stash.go` + `web/templates/stash.html` exist; `GET /stash/{holderID}` renders the dashboard.
|
|
||||||
- [ ] Balance shown in Grain + Bread-scale conversion using `x/bread/types.BreadScaleAll()` + `GrainsPerBread=10000` (D-073 — code constants, NOT docs).
|
|
||||||
- [ ] 90-day maturity progress bar + `IsMature` badge using `x/stash/types.StashActivity.IsMature()` + `MaturityThresholdDays=90` + `MaxGapForMaturity=30`.
|
|
||||||
- [ ] Bread-scale conversion correctness test (would fail if docs values were used instead of code constants — D-073 regression guard).
|
|
||||||
- [ ] ≥80% coverage on `web/store` + `web/handlers` (cumulative).
|
|
||||||
- [ ] `lexicon_meta_web/` firewall green; rendered-HTML lexicon check green.
|
|
||||||
- [ ] `go.mod` unchanged (G-006).
|
|
||||||
- [ ] Git tag `v0.5.2`.
|
|
||||||
|
|
||||||
### P2 Risks & Mitigations
|
|
||||||
- **Bread-scale source-of-truth drift (D-073)** → the conversion correctness test asserts the handler uses `BreadScaleAll()` + `GrainsPerBread=10000` (code constants); a test using the outdated `docs/shared/bread-scale.md` 1,000× ratios would fail. The doc-fix is a P1+ follow-up (NOT v0.6 scope — PROJECT.md out-of-scope).
|
|
||||||
- **Maturity progress > 100%** → cap `ActiveDays/90` at 100% in the template/handler; test the cap.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Phase P3 — Window Authorization (REQ-042) → v0.5.3
|
|
||||||
|
|
||||||
- **Slug**: `window-authorization`
|
|
||||||
- **Branch**: `phase/03-window-authorization`
|
|
||||||
- **REQs covered**: REQ-042 (Window authorization — open Window (scope+duration+rate-limit), lifecycle Open→Active→Revoked/Expired via `Window.Activate/Revoke/Expire`, audit log)
|
|
||||||
- **Tag**: `v0.5.3`
|
|
||||||
- **Type**: `feat`
|
|
||||||
- **Goal**: Ship the Window authorization screen: a form to open a Window (scope + duration + rate-limit) delegating to a service, a lifecycle view (Open→Active→Revoked/Expired using `x/window/types.Window.Activate/Revoke/Expire`), and an audit log view (`AuditEntry`). Depends on P2 (Window scope references a Stash).
|
|
||||||
|
|
||||||
### Wave 1 — Store extensions + handler + template (blocked-by P2 ship)
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P3-01-01 | REQ-042 | backend-engineer | `web/store/store.go` (EXTEND), `web/store/fixtures.go` (EXTEND) | Extend the mock store: add `windows map[string]windowtypes.Window` + `auditLogs map[string][]windowtypes.AuditEntry`. Methods: `OpenWindow(grantorHolder, grantee string, scope windowtypes.Scope, start, end int64, rateLimit windowtypes.RateLimit) (windowtypes.Window, error)` (creates a Window status=Open + an initial `AuditEntry`); `ActivateWindow(windowID string) error` (calls `Window.Activate()` — Open→Active); `RevokeWindow(windowID string) error` (calls `Window.Revoke()` — idempotent; Revoked/Expired are no-ops); `ExpireWindow(windowID string)` (calls `Window.Expire()`); `ListWindows(grantorHolder string) []windowtypes.Window`; `GetWindow(windowID string) (windowtypes.Window, bool)`; `GetAuditLog(windowID string) []windowtypes.AuditEntry`; `AppendAuditEntry(windowID string, entry windowtypes.AuditEntry)`. Import `x/window/types` (app-layer — D-070). Seed fixtures: a few Windows in various lifecycle states (Open, Active, Revoked, Expired) + audit logs. | `go build ./web/store` succeeds; `OpenWindow` creates a Window status=Open; `ActivateWindow` transitions Open→Active; `RevokeWindow` transitions to Revoked (idempotent on already-Revoked/Expired); `ExpireWindow` transitions to Expired; `web/store` still imports only `x/*/types` (import-invariant green); lexicon firewall green | P2-99-01 |
|
|
||||||
| P3-02-01 | REQ-042 | frontend-engineer | `web/handlers/window.go`, `web/handlers/server.go` (EXTEND) | `WindowHandler` struct. Routes: `GET /window` → list of Windows for a holder; `GET /window/{id}` → detail (lifecycle state + scope + rate-limit + audit log); `GET /window/new` → "Open a Window" form (scope kind dropdown from `ScopeKind` enum: ReadStash/ReadStanding/ProcessPassActForStand; resource-id; grantee; duration start/end; rate-limit max-actions + per-duration); `POST /window` → `OpenWindow` + redirect to detail; `POST /window/{id}/activate` → `ActivateWindow` (HTMX swap); `POST /window/{id}/revoke` → `RevokeWindow`; `POST /window/{id}/expire` → `ExpireWindow`. Each lifecycle action appends an `AuditEntry`. | `go build ./web` succeeds; `go run ./web` serves the 4 Window routes; lifecycle transitions call `Window.Activate/Revoke/Expire` (verified by test); lexicon firewall green | P3-01-01, P1-02-03 |
|
|
||||||
| P3-02-02 | REQ-042 | frontend-engineer | `web/templates/window_list.html`, `web/templates/window_detail.html`, `web/templates/window_new.html` | `window_list.html`: table of Windows (WindowID, GrantorHolder, Grantee, Scope, Status) + "Open a Window" link. `window_detail.html`: Window fields + lifecycle state badge (Open=amber, Active=green, Revoked=red, Expired=grey) + Activate/Revoke/Expire buttons (HTMX `hx-post`) + audit log table (`AuditEntry` rows: timestamp, action, result, granter-ref). `window_new.html`: the "Open a Window" form. Extends `base.html`. Lexicon-clean ("Window"/"scope"/"Holder"/"Reach"; NOT "account"/"bank"). | `go run ./web` renders all 3 Window templates; manual check: open a Window → activate → revoke → audit log shows the actions; lexicon firewall green on all 3 templates | P3-02-01, P1-02-03 |
|
|
||||||
|
|
||||||
### Wave 2 — Tests (blocked-by Wave 1)
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P3-03-01 | REQ-042, D-033 | frontend-engineer + backend-engineer | `web/handlers/window_test.go`, `web/store/store_test.go` (EXTEND) | Handler tests (`httptest`): `GET /window` (list 200); `GET /window/{id}` (detail 200 + lifecycle badge + audit log); `GET /window/new` (form 200); `POST /window` (open → 302 to detail; new Window status=Open + initial AuditEntry); `POST /window/{id}/activate` (Open→Active; AuditEntry appended); `POST /window/{id}/revoke` (→Revoked; idempotent — second revoke is a no-op, no new AuditEntry); `POST /window/{id}/expire` (→Expired; revoke-after-expire is a no-op). **Lifecycle correctness test**: asserts the handler calls `Window.Activate/Revoke/Expire` (the real `x/window/types` methods — not a reimplementation); `Revoke()` on an Expired window is a no-op (matches the v0.2 type contract). Store tests: `OpenWindow`/`ActivateWindow`/`RevokeWindow`/`ExpireWindow`/`ListWindows`/`GetAuditLog` round-trips. Rendered-HTML lexicon check. Coverage ≥80% on `web/handlers` (P1+P2+P3 cumulative). | `go test ./web/...` passes; lifecycle transitions match `Window.Activate/Revoke/Expire`; revoke-on-expired no-op; coverage ≥80% (cumulative); rendered-HTML lexicon check green | P3-02-02, P3-01-01 |
|
|
||||||
|
|
||||||
### Wave 3 — Phase verification + ship
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P3-99-01 | REQ-012, REQ-042 | lead-developer | (cross-cutting) | `go build ./...` + `go test ./...` green; coverage ≥80% (cumulative); `lexicon_meta_web/` green; `go.mod` unchanged; `go run ./web` serves the Window screen; tag `v0.5.3`. | `go test ./...` green; coverage ≥80% (cumulative); `lexicon_meta_web/` green; `go.mod` unchanged; Window screen reachable from home; git tag `v0.5.3` | P3-03-01 |
|
|
||||||
|
|
||||||
### P3 Must-Haves
|
|
||||||
- [ ] `web/handlers/window.go` + 3 Window templates exist; `GET /window` (list), `GET /window/{id}` (detail + lifecycle + audit log), `GET /window/new` (form), `POST /window` (open), `POST /window/{id}/activate|revoke|expire` (lifecycle).
|
|
||||||
- [ ] Lifecycle transitions call `x/window/types.Window.Activate/Revoke/Expire` (the real methods); `Revoke()` on Expired is a no-op (v0.2 type contract).
|
|
||||||
- [ ] Audit log (`AuditEntry`) appended on each lifecycle action; displayed in the detail view.
|
|
||||||
- [ ] Window form uses `ScopeKind` enum (ReadStash/ReadStanding/ProcessPassActForStand) + rate-limit fields.
|
|
||||||
- [ ] ≥80% coverage on `web/store` + `web/handlers` (cumulative).
|
|
||||||
- [ ] `lexicon_meta_web/` firewall green; rendered-HTML lexicon check green.
|
|
||||||
- [ ] `go.mod` unchanged (G-006).
|
|
||||||
- [ ] Git tag `v0.5.3`.
|
|
||||||
|
|
||||||
### P3 Risks & Mitigations
|
|
||||||
- **Lifecycle state-machine divergence from the type contract** → the handler MUST call `Window.Activate/Revoke/Expire` (not reimplement transitions); the lifecycle correctness test asserts the real methods are invoked.
|
|
||||||
- **Revoke-on-Expired no-op** → the v0.2 `Revoke()` returns nil on Expired (terminal state wins); the test covers this edge.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Phase P4 — Standing + Freeholder Signals (REQ-043) → v0.5.4
|
|
||||||
|
|
||||||
- **Slug**: `standing-freeholder-signals`
|
|
||||||
- **Branch**: `phase/04-standing-freeholder-signals`
|
|
||||||
- **REQs covered**: REQ-043 (Standing + Freeholder signals progress — computed from mock `Rating`/`Vouch`/`Slash` using locked constants + `GetStandingBucket`/`ComputeDiversityBonus`/`GetVoucherWeight`; 4-signal progress via `FreeholderSignals.IsFreeholderEligible`)
|
|
||||||
- **Tag**: `v0.5.4`
|
|
||||||
- **Type**: `feat`
|
|
||||||
- **Goal**: Ship the Standing + Freeholder signals progress screen: computed from mock `Rating`/`Vouch`/`Slash` records using the locked formula constants + `GetStandingBucket`/`ComputeDiversityBonus`/`GetVoucherWeight`; displays the 4-signal progress (`FreeholderSignals.IsFreeholderEligible` — StashMaturity, MultiDomainStanding, CommittedCapital, CommunityEndorsement). Depends on P1 (Standing is per-Reach).
|
|
||||||
|
|
||||||
### Wave 1 — Store extensions + handler + template (blocked-by P3 ship)
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P4-01-01 | REQ-043 | backend-engineer | `web/store/store.go` (EXTEND), `web/store/fixtures.go` (EXTEND) | Extend the mock store: add `ratings map[string][]standingtypes.Rating` (per-ratee), `vouches map[string][]standingtypes.Vouch`, `slashes map[string][]standingtypes.Slash`. Methods: `ListRatings(rateeID string) []standingtypes.Rating`; `ListVouches(voucheeID string) []standingtypes.Vouch`; `ListSlashes(reachID string) []standingtypes.Slash`; `ComputeStandingScore(reachID string) (float64, standingtypes.StandingBucket)` — computes a simplified standing score from the mock Ratings using the locked constants (`PriorMean=4.0`, `PriorWeight=10`, decay buckets, `ComputeDiversityBonus`, `GetVoucherWeight`) + `GetStandingBucket(score, ratingCount, isSlashed)`; `ComputeFreeholderSignals(reachID string) standingtypes.FreeholderSignals` — computes the 4 signals: `StashMaturity` (from `StashActivity.IsMature()` — P2 store method), `MultiDomainStanding` (score >= `FreeholderMinStandingScore=4.5` in >= `FreeholderMinCategories=3`), `CommittedCapital` (mock: Stash balance >= a threshold), `CommunityEndorsement` (>= 1 Vouch). Import `x/standing/types` + `x/stash/types` (app-layer — D-070). Seed fixtures: a Reach with enough Ratings/Vouches to be Freeholder-eligible + one that is not. | `go build ./web/store` succeeds; `ComputeStandingScore` returns a score + bucket using the locked constants; `ComputeFreeholderSignals` returns 4 booleans; `web/store` imports only `x/*/types` (import-invariant green); lexicon firewall green | P3-99-01 |
|
|
||||||
| P4-02-01 | REQ-043 | frontend-engineer | `web/handlers/standing.go`, `web/handlers/server.go` (EXTEND) | `StandingHandler` struct. Route: `GET /standing/{reachID}` → Standing + Freeholder signals progress. Loads Ratings/Vouches/Slashes from the store; calls `ComputeStandingScore` + `ComputeFreeholderSignals`; passes the score, bucket, 4 signals (each as a progress indicator), and the underlying records to the template. | `go build ./web` succeeds; `go run ./web` serves `GET /standing/{reachID}` (200 + progress HTML); the score is computed from the locked constants (verified by test); lexicon firewall green | P4-01-01, P1-02-03 |
|
|
||||||
| P4-02-02 | REQ-043 | frontend-engineer | `web/templates/standing.html` | Standing + Freeholder signals template: standing score (float, 1 decimal) + `StandingBucket` badge (New/Trusted/Preferred/Top/Slashed) + 4-signal progress (StashMaturity, MultiDomainStanding, CommittedCapital, CommunityEndorsement — each a check/cross + label) + Freeholder-eligible badge (green if `IsFreeholderEligible()`, grey if not) + underlying Ratings/Vouches/Slashes tables. Extends `base.html`. Lexicon-clean ("Standing"/"Freeholder"/"Vouch"/"Rating"; NOT "account"/"bank"). | `go run ./web` renders the Standing screen; manual check: a seeded Freeholder-eligible Reach shows 4 checks + green badge; a non-eligible Reach shows crosses; lexicon firewall green on `web/templates/standing.html` | P4-02-01, P1-02-03 |
|
|
||||||
|
|
||||||
### Wave 2 — Tests (blocked-by Wave 1)
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P4-03-01 | REQ-043, D-033 | frontend-engineer + backend-engineer | `web/handlers/standing_test.go`, `web/store/store_test.go` (EXTEND) | Handler test (`httptest`): `GET /standing/{reachID}` returns 200 + progress HTML; the rendered HTML shows the score + bucket + 4 signals + Freeholder-eligible badge. **Standing score computed-from-locked-constants test**: asserts `ComputeStandingScore` uses `x/standing/types` constants (`PriorMean=4.0`, `PriorWeight=10`, `ComputeDiversityBonus`, `GetVoucherWeight`, `GetStandingBucket`) — a test that would FAIL if the handler hardcoded a score instead of computing from the locked constants. **Freeholder-eligible badge test**: a seeded eligible Reach (`IsFreeholderEligible()==true` → green badge) vs a non-eligible Reach (a signal false → grey badge); asserts the badge reflects `IsFreeholderEligible()`. Store tests: `ListRatings`/`ListVouches`/`ListSlashes`/`ComputeStandingScore`/`ComputeFreeholderSignals` round-trips. Rendered-HTML lexicon check. Coverage ≥80% on `web/handlers` (cumulative P1..P4). | `go test ./web/...` passes; standing score computed from locked constants; Freeholder-eligible badge reflects `IsFreeholderEligible()`; coverage ≥80% (cumulative); rendered-HTML lexicon check green | P4-02-02, P4-01-01 |
|
|
||||||
|
|
||||||
### Wave 3 — Phase verification + ship
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P4-99-01 | REQ-012, REQ-043 | lead-developer | (cross-cutting) | `go build ./...` + `go test ./...` green; coverage ≥80% (cumulative); `lexicon_meta_web/` green; `go.mod` unchanged; `go run ./web` serves the Standing screen; tag `v0.5.4`. | `go test ./...` green; coverage ≥80% (cumulative); `lexicon_meta_web/` green; `go.mod` unchanged; Standing screen reachable from home; git tag `v0.5.4` | P4-03-01 |
|
|
||||||
|
|
||||||
### P4 Must-Haves
|
|
||||||
- [ ] `web/handlers/standing.go` + `web/templates/standing.html` exist; `GET /standing/{reachID}` renders the progress.
|
|
||||||
- [ ] Standing score computed from `x/standing/types` locked constants (`PriorMean`, `PriorWeight`, decay buckets, `ComputeDiversityBonus`, `GetVoucherWeight`, `GetStandingBucket`) — NOT hardcoded.
|
|
||||||
- [ ] 4-signal progress (StashMaturity, MultiDomainStanding, CommittedCapital, CommunityEndorsement) displayed; Freeholder-eligible badge reflects `FreeholderSignals.IsFreeholderEligible()`.
|
|
||||||
- [ ] Standing-score computed-from-locked-constants test (regression guard against hardcoding).
|
|
||||||
- [ ] ≥80% coverage on `web/store` + `web/handlers` (cumulative).
|
|
||||||
- [ ] `lexicon_meta_web/` firewall green; rendered-HTML lexicon check green.
|
|
||||||
- [ ] `go.mod` unchanged (G-006).
|
|
||||||
- [ ] Git tag `v0.5.4`.
|
|
||||||
|
|
||||||
### P4 Risks & Mitigations
|
|
||||||
- **Standing formula oversimplification** → the mock `ComputeStandingScore` is a SIMPLIFIED computation from the locked constants (not the full Bayesian formula — sub-tables deferred per PROJECT.md Q2); the test asserts it uses the locked constants, not that it matches a full oracle. Document the simplification in a code comment.
|
|
||||||
- **Freeholder-eligible badge divergence** → the badge MUST reflect `IsFreeholderEligible()` (the real method); the test asserts the rendered badge matches the method output.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Phase P5 — Bloom Accrual (REQ-044) → v0.5.5
|
|
||||||
|
|
||||||
- **Slug**: `bloom-accrual`
|
|
||||||
- **Branch**: `phase/05-bloom-accrual`
|
|
||||||
- **REQs covered**: REQ-044 (Bloom accrual — per-Stash `BloomRecord` view: `AccruedGrain`, `RateBasisPoints`, `LastAccrualBlock`; 4.5% target rate)
|
|
||||||
- **Tag**: `v0.5.5`
|
|
||||||
- **Type**: `feat`
|
|
||||||
- **Goal**: Ship the Bloom accrual screen: a per-Stash `BloomRecord` view (`AccruedGrain`, `RateBasisPoints`, `LastAccrualBlock`) computed from mock data; shows the 4.5% target rate (`TargetBloomRateBasisPoints=450`). Depends on P2 (BloomRecord is per-Stash).
|
|
||||||
|
|
||||||
### Wave 1 — Store extensions + handler + template (blocked-by P4 ship)
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P5-01-01 | REQ-044 | backend-engineer | `web/store/store.go` (EXTEND), `web/store/fixtures.go` (EXTEND) | Extend the mock store: add `bloomRecords map[string]bloomtypes.BloomRecord` (keyed by StashID). Methods: `GetBloomRecord(stashID string) (bloomtypes.BloomRecord, bool)`; `ListBloomRecords(holderID string) []bloomtypes.BloomRecord` (via the holder's Stashes). Import `x/bloom/types` (app-layer — D-070). Seed fixtures: `BloomRecord` per Stash with `AccruedGrain` (mock value), `RateBasisPoints` (e.g., 450 = the target rate), `LastAccrualBlock` (mock block height). | `go build ./web/store` succeeds; `GetBloomRecord`/`ListBloomRecords` return seeded records; `web/store` imports only `x/*/types` (import-invariant green); lexicon firewall green | P4-99-01 |
|
|
||||||
| P5-02-01 | REQ-044 | frontend-engineer | `web/handlers/bloom.go`, `web/handlers/server.go` (EXTEND) | `BloomHandler` struct. Route: `GET /bloom/{stashID}` → Bloom accrual view. Loads the `BloomRecord` from the store; reads `x/bloom/types.TargetBloomRateBasisPoints=450` (4.5% target rate — D-073 code-constant source-of-truth) + `MinBloomRateBasisPoints=400` + `MaxBloomRateBasisPoints=500` + `AccrualPeriodBlocks=144`; passes the record + the target rate band to the template. | `go build ./web` succeeds; `go run ./web` serves `GET /bloom/{stashID}` (200 + accrual HTML); the target rate is read from `x/bloom/types.TargetBloomRateBasisPoints` (verified by test); lexicon firewall green | P5-01-01, P1-02-03 |
|
|
||||||
| P5-02-02 | REQ-044 | frontend-engineer | `web/templates/bloom.html` | Bloom accrual template: `BloomRecord` fields (`AccruedGrain`, `RateBasisPoints` displayed as a percentage e.g. 4.5%, `LastAccrualBlock`) + the target rate band (4.0%–5.0%, target 4.5%) + a note that "Bloom originates only from real production" (the `MissionLockBloom` const, lexicon-clean). Extends `base.html`. Lexicon-clean ("Bloom"/"Grain"/"real production"; NOT "yield"/"interest"/"deposit"). | `go run ./web` renders the Bloom screen; manual check: accrued Grain + 4.5% target rate displayed; lexicon firewall green on `web/templates/bloom.html` | P5-02-01, P1-02-03 |
|
|
||||||
|
|
||||||
### Wave 2 — Tests (blocked-by Wave 1)
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P5-03-01 | REQ-044, D-033 | frontend-engineer + backend-engineer | `web/handlers/bloom_test.go`, `web/store/store_test.go` (EXTEND) | Handler test (`httptest`): `GET /bloom/{stashID}` returns 200 + accrual HTML; the rendered HTML shows `AccruedGrain` + `RateBasisPoints` (as %) + `LastAccrualBlock` + the 4.5% target rate. **Target-rate source-of-truth test**: asserts the handler reads `x/bloom/types.TargetBloomRateBasisPoints=450` (NOT a hardcoded 450 or a docs value — D-073 pattern); a test that would FAIL if the handler hardcoded the rate. Store tests: `GetBloomRecord`/`ListBloomRecords` round-trips. Rendered-HTML lexicon check (highest-risk screen for "yield"/"interest" drift — the test scans the response body). Coverage ≥80% on `web/handlers` (cumulative P1..P5). | `go test ./web/...` passes; target rate read from code constant (D-073); coverage ≥80% (cumulative); rendered-HTML lexicon check green (no "yield"/"interest") | P5-02-02, P5-01-01 |
|
|
||||||
|
|
||||||
### Wave 3 — Phase verification + ship
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P5-99-01 | REQ-012, REQ-044 | lead-developer | (cross-cutting) | `go build ./...` + `go test ./...` green; coverage ≥80% (cumulative across all `web/` packages); `lexicon_meta_web/` green; `go.mod` unchanged; `go run ./web` serves the Bloom screen; tag `v0.5.5`. | `go test ./...` green; coverage ≥80% (cumulative); `lexicon_meta_web/` green; `go.mod` unchanged; Bloom screen reachable from home; git tag `v0.5.5` | P5-03-01 |
|
|
||||||
|
|
||||||
### P5 Must-Haves
|
|
||||||
- [ ] `web/handlers/bloom.go` + `web/templates/bloom.html` exist; `GET /bloom/{stashID}` renders the accrual view.
|
|
||||||
- [ ] `BloomRecord` fields displayed: `AccruedGrain`, `RateBasisPoints` (as %), `LastAccrualBlock`.
|
|
||||||
- [ ] 4.5% target rate read from `x/bloom/types.TargetBloomRateBasisPoints=450` (D-073 code-constant source-of-truth; NOT hardcoded).
|
|
||||||
- [ ] Target-rate source-of-truth test (regression guard against hardcoding).
|
|
||||||
- [ ] ≥80% coverage on `web/store` + `web/handlers` (cumulative P1..P5).
|
|
||||||
- [ ] `lexicon_meta_web/` firewall green; rendered-HTML lexicon check green (no "yield"/"interest").
|
|
||||||
- [ ] `go.mod` unchanged (G-006).
|
|
||||||
- [ ] Git tag `v0.5.5`.
|
|
||||||
|
|
||||||
### P5 Risks & Mitigations
|
|
||||||
- **"yield"/"interest" lexicon drift in Bloom prose** (highest P5 risk — Bloom is conceptually close to "yield") → "Bloom"/"real production"/"accrual" labels; the `lexicon_meta_web/` firewall scans `web/templates/bloom.html`; the rendered-HTML lexicon check (P5-03-01) scans the response body. "Bloom" is the vision lexicon (§6); "yield" is banned.
|
|
||||||
- **Target-rate hardcoding** → the handler MUST read `TargetBloomRateBasisPoints` from `x/bloom/types` (D-073); the source-of-truth test asserts it.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Phase P6 — Final Review + Audit + Milestone Ship → v0.5.6
|
|
||||||
|
|
||||||
- **Slug**: `final-review-audit-ship`
|
|
||||||
- **Branch**: `phase/06-final-review-audit-ship`
|
|
||||||
- **REQs covered**: all v0.6 REQs (REQ-040..REQ-045) — final coverage accounting; no new REQs (covers post-hoc fixes from REVIEW/AUDIT)
|
|
||||||
- **Tag**: `v0.5.6` (IS the v0.6 milestone release; D-008)
|
|
||||||
- **Type**: `final`
|
|
||||||
- **Personas**: lead-developer (review/ship) + ci-security-auditor (ACTIVATED for the v0.6 milestone audit + feature purity gate)
|
|
||||||
- **Goal**: Multi-persona review across P1..P5, audit (reconstruction test + feature purity gate: no breaking schema changes; G-003 production firewall intact — `web/` is app-layer, not an `x/` module; G-006 go.mod unchanged — HTMX is a vendored static asset, not a Go dep; locked-const firewall intact — no `x/` consts amended), milestone ship (merge to main, tag `v0.5.6` = v0.6 milestone release, release, delete all milestone branches).
|
|
||||||
|
|
||||||
### Wave 1 — Review + Audit (parallel)
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P6-01-01 | — | lead-developer (review) | `.ciagent/oy/REVIEW.md` (NEW for v0.6) | Multi-persona code review across P1..P5. Adversarial probes: (1) does `go run ./web` start with no external deps (G-006); (2) are all 5 screens reachable from the home page; (3) does the `lexicon_meta_web/` firewall scan all `web/templates/**` + `web/static/**` + `web/**/*.go`; (4) does the Bread-scale conversion match `x/bread/types` code constants (D-073); (5) does the Standing score use the locked formula constants; (6) does the Freeholder-eligible badge reflect `IsFreeholderEligible()`; (7) do the Window lifecycle transitions call `Window.Activate/Revoke/Expire`; (8) are there any banned terms in any rendered page (rendered-HTML lexicon checks). Auto-apply P0 fixes; flag P1+ for post-hoc. | REVIEW.md v0.6 section written; P0 issues (if any) fixed in P6; P1+ flagged. | P1..P5 |
|
|
||||||
| P6-02-01 | — | ci-security-auditor (audit) | `.ciagent/oy/AUDIT.md` (v0.6 section) | Audit: (1) reconstruction test (git log ↔ `.ciagent/` files for v0.6; each REQ-040..REQ-045 maps to a shipped UI screen / firewall); (2) file/branch/commit discipline (6 phase branches `phase/01-*`..`phase/06-*`; 6 patch tags `v0.5.1`..`v0.5.6`; D-072 ordering respected — firewall-first P1 before content P2..P5); (3) **feature purity gate**: no breaking schema changes (no `x/` module modified — `web/` is new app-layer, not an `x/` amendment); locked-const firewall intact (all v0.1..v0.5 consts unchanged — `web/` does not touch `x/` consts); G-003 production firewall intact (`web/` imports only `x/*/types` per D-070; the `web/store/import_test.go` import-invariant green; no `x/` module gains a production import of another `x/` module's types via `web/`); G-006 go.mod unchanged (HTMX is a vendored static asset, NOT a `go get` — zero new require lines in v0.6); (4) coverage ≥80% on all `web/` packages (`web/store`, `web/handlers`); (5) all 3 lexicon firewalls green (`lexicon_meta_test.go` x/*.go, `lexicon_meta_docs_test.go` docs, `lexicon_meta_web/` web); (6) manual browser check: `go run ./web` → all 5 screens reachable + the happy path works end-to-end. | AUDIT.md v0.6 section written; feature purity gate GREEN (no breaking schema changes; locked-const firewall intact; G-003 intact — `web/` is app-layer; G-006 go.mod unchanged); reconstruction test passes. | P1..P5 |
|
|
||||||
|
|
||||||
### Wave 2 — Ship (blocked-by Wave 1)
|
|
||||||
|
|
||||||
| Task ID | REQ | Persona | Files | Deliverable | Must-have verification | Blocked-by |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| P6-03-01 | REQ-040..REQ-045 | lead-developer (ship) | `.ciagent/oy/REQUIREMENTS.md`, `.ciagent/oy/ROADMAP.md` | Update REQUIREMENTS.md: mark REQ-040..REQ-045 → Complete (UI shipped). Update ROADMAP.md: mark v0.6 milestone COMPLETE; add the tag-line note that v0.6 shipped on the `v0.5.x` patch line (P0 → `v0.5.0`, P1..P5 → `v0.5.1..v0.5.5`, P6 → `v0.5.6` = milestone release, per D-008). | REQUIREMENTS.md status column updated for all 6 v0.6 REQs → Complete; ROADMAP.md v0.6 marked complete + tag-line note present. | P6-01-01, P6-02-01 |
|
|
||||||
| P6-03-02 | (milestone) | lead-developer | (cross-cutting) | Final ship: merge `phase/06` → `milestone/v0.6-nomad-web-ui` → `main`; create milestone release tag `v0.5.6` (= v0.6 milestone release per D-008); delete the 6 phase branches (`phase/01-*`..`phase/06-*`) after merge; confirm `go build ./...` + `go test ./...` green at the `v0.5.6` tag; confirm `go run ./web` starts at the tag. | `v0.5.6` tag created on main; `go test ./...` green at the tag; `go run ./web` starts at the tag; ROADMAP.md v0.6 complete; phase branches deleted; release notes reference v0.6 scope (5-screen Nomad Web UI: Reach signup, Stash dashboard, Window authorization, Standing + Freeholder signals, Bloom accrual; Go html/template + HTMX vendored; mock server over real x/*/types; lexicon firewall extended to web/). | P6-03-01 |
|
|
||||||
|
|
||||||
### P6 Must-Haves
|
|
||||||
- [ ] REVIEW.md v0.6 section written; P0 fixes applied.
|
|
||||||
- [ ] AUDIT.md v0.6 section written; reconstruction test passes.
|
|
||||||
- [ ] **Feature purity gate GREEN**: no breaking schema changes (no `x/` module modified); locked-const firewall intact (all v0.1..v0.5 consts unchanged); G-003 production firewall intact (`web/` imports only `x/*/types` per D-070; import-invariant green); G-006 go.mod unchanged (HTMX vendored, not a Go dep).
|
|
||||||
- [ ] Coverage ≥80% on all `web/` packages (`web/store`, `web/handlers`).
|
|
||||||
- [ ] All 3 lexicon firewalls green (`lexicon_meta_test.go` x/*.go, `lexicon_meta_docs_test.go` docs, `lexicon_meta_web/` web).
|
|
||||||
- [ ] `go run ./web` starts at the `v0.5.6` tag; all 5 screens reachable; happy path works end-to-end.
|
|
||||||
- [ ] REQUIREMENTS.md + ROADMAP.md mark v0.6 COMPLETE.
|
|
||||||
- [ ] Tag `v0.5.6` created (= v0.6 milestone release).
|
|
||||||
- [ ] Milestone branch merged to `main`.
|
|
||||||
- [ ] All 6 phase branches deleted (local + remote).
|
|
||||||
|
|
||||||
### P6 Risks & Mitigations
|
|
||||||
- **UI mock diverges from `x/*/types` contracts** → the mock store instantiates the REAL `x/*/types` structs (D-067); the handler tests assert the conversions match the code constants (D-073 for Bread-scale, locked formula constants for Standing, `TargetBloomRateBasisPoints` for Bloom); divergence is caught by the tests, not just the audit.
|
|
||||||
- **G-006 dep exception confusion** → v0.6 adds NO Go deps (HTMX is a vendored static asset); the v0.5 cosmos-sdk/ibc-go deps stay but v0.6 adds nothing; the audit verifies `go.mod` is unchanged across the v0.6 milestone range.
|
|
||||||
- **Milestone versioning confusion (v0.6 milestone = v0.5.6 tag)** → lead-developer enforces D-008: final phase patch IS the milestone release; no separate minor tag. ROADMAP tag-line note (P6-03-01) prevents `v0.5.6`/`v0.6.0` confusion.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Coverage Targets (D-033) — v0.6
|
|
||||||
|
|
||||||
| Package | Phase | Target | Key tests |
|
|
||||||
|---|---|---|---|
|
|
||||||
| `web/store` | P1 (created), P2..P5 (extended) | ≥80% | Atomic Reach+Stash create (D-071); `GetStashActivity`/`IsMature` (P2); `OpenWindow`/`ActivateWindow`/`RevokeWindow`/`ExpireWindow` lifecycle (P3); `ComputeStandingScore`/`ComputeFreeholderSignals` from locked constants (P4); `GetBloomRecord` (P5); import-invariant (only `x/*/types`, no `x/*/keeper` — D-070) |
|
|
||||||
| `web/handlers` | P1 (created), P2..P5 (extended) | ≥80% | Reach signup form + atomic create (P1); Stash dashboard + Bread-scale conversion correctness (P2, D-073); Window lifecycle via `Window.Activate/Revoke/Expire` (P3); Standing score from locked constants + Freeholder-eligible badge (P4); Bloom target-rate from code constant (P5); rendered-HTML lexicon checks (all phases) |
|
|
||||||
| `lexicon_meta_web` | P1 | 100% (test-only) | G-009 self-test via `SyntheticBannedStrings()`; G-013 walk-coverage; no-false-positive on "openyield"/"european"; scans `web/templates/**` + `web/static/**` + `web/**/*.go` |
|
|
||||||
|
|
||||||
**Lexicon assertions (REQ-012)**: the NEW `lexicon_meta_web/` firewall (P1) scans all `web/**/*.{html,js,go}` for the 10 banned terms. Per-handler rendered-HTML lexicon checks (each phase's handler test) scan the HTTP response body for banned terms — catching dynamic content the file-scan firewall cannot see. The v0.2 `lexicon_meta_test.go` (x/*.go) + v0.3 `lexicon_meta_docs_test.go` (docs) are UNCHANGED (no regression).
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Task Count Summary — v0.6
|
|
||||||
|
|
||||||
| Phase | Waves | Tasks | New/Extended |
|
|
||||||
|---|---|---|---|
|
|
||||||
| P1 | 5 | 9 | `lexicon_meta_web/` (new firewall); `web/main.go`, `web/server.go`, `web/static/`, `web/templates/base.html`+`home.html`, `web/store/`, `web/handlers/reach.go` + 3 Reach templates |
|
|
||||||
| P2 | 3 | 5 | `web/handlers/stash.go` + `web/templates/stash.html` (Stash dashboard) |
|
|
||||||
| P3 | 3 | 5 | `web/handlers/window.go` + 3 Window templates (Window authorization) |
|
|
||||||
| P4 | 3 | 5 | `web/handlers/standing.go` + `web/templates/standing.html` (Standing + Freeholder signals) |
|
|
||||||
| P5 | 3 | 5 | `web/handlers/bloom.go` + `web/templates/bloom.html` (Bloom accrual) |
|
|
||||||
| P6 | 2 | 4 | (review + audit + ship; 0 new — audit + REQUIREMENTS/ROADMAP update + tag) |
|
|
||||||
| **Total** | — | **33** | **`web/` new dir (5 screens) + `lexicon_meta_web/` new firewall; zero `x/` modifications** |
|
|
||||||
|
|
||||||
## Per-Phase REQ Coverage — v0.6
|
|
||||||
|
|
||||||
| Phase | REQs | Components |
|
|
||||||
|---|---|---|
|
|
||||||
| P1 | REQ-040, REQ-045 | Web foundation + Reach signup (mock server, base templates, HTMX, store, "Create a Reach" form/list/detail) + lexicon firewall extension to `web/` |
|
|
||||||
| P2 | REQ-041 | Stash dashboard (balance in Grain + Bread-scale conversion via `BreadScaleAll()`/`GrainsPerBread` + 90-day maturity progress via `IsMature()`) |
|
|
||||||
| P3 | REQ-042 | Window authorization (open/lifecycle/audit-log via `Window.Activate/Revoke/Expire`) |
|
|
||||||
| P4 | REQ-043 | Standing + Freeholder signals (computed from mock Ratings/Vouches/Slashes using locked constants + `GetStandingBucket`/`ComputeDiversityBonus`/`GetVoucherWeight`; 4-signal `IsFreeholderEligible`) |
|
|
||||||
| P5 | REQ-044 | Bloom accrual (per-Stash `BloomRecord` + 4.5% target rate from `TargetBloomRateBasisPoints=450`) |
|
|
||||||
| P6 | all v0.6 REQs (audit) | Feature purity gate; G-003 (app-layer) + G-006 (go.mod unchanged) verification; milestone ship |
|
|
||||||
|
|
||||||
## Cross-Phase Blockers (hard) — v0.6
|
|
||||||
|
|
||||||
- **P1-01-01 (lexicon firewall `lexicon_meta_web/`)** → blocks P1-02-03 + P1-04-02 (templates scanned by the firewall) and P2..P5 (content scanned).
|
|
||||||
- **P1-02-01 (web foundation `main.go`/`server.go`)** → blocks P1-03-01 (store used by handlers) and all subsequent handler/template tasks.
|
|
||||||
- **P1-03-01 (mock store)** → blocks P1-04-01 (Reach handler uses the store) and P2..P5 (each screen extends the store).
|
|
||||||
- **P1-04-01 (Reach signup handler)** → blocks P2 (Stash dashboard needs a Stash created at signup — D-071), P4 (Standing is per-Reach).
|
|
||||||
- **P2-99-01 (P2 ship)** → blocks P3 (Window scope references a Stash), P5 (BloomRecord is per-Stash).
|
|
||||||
- **P3-99-01 (P3 ship)** → blocks P4 (soft ordering for branch hygiene; Standing is per-Reach, not per-Window, but the cumulative test suite + branch hygiene enforce serial phases).
|
|
||||||
- **P4-99-01 (P4 ship)** → blocks P5 (soft ordering).
|
|
||||||
- **P5-99-01 (P5 ship)** → blocks P6-01-01 (P6 audit).
|
|
||||||
- All P(N) phase-ship tasks block P(N+1) Wave 1 tasks (soft ordering for branch hygiene).
|
|
||||||
|
|
||||||
## v0.6 Decisions Applied (D-066..D-073)
|
|
||||||
|
|
||||||
The v0.6 Phase 0 clarify/ideate/research stages produced 8 clarification decisions (D-066..D-073), all applied to this plan:
|
|
||||||
|
|
||||||
| ID | Decision | Applied to |
|
|
||||||
|---|---|---|
|
|
||||||
| D-066 | Frontend stack = Go `html/template` + HTMX (vendored, no node); G-006 preserved | P1-02-01, P1-02-02 (web foundation + HTMX vendored); Milestone Summary (G-006) |
|
|
||||||
| D-067 | Mock data layer = Go HTTP server in `web/` instantiating real `x/*/types` structs; no keeper, no Cosmos runtime, no `app.go` | P1-02-01, P1-03-01 (mock store imports `x/*/types`); all handler tasks |
|
|
||||||
| D-068 | UI code location = new top-level `web/` dir (not an `x/` module) | P1-02-01, P1-03-01 (web/ dir); Milestone Summary |
|
|
||||||
| D-069 | Lexicon firewall extension to `web/` = new sibling `lexicon_meta_web/` (mirrors `lexicon_meta_docs/`); firewall-first (P1 before content) | P1-01-01 (firewall); all P2..P5 content scanned |
|
|
||||||
| D-070 | G-003 boundary: `web/` importing `x/*/types` is app-layer consumption, NOT a cross-`x/` production import | P1-03-01, P1-03-03 (import-invariant test); all store tasks; P6 audit |
|
|
||||||
| D-071 | "Sign up" = create a Reach + open a Stash atomically; UI labels it "Create a Reach" ("account" is banned) | P1-03-01 (atomic `CreateReach`), P1-04-01/02 ("Create a Reach" labels) |
|
|
||||||
| D-072 | Phase ordering: P1 foundation+Reach+firewall → P2 Stash → P3 Window → P4 Standing → P5 Bloom → P6 final | Cross-Phase Dependency Map; all phase goals |
|
|
||||||
| D-073 | Bread-scale source of truth = `x/bread/types` code constants (`GrainsPerBread=10000`, `BreadScaleAll()`), NOT docs | P2-02-01, P2-03-01 (Bread-scale conversion correctness test); P5-02-01 (Bloom target rate from `TargetBloomRateBasisPoints=450`) |
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## User-Facing Surface
|
|
||||||
|
|
||||||
**Web UI at `http://localhost:8080`** — runnable via `go run ./web` (single binary, no external deps, no node toolchain, no build step). The UI is a Go `html/template` server-rendered HTML layer with HTMX progressive enhancement (vendored `web/static/htmx.min.js`). Five screens, all reachable from the home page nav:
|
|
||||||
|
|
||||||
1. **Reach signup** (`GET /reach/new` → `POST /reach`): the "Create a Reach" form. A visitor signs up to be a Nomad by creating a Reach (atomically creates a Stash per D-071). Reach list (`GET /reach`) + detail (`GET /reach/{id}`).
|
|
||||||
2. **Stash dashboard** (`GET /stash/{holderID}`): balance in Grain + Bread-scale conversion (all 11 denominations from `BreadScaleAll()`) + 90-day maturity progress bar + `IsMature` badge.
|
|
||||||
3. **Window authorization** (`GET /window/new` → `POST /window`; `GET /window/{id}`): open a Window (scope + duration + rate-limit), lifecycle transitions (Activate/Revoke/Expire via HTMX buttons), audit log.
|
|
||||||
4. **Standing + Freeholder signals** (`GET /standing/{reachID}`): standing score + bucket + 4-signal progress (StashMaturity, MultiDomainStanding, CommittedCapital, CommunityEndorsement) + Freeholder-eligible badge.
|
|
||||||
5. **Bloom accrual** (`GET /bloom/{stashID}`): per-Stash `BloomRecord` (`AccruedGrain`, `RateBasisPoints` as %, `LastAccrualBlock`) + 4.5% target rate band.
|
|
||||||
|
|
||||||
**README quickstart**: `go run ./web` → open `http://localhost:8080`. No `make`, no `npm`, no `docker` — just Go 1.22 stdlib + one vendored JS file. The README (updated in P1 or P6) documents the `go run` invocation + the 5 screen routes.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Happy Path
|
|
||||||
|
|
||||||
**Scenario: a visitor signs up as a Nomad and exercises the full UI end-to-end (mock data, no chain, no real values).**
|
|
||||||
|
|
||||||
1. The visitor opens `http://localhost:8080/` (home page) in a browser. The home page shows a one-paragraph OpenYield overview + nav links to the 5 screens.
|
|
||||||
2. The visitor clicks "Create a Reach" → `GET /reach/new` renders the signup form (HolderID + PublicKey inputs; labeled "Create a Reach" — NOT "Sign up for an account").
|
|
||||||
3. The visitor fills the form and submits (`POST /reach`). The handler calls `store.CreateReach` which **atomically** creates a `Reach` (`IsNomad=true`) + a `Stash` (matching `HolderID`, `BalanceGrain` seeded to 500000 Grain = 50 Bread per D-071). The browser redirects to `GET /reach/{id}` (Reach detail showing the Reach + the associated Stash).
|
|
||||||
4. The visitor clicks the Stash link → `GET /stash/{holderID}` renders the Stash dashboard: balance 500000 Grain + the Bread-scale conversion table (50 Bread, 5 Loaves, 0.5 Batch, … from `BreadScaleAll()`) + a 90-day maturity progress bar (e.g., 45/90 days = 50% — the seeded `StashActivity` is immature) + an amber "Not Mature" badge (`IsMature()==false` because `ActiveDays < 90`).
|
|
||||||
5. The visitor clicks "Window authorization" → `GET /window/new` renders the "Open a Window" form (scope dropdown: ReadStash/ReadStanding/ProcessPassActForStand; grantee; duration; rate-limit). The visitor opens a Window delegating ReadStash to a service → `POST /window` creates the Window (status=Open) + an initial `AuditEntry` → redirects to `GET /window/{id}`.
|
|
||||||
6. On the Window detail page, the visitor clicks "Activate" (`POST /window/{id}/activate` via HTMX) → the Window transitions Open→Active (`Window.Activate()`); an `AuditEntry` is appended; the badge turns green. The visitor clicks "Revoke" → the Window transitions to Revoked (`Window.Revoke()`); the badge turns red; the audit log shows both actions.
|
|
||||||
7. The visitor clicks "Standing" → `GET /standing/{reachID}` renders the Standing + Freeholder signals progress: a standing score (computed from mock Ratings using the locked constants) + a `StandingBucket` badge + 4-signal progress (StashMaturity: cross — the Stash is immature; MultiDomainStanding: check; CommittedCapital: check; CommunityEndorsement: cross — no Vouch) + a grey "Not Freeholder-eligible" badge (`IsFreeholderEligible()==false` because 2 signals are false).
|
|
||||||
8. The visitor clicks "Bloom accrual" → `GET /bloom/{stashID}` renders the Bloom view: `AccruedGrain` (mock value) + `RateBasisPoints` 4.5% (from `TargetBloomRateBasisPoints=450`) + `LastAccrualBlock` + the target rate band (4.0%–5.0%) + the Mission Lock note ("Bloom originates only from real production").
|
|
||||||
9. End-to-end in-browser with mock data; no chain, no real values, no persistence (resets on restart). The whole flow took ~6 clicks across 5 screens.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## UX Acceptance Criteria
|
|
||||||
|
|
||||||
The v0.6 deliverable MUST meet these explicit criteria (verified in P6 audit):
|
|
||||||
|
|
||||||
1. **`go run ./web` starts without external deps**: `go.mod` is unchanged across the v0.6 milestone range (G-006 — zero new require lines; HTMX is a vendored static asset at `web/static/htmx.min.js`, NOT a `go get`); `go run ./web` starts a server on `:8080` using only Go 1.22 stdlib (`net/http.ServeMux` + `html/template`).
|
|
||||||
2. **All 5 screens reachable from the home page**: the home page nav (`web/templates/base.html`) links to Reach signup, Stash dashboard, Window authorization, Standing progress, Bloom accrual; each route returns 200 (verified by handler tests + manual browser check at `http://localhost:8080`).
|
|
||||||
3. **Lexicon firewall green on all UI strings**: the `lexicon_meta_web/` firewall (P1-01-01) scans `web/templates/**/*.html` + `web/static/**/*.js` + `web/**/*.go` for the 10 banned terms and passes; per-handler rendered-HTML lexicon checks (each phase's handler test) scan the HTTP response body and pass; "Sign up" is labeled "Create a Reach" ("account" is banned per REQ-012).
|
|
||||||
4. **Bread-scale conversion matches `x/bread/types` constants**: the Stash dashboard conversion uses `x/bread/types.BreadScaleAll()` + `GrainsPerBread=10000` (D-073 — code constants, NOT `docs/shared/bread-scale.md`); the Bread-scale conversion correctness test (P2-03-01) asserts the conversion matches the code constants and would FAIL if the outdated docs values (1,000× ratios) were used.
|
|
||||||
5. **Standing score computed from locked formula constants**: the Standing screen score uses `x/standing/types` constants (`PriorMean=4.0`, `PriorWeight=10`, decay buckets, `ComputeDiversityBonus`, `GetVoucherWeight`, `GetStandingBucket`) — NOT hardcoded; the standing-score computed-from-locked-constants test (P4-03-01) asserts this.
|
|
||||||
6. **Freeholder-eligible badge reflects `IsFreeholderEligible()`**: the Standing screen badge is green when `FreeholderSignals.IsFreeholderEligible()==true` and grey when false; the Freeholder-eligible badge test (P4-03-01) asserts the rendered badge matches the method output.
|
|
||||||
7. **Window lifecycle transitions match `Window.Activate/Revoke/Expire`**: the Window screen lifecycle buttons call the real `x/window/types.Window.Activate/Revoke/Expire` methods (NOT a reimplementation); `Revoke()` on an Expired window is a no-op (v0.2 type contract); the lifecycle correctness test (P3-03-01) asserts the real methods are invoked.
|
|
||||||
8. **No banned terms in any rendered page**: the per-handler rendered-HTML lexicon checks (P1-04-03, P2-03-01, P3-03-01, P4-03-01, P5-03-01) scan each screen's HTTP response body via `lexicon.FindBannedTerm` and pass; the `lexicon_meta_web/` file-scan firewall passes on all `web/**/*.{html,js,go}` files.
|
|
||||||
+2
-65
@@ -61,55 +61,7 @@ OpenYield (OY) is a durable, anti-greed, jurisdiction-light financial layer —
|
|||||||
- D-009: Rebased history to fix v1.0 → v0.1 in ---ci--- blocks
|
- D-009: Rebased history to fix v1.0 → v0.1 in ---ci--- blocks
|
||||||
|
|
||||||
## Milestone
|
## Milestone
|
||||||
v0.6 — Nomad Web UI (in progress; feature type; tags run on the v0.5.x patch line)
|
v0.5 — Bearers Runtime (in progress; feature type; tags run on the v0.4.x patch line)
|
||||||
|
|
||||||
### v0.6 Scope (Nomad Web UI MVP — generated test data, no real chain)
|
|
||||||
|
|
||||||
v0.6 is the project's first UI milestone. It delivers a working prototype Web
|
|
||||||
UI where a person can sign up to be a Nomad (create a Reach + open a Stash)
|
|
||||||
and exercise basic functionality around the (Reach, Stash) components, plus
|
|
||||||
Window authorization, Standing progress, and Bloom accrual views. All data is
|
|
||||||
generated as test fixtures — there is no real blockchain interaction, no live
|
|
||||||
chain launch, no real bearer transports (D-020 continues to govern network
|
|
||||||
deployment). The UI is a greenfield Go `html/template` + HTMX layer served by a
|
|
||||||
Go mock HTTP server that instantiates the real `x/*/types` structs (Reach,
|
|
||||||
Stash, Window, FreeholderSignals, BloomRecord) populated from in-memory
|
|
||||||
fixtures. No keeper, no Cosmos runtime, no `app.go` (none exists in the repo).
|
|
||||||
|
|
||||||
This milestone is the prerequisite for real-world MVP testing: it makes the
|
|
||||||
Nomad path visible and exercisable in a browser. Wiring the UI to a real `oyd`
|
|
||||||
daemon (once one exists) is deferred to v0.7+ (no `app.go`, `cmd/`, or `main.go`
|
|
||||||
exists in the repo today).
|
|
||||||
|
|
||||||
- **REQ-040** Nomad Reach signup Web UI — Go HTTP mock server (`web/`) + "Create a Reach" form + Reach list/detail; grounds the UI in `x/identity/types.Reach`. "Sign up" maps to "Create a Reach" (the word "account" is banned per REQ-012).
|
|
||||||
- **REQ-041** Stash dashboard Web UI — balance in Grain + Bread-scale conversion (using `x/bread/types.BreadScaleAll()`) + 90-day maturity progress bar (`x/stash/types.StashActivity.IsMature`).
|
|
||||||
- **REQ-042** Window authorization Web UI — form to open a Window (scope + duration + rate-limit), lifecycle view (Open→Active→Revoked/Expired via `x/window/types.Window.Activate/Revoke/Expire`), audit log.
|
|
||||||
- **REQ-043** Standing + Freeholder signals progress Web UI — computed from mock `Rating`/`Vouch`/`Slash` records using the locked constants + `GetStandingBucket`/`ComputeDiversityBonus`/`GetVoucherWeight`; 4-signal progress (`FreeholderSignals.IsFreeholderEligible`).
|
|
||||||
- **REQ-044** Bloom accrual Web UI — per-Stash `BloomRecord` view (`AccruedGrain`, `RateBasisPoints`), computed from mock data; shows the 4.5% target rate.
|
|
||||||
- **REQ-045** Extend REQ-012 lexicon firewall to scan `web/templates/**` + `web/static/**` (new `lexicon_meta_web_test.go`). Firewall-first: lands in P1 before content.
|
|
||||||
|
|
||||||
### Milestone Type
|
|
||||||
Feature (all execution phases are `feat` except REQ-045 which is `test`). Phase 0 → `v0.5.0`; execution phases `v0.5.1..v0.5.5`; final phase patch `v0.5.6` IS the v0.6 milestone release. No separate minor tag. The final-phase audit enforces the feature purity gate (no breaking schema changes; G-003 production firewall intact; G-006 go.mod unchanged unless a runtime dep is GRILL-approved — HTMX is a vendored static asset, not a Go dep).
|
|
||||||
|
|
||||||
### Out of Scope (v0.6)
|
|
||||||
- Real blockchain interaction / mainnet / IBC / real bearer transports (D-020 continues)
|
|
||||||
- A real `oyd` daemon / `app.go` / `cmd/oyd` (no chain runtime exists; deferred to v0.7+)
|
|
||||||
- Real Anchors onboarding / Hub API B2B / real custody (simtest/mock only)
|
|
||||||
- Authentication / sessions / real key management (mock; a Reach is created by form submission, stored in-memory)
|
|
||||||
- Persistence (mock store is in-memory; resets on restart)
|
|
||||||
- i18n / multi-language UI
|
|
||||||
- Real Standing oracle / real Bloom accrual engine (computed from fixtures using locked constants)
|
|
||||||
- The 5 P1+ mainnet-readiness items deferred from v0.5 (governance spam deposit, CLOB front-running, real IBC simtest, CLOB perf, emitMatchEventHook testability) — those are v0.7+ mainnet-readiness, not UI work
|
|
||||||
|
|
||||||
### Prior Milestones
|
|
||||||
- v0.1 — OpenYield Foundation Init (COMPLETE; pre-MVP foundation skeleton; released as v0.0.9)
|
|
||||||
- v0.2 — The Mesh (COMPLETE; skeleton + tests; released as v0.1.5)
|
|
||||||
- v0.3 — Bearers & Documentation (COMPLETE; feature; released as v0.2.6)
|
|
||||||
- v0.4 — Refinement (COMPLETE; NFR; released as v0.3.4)
|
|
||||||
- v0.5 — Bearers Runtime (COMPLETE; feature; released as v0.4.8)
|
|
||||||
|
|
||||||
## Prior Milestone
|
|
||||||
v0.5 — Bearers Runtime (complete; feature type; tags ran on the v0.4.x patch line)
|
|
||||||
|
|
||||||
### v0.5 Scope (Live-runtime promotions of the v0.3 Bearers skeletons)
|
### v0.5 Scope (Live-runtime promotions of the v0.3 Bearers skeletons)
|
||||||
|
|
||||||
@@ -291,19 +243,4 @@ Auto-decided defaults logged per clarify workflow Step 4 (full autonomy → acce
|
|||||||
| D-058 | **Hub custody model = key-share abstraction (MPC-via-interface, not a concrete HSM/MPC vendor).** `x/hub` custody handlers expose a `CustodyKeyring` interface with `Sign`/`Derive` methods; v0.5 ships an in-memory test-only implementation. Real MPC/HSM backing is deferred (operational, Year 3+). This keeps v0.5 dep-neutral w.r.t. custody vendors while landing the handler surface. | Custody key management is operational, not protocol-level. An interface + test impl lets runtime handlers be exercised in simtest without committing to a vendor. GRILL reviews the interface boundary. | 0.78 | [commit to a specific MPC vendor (premature); hand-roll shamir (out of scope)] |
|
| D-058 | **Hub custody model = key-share abstraction (MPC-via-interface, not a concrete HSM/MPC vendor).** `x/hub` custody handlers expose a `CustodyKeyring` interface with `Sign`/`Derive` methods; v0.5 ships an in-memory test-only implementation. Real MPC/HSM backing is deferred (operational, Year 3+). This keeps v0.5 dep-neutral w.r.t. custody vendors while landing the handler surface. | Custody key management is operational, not protocol-level. An interface + test impl lets runtime handlers be exercised in simtest without committing to a vendor. GRILL reviews the interface boundary. | 0.78 | [commit to a specific MPC vendor (premature); hand-roll shamir (out of scope)] |
|
||||||
| D-059 | **IBC packet scope = the 5 L2 chains already in the v0.2 skeleton** (Polygon, Base, Arbitrum, Optimism, Solana per REQ-009/`x/satellite`). v0.5 `x/bridge` handlers implement IBC packet recv/ack for these 5 chains' `BridgeStatus` transitions. No new L2 chains in v0.5. Solana IBC uses the wormhole-style bridge adapter (already stubbed in `x/bridge` per D-021). | The 5 L2 chains are the locked-const set (REQ-009). Adding new chains is a Year-4 concern. Solana IBC was a v0.1 deferred item (D-021) now promoted. | 0.82 | [add 3+ new L2 chains (Year 4); defer Solana IBC again (stalls)] |
|
| D-059 | **IBC packet scope = the 5 L2 chains already in the v0.2 skeleton** (Polygon, Base, Arbitrum, Optimism, Solana per REQ-009/`x/satellite`). v0.5 `x/bridge` handlers implement IBC packet recv/ack for these 5 chains' `BridgeStatus` transitions. No new L2 chains in v0.5. Solana IBC uses the wormhole-style bridge adapter (already stubbed in `x/bridge` per D-021). | The 5 L2 chains are the locked-const set (REQ-009). Adding new chains is a Year-4 concern. Solana IBC was a v0.1 deferred item (D-021) now promoted. | 0.82 | [add 3+ new L2 chains (Year 4); defer Solana IBC again (stalls)] |
|
||||||
| D-060 | **Council governance shape (AUDIT §193 P1-1)**: add `Proposal` and `VoteOption` enum types to `x/council/types` (currently absent per AUDIT). `ProposalKind` enum = {Stand, Guild, Mesh, MissionLockAmendment-Rejected} (Mission Lock non-amendable → the enum value exists but the handler rejects it; documents the non-amendability in code). `VoteOption` enum = {Yes, No, Abstain, Veto} (Veto = Watcher-only, quorum rule). SignalKind stays at 4 sources (P1-2 defensible per AUDIT; expansion deferred to v0.6+ governance vote). Mission Lock const firewall (G-003) intact. | AUDIT P1-1 flagged the absence as a divergence. Adding the enums is `feat:` (deferred from v0.4 by D-001). P1-2 (SignalKind 4→5) is a locked-const change rejected by the audit rationale, so it stays at 4. | 0.82 | [add SignalKind 5th source (locked-const change, rejected); defer Proposal/VoteOption again (stalls)] |
|
| D-060 | **Council governance shape (AUDIT §193 P1-1)**: add `Proposal` and `VoteOption` enum types to `x/council/types` (currently absent per AUDIT). `ProposalKind` enum = {Stand, Guild, Mesh, MissionLockAmendment-Rejected} (Mission Lock non-amendable → the enum value exists but the handler rejects it; documents the non-amendability in code). `VoteOption` enum = {Yes, No, Abstain, Veto} (Veto = Watcher-only, quorum rule). SignalKind stays at 4 sources (P1-2 defensible per AUDIT; expansion deferred to v0.6+ governance vote). Mission Lock const firewall (G-003) intact. | AUDIT P1-1 flagged the absence as a divergence. Adding the enums is `feat:` (deferred from v0.4 by D-001). P1-2 (SignalKind 4→5) is a locked-const change rejected by the audit rationale, so it stays at 4. | 0.82 | [add SignalKind 5th source (locked-const change, rejected); defer Proposal/VoteOption again (stalls)] |
|
||||||
| D-061 | **No IDEATE stage in v0.5** (no `--ideate` flag this run). The feature scope was pre-seeded from PROJECT.md v0.4 out-of-scope + AUDIT §193 P1-1 + D-050 and ratified at CLARIFY. The D-001 refinement-only filter does NOT apply (v0.5 is a feature milestone, not NFR). | run.md §IDEATE is conditional on `--ideate`. This invocation has no `--ideate`. | 1.00 | [run IDEATE anyway] |
|
| D-061 | **No IDEATE stage in v0.5** (no `--ideate` flag this run). The feature scope was pre-seeded from PROJECT.md v0.4 out-of-scope + AUDIT §193 P1-1 + D-050 and ratified at CLARIFY. The D-001 refinement-only filter does NOT apply (v0.5 is a feature milestone, not NFR). | run.md §IDEATE is conditional on `--ideate`. This invocation has no `--ideate`. | 1.00 | [run IDEATE anyway] |
|
||||||
|
|
||||||
## Clarification Decisions (Phase 0 v0.6 — CLARIFY, autonomy=full)
|
|
||||||
|
|
||||||
Auto-decided defaults logged per clarify workflow Step 4 (full autonomy → accept defaults, log decisions). `--ideate` flag IS present this run; v0.6 is the project's first UI milestone. The D-001 refinement-only filter does NOT apply (v0.6 is a feature milestone). User-validated stack choices recorded via interactive questions: Go `html/template` + HTMX (frontend stack), Go mock API server (mock data layer), all 5 screens (Reach signup, Stash dashboard, Window authorization, Standing + Freeholder signals, Bloom accrual), new top-level `web/` dir (UI code location).
|
|
||||||
|
|
||||||
| ID | Decision | Rationale | Confidence | Alternatives |
|
|
||||||
|----|----------|-----------|------------|--------------|
|
|
||||||
| D-066 | **Frontend stack = Go `html/template` + HTMX.** HTMX is a single vendored JS file served as a static asset — no node toolchain, no `package.json`, no build step. Go `html/template` is stdlib. **G-006 (zero-dep) is preserved** — this is the decisive factor vs. a React/Svelte SPA. Sufficient for Reach/Stash/Window/Standing/Bloom screens (progressive enhancement over server-rendered HTML). Weakest for rich dashboards, but adequate for an MVP prototype. | User-validated. Project has a strong zero-dep ethos (G-006); v0.5 took a controlled G-006 exception for cosmos-sdk only after GRILL ratification. A node toolchain + `package.json` would be a far larger exception for a UI MVP that can be served by stdlib + one vendored JS file. | 0.88 | [React/Vite SPA (adds node toolchain, breaks Go-only convention); SvelteKit (same tradeoff); pure static HTML/CSS/vanilla JS (most fragile)] |
|
|
||||||
| D-067 | **Mock data layer = Go HTTP server in `web/` instantiating real `x/*/types` structs.** New top-level `web/` dir holds `main.go`, HTTP handlers, an in-memory mock store seeded from fixtures, and `static/` + `templates/`. The mock store imports `x/identity/types`, `x/stash/types`, `x/window/types`, `x/standing/types`, `x/bread/types`, `x/bloom/types` and populates them with test values. **No keeper, no Cosmos runtime, no `app.go`** (none exists in the repo). This grounds the UI in the actual locked data shapes (Reach, Stash, Window, FreeholderSignals, BloomRecord) — the UI does not exercise a chain but does exercise the real Go type definitions. | User-validated. The four modules the Nomad UI primarily surfaces (identity, stash, window, standing) are types-only skeletons with no keeper/MsgServer. A Go mock server reuses the type definitions as the source of truth, so the UI is grounded in the locked constants (GrainsPerBread=10000, MaturityThresholdDays=90, standing formula) rather than mirroring them in TS/JSON. | 0.85 | [frontend-only TS/JSON fixtures (UI would not exercise any Go code path); Go mock API + in-memory keepers (more code, premature)] |
|
|
||||||
| D-068 | **UI code location = new top-level `web/` dir.** Clean separation from `x/` protocol modules; does not touch the `go.mod` module path; does not pretend to be a Cosmos module. `web/` contains `main.go` (or `cmd/oyd-ui/main.go`), handlers, mock store, fixtures, `static/`, `templates/`. | User-validated. The Mesh Experience component is ROADMAP Phase 2, not a v0.6 deliverable; coupling the UI to Cosmos module conventions (a new `x/meshexperience`) is premature. A top-level `web/` dir matches the project's existing convention of non-`x/` top-level dirs (`docs/`, `lexicon/`, `lexicon_meta_docs/`). | 0.90 | [new `x/meshexperience` Cosmos module (couples UI to Cosmos conventions prematurely); `cmd/oyd-ui` + `web/` split (more files, clearer build)] |
|
|
||||||
| D-069 | **Lexicon firewall extension to `web/`.** REQ-012 currently scans `x/` + `docs/`. A new sibling meta-test `lexicon_meta_web_test.go` (package `lexicon_meta_web`) scans `web/templates/**/*.html` + `web/static/**/*.js` for the 10 banned terms, using the same `lexicon.FindBannedTerm` + word-boundary regex. Self-exclusion + fragment pattern preserved. **"Sign up" maps to "Create a Reach"** — the word "account" is banned (REQ-012). Firewall-first: lands in P1 before content (P2..P5) so UI strings are lexicon-clean by construction. | REQ-012 is `All` phases and UI strings are user-facing; the firewall must cover the UI to be durable. Extending the existing meta-test pattern (not modifying it) preserves v0.2/v0.3 coverage. Firewall-first (D-044 pattern) ensures UI content is lexicon-clean by construction, not by retrofit. | 0.88 | [skip (REQ-012 is All phases); single combined meta-test scanning x/ + docs/ + web/ (loses isolation)] |
|
|
||||||
| D-070 | **G-003 firewall scope: `web/` importing `x/*/types` is app-layer consumption, not a cross-`x/` production import.** G-003 (production import firewall) prohibits production struct imports across `x/<module>/types` packages. `web/` is not an `x/` module — it is the application layer that consumes protocol types, exactly as a future `cmd/oyd` would. The G-003 firewall stays intact: no `x/` module gains a production import of another `x/` module's types via `web/`. GRILL reviews this boundary. | G-003's intent is to prevent cross-module coupling inside the protocol layer. The application layer consuming types is the intended consumption direction. `web/` importing `x/identity/types` is no different from `cmd/oyd` importing it (when one exists). | 0.85 | [treat `web/` as an `x/` module (wrong — it is not protocol); forbid `web/` from importing `x/*/types` (would force TS/JSON fixtures, losing the grounding in locked constants)] |
|
|
||||||
| D-071 | **"Sign up" = create a Reach + open a Stash atomically.** The Nomad entry path per `docs/nomads/reach.md` is "a Nomad starts with a Reach and a Stash". The signup form creates both atomically: a `Reach` with `IsNomad=true` + a `Stash` with `HolderID` matching the Reach's `HolderID` and `BalanceGrain` seeded to a test value (e.g., 500,000 Grain = 50 Bread). No KYC, no custodian (REQ-001 self-service principle). The UI labels this "Create a Reach" (lexicon-clean; "account" is banned). | The docs define the Nomad starting state as Reach + Stash. Creating only a Reach would leave the Nomad unable to view a Stash dashboard (P2) — the atomic creation matches the docs and makes the happy path contiguous. | 0.82 | [create Reach only, defer Stash creation to a separate flow (fractures the happy path); create Reach + Stash + Window all at signup (over-scope for an MVP)] |
|
|
||||||
| D-072 | **Phase ordering** (provisional, planner finalizes): P1 Web foundation + Reach signup + lexicon firewall extension (REQ-040 + REQ-045 — same `web/` territory, vertical slice, firewall-first) → P2 Stash dashboard (REQ-041, depends on Reach existing) → P3 Window authorization (REQ-042, depends on Stash existing) → P4 Standing + Freeholder signals (REQ-043, depends on Reach existing) → P5 Bloom accrual (REQ-044, depends on Stash existing) → P6 final review + audit + milestone ship. Each phase independently shippable; P1 lands the foundation + firewall first (lexicon-clean by construction). | P1 bundles the web foundation + Reach signup + the firewall extension (same `web/` territory, vertical slice). P2..P5 each add one screen, ordered by the Nomad happy path (Reach → Stash → Window → Standing → Bloom). Vertical slices, each phase shippable. | 0.82 | [different wave ordering; bundle Stash + Window in one phase] |
|
|
||||||
| D-073 | **Bread-scale source of truth = `x/bread/types` code constants, NOT `docs/shared/bread-scale.md`.** The code constants (`GrainsPerBread=10000`, `BreadScaleAll()` table) are the locked, tested values; the docs table is aspirational/outdated (states 1,000× ratios that do not match the code). The UI uses the code constants for all Bread-scale conversions. A doc-fix for `docs/shared/bread-scale.md` is flagged as a P1+ follow-up (not a v0.6 deliverable — docs were a v0.3 deliverable; this is a doc-drift fix, not a UI feature). | The code constants are tested (`x/bread/types/types_test.go` asserts them); the docs are not. Using the code as the source of truth keeps the UI consistent with the protocol layer. | 0.90 | [use the docs table (wrong — not tested, disagrees with code); fix the docs in v0.6 (out of scope — doc-drift fix, not a UI feature)] |
|
|
||||||
+32
-71
@@ -83,13 +83,13 @@ deferred items (D-050, PROJECT.md v0.4 out-of-scope, ROADMAP Phase 3 runtime).
|
|||||||
|
|
||||||
| ID | Requirement | Source | Class | Priority | Status | Phase |
|
| ID | Requirement | Source | Class | Priority | Status | Phase |
|
||||||
|----|-------------|--------|-------|----------|--------|-------|
|
|----|-------------|--------|-------|----------|--------|-------|
|
||||||
| REQ-033 | Exit layer runtime — `x/exit` DEX swap routing + `x/bridge` L2↔L1 IBC packet handlers; promotes REQ-010 from skeleton → runtime (simtest-grade message handlers; live DEX/IBC channels deferred) | PROJECT.md v0.4 OOS / D-050 | feat | High | Complete | v0.5/P1 |
|
| REQ-033 | Exit layer runtime — `x/exit` DEX swap routing + `x/bridge` L2↔L1 IBC packet handlers; promotes REQ-010 from skeleton → runtime (simtest-grade message handlers; live DEX/IBC channels deferred) | PROJECT.md v0.4 OOS / D-050 | feat | High | pending | v0.5/P1 |
|
||||||
| REQ-034 | Bearers transport runtime — OY-SAT + OY-QR bearer transport message handlers in `x/bearers` (extends REQ-019/REQ-022); session lifecycle in simtest (hardware integration deferred) | PROJECT.md v0.4 OOS | feat | Medium | Complete | v0.5/P2 |
|
| REQ-034 | Bearers transport runtime — OY-SAT + OY-QR bearer transport message handlers in `x/bearers` (extends REQ-019/REQ-022); session lifecycle in simtest (hardware integration deferred) | PROJECT.md v0.4 OOS | feat | Medium | pending | v0.5/P2 |
|
||||||
| REQ-035 | Anchors onboarding runtime — `x/partner` Anchor tier credential issuance + revocation handlers (extends REQ-018/REQ-023); credential lifecycle in simtest (real institutional onboarding deferred) | PROJECT.md v0.4 OOS | feat | Medium | Complete | v0.5/P3 |
|
| REQ-035 | Anchors onboarding runtime — `x/partner` Anchor tier credential issuance + revocation handlers (extends REQ-018/REQ-023); credential lifecycle in simtest (real institutional onboarding deferred) | PROJECT.md v0.4 OOS | feat | Medium | pending | v0.5/P3 |
|
||||||
| REQ-036 | Hub API B2B runtime — `x/hub` custody, lending primitive, compliance message handlers; keeper handlers + simtest (real B2B suite deferred) | PROJECT.md v0.4 OOS | feat | High | Complete | v0.5/P4 |
|
| REQ-036 | Hub API B2B runtime — `x/hub` custody, lending primitive, compliance message handlers; keeper handlers + simtest (real B2B suite deferred) | PROJECT.md v0.4 OOS | feat | High | pending | v0.5/P4 |
|
||||||
| REQ-037 | Services runtime — `x/services` Care / SIM / Vault / Mail service lifecycle handlers; runtime handlers + simtest (live service integrations deferred) | PROJECT.md v0.4 OOS | feat | Medium | Complete | v0.5/P5 |
|
| REQ-037 | Services runtime — `x/services` Care / SIM / Vault / Mail service lifecycle handlers; runtime handlers + simtest (live service integrations deferred) | PROJECT.md v0.4 OOS | feat | Medium | pending | v0.5/P5 |
|
||||||
| REQ-038 | Bond market depth runtime — `x/bond` Growth Bonds + secondary-market matching handlers (extends REQ-021/REQ-026); matching engine + simtest (live market depth deferred) | PROJECT.md v0.4 OOS | feat | High | Complete | v0.5/P6 |
|
| REQ-038 | Bond market depth runtime — `x/bond` Growth Bonds + secondary-market matching handlers (extends REQ-021/REQ-026); matching engine + simtest (live market depth deferred) | PROJECT.md v0.4 OOS | feat | High | pending | v0.5/P6 |
|
||||||
| REQ-039 | Council governance runtime — `x/council` Proposal/VoteOption enum types (AUDIT §193 P1-1, deferred from v0.4) + Voice lifecycle handlers; governance message handlers + simtest (Mission Lock const firewall intact per G-003; SignalKind 4→5 expansion deferred to v0.6+) | AUDIT §193 P1-1 / D-050 | feat | Medium | Complete | v0.5/P7 |
|
| REQ-039 | Council governance runtime — `x/council` Proposal/VoteOption enum types (AUDIT §193 P1-1, deferred from v0.4) + Voice lifecycle handlers; governance message handlers + simtest (Mission Lock const firewall intact per G-003; SignalKind 4→5 expansion deferred to v0.6+) | AUDIT §193 P1-1 / D-050 | feat | Medium | pending | v0.5/P7 |
|
||||||
|
|
||||||
> REQ-033..REQ-039 are NEW in v0.5. All are `feat`-class (runtime promotion
|
> REQ-033..REQ-039 are NEW in v0.5. All are `feat`-class (runtime promotion
|
||||||
> from skeleton). No breaking schema changes; locked-const firewall intact
|
> from skeleton). No breaking schema changes; locked-const firewall intact
|
||||||
@@ -97,77 +97,38 @@ deferred items (D-050, PROJECT.md v0.4 out-of-scope, ROADMAP Phase 3 runtime).
|
|||||||
> purity gate (no breaking schema changes; G-003 production firewall intact;
|
> purity gate (no breaking schema changes; G-003 production firewall intact;
|
||||||
> G-006 go.mod unchanged unless a runtime dep is GRILL-approved).
|
> G-006 go.mod unchanged unless a runtime dep is GRILL-approved).
|
||||||
|
|
||||||
## Milestone v0.5 Summary (Bearers Runtime — Feature) — COMPLETE
|
## IDEATE Traceability (Phase 0 — IDEATE stage, autonomy=full)
|
||||||
|
|
||||||
- 7 v0.5-scope REQs shipped as feature (runtime promotion from skeleton): REQ-033, REQ-034, REQ-035, REQ-036, REQ-037, REQ-038, REQ-039
|
|
||||||
- 8 modules promoted to runtime (keeper MsgServer handlers + simtest-grade end-to-end flows): x/exit, x/bridge, x/bearers, x/partner, x/hub, x/services, x/bond, x/council
|
|
||||||
- cosmos-sdk v0.50.8 + ibc-go v8.2.1 added (D-055/D-062, G-006 controlled exception — scoped to runtime phases; types/ packages stay dep-free)
|
|
||||||
- G-003 production firewall intact (expected_keepers.go interfaces; no production struct imports across x/<module>/types)
|
|
||||||
- Locked-const firewall intact: all v0.1..v0.4 consts unchanged (ExitStatusCount=5, BridgeStatusCount=4, BearerTypeCount=6, OYSATLink.SurveillanceResistant=true, PartnerTierCount=4, HubServiceCount=3, LendingCouponCapBps=800, LendingCouponFloorBps=0, ServiceKindCount=4, CouponCapBps=800, CouponFloorBps=0, CouncilKindCount=3, SignalKindCount=4, MissionLockAmendable=false); v0.5 additions additive (AnchorCredentialStatusCount=4, WatcherVetoQuorum default 6 param-tunable)
|
|
||||||
- 5 GRILL decisions ratified: D-055 (cosmos-sdk dep), D-062 (version pin), D-063 (bond CLOB REJECT above 800bps), D-064 (MissionLockAmendment reject-at-ValidateBasic), D-065 (Watcher Veto quorum default 6)
|
|
||||||
- 8 binding fixes landed: G-017 (NoWithVeto test reconciled), G-018 (go 1.22 build gate), G-019 (ImpliedCoupon helper + boundary test), G-020 (WatcherVetoQuorum bounds [2,9]), G-021 (IBC replay ERROR), G-022 (baseline stubs documented), G-023 (keeper/msg_server.go ownership split), G-024 (types/ tests stdlib-only)
|
|
||||||
- Coverage ≥80% on all 8 keeper packages: x/exit/keeper 85.0%, x/bridge/keeper 82.1%, x/bearers/keeper 91.2%, x/partner/keeper 87.6%, x/hub/keeper 90.0%, x/services/keeper 91.5%, x/bond/keeper 92.5%, x/council/keeper 90.3%
|
|
||||||
- 34 packages green (no regression on v0.1..v0.4 baseline)
|
|
||||||
- Tags: v0.4.0 (P0) -> v0.4.1 (P1) -> v0.4.2 (P2) -> v0.4.3 (P3) -> v0.4.4 (P4) -> v0.4.5 (P5) -> v0.4.6 (P6) -> v0.4.7 (P7) -> v0.4.8 (P8 = v0.5 milestone release)
|
|
||||||
- Tag-line note: v0.5 (feature) ships on the v0.4.x patch line (config tag_base). The v0.4.8 milestone release IS the deliverable (D-008 — final phase patch IS the milestone release; no separate minor tag).
|
|
||||||
- 5 P1+ issues flagged for v0.6+ mainnet-readiness (governance spam deposit, CLOB front-running/batch auction, real IBC light-client simtest, CLOB prefix-key perf, emitMatchEventHook testability)
|
|
||||||
|
|
||||||
## v0.6 Milestone Requirements (Nomad Web UI — Feature)
|
|
||||||
|
|
||||||
v0.6 is the project's first UI milestone. It delivers a working prototype Web
|
|
||||||
UI where a person can sign up to be a Nomad (create a Reach + open a Stash)
|
|
||||||
and exercise basic functionality around the (Reach, Stash) components, plus
|
|
||||||
Window authorization, Standing progress, and Bloom accrual views. All data is
|
|
||||||
generated as test fixtures — no real blockchain interaction (D-020 continues).
|
|
||||||
The UI is a greenfield Go `html/template` + HTMX layer served by a Go mock HTTP
|
|
||||||
server (`web/`) that instantiates the real `x/*/types` structs from in-memory
|
|
||||||
fixtures. No keeper, no Cosmos runtime, no `app.go`.
|
|
||||||
|
|
||||||
| ID | Requirement | Source | Class | Priority | Status | Phase |
|
|
||||||
|----|-------------|--------|-------|----------|--------|-------|
|
|
||||||
| REQ-040 | Nomad Reach signup Web UI — Go HTTP mock server (`web/main.go`, Go 1.22 `net/http.ServeMux`, mock store) + "Create a Reach" form (POST) + Reach list/detail views; grounds the UI in `x/identity/types.Reach`. "Sign up" maps to "Create a Reach" (the word "account" is banned per REQ-012). Signup atomically creates a Reach (`IsNomad=true`) + a Stash (per D-071, Nomad starts with both). | user `--ideate` request + D-066/D-067/D-068/D-071 | feat | High | Complete | v0.6/P1 |
|
|
||||||
| REQ-041 | Stash dashboard Web UI — balance in Grain + Bread-scale conversion (using `x/bread/types.BreadScaleAll()` + `GrainsPerBread=10000`, per D-073 code constants are the source of truth) + 90-day maturity progress bar (`x/stash/types.StashActivity.IsMature`, `MaturityThresholdDays=90`). | user `--ideate` request + D-073 | feat | High | Complete | v0.6/P2 |
|
|
||||||
| REQ-042 | Window authorization Web UI — form to open a Window (scope + duration + rate-limit) delegating to a service, lifecycle view (Open→Active→Revoked/Expired via `x/window/types.Window.Activate/Revoke/Expire`), audit log (`AuditEntry`). | user `--ideate` request | feat | Medium | Complete | v0.6/P3 |
|
|
||||||
| REQ-043 | Standing + Freeholder signals progress Web UI — computed from mock `Rating`/`Vouch`/`Slash` records using the locked constants + `GetStandingBucket`/`ComputeDiversityBonus`/`GetVoucherWeight`; 4-signal progress (`FreeholderSignals.IsFreeholderEligible` — StashMaturity, MultiDomainStanding, CommittedCapital, CommunityEndorsement). | user `--ideate` request | feat | Medium | Complete | v0.6/P4 |
|
|
||||||
| REQ-044 | Bloom accrual Web UI — per-Stash `BloomRecord` view (`AccruedGrain`, `RateBasisPoints`, `LastAccrualBlock`), computed from mock data; shows the 4.5% target rate (`TargetBloomRateBasisPoints=450`). | user `--ideate` request | feat | Low | Complete | v0.6/P5 |
|
|
||||||
| REQ-045 | Extend REQ-012 lexicon firewall to scan `web/templates/**` + `web/static/**` + `web/**/*.go` (new `lexicon_meta_web_test.go`, package `lexicon_meta_web`, subdir `lexicon_meta_web/`). Mirrors the `lexicon_meta_docs` pattern with G-013 walk-coverage + G-009 self-test + G-014 shared `SyntheticBannedStrings()`. Firewall-first: lands in P1 before content (P2..P5). | D-069 + RESEARCH D-075 | test/quality | High | Complete | v0.6/P1 |
|
|
||||||
|
|
||||||
> REQ-040..REQ-045 are NEW in v0.6. REQ-040..REQ-044 are `feat`-class (UI
|
|
||||||
> screens); REQ-045 is `test` (lexicon firewall extension). No breaking schema
|
|
||||||
> changes; G-003 production firewall intact (`web/` is app-layer, not an `x/`
|
|
||||||
> module); G-006 go.mod unchanged (HTMX is a vendored static asset, not a Go
|
|
||||||
> dep). The final-phase audit enforces the feature purity gate.
|
|
||||||
|
|
||||||
## IDEATE Traceability (Phase 0 v0.6 — IDEATE stage, autonomy=full)
|
|
||||||
|
|
||||||
The IDEATE stage ran the three ideation tiers (mechanical, backend-enriched,
|
The IDEATE stage ran the three ideation tiers (mechanical, backend-enriched,
|
||||||
cross-project) on the v0.6 milestone scope and ratified 6 ideas (IDEATE-09..
|
cross-project) on the v0.3 milestone scope and ratified 8 ideas (IDEATE-01..
|
||||||
IDEATE-14) at full autonomy. Each IDEATE-NN maps to a REQ-ID in the v0.6
|
IDEATE-08) at full autonomy. Each IDEATE-NN maps to a REQ-ID in the v0.3
|
||||||
requirements table above. The user pre-validated the 5 screens + stack via
|
requirements table above. Mechanical tier: no `lessons:`/`compound:` tags in
|
||||||
interactive questions during CLARIFY (Go html/template + HTMX, Go mock API
|
v0.1/v0.2 history (convention unused); one historical escalation (milestone
|
||||||
server, new `web/` dir, all 5 screens); IDEATE ratifies that validation.
|
release pending — no remote) resolved in v0.2; v0.2 closed clean (9/9 REQs,
|
||||||
|
303 tests, ≥95.9% coverage). Backend-enriched + cross-project tiers confirmed
|
||||||
Mechanical tier: v0.5 closed clean (7/7 REQs, 8 keeper packages ≥80% coverage,
|
the docs deliverable + Bearers skeleton bundle (D-034) and the firewall-first
|
||||||
G-003/locked-const firewalls intact, 5 P1+ flagged for v0.7+ mainnet-readiness);
|
ordering (D-044). Defaults accepted per full autonomy.
|
||||||
no `lessons:`/`compound:` tags in v0.1..v0.5 history (convention unused).
|
|
||||||
Backend-enriched tier: confirmed the mock-server-over-real-Go-types approach
|
|
||||||
grounds the UI in the locked constants (D-067/D-073). Cross-project tier: no
|
|
||||||
applicable cross-project patterns (this is the project's first UI; no prior UI
|
|
||||||
conventions to inherit). Defaults accepted per full autonomy.
|
|
||||||
|
|
||||||
| IDEATE ID | REQ-ID | Category | Source | Confidence | Phase |
|
| IDEATE ID | REQ-ID | Category | Source | Confidence | Phase |
|
||||||
|-----------|--------|----------|--------|------------|-------|
|
|-----------|--------|----------|--------|------------|-------|
|
||||||
| IDEATE-09 | REQ-040 | feature/ui | user `--ideate` request + D-066/D-067/D-068/D-071 | 0.92 | v0.6/P1 |
|
| IDEATE-01 | REQ-027 | improvement/docs | user `--ideate` request + D-042/D-045 | 0.90 | v0.3/P1-P3 |
|
||||||
| IDEATE-10 | REQ-041 | feature/ui | user `--ideate` request + D-073 | 0.90 | v0.6/P2 |
|
| IDEATE-02 | REQ-028 | quality/security | D-043 + RESEARCH firewall-extension design | 0.88 | v0.3/P1 |
|
||||||
| IDEATE-11 | REQ-042 | feature/ui | user `--ideate` request | 0.85 | v0.6/P3 |
|
| IDEATE-03 | REQ-010 | coverage/architecture | ROADMAP Phase 3 + D-036 | 0.80 | v0.3/P4 |
|
||||||
| IDEATE-12 | REQ-043 | feature/ui | user `--ideate` request | 0.85 | v0.6/P4 |
|
| IDEATE-04 | REQ-022 | coverage | ROADMAP Phase 3 + D-037 | 0.82 | v0.3/P4 |
|
||||||
| IDEATE-13 | REQ-044 | feature/ui | user `--ideate` request | 0.80 | v0.6/P5 |
|
| IDEATE-05 | REQ-023 | coverage | ROADMAP Phase 3 + D-038 | 0.78 | v0.3/P4 |
|
||||||
| IDEATE-14 | REQ-045 | quality/security | D-069 + RESEARCH D-075 | 0.88 | v0.6/P1 |
|
| IDEATE-06 | REQ-024 | architecture | ROADMAP Phase 3 + D-039 | 0.80 | v0.3/P5 |
|
||||||
|
| IDEATE-07 | REQ-025 | coverage | ROADMAP Phase 3 + D-040 | 0.78 | v0.3/P5 |
|
||||||
|
| IDEATE-08 | REQ-026 | coverage | ROADMAP Phase 3 + D-041 | 0.80 | v0.3/P5 |
|
||||||
|
|
||||||
Notes:
|
Notes:
|
||||||
- IDEATE-09/14 ship in P1 (web foundation + firewall-first, same `web/` territory — vertical slice).
|
- IDEATE-01/02 (docs deliverable + firewall) are the user's `--ideate` request
|
||||||
- IDEATE-10..13 ship in P2..P5 (one screen per phase, ordered by the Nomad happy path: Reach → Stash → Window → Standing → Bloom).
|
ratified via D-042/D-043/D-045.
|
||||||
- The D-001 refinement-only filter does NOT apply (v0.6 is a feature milestone, not NFR).
|
- IDEATE-03..08 (Bearers skeleton) are the ROADMAP Phase 3 subset bundled into
|
||||||
|
v0.3 per D-034.
|
||||||
|
- IDEATE-02 lands in P1 (firewall-first) BEFORE IDEATE-01 content (P2/P3) per
|
||||||
|
D-044 — docs are lexicon-clean by construction.
|
||||||
|
- IDEATE-03..05 ship in P4 (Bearers skeleton I); IDEATE-06..08 ship in P5
|
||||||
|
(Bearers skeleton II) — vertical slices, each phase independently shippable.
|
||||||
|
|
||||||
## Milestone v0.1 Summary
|
## Milestone v0.1 Summary
|
||||||
- 10 REQs complete (skeleton + tests)
|
- 10 REQs complete (skeleton + tests)
|
||||||
|
|||||||
+1
-530
@@ -2194,533 +2194,4 @@ flow per the researcher role — NOT flagged `[ASSUMED]`):
|
|||||||
rejection is proposed. Confidence 0.80.
|
rejection is proposed. Confidence 0.80.
|
||||||
4. **A-574** (Watcher Veto quorum value): default 6 proposed (matches
|
4. **A-574** (Watcher Veto quorum value): default 6 proposed (matches
|
||||||
REQ-004 6-of-9); the exact param value is a planner decision.
|
REQ-004 6-of-9); the exact param value is a planner decision.
|
||||||
Confidence 0.75.
|
Confidence 0.75.
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## v0.6 Research (Nomad Web UI MVP)
|
|
||||||
|
|
||||||
> v0.6 is the project's first UI milestone (D-066..D-073, CLARIFY). Stack is
|
|
||||||
> Go `html/template` + HTMX (vendored single JS file, no node toolchain —
|
|
||||||
> G-006 zero-dep preserved). Mock data layer = Go HTTP server in new
|
|
||||||
> top-level `web/` dir instantiating real `x/*/types` structs from in-memory
|
|
||||||
> fixtures (no keeper, no Cosmos runtime, no `app.go`). 5 screens: Reach
|
|
||||||
> signup, Stash dashboard, Window authorization, Standing + Freeholder
|
|
||||||
> signals, Bloom accrual. This research grounds the UI in the live codebase
|
|
||||||
> (read-only — no files modified).
|
|
||||||
|
|
||||||
### v0.6 §1. Go `html/template` + HTMX Architecture
|
|
||||||
|
|
||||||
**Server structure** — A Go `html/template` server for the mock UI follows
|
|
||||||
the standard stdlib-only layout (matches D-068's `web/` dir decision):
|
|
||||||
|
|
||||||
```
|
|
||||||
web/
|
|
||||||
main.go # entrypoint: registers routes, serves static + templates
|
|
||||||
handlers/ # one file per screen (reach.go, stash.go, window.go, ...)
|
|
||||||
store/ # in-memory mock store (imports x/*/types, seeded from fixtures)
|
|
||||||
templates/
|
|
||||||
base.html # layout: <html><head>...<script htmx>...</head><body>{{template "content" .}}</body>
|
|
||||||
reach_signup.html # {{define "content"}}...{{end}} per page
|
|
||||||
stash_dashboard.html
|
|
||||||
window_authorize.html
|
|
||||||
standing_signals.html
|
|
||||||
bloom_accrual.html
|
|
||||||
fragments/ # HTMX swap targets (partial HTML, no base layout)
|
|
||||||
static/
|
|
||||||
htmx.min.js # vendored single JS file (G-006: no go get, no npm)
|
|
||||||
style.css
|
|
||||||
```
|
|
||||||
|
|
||||||
**Layout/base template pattern** — Go `html/template` supports template
|
|
||||||
composition via `{{template "name" .}}` + `{{define "name"}}...{{end}}`. The
|
|
||||||
conventional pattern: `base.html` defines the full HTML skeleton and a
|
|
||||||
`{{template "content" .}}` slot; each page template uses
|
|
||||||
`{{define "content"}}...{{end}}` to fill the slot. `template.ParseGlob` or
|
|
||||||
`template.New("").ParseFiles` loads both base + page; `template.ExecuteTemplate`
|
|
||||||
renders the page within the base. The base references the vendored HTMX via
|
|
||||||
`<script src="/static/htmx.min.js"></script>` (served by `http.FileServer` or
|
|
||||||
`http.ServeFile` from `web/static/`).
|
|
||||||
|
|
||||||
**HTMX vendoring (G-006-compliant)** — HTMX is a dependency-free, browser-
|
|
||||||
oriented JS library: a single `htmx.min.js` file loaded via `<script>` tag.
|
|
||||||
**No build step, no node, no npm, no `go get`** — confirmed from the official
|
|
||||||
docs (htmx.org/docs/#installing: "There is no need for a build system to use
|
|
||||||
it"). Vendoring = download `htmx.min.js` (current stable: **2.0.10**, per
|
|
||||||
htmx.org quick-start script tag `htmx.org@2.0.10`) into `web/static/htmx.min.js`
|
|
||||||
and serve it as a static asset. This preserves G-006 (zero-dep go.mod — HTMX is
|
|
||||||
a static file, not a Go module dependency). The `go.mod` (go.mod:1-10) is
|
|
||||||
unchanged by v0.6: no new `require` entries for the UI.
|
|
||||||
|
|
||||||
**HTMX progressive enhancement + Go handler contract** — HTMX generalizes
|
|
||||||
HTML: any element can issue AJAX requests via `hx-get`/`hx-post`/etc.
|
|
||||||
attributes, and the response HTML is swapped into a target element. The Go
|
|
||||||
handler contract for HTMX:
|
|
||||||
- **Initial GET (full page)**: handler renders the full page (base + content
|
|
||||||
template). No-JS fallback works because forms still POST normally.
|
|
||||||
- **HTMX request (fragment)**: HTMX sets the `HX-Request: true` header on
|
|
||||||
AJAX requests. The Go handler checks `r.Header.Get("HX-Request") == "true"`
|
|
||||||
and, if so, renders ONLY the content fragment (no base layout) — returning
|
|
||||||
partial HTML for the swap. Non-HTMX requests get the full page.
|
|
||||||
- **Forms**: `<form hx-post="/reaches" hx-target="#reach-list">` posts to a
|
|
||||||
Go endpoint; the handler validates, mutates the in-memory store, and
|
|
||||||
returns the updated fragment (e.g., the new Reach row) for HTMX to swap in.
|
|
||||||
No-JS fallback: the form's native `action`/`method` attributes handle the
|
|
||||||
POST, returning a full page redirect/render.
|
|
||||||
- **`hx-boost="true"`**: wraps regular `<a>`/`<form>` in AJAX, degrading
|
|
||||||
gracefully to native navigation if JS is disabled (progressive enhancement,
|
|
||||||
confirmed by htmx docs).
|
|
||||||
|
|
||||||
**`html/template` auto-escaping (XSS)** — Go's `html/template` package
|
|
||||||
contextually auto-escapes template actions based on their parsing context
|
|
||||||
(HTML, attribute, CSS, JS, URL). `{{.ReachID}}` in an HTML context becomes
|
|
||||||
`<script>...`-escaped; in a `href="..."` attribute context it's URL-
|
|
||||||
encoded; in a `<script>` block it's JS-escaped. This prevents XSS in user-
|
|
||||||
submitted content (e.g., the Reach signup form's `PublicKey` field) WITHOUT
|
|
||||||
requiring explicit `template.HTMLEscapeString` calls. The auto-escaping is
|
|
||||||
context-aware: `{{template "content" .}}` passes the data through, and each
|
|
||||||
`{{.Field}}` action is escaped per its position. This is a stdlib guarantee
|
|
||||||
(contrast with `text/template`, which does NOT escape — `html/template` must
|
|
||||||
be used for any HTML output). The mock store's string fields (ReachID,
|
|
||||||
PublicKey, etc.) are safe to render directly via `{{.Field}}`.
|
|
||||||
|
|
||||||
### v0.6 §2. Mock Server Data Model — Exact Struct Shapes + Import Paths
|
|
||||||
|
|
||||||
The mock store in `web/store/` instantiates real `x/*/types` structs. Module
|
|
||||||
path is `github.com/oy/openyield` (go.mod:1). The 6 target modules and their
|
|
||||||
exact struct shapes (verified by reading the source):
|
|
||||||
|
|
||||||
**1. Identity — `github.com/oy/openyield/x/identity/types`**
|
|
||||||
(`x/identity/types/types.go:14-21`)
|
|
||||||
```go
|
|
||||||
type Reach struct {
|
|
||||||
ReachID string `json:"reach_id"`
|
|
||||||
HolderID string `json:"holder_id"`
|
|
||||||
CreatedAt int64 `json:"created_at"`
|
|
||||||
PublicKey string `json:"public_key"`
|
|
||||||
IsNomad bool `json:"is_nomad"`
|
|
||||||
IsFreeholder bool `json:"is_freeholder"`
|
|
||||||
}
|
|
||||||
```
|
|
||||||
Plus `CitizenshipTier` (`"Nomad"`/`"Freeholder"`, types.go:24-29) for the
|
|
||||||
signup screen's tier selection. The UI's "Create a Reach" screen instantiates
|
|
||||||
`Reach{ReachID:..., IsNomad:true, ...}` (lexicon-safe: "sign up" maps to
|
|
||||||
"Create a Reach" per REQ-012 — "account" is banned).
|
|
||||||
|
|
||||||
**2. Stash — `github.com/oy/openyield/x/stash/types`**
|
|
||||||
(`x/stash/types/types.go:14-21`)
|
|
||||||
```go
|
|
||||||
type Stash struct {
|
|
||||||
HolderID string `json:"holder_id"`
|
|
||||||
StashID string `json:"stash_id"`
|
|
||||||
CreatedAt int64 `json:"created_at"`
|
|
||||||
LastActive int64 `json:"last_active"`
|
|
||||||
BalanceGrain int64 `json:"balance_grain"`
|
|
||||||
IsStill bool `json:"is_still"` // Still = Holder paused partner access
|
|
||||||
}
|
|
||||||
```
|
|
||||||
Plus `StashActivity` (types.go:24-29) with `ActiveDays uint32`, `MaxGapDays
|
|
||||||
uint32`, `LastActivityDay int64` — and the `IsMature()` helper (types.go:38-40)
|
|
||||||
that checks `ActiveDays >= MaturityThresholdDays && MaxGapDays <=
|
|
||||||
MaxGapForMaturity`. Locked consts: `MaturityThresholdDays = 90` (types.go:32),
|
|
||||||
`MaxGapForMaturity = 30` (types.go:35). The Stash dashboard screen displays
|
|
||||||
`BalanceGrain` (converted to Bread via `x/bread/types` — see §below) and the
|
|
||||||
maturity progress (`ActiveDays/90`).
|
|
||||||
|
|
||||||
**3. Window — `github.com/oy/openyield/x/window/types`**
|
|
||||||
(`x/window/types/types.go:82-93`)
|
|
||||||
```go
|
|
||||||
type Window struct {
|
|
||||||
WindowID string `json:"window_id"`
|
|
||||||
GrantorHolder string `json:"grantor_holder"`
|
|
||||||
Grantee string `json:"grantee"`
|
|
||||||
Scope Scope `json:"scope"`
|
|
||||||
Start int64 `json:"start"`
|
|
||||||
End int64 `json:"end"`
|
|
||||||
RateLimit RateLimit `json:"rate_limit"`
|
|
||||||
Revoked bool `json:"revoked"`
|
|
||||||
Status WindowStatus `json:"status"`
|
|
||||||
AuditLogRefs []string `json:"audit_log_refs"`
|
|
||||||
}
|
|
||||||
```
|
|
||||||
Supporting types: `ScopeKind` (types.go:19-25: `ReadStash`/`ReadStanding`/
|
|
||||||
`ProcessPassActForStand`), `Scope` (types.go:28-31: `Kind ScopeKind`,
|
|
||||||
`ResourceID string`), `RateLimit` (types.go:36-40: `MaxActions uint32`,
|
|
||||||
`PerDurationSeconds int64`, `ActionsConsumed uint32`), `AuditEntry`
|
|
||||||
(types.go:56-62), `WindowStatus` (types.go:65-72: `Open`/`Active`/`Revoked`/
|
|
||||||
`Expired`), `WindowStatusCount = 4` (types.go:76, locked). Methods the mock
|
|
||||||
store can invoke to demonstrate lifecycle: `Window.Activate()` (types.go:123-
|
|
||||||
129, Open→Active), `Window.Revoke()` (types.go:100-112, idempotent, Expired
|
|
||||||
is terminal), `Window.Expire()` (types.go:117-119), `RateLimit.Consume()`
|
|
||||||
(types.go:46-52, returns false when cap reached). The Window authorization
|
|
||||||
screen lets a Holder grant a scoped, time-limited, rate-limited Window.
|
|
||||||
|
|
||||||
**4. Standing — `github.com/oy/openyield/x/standing/types`**
|
|
||||||
(`x/standing/types/types.go:44-96`)
|
|
||||||
```go
|
|
||||||
type Rating struct {
|
|
||||||
RaterID, RateeID, Category, TxRef string
|
|
||||||
Score, Weight float64
|
|
||||||
Timestamp int64
|
|
||||||
DecayBucket uint8
|
|
||||||
}
|
|
||||||
type Vouch struct {
|
|
||||||
VoucherID, VoucheeID, Category string
|
|
||||||
BondAmount int64
|
|
||||||
Timestamp int64
|
|
||||||
}
|
|
||||||
type Slash struct {
|
|
||||||
ReachID, Reason, Attester string
|
|
||||||
Amount float64
|
|
||||||
Timestamp int64
|
|
||||||
}
|
|
||||||
type FreeholderSignals struct {
|
|
||||||
StashMaturity bool
|
|
||||||
MultiDomainStanding bool
|
|
||||||
CommittedCapital bool
|
|
||||||
CommunityEndorsement bool
|
|
||||||
}
|
|
||||||
```
|
|
||||||
Helpers the UI invokes: `FreeholderSignals.IsFreeholderEligible()` (types.go:94-
|
|
||||||
96, all four must be true), `GetStandingBucket(score, ratingCount, isSlashed)`
|
|
||||||
(types.go:129-145, returns `New`/`Trusted`/`Preferred`/`Top`/`Slashed`),
|
|
||||||
`ComputeDiversityBonus(categoryCount)` (types.go:99-109), `GetVoucherWeight(
|
|
||||||
isFreeholder, standingScore, ratingCount)` (types.go:112-126). Locked formula
|
|
||||||
consts (types.go:12-41): `PriorMean=4.0`, `PriorWeight=10`, decay buckets
|
|
||||||
(`1.0`/`0.5`/`0.25`/`0.0`), diversity bonuses (`0.05`/`0.10`/`0.15`), voucher
|
|
||||||
weights (`1.5`/`1.2`/`1.0`/`0.5`/`0.3`), min counterparties (`3`/`10`/`30`),
|
|
||||||
Freeholder thresholds (`90` days, `30` max gap, `4.5` score, `3` categories).
|
|
||||||
The Standing + Freeholder signals screen displays the 4 signals and the
|
|
||||||
computed bucket.
|
|
||||||
|
|
||||||
**5. Bread — `github.com/oy/openyield/x/bread/types`**
|
|
||||||
(`x/bread/types/types.go:13, 30-50`)
|
|
||||||
```go
|
|
||||||
const GrainsPerBread = 10000
|
|
||||||
type BreadScale struct {
|
|
||||||
Name string
|
|
||||||
GrainValue int64
|
|
||||||
}
|
|
||||||
func BreadScaleAll() []BreadScale // returns 11 denominations
|
|
||||||
```
|
|
||||||
**Source of truth = code constants, NOT docs** (D-073). The 11-tier scale
|
|
||||||
from `BreadScaleAll()` (types.go:37-49), each tier 100× the previous (NOT
|
|
||||||
1,000× as the outdated `docs/shared/bread-scale.md:7-19` claims):
|
|
||||||
| Tier | Name | GrainValue |
|
|
||||||
|---|---|---|
|
|
||||||
| 1 | Grain | 1 |
|
|
||||||
| 2 | Crumb | 100 |
|
|
||||||
| 3 | Bread | 10,000 |
|
|
||||||
| 4 | Loaf | 100,000 |
|
|
||||||
| 5 | Batch | 1,000,000 |
|
|
||||||
| 6 | Cake | 10,000,000 |
|
|
||||||
| 7 | Bakery | 100,000,000 |
|
|
||||||
| 8 | Granary | 1,000,000,000 |
|
|
||||||
| 9 | Mill | 10,000,000,000 |
|
|
||||||
| 10 | Harvest | 100,000,000,000 |
|
|
||||||
| 11 | Earth | 1,000,000,000,000 |
|
|
||||||
|
|
||||||
Verified by `x/bread/types/types_test.go:9-28` (asserts `GrainsPerBread ==
|
|
||||||
10000` and the full `BreadScaleAll()` table). The UI's Stash dashboard and
|
|
||||||
Bloom accrual screens use these code constants for all Grain↔Bread
|
|
||||||
conversions. **Doc-drift finding**: `docs/shared/bread-scale.md:10-19` states
|
|
||||||
Crumb=1,000 Grain and each tier is 1,000× the previous — this contradicts the
|
|
||||||
code (Crumb=100, each tier 100×). D-073 flags a doc-fix as a P1+ follow-up
|
|
||||||
(NOT a v0.6 deliverable); the UI uses the code constants.
|
|
||||||
|
|
||||||
**6. Bloom — `github.com/oy/openyield/x/bloom/types`**
|
|
||||||
(`x/bloom/types/types.go:23-28`)
|
|
||||||
```go
|
|
||||||
type BloomRecord struct {
|
|
||||||
StashID string `json:"stash_id"`
|
|
||||||
AccruedGrain int64 `json:"accrued_grain"`
|
|
||||||
LastAccrualBlock int64 `json:"last_accrual_block"`
|
|
||||||
RateBasisPoints uint32 `json:"rate_basis_points"`
|
|
||||||
}
|
|
||||||
```
|
|
||||||
Locked consts (types.go:13-19): `TargetBloomRateBasisPoints = 450` (4.5%),
|
|
||||||
`MinBloomRateBasisPoints = 400`, `MaxBloomRateBasisPoints = 500`,
|
|
||||||
`AccrualPeriodBlocks = 144`. The Bloom accrual screen displays a Stash's
|
|
||||||
`BloomRecord` — `AccruedGrain` (in Bread-scale via `x/bread/types`), the
|
|
||||||
rate in bps, and the accrual block. `MissionLockBloom` (types.go:52) is the
|
|
||||||
locked const: "Bloom originates only from real production. No synthetic
|
|
||||||
Bloom. No protocol-printed Bloom." — the UI surfaces this as a tooltip/
|
|
||||||
explanatory note.
|
|
||||||
|
|
||||||
**G-003 scope confirmation** — `web/store/` importing `x/*/types` is app-
|
|
||||||
layer consumption (the mock store reads type definitions to populate
|
|
||||||
fixtures), NOT cross-`x/` production import. The G-003 production firewall
|
|
||||||
governs keeper-to-keeper cross-module calls (use `expected_keepers.go`
|
|
||||||
interface shims, not struct imports). `web/` is not a keeper; it imports
|
|
||||||
types packages the same way `x/*/types/types_test.go` does (test-only
|
|
||||||
exemption). The firewall is intact (D-067 rationale).
|
|
||||||
|
|
||||||
### v0.6 §3. Lexicon Firewall Extension — `lexicon_meta_web_test.go`
|
|
||||||
|
|
||||||
**Existing pattern to mirror** — Two meta-tests exist:
|
|
||||||
1. `lexicon_meta_test.go` (repo root, package `lexicon_meta`) — scans
|
|
||||||
`x/**/*.go` (lexicon_meta_test.go:37-72).
|
|
||||||
2. `lexicon_meta_docs/lexicon_meta_docs_test.go` (subdir, package
|
|
||||||
`lexicon_meta_docs`) — scans `README.md` + `docs/**/*.md`
|
|
||||||
(lexicon_meta_docs_test.go:75-122).
|
|
||||||
|
|
||||||
Both share a single source of truth via `lexicon.SyntheticBannedStrings()`
|
|
||||||
(lexicon.go:111-125, REQ-029 / G-014) and `lexicon.FindBannedTerm()`
|
|
||||||
(lexicon.go:73-82, word-boundary case-insensitive regex match).
|
|
||||||
|
|
||||||
**Pattern for `lexicon_meta_web_test.go`** — A new sibling meta-test,
|
|
||||||
mirroring the docs firewall:
|
|
||||||
- **Location**: `lexicon_meta_web/lexicon_meta_web_test.go` (subdir, like
|
|
||||||
`lexicon_meta_docs/` — Go forbids two packages in one dir).
|
|
||||||
- **Package**: `lexicon_meta_web`.
|
|
||||||
- **Scan targets**: `web/templates/**/*.html` + `web/static/**/*.js` (REQ-012
|
|
||||||
extension for the UI surface). NOT `.go` files in `web/` (those are covered
|
|
||||||
by the existing `lexicon_meta_test.go` x/ scan only if `web/` is under
|
|
||||||
`x/` — it is NOT, so `web/**/*.go` must ALSO be scanned; the new test
|
|
||||||
should scan `web/**/*.{html,js,go}` or a separate walk for `.go`).
|
|
||||||
- **Self-exclusion**: via `runtime.Caller(0)` + `thisFile(t)` helper
|
|
||||||
(lexicon_meta_test.go:160-167), the test file excludes itself from its own
|
|
||||||
scan (it references banned terms via the `lexicon` package's fragment-
|
|
||||||
assembled helpers, so no banned-term literal appears in the firewall's own
|
|
||||||
code).
|
|
||||||
- **Detection**: `lexicon.FindBannedTerm(string(bz))` — NO reimplementation.
|
|
||||||
- **Walk-coverage (G-013)**: mirror `TestLexiconMetaDocsWalkCoverage`
|
|
||||||
(lexicon_meta_docs_test.go:218-296) — inject a synthetic banned-term
|
|
||||||
fixture into a temp `web/templates/.lexicon_fixture/` subtree and assert
|
|
||||||
the walk FINDS it (closes the "silently scans nothing, reports green" gap).
|
|
||||||
- **Self-test table (G-009)**: consume `lexicon.SyntheticBannedStrings()`
|
|
||||||
(single source, G-014) — no duplicated table.
|
|
||||||
- **Banned-terms count assertion**: `len(lexicon.BannedTerms()) == 10`
|
|
||||||
(mirror lexicon_meta_test.go:113-125).
|
|
||||||
- **False-positive regression**: `TestLexiconMetaNoFalsePositiveOnOpenYield`
|
|
||||||
(lexicon_meta_test.go:131-143) — "openyield" must NOT trigger "yield".
|
|
||||||
|
|
||||||
**10 banned terms — verified from code** (`lexicon/lexicon.go:30-41`):
|
|
||||||
`bank`, `deposit`, `interest`, `yield`, `currency`, `dollar`, `euro`,
|
|
||||||
`account`, `savings`, `depositor`. Assembled at runtime from two-character
|
|
||||||
fragments (e.g., `{"ba", "nk"}` → "bank") so the firewall's own source
|
|
||||||
contains no banned-term literal. The spec lists 10; plan docs say "9"
|
|
||||||
counting dollar/euro as a pair (lexicon.go:43-48, lexicon_meta_test.go:87-89).
|
|
||||||
|
|
||||||
**Lexicon-safe UI vocabulary** — "account" is banned → the Reach signup
|
|
||||||
screen uses "Create a Reach" (not "Create an account"). "deposit"/"savings"
|
|
||||||
banned → the Stash dashboard uses "Stash" / "balance" / "Grain" / "Bread".
|
|
||||||
"interest"/"yield" banned → the Bloom screen uses "Bloom" / "accrual" /
|
|
||||||
"rate". "bank"/"currency"/"dollar"/"euro" banned → Bread-scale only. The
|
|
||||||
meta-test enforces this across all `web/templates/**` + `web/static/**`.
|
|
||||||
|
|
||||||
### v0.6 §4. HTTP Routing (stdlib — Go 1.22 `net/http.ServeMux`)
|
|
||||||
|
|
||||||
**Go version confirmed**: `go.mod:3` declares `go 1.22`. Go 1.22 enhanced
|
|
||||||
`net/http.ServeMux` with method + path-pattern routing (no third-party
|
|
||||||
router needed — G-006 preserved; `gorilla/mux` is a transitive cosmos-sdk
|
|
||||||
dep at go.mod:75 but is NOT used by `web/`).
|
|
||||||
|
|
||||||
**Pattern** — Go 1.22 `ServeMux` supports `"METHOD /path/{param}"` patterns:
|
|
||||||
```go
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
mux.HandleFunc("GET /reaches/{id}", reachHandler) // path param
|
|
||||||
mux.HandleFunc("POST /reaches", createReachHandler) // form submit
|
|
||||||
mux.HandleFunc("GET /stashes/{id}", stashHandler)
|
|
||||||
mux.HandleFunc("POST /windows/{id}/revoke", revokeWindowHandler)
|
|
||||||
```
|
|
||||||
Path-parameter extraction: `r.PathValue("id")` (replaces the legacy
|
|
||||||
`r.URL.Query().Get()` hack). Method matching is exact: `"GET /reaches/{id}"`
|
|
||||||
matches only GET; a POST to the same path 404s unless a `"POST /reaches"`
|
|
||||||
handler is also registered. `{$}` suffix anchors the pattern (e.g.,
|
|
||||||
`"GET /"` matches only the root, not `/foo`).
|
|
||||||
|
|
||||||
**Why stdlib, not gorilla/mux** — G-006 (zero-dep for the UI layer): the
|
|
||||||
mock server is a standalone Go binary in `web/`, not a Cosmos module. It
|
|
||||||
should not pull router deps that exist only because cosmos-sdk transitively
|
|
||||||
requires them. Go 1.22's enhanced `ServeMux` covers all 5 screens' routing
|
|
||||||
needs (GET for render, POST for form submit, path params for entity detail).
|
|
||||||
The `gorilla/mux` at go.mod:75 is an indirect cosmos-sdk dep — `web/` does
|
|
||||||
not import it.
|
|
||||||
|
|
||||||
**Static assets** — `mux.Handle("/static/", http.StripPrefix("/static/",
|
|
||||||
http.FileServer(http.Dir("web/static"))))` serves the vendored `htmx.min.js`
|
|
||||||
+ CSS. No middleware needed for the MVP.
|
|
||||||
|
|
||||||
### v0.6 §5. PERSONAS.md Update — frontend-engineer Activation
|
|
||||||
|
|
||||||
**Current state** — `.ciagent/oy/PERSONAS.md:52-56` lists `frontend-engineer`
|
|
||||||
under `deactivated:` with reason "INACTIVE for v0.5. The v0.3 docs site is
|
|
||||||
COMPLETE; v0.5 has no UI/docs-content work." This is the project's FIRST UI
|
|
||||||
milestone — frontend-engineer must be **activated** for v0.6.
|
|
||||||
|
|
||||||
**YAML frontmatter format** (PERSONAS.md:1-61) — The file uses YAML frontmatter
|
|
||||||
between `---` fences with this structure:
|
|
||||||
```yaml
|
|
||||||
---
|
|
||||||
active_personas:
|
|
||||||
- id: <persona-id>
|
|
||||||
active: true
|
|
||||||
phase_specific: false | true
|
|
||||||
reason: <paragraph — why active, what they own>
|
|
||||||
frameworks: [<list>]
|
|
||||||
territory: [<glob list>]
|
|
||||||
constraints: [<list of invariant strings>]
|
|
||||||
|
|
||||||
phase_specific_personas: # optional, for phase-scoped personas
|
|
||||||
- id: ...
|
|
||||||
...
|
|
||||||
|
|
||||||
deactivated:
|
|
||||||
- id: <persona-id>
|
|
||||||
reason: <paragraph — why inactive>
|
|
||||||
|
|
||||||
custom_personas: []
|
|
||||||
---
|
|
||||||
```
|
|
||||||
Followed by a Markdown body (`# Personas: OpenYield (oy) — v0.6 ...`) with an
|
|
||||||
Active Roster table, Phase-Persona Matrix, and Constraints Carried Forward
|
|
||||||
sections (PERSONAS.md:63-133).
|
|
||||||
|
|
||||||
**Proposed frontend-engineer activation** (v0.6):
|
|
||||||
- **Move** `frontend-engineer` from `deactivated:` (PERSONAS.md:52-54) to
|
|
||||||
`active_personas:` (after the existing active personas).
|
|
||||||
- **`active: true`**, **`phase_specific: false`** (spans all v0.6 phases —
|
|
||||||
P1..P5 for the 5 screens + lexicon firewall).
|
|
||||||
- **`reason`**: First UI milestone. Owns the Go `html/template` + HTMX mock
|
|
||||||
Web UI in `web/` — 5 screens (Reach signup, Stash dashboard, Window
|
|
||||||
authorization, Standing + Freeholder signals, Bloom accrual), the vendored
|
|
||||||
HTMX static asset, the in-memory mock store's template rendering, and the
|
|
||||||
`lexicon_meta_web_test.go` firewall extension. Co-owns the mock store's
|
|
||||||
Go type integration with backend-engineer (the store imports `x/*/types`).
|
|
||||||
- **`frameworks`**: `[Go 1.22, html/template (stdlib), HTMX 2.0.x (vendored JS), net/http.ServeMux (Go 1.22), Go testing]`. **NO node, NO React, NO
|
|
||||||
package.json, NO build step.**
|
|
||||||
- **`territory`**: `["web/templates/**", "web/static/**", "web/handlers/**",
|
|
||||||
"web/store/**", "web/main.go", "lexicon_meta_web/lexicon_meta_web_test.go"]`.
|
|
||||||
- **`constraints`**:
|
|
||||||
- "G-006 zero-dep preserved — HTMX is a vendored static JS file
|
|
||||||
(`web/static/htmx.min.js`), NOT a `go get` dependency; `go.mod` unchanged
|
|
||||||
by v0.6 UI work; no node/npm/package.json toolchain"
|
|
||||||
- "G-003 app-layer consumption — `web/store/` imports `x/*/types` to
|
|
||||||
instantiate real structs (Reach, Stash, Window, FreeholderSignals,
|
|
||||||
BloomRecord); this is app-layer consumption, NOT cross-`x/` production
|
|
||||||
import; the production firewall (keeper-to-keeper shims) is intact"
|
|
||||||
- "REQ-012 lexicon firewall extended — new `lexicon_meta_web_test.go`
|
|
||||||
scans `web/templates/**` + `web/static/**`; 'account' is banned — Reach
|
|
||||||
signup uses 'Create a Reach'; 'deposit'/'savings'/'interest'/'yield'/
|
|
||||||
'bank'/'currency'/'dollar'/'euro'/'depositor' all banned"
|
|
||||||
- "Bread-scale source of truth = `x/bread/types` code constants
|
|
||||||
(`GrainsPerBread=10000`, `BreadScaleAll()` 11-tier table, each tier
|
|
||||||
100× the previous), NOT `docs/shared/bread-scale.md` (which is outdated —
|
|
||||||
states 1,000× ratios; D-073)"
|
|
||||||
- "`html/template` auto-escaping prevents XSS in user-submitted content
|
|
||||||
(Reach form input); no manual escaping needed"
|
|
||||||
- "HTMX progressive enhancement — forms work without JS (native
|
|
||||||
`action`/`method` fallback); `HX-Request` header distinguishes fragment
|
|
||||||
vs full-page rendering in handlers"
|
|
||||||
|
|
||||||
**backend-engineer co-ownership note** — Add a note that backend-engineer
|
|
||||||
co-owns the mock store's Go type integration (`web/store/` importing
|
|
||||||
`x/*/types`), since backend-engineer owns the `x/` module types. The
|
|
||||||
frontend-engineer owns the template/handler/HTMX layer; backend-engineer
|
|
||||||
advises on the struct shapes and locked consts. This mirrors the v0.5
|
|
||||||
cosmos-engineer advisory pattern.
|
|
||||||
|
|
||||||
**Other persona changes** — backend-engineer, lead-developer stay active
|
|
||||||
(lead-developer owns `.ciagent/` updates + milestone ship). security-
|
|
||||||
engineer, cosmos-engineer, mesh-engineer, data-engineer: **deactivate** for
|
|
||||||
v0.6 (no runtime promotion, no IBC, no bearers, no custody store — v0.6 is
|
|
||||||
UI-only, mock data, no chain). ci-security-auditor: default off, activate in
|
|
||||||
the final phase for the feature purity gate. docs-writer: stays deactivated
|
|
||||||
(the doc-drift fix for `bread-scale.md` is a P1+ follow-up, not a v0.6
|
|
||||||
deliverable — D-073).
|
|
||||||
|
|
||||||
### v0.6 §6. ARCHITECTURE.md Update — Proposed Section Outline
|
|
||||||
|
|
||||||
**Current structure** (`.ciagent/oy/ARCHITECTURE.md`, 514 lines) — top-level
|
|
||||||
sections by line:
|
|
||||||
- `# Architecture: OpenYield (oy) — Phase 0 Index` (line 1)
|
|
||||||
- `## Source` (3), `## Component Index` (7), `## Cross-Component Interfaces`
|
|
||||||
(26), `## Critical Blocker Chain` (34), `## Non-Negotiables` (45), `##
|
|
||||||
Phase 0 Architecture Deliverables` (57)
|
|
||||||
- `## v0.3 Architecture (Bearers & Documentation)` (64) + subsections
|
|
||||||
(72-186)
|
|
||||||
- `## v0.4 Architecture (Refinement — NFR)` (188) + subsections (194-264)
|
|
||||||
- `## v0.5 Runtime Architecture (Bearers Runtime)` (266) + subsections
|
|
||||||
(277-514, the file's end)
|
|
||||||
|
|
||||||
**Insertion point** — A new `## v0.6 Architecture (Nomad Web UI MVP)`
|
|
||||||
section appended AFTER the v0.5 section (after line 514, the file's current
|
|
||||||
end). This matches the chronological append convention (v0.3 → v0.4 → v0.5
|
|
||||||
→ v0.6).
|
|
||||||
|
|
||||||
**Proposed section outline** (do NOT write — report only):
|
|
||||||
```
|
|
||||||
## v0.6 Architecture (Nomad Web UI MVP)
|
|
||||||
### v0.6 Scope Recap (from D-066..D-073)
|
|
||||||
### v0.6 Component Map (new web/ dir — not a Cosmos module)
|
|
||||||
- web/main.go (entrypoint, Go 1.22 net/http.ServeMux)
|
|
||||||
- web/handlers/ (5 screen handlers + fragment vs full-page dispatch)
|
|
||||||
- web/store/ (in-memory mock store, imports x/*/types)
|
|
||||||
- web/templates/ (base.html layout + 5 page templates + fragments/)
|
|
||||||
- web/static/ (vendored htmx.min.js 2.0.10 + style.css)
|
|
||||||
### v0.6 Mock Data Layer (D-067 — real x/*/types structs, no keeper)
|
|
||||||
- 6 imported type packages: identity, stash, window, standing, bread, bloom
|
|
||||||
- Locked consts surfaced: GrainsPerBread=10000, MaturityThresholdDays=90,
|
|
||||||
TargetBloomRateBasisPoints=450, standing formula constants
|
|
||||||
- Bread-scale source = code constants (D-073), NOT docs/shared/bread-scale.md
|
|
||||||
### v0.6 G-003 Firewall (app-layer consumption, not cross-x/ production)
|
|
||||||
- web/store/ imports x/*/types (like x/*/types/types_test.go test exemption)
|
|
||||||
- No keeper, no expected_keepers.go, no sdk.Msg — web/ is not a Cosmos module
|
|
||||||
### v0.6 G-006 Zero-Dep (HTMX vendored as static asset, not a Go dep)
|
|
||||||
- go.mod unchanged by v0.6
|
|
||||||
- htmx.min.js is a static file served by http.FileServer, not a go get
|
|
||||||
### v0.6 Lexicon Firewall Extension (REQ-012 — new lexicon_meta_web_test.go)
|
|
||||||
- Scans web/templates/** + web/static/** (+ web/**/*.go)
|
|
||||||
- 10 banned terms (account, bank, deposit, savings, interest, yield, ...)
|
|
||||||
- "Create a Reach" not "Create an account"
|
|
||||||
### v0.6 Interface Contracts (unchanged — UI is read-only mock, no new x/ interfaces)
|
|
||||||
```
|
|
||||||
|
|
||||||
This outline mirrors the v0.5 section's subsection density (scope recap →
|
|
||||||
component map → per-concern firewall/dep sections → interface contracts).
|
|
||||||
|
|
||||||
### v0.6 Cross-Reference Summary
|
|
||||||
|
|
||||||
| Concern | Source | Reference |
|
|
||||||
|---|---|---|
|
|
||||||
| Module path | go.mod:1 | `github.com/oy/openyield` |
|
|
||||||
| Go version | go.mod:3 | `go 1.22` (ServeMux method patterns) |
|
|
||||||
| Reach struct | x/identity/types/types.go:14-21 | 6 fields |
|
|
||||||
| Stash struct | x/stash/types/types.go:14-21 | 6 fields + IsMature() helper |
|
|
||||||
| Window struct | x/window/types/types.go:82-93 | 10 fields + Activate/Revoke/Expire |
|
|
||||||
| FreeholderSignals | x/standing/types/types.go:85-90 | 4 bools + IsFreeholderEligible() |
|
|
||||||
| BreadScaleAll | x/bread/types/types.go:36-50 | 11 tiers, 100× ratios (NOT 1,000×) |
|
|
||||||
| BloomRecord | x/bloom/types/types.go:23-28 | 4 fields + TargetBloomRateBasisPoints=450 |
|
|
||||||
| Banned terms | lexicon/lexicon.go:30-41 | 10 terms (bank, deposit, interest, yield, currency, dollar, euro, account, savings, depositor) |
|
|
||||||
| Meta-test pattern | lexicon_meta_test.go:37-72 | Walk + FindBannedTerm + self-exclusion |
|
|
||||||
| Docs meta-test | lexicon_meta_docs/lexicon_meta_docs_test.go:75-122 | subdir pattern + G-013 walk-coverage |
|
|
||||||
| HTMX version | htmx.org docs | 2.0.10 (stable, single JS file, no build) |
|
|
||||||
| PERSONAS.md format | .ciagent/oy/PERSONAS.md:1-61 | YAML frontmatter + Markdown body |
|
|
||||||
| ARCHITECTURE.md end | .ciagent/oy/ARCHITECTURE.md:514 | v0.6 section appends after |
|
|
||||||
| D-067 (mock store) | PROJECT.md:303 | Go HTTP server, real x/*/types structs |
|
|
||||||
| D-073 (bread-scale) | PROJECT.md:309 | Code constants, not docs (docs outdated) |
|
|
||||||
|
|
||||||
### v0.6 Assumptions (logged with confidence scores; not flagged for human validation)
|
|
||||||
|
|
||||||
1. **HTMX 2.0.10 is the version to vendor** — the htmx.org quick-start
|
|
||||||
script tag pins `htmx.org@2.0.10`; v4 is in beta (Summer '26 target).
|
|
||||||
2.0.10 is the current stable. Confidence 0.95.
|
|
||||||
2. **`web/**/*.go` must be scanned by the lexicon firewall** — the existing
|
|
||||||
`lexicon_meta_test.go` scans only `x/**/*.go`; `web/` is a new top-level
|
|
||||||
dir NOT under `x/`. The new `lexicon_meta_web_test.go` should scan
|
|
||||||
`web/**/*.{html,js,go}` (or a separate `.go` walk) to cover handler/
|
|
||||||
store Go files. Confidence 0.85.
|
|
||||||
3. **`html/template` auto-escaping is sufficient for the MVP** — the mock
|
|
||||||
UI has no authenticated users and no persistent storage; user input
|
|
||||||
(Reach signup form) is rendered via `{{.Field}}` which context-auto-
|
|
||||||
escapes. No `template.JS`/`template.HTML` unsafe injection points needed
|
|
||||||
for the MVP. Confidence 0.90.
|
|
||||||
4. **Go 1.22 `ServeMux` covers all 5 screens' routing** — GET (render) +
|
|
||||||
POST (form submit) + path params (`/reaches/{id}`) is the full routing
|
|
||||||
surface; no middleware, no wildcard host matching needed. Confidence
|
|
||||||
0.95.
|
|
||||||
5. **`web/main.go` is the entrypoint (not `cmd/oyd-ui/main.go`)** — D-068
|
|
||||||
says `web/` contains `main.go` (or `cmd/oyd-ui/main.go`); the simpler
|
|
||||||
`web/main.go` matches the mock-server scope (single binary, no
|
|
||||||
subcommands). Confidence 0.80.
|
|
||||||
+418
-14
@@ -1,19 +1,423 @@
|
|||||||
# v0.6 Review (Nomad Web UI)
|
# Review: OpenYield (oy) — v0.2 (The Mesh) Final Phase (P1-P4)
|
||||||
|
|
||||||
## Multi-persona code review across P1..P5
|
> **Reviewer**: CIAgent code reviewer (correctness, security, maintainability, adversarial lenses)
|
||||||
|
> **Date**: 2026-08-17
|
||||||
|
> **Scope**: `git diff main..oy/milestone/v0.2-mesh` — all v0.2 execution work (P1-P4: x/window, x/stand, x/guild, x/pact, x/partner, x/council, x/forex, x/bond, x/satellite, x/bearers extension, lexicon package, lexicon_meta_test.go)
|
||||||
|
> **Milestone**: v0.2 — The Mesh
|
||||||
|
> **Mode**: multi-project (slug `oy`)
|
||||||
|
> **Autonomy**: full — P0 fixes auto-applied; P1+ flagged for post-hoc review (do not block ship)
|
||||||
|
|
||||||
### 8 adversarial probes
|
---
|
||||||
|
|
||||||
1. **`go run ./web` starts with no external deps (G-006)** — PASS. `git diff v0.5.0..HEAD -- go.mod go.sum` is empty. HTMX is a vendored static asset (`web/static/htmx.min.js`), NOT a `go get`. Zero new require lines across the v0.6 milestone.
|
## Verification Commands Run
|
||||||
2. **All 5 screens reachable from the home page** — PASS. Nav in `web/templates/base.html` links to /reach, /stash, /window, /standing, /bloom. Each route returns 200 (handler tests + smoke test on dynamic port 47077/53907).
|
|
||||||
3. **`lexicon_meta_web/` firewall scans `web/templates/**` + `web/static/**` + `web/**/*.go`** — PASS. `go test ./lexicon_meta_web/...` green; G-013 walk-coverage test injects a synthetic banned-term fixture and finds it.
|
|
||||||
4. **Bread-scale conversion matches `x/bread/types` code constants (D-073)** — PASS. `TestStashBreadScaleConversionCorrectness` asserts GrainsPerBread=10000, Crumb=100 Grain (code values); would FAIL if the outdated docs 1000x values were used.
|
|
||||||
5. **Standing score uses locked formula constants** — PASS. `TestStandingScoreComputedFromLockedConstants` asserts PriorMean=4.0, PriorWeight=10, ComputeDiversityBonus, GetVoucherWeight, GetStandingBucket (all from x/standing/types, NOT hardcoded).
|
|
||||||
6. **Freeholder-eligible badge reflects `IsFreeholderEligible()`** — PASS. `TestFreeholderEligibleBadgeReflectsMethod` asserts the rendered badge matches the real method output for both eligible (holder-alia) and non-eligible (holder-bryn) Reaches.
|
|
||||||
7. **Window lifecycle transitions call `Window.Activate/Revoke/Expire`** — PASS. `TestWindowActivateTransitionsOpenToActive` + `TestWindowRevokeTransitionsToRevoked` assert the real x/window/types methods are invoked (status transitions verified). `TestWindowRevokeOnExpiredIsNoOp` asserts the v0.2 terminal-state contract (revoke-on-expired is a no-op).
|
|
||||||
8. **No banned terms in any rendered page** — PASS. Per-handler rendered-HTML lexicon checks (G-026) in all 5 phases scan BOTH 200 happy-path AND error response bodies (400/404). `lexicon_meta_web/` file-scan firewall green on all web/**/*.{html,js,go} files.
|
|
||||||
|
|
||||||
### Verdict: SHIP. No P0 issues. No P1+ issues flagged.
|
| Command | Result |
|
||||||
|
|---|---|
|
||||||
|
| `go build ./...` | **GREEN** (exit 0) |
|
||||||
|
| `go test ./...` | **GREEN** (exit 0, all 25 packages: 15 v0.1 baseline + 10 v0.2 new/extended) |
|
||||||
|
| `go test -cover ./x/{window,stand,guild,pact,partner,council,forex,bond,bearers,satellite}/types/...` | **ALL ≥80%** (range 95.9%–100.0%; 8 of 10 at 100%) |
|
||||||
|
| `go test -run TestLexiconMeta ./...` | **GREEN** (4 meta-tests pass at root pkg) |
|
||||||
|
| `go test -run TestG003NoCrossModuleStructImportsInProduction ./x/window/types/` | **GREEN** (G-003 invariant enforced) |
|
||||||
|
| `git diff main..oy/milestone/v0.2-mesh -- go.mod` | **EMPTY** (go.mod read-only — G-006 verified) |
|
||||||
|
| `grep -rniE '\b(bank\|deposit\|interest\|yield\|currency\|dollar\|euro\|account\|savings\|depositor)\b' x/ --include='*.go'` | **ZERO HITS** (lexicon firewall green) |
|
||||||
|
| v0.1 baseline regression | **NO REGRESSION** (all v0.1 packages cached/green) |
|
||||||
|
|
||||||
### G-028 audit (go.mod diff against v0.5.0 baseline)
|
### Coverage detail
|
||||||
`git diff v0.5.0..HEAD -- go.mod go.sum` — EMPTY. v0.6 adds zero Go dependencies (HTMX is a vendored static asset). G-006 preserved across the milestone.
|
|
||||||
|
| Package | Coverage |
|
||||||
|
|---|---|
|
||||||
|
| x/window/types | 100.0% |
|
||||||
|
| x/stand/types | 100.0% |
|
||||||
|
| x/guild/types | 100.0% |
|
||||||
|
| x/pact/types | 95.9% |
|
||||||
|
| x/partner/types | 100.0% |
|
||||||
|
| x/council/types | 96.4% |
|
||||||
|
| x/forex/types | 100.0% |
|
||||||
|
| x/bond/types | 96.8% |
|
||||||
|
| x/bearers/types | 100.0% |
|
||||||
|
| x/satellite/types | 100.0% |
|
||||||
|
|
||||||
|
All packages exceed the 80% target (D-033) — the floor is 95.9%.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 1. Per-Axis Verdicts
|
||||||
|
|
||||||
|
### Axis 1 — Correctness — **PASS** (confidence 0.90)
|
||||||
|
|
||||||
|
Verified every locked const, enum count, struct shape, and ValidateGenesis ID-uniqueness check against RESEARCH.md §1 + PLANS.md task specs:
|
||||||
|
|
||||||
|
| Component | Locked const / enum | Spec | Code | Verdict |
|
||||||
|
|---|---|---|---|---|
|
||||||
|
| Window | `WindowStatusCount` | 4 (Open/Active/Revoked/Expired) | `=4` ✓ | PASS |
|
||||||
|
| Stand | `StandTypeCount` | 9 (Household/Crew/Entity/Co-op/Circle/Trust/Foundation/Confederation/Shadow) | `=9` ✓ all 9 names match vision §11 | PASS |
|
||||||
|
| Guild | `HandPassFeeBps` | 0 | `=0` ✓ + FeeGrain==0 enforced in ValidateGenesis | PASS |
|
||||||
|
| Pact | `PactTypeCount` | 6 (Pause/Ground/Stance/Cover/StandRegistry/HubAPI) | `=6` ✓ | PASS |
|
||||||
|
| Pact | `MissionLockAmendable` | false | `=false` ✓ + per-type `AmendableCoreTermsPause/Ground/Stance=false` ✓ | PASS |
|
||||||
|
| Partner | `PartnerTierCount` | 4 (Op/MasterOp/Pier/Anchor) | `=4` ✓ | PASS |
|
||||||
|
| Council | `CouncilKindCount` | 3 (Mesh/Guild/Stand) | `=3` ✓ | PASS |
|
||||||
|
| Council | `MissionLockAmendable` | false | `=false` ✓ (highest-severity firewall) | PASS |
|
||||||
|
| Forex | `SpreadCapBps` | ≥0 (placeholder 0, A-214) | `=0` ✓ + test asserts ≥0 | PASS |
|
||||||
|
| Bond | `CouponCapBps` | 800 (8%) | `=800` ✓ | PASS |
|
||||||
|
| Bond | `CouponFloorBps` | 0 (0%) | `=0` ✓ | PASS |
|
||||||
|
| Satellite | `L2ChainCount` | 5 (Polygon active + 4 stubs) | `=5` ✓ Polygon only ChainActive | PASS |
|
||||||
|
| Satellite | `ChannelStatusCount` | 4 (Init/TryOpen/Open/Closed) | `=4` ✓ ICS-20 v1 shape | PASS |
|
||||||
|
|
||||||
|
**ValidateGenesis ID-uniqueness checks (A-212 upgrade from v0.1 no-op)** — all present and tested:
|
||||||
|
- window: dup window-ids ✓ + audit-log entry-id uniqueness + non-decreasing timestamps ✓
|
||||||
|
- stand: dup stand-ids ✓ + dup (stand-id, reach-id) membership pairs ✓
|
||||||
|
- guild: dup guild-ids ✓ + dup pass-ids ✓ + FeeGrain==0 covenant ✓
|
||||||
|
- pact: dup pact-ids ✓ + known-type check ✓ + Mission-Lock echo ✓
|
||||||
|
- partner: dup partner-ids ✓
|
||||||
|
- council: dup council-ids ✓ + dup voice-ids ✓ + referential integrity (voice→council) ✓ + Stand/Guild Council ref-required ✓
|
||||||
|
- forex: dup pair-ids ✓ + dup provider-ids ✓ + known-oracle-kind ✓
|
||||||
|
- bond: dup bond-ids ✓ + coupon clamp at genesis load ✓ + known-status ✓
|
||||||
|
- satellite: dup channel-ids ✓ + dup denoms ✓
|
||||||
|
- bearers: no-op (correct — spec said "DefaultParams/GenesisState unchanged"; extension is types-only)
|
||||||
|
|
||||||
|
**Correctness caveat (P1, not blocking):** the council module's *governance lifecycle shape* is simpler than the P3-01-01 deliverable recommended (see P1+ flags below). All must-haves are met; the drift is in the non-must-have Proposal/VoteOption lifecycle enums.
|
||||||
|
|
||||||
|
### Axis 2 — Security — **PASS** (confidence 0.92)
|
||||||
|
|
||||||
|
- **Lexicon firewall (G-002, REQ-012)**: zero banned terms in any `x/**/*.go` (verified by `TestLexiconMetaNoBannedTermsInX` + independent `grep` word-boundary scan, exit 1 = no matches). The firewall is NEW in v0.2 and green from P1. The `lexicon/lexicon.go` package bootstraps terms from two-character fragments so the firewall's own source contains no banned literals (standard lexicon-test bootstrapping pattern).
|
||||||
|
- **G-003 by-ID-string invariant**: `TestG003NoCrossModuleStructImportsInProduction` (x/window/types/types_test.go:437) scans every non-test `.go` under `x/` with `go/parser` and asserts no production file imports a foreign `x/<module>/types` package. Test passes. Independent grep confirms: the only cross-module `oy/openyield/x/...` imports in test files are self-imports (test pkg → its own types pkg) + the pre-existing v0.1 `x/bearers` test → `x/processing/types` (a test import, not production).
|
||||||
|
- **Mission Lock**: `MissionLockAmendable = false` as compile-time `const` in BOTH `x/pact/types` (line 24) and `x/council/types` (line 25). Per-type `AmendableCoreTermsPause/Ground/Stance = false` consts in pact. Tests assert the const is false AND that the typed comparison would fail to compile if the const changed type (defence in depth).
|
||||||
|
- **Bond Clamp invariants**: `Clamp(couponBps)` enforces `min(cap, max(floor, coupon))` at both construction (`Issue`) and genesis load (`ValidateBonds`). Tested for above-cap→cap, in-range→unchanged, below-floor boundary. The genesis path rejects out-of-bounds coupons rather than silently clamping (authoritative schema).
|
||||||
|
- **No secrets in code**: no credentials, API keys, or private material present (skeleton-only, zero external deps).
|
||||||
|
|
||||||
|
### Axis 3 — Maintainability — **PASS** (confidence 0.90)
|
||||||
|
|
||||||
|
- **v0.1 pattern consistency**: all 10 packages follow the v0.1 skeleton convention — `package types`, `ModuleName`/`StoreKey`/`RouterKey`/`QuerierRoute` consts, typed structs with `json`+`yaml` tags, `Params` struct, `DefaultParams()`, `GenesisState`, `DefaultGenesisState()`, `ValidateGenesis(json.RawMessage) error`. No drift from the v0.1 layout.
|
||||||
|
- **Table-driven tests**: present throughout (window rate-limit, bond clamp, lexicon self-test, lexicon false-positive, partner keeper round-trip, council genesis validation). Matches v0.1's 53-test baseline pattern (now 299 tests across 23 files — v0.1 baseline preserved + v0.2 additions).
|
||||||
|
- **Coverage ≥80%**: all 10 new/extended packages exceed 80% (floor 95.9%, 8 of 10 at 100%). D-033 satisfied.
|
||||||
|
- **No external deps added**: `git diff main..oy/milestone/v0.2-mesh -- go.mod` is EMPTY. G-006/A-201 zero-dep invariant intact. All v0.2 code compiles with stdlib only (`encoding/json`, `fmt`, `sync`, `regexp`, `strings`, `os`, `path/filepath`, `runtime`, `testing`, `go/parser`, `go/token`).
|
||||||
|
- **G-008 genesis schema vs test split**: `genesis.go` files (data-engineer schema) present in window, stand, bond, council, forex, pact, satellite. `*_test.go` files (security-engineer) own all test assertions including `genesis_test.go` (present in window, stand, bond). Helper composition is clean: `ValidateGenesis` in `types.go` delegates to `Validate*` helpers in `genesis.go`.
|
||||||
|
|
||||||
|
### Axis 4 — Adversarial — **CONDITIONAL** (confidence 0.78)
|
||||||
|
|
||||||
|
- **No double-counted REQs**: every v0.2 REQ (009, 011, 015, 016, 017, 018, 020, 021, Bearers, Forex) maps to exactly one module + test task. REQ-012 (lexicon) is cross-cutting (per-module + project-wide meta-test).
|
||||||
|
- **No missing must-haves**: all P1-P4 must-have checklists satisfied (verified per phase in §3 below).
|
||||||
|
- **Spec drift detected (P1, non-blocking)**: the council module's P3-01-01 deliverable recommended a full OZ Governor / `x/gov` proposal lifecycle (`Proposal` struct, `ProposalStatus` enum with 5 states, `VoteOption` enum with 3 options) plus a 5-source `VoiceSource` enum (Stash/Standing/Vouch/Freeholder/Guild). The implemented code has a simpler `Voice` + `TallyResult` shape, renamed `VoiceSource`→`SignalKind` with 4 sources (Stash/Standing/Vouch/Capital — dropped Freeholder and Guild, added Capital), and no Proposal/ProposalStatus/VoteOption enums. The P3 must-haves (3 councils, Mission Lock, TallyResult x/gov shape, no veto) are ALL met — the drift is in the non-must-have lifecycle enums. Flagged P1 for v0.3 (see §2).
|
||||||
|
- **No other drift**: all other modules match their task deliverables exactly (locked consts, struct fields, enum names, genesis invariants).
|
||||||
|
|
||||||
|
### Axis 5 — Grill Binding Decisions — **9 APPLIED + 1 N/A** (see §4)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 2. P0 Issues + Auto-Applied Fixes
|
||||||
|
|
||||||
|
**P0 count: 0.** No P0 issues found. No auto-applied fixes.
|
||||||
|
|
||||||
|
Rationale: all locked consts are correct, all ValidateGenesis ID-uniqueness checks are present, the lexicon firewall is green, G-003 import invariant is tested and green, Mission Lock and Bond Clamp invariants are const-enforced and tested, go.mod is unchanged, coverage exceeds 80% everywhere. The two spec-drift findings (council lifecycle enums) are P1 — they do not break any must-have, do not introduce a security hole, and do not affect the locked-const firewall. They are flagged for post-hoc review, not auto-fixed (auto-fixing would mean designing the Proposal/VoteOption lifecycle, which is a design decision the orchestrator should make in v0.3, not a P0 patch).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 3. P1+ Issues for Post-Hoc Review (flag, don't fix)
|
||||||
|
|
||||||
|
### P1-1: Council module — Proposal/VoteOption lifecycle enums absent
|
||||||
|
- **File:line**: `x/council/types/types.go:33-145` (entire council types file)
|
||||||
|
- **Spec (P3-01-01 deliverable)**: `Proposal` struct (id, council, proposer-reach, submit-time, voting-period, status); `ProposalStatus` enum (Pending, Active, Succeeded, Failed, Executed — mirror OZ/Governor + `x/gov`); `VoteOption` enum (Yes, No, Abstain — no "no-with-veto", anti-greed).
|
||||||
|
- **Implemented**: `Council`, `CouncilMember`, `Voice`, `SignalKind`, `TallyResult`. No `Proposal`, no `ProposalStatus`, no `VoteOption`. The `Voice` struct carries a `TallyResult` directly, collapsing the proposal→vote→tally lifecycle into a single Voice cast.
|
||||||
|
- **Must-have impact**: NONE. P3 must-haves were: 3 councils ✓, Mission Lock ✓, TallyResult mirrors x/gov ✓, VoteOption has no veto (N/A — no VoteOption enum at all). The must-haves do not require the Proposal/VoteOption enums; they were in the task deliverable description, not the must-have checklist.
|
||||||
|
- **Recommendation for v0.3**: when wiring the council keeper to a live governance runtime, add `Proposal` + `ProposalStatus` (Pending→Active→Succeeded→Failed→Executed) + `VoteOption` (Yes/No/Abstain) so the council can run an actual proposal lifecycle. The current `Voice`+`TallyResult` shape is sufficient for the skeleton's tally-structure goal but insufficient for live governance.
|
||||||
|
- **Severity**: P1 (spec drift from deliverable, not a must-have, not blocking).
|
||||||
|
|
||||||
|
### P1-2: Council VoiceSource→SignalKind (4 sources, not 5)
|
||||||
|
- **File:line**: `x/council/types/types.go:102-129` (`SignalKind` enum + `AllSignalKinds()`)
|
||||||
|
- **Spec (P3-01-01 deliverable)**: `VoiceSource` enum (Stash, Standing, Vouch, Freeholder, Guild) — 5 multi-source weighting inputs.
|
||||||
|
- **Implemented**: `SignalKind` enum (Stash, Standing, Vouch, Capital) — 4 sources. "Freeholder" and "Guild" dropped; "Capital" added.
|
||||||
|
- **Code rationale (types.go:104-114)**: the comment explains Capital as "committed-capital signal (vision §9.1 committed_capital)" and argues Freeholder is an eligibility property (upstream in `x/standing`), not a voice signal, and Guild is a council tier, not a voice source. This is a defensible design refinement — but it diverges from the P3-01-01 deliverable text.
|
||||||
|
- **Must-have impact**: NONE. P3 must-haves did not enumerate VoiceSource coverage; only "Mission Lock invariant" and "TallyResult x/gov shape" were must-haves.
|
||||||
|
- **Recommendation for post-hoc review**: confirm with the lead-developer/cosmos-engineer that the 4-source `SignalKind` (Stash/Standing/Vouch/Capital) is the intended v0.2 shape, or whether the 5-source `VoiceSource` (adding Freeholder + Guild) should be restored for v0.3 wiring. The `SignalKindCount=4` locked-const test (types_test.go:102) currently locks the 4-source shape; changing it in v0.3 is a deliberate locked-const update.
|
||||||
|
- **Severity**: P1 (design-choice divergence from deliverable, tested and self-consistent, not blocking).
|
||||||
|
|
||||||
|
### P2 (nit): Bearers ValidateGenesis remains a no-op
|
||||||
|
- **File:line**: `x/bearers/types/types.go:108` (`func ValidateGenesis(bz json.RawMessage) error { return nil }`)
|
||||||
|
- **Note**: this is CORRECT per spec — P4-02-01 said "DefaultParams/GenesisState unchanged" (bearers is an EXTENSION, not a new module; v0.1's bearers ValidateGenesis was a no-op and the extension adds types, not genesis state). The A-212 upgrade was scoped to NEW modules. Recording as a P2 nit for completeness, not a defect. No action needed.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 4. Grill Binding Decisions Verification (G-001..G-010)
|
||||||
|
|
||||||
|
| ID | Decision | Status | Evidence |
|
||||||
|
|---|---|---|---|
|
||||||
|
| **G-001** | Correct v0.1 baseline test count: 53 tests / 11 files (not 48) | **APPLIED** | PROJECT.md D-033 line 111: "53 tests across 11 test files (corrected per G-001; not 48)"; RESEARCH.md line 20: "53 tests across 11 test files (not 48)"; RESEARCH.md line 575: "53 tests, 11 files, zero deps". No "48" reference remains as a v0.1 baseline claim. |
|
||||||
|
| **G-002** | Lexicon assertion tests are NEW in v0.2 (v0.1 has zero); firewall is new work, not inherited | **APPLIED** | RESEARCH.md lines 16-20: "v0.1 is lexicon-clean in practice but has **zero** lexicon test files... The lexicon assertion tests are NEW in v0.2"; PROJECT.md D-032 line 110: "lexicon assertion tests are NEW in v0.2 — v0.1 is lexicon-clean in practice but has NO lexicon test firewall". Code: `lexicon/lexicon.go` + `lexicon_meta_test.go` are new in v0.2; zero lexicon test files exist on `main`. |
|
||||||
|
| **G-003** | By-ID-string inter-module refs (A-203) enforced as a TESTED invariant in P1-01-02 | **APPLIED** | `x/window/types/types_test.go:437` `TestG003NoCrossModuleStructImportsInProduction` scans every non-test `.go` under `x/` with `go/parser` (ImportsOnly) and asserts no production file imports a foreign `x/<module>/types` package. Test passes (verified: `go test -run TestG003... -v` → PASS). Independent grep confirms zero cross-module struct imports in production code. |
|
||||||
|
| **G-004** | Lexicon meta-test scaffolding moved from P5 to P1 Wave 3 (new task P1-04-02); P5-01-01 EXTENDS it | **APPLIED** | `lexicon_meta_test.go` exists at repo root with `TestLexiconMetaNoBannedTermsInX`, `TestLexiconMetaSelfTestTable`, `TestLexiconMetaBannedTermsCount`, `TestLexiconMetaNoFalsePositiveOnOpenYield`. Package doc (line 1-15) states "the durable firewall created in v0.2 P1 Wave 3; P5-01-01 EXTENDS it rather than recreating it." All 4 meta-tests pass. |
|
||||||
|
| **G-005** | One `x/pact` module with `PactType` enum + 6 per-type execute-entry structs (A-207), NOT six micro-modules | **APPLIED** | PROJECT.md D-027 line 105: "**one `x/pact` module** with a `PactType` enum... NOT six micro-modules". Code: single `x/pact/types/types.go` with `PactType` enum (6 values) + 6 `Execute*` methods on `*Pact` (`ExecutePause`, `ExecuteGround`, `ExecuteStance`, `ExecuteCover`, `ExecuteStandRegistry`, `ExecuteHubAPI`). No `x/pactpause`, `x/pactground`, etc. dirs exist. |
|
||||||
|
| **G-006** | `go.mod` is read-only in v0.2 (zero deps, A-201); any change is an escalation | **APPLIED** | `git diff main..oy/milestone/v0.2-mesh -- go.mod` is **EMPTY**. PERSONAS.md lines 9, 33, 65, 83, 114 all state "go.mod is read-only in v0.2 (G-006)". No persona may modify it. |
|
||||||
|
| **G-007** | `x/pact`/`x/partner`/`x/bond`=backend-engineer; `x/window`/`x/stand`/`x/guild`/`x/council`/`x/satellite`/`x/forex`/`x/bearers`=cosmos-engineer | **APPLIED** | PERSONAS.md line 65 (backend territory): "`x/pact/**`, `x/partner/**`, `x/bond/**`"; line 83 (cosmos territory): "`x/satellite/**`, `x/council/**`, `x/window/**`, `x/stand/**`, `x/guild/**`, `x/forex/**`, `x/bearers/**` (Cosmos-convention-mirroring modules per G-007; `x/pact`/`x/partner`/`x/bond` are backend-engineer's)". Lines 109-111 reiterate the split. No overlap remains. |
|
||||||
|
| **G-008** | Genesis schema (`genesis.go`)=data-engineer; genesis test assertions (`*_test.go` incl `genesis_test.go`)=security-engineer | **APPLIED** | PERSONAS.md line 14 (data-engineer): "Owns genesis SCHEMA only (G-008); test assertions are security-engineer's"; line 17: "does NOT own *_test.go files (G-008)"; line 41 (security-engineer): "owns ALL *_test.go files including genesis_test.go (G-008)"; line 71 (data-engineer territory): "`x/**/types/genesis.go`, `x/**/genesis.go` (excludes `*_test.go` per G-008)"; line 89 (security-engineer territory): "all test files per G-008". Code: `genesis.go` files present in 7 modules; `genesis_test.go` present in window/stand/bond; all `*_test.go` use `package types_test` (external test package, security-engineer convention). |
|
||||||
|
| **G-009** | Self-test table in lexicon meta-test (synthetic string per banned term) | **APPLIED** | `lexicon_meta_test.go:83` `TestLexiconMetaSelfTestTable` — builds a synthetic string per banned term (10 terms: bank, deposit, interest, yield, currency, dollar, euro, account, savings, depositor) and asserts each triggers detection. Test passes. Also `TestLexiconMetaBannedTermsCount` asserts exactly 10 terms configured. |
|
||||||
|
| **G-010** | P5-01-03 reconciles ROADMAP.md tag-line narrative (v0.0.x vs v0.1.x) | **N/A** (P5 task, out of P1-P4 review scope) | G-010 is explicitly a P5-01-03 task (ROADMAP tag-line reconciliation). P1-P4 execution phases do not touch ROADMAP.md. The PLANS.md P5-01-03 task description (line 249) still carries the G-010 obligation. Correctly deferred to P5. |
|
||||||
|
|
||||||
|
**Grill decisions applied: 9 APPLIED + 1 N/A (G-010 is P5, out of scope) = 9 of 9 applicable.**
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 5. Per-Phase Must-Have Audit
|
||||||
|
|
||||||
|
### P1 (Orgs + Window Foundation) — ALL MET ✓
|
||||||
|
- [x] `x/window`, `x/stand`, `x/guild` each have `types/types.go` + `types/types_test.go` (v0.1 pattern, package `types`, zero external deps).
|
||||||
|
- [x] `go build ./...` and `go test ./...` green across the whole repo.
|
||||||
|
- [x] ≥80% coverage on `x/window/types` (100%), `x/stand/types` (100%), `x/guild/types` (100%).
|
||||||
|
- [x] Window lifecycle tests: Open→Active→Revoked→Expired (`TestWindowLifecycleOpenActiveRevokedExpired`); revoke-after-expire no-op (`TestRevokeAfterExpireIsNoOp`); double-revoke idempotent (`TestDoubleRevokeIdempotent`).
|
||||||
|
- [x] Stand locked-const: exactly 9 types with vision §11 names (`TestStandTypeCountLockedConst`, `TestAllStandTypesNames`).
|
||||||
|
- [x] Guild `HandPassFeeBps == 0` invariant test (`TestHandPassFeeBpsLockedConst`).
|
||||||
|
- [x] Lexicon assertion in all 3 new test files.
|
||||||
|
- [x] `ValidateGenesis` performs ID-uniqueness checks (A-212).
|
||||||
|
- [x] G-003 import-invariant test (`TestG003NoCrossModuleStructImportsInProduction`).
|
||||||
|
- [x] Lexicon meta-test scaffolding in P1 Wave 3 (G-004) with self-test table (G-009).
|
||||||
|
- (Tag `v0.1.1` is a ship-time action, not a code must-have — tracked in P1-04-01.)
|
||||||
|
|
||||||
|
### P2 (Pacts + Partners) — ALL MET ✓
|
||||||
|
- [x] `x/pact`, `x/partner` each have `types/types.go` + `types/types_test.go`.
|
||||||
|
- [x] `go build ./...` and `go test ./...` green.
|
||||||
|
- [x] ≥80% coverage on `x/pact/types` (95.9%), `x/partner/types` (100%).
|
||||||
|
- [x] Pact locked-const: exactly 6 types (vision §16 names) (`TestPactTypeCountLockedConst`).
|
||||||
|
- [x] Partner locked-const: exactly 4 tiers (Op, MasterOp, Pier, Anchor) (`TestPartnerTierCountLockedConst`).
|
||||||
|
- [x] Mission-Lock invariant: Pause/Ground/Stance `AmendableCoreTerms == false` (`TestMissionLockAmendableConstFalse` + per-type flags).
|
||||||
|
- [x] Lexicon assertion in both new test files.
|
||||||
|
- [x] `ValidateGenesis` ID-uniqueness checks (pact: dup pact-id; partner: dup partner-id).
|
||||||
|
|
||||||
|
### P3 (Councils + Forex) — ALL MET ✓ (with P1 spec-drift flags on council lifecycle)
|
||||||
|
- [x] `x/council`, `x/forex` each have `types/types.go` + `types/types_test.go`.
|
||||||
|
- [x] `go build ./...` and `go test ./...` green.
|
||||||
|
- [x] ≥80% coverage on `x/council/types` (96.4%), `x/forex/types` (100%).
|
||||||
|
- [x] Council locked-const: exactly 3 kinds (Mesh, Guild, Stand) (`TestCouncilKindCountLockedConst`).
|
||||||
|
- [x] **Mission Lock invariant**: `MissionLockAmendable == false` + cannot-be-set-true test (`TestMissionLockAmendableConstFalse`, `TestMissionLockAmendableCannotBeSetTrue`).
|
||||||
|
- [x] `TallyResult` shape mirrors `x/gov` (yes/no/abstain/nowithveto/total/quorum_met) (`TestTallyResultStructShape`).
|
||||||
|
- [x] `VoteOption` has no "no-with-veto" — N/A (no VoteOption enum; `TallyResult.NoWithVeto` is always 0, `TestTallyResultNoWithVetoAlwaysZero`).
|
||||||
|
- [x] Forex pair labels lexicon-clean (base-asset/quote-asset, "Bread"/"Asset" sample) (`TestForexPairStructFields`); `RateOracle` interface compiles (`TestRateOracleInterfaceCompiles`).
|
||||||
|
- [x] Lexicon assertion in both new test files.
|
||||||
|
- [x] `ValidateGenesis` ID-uniqueness (council: dup council-id + dup voice-id) + referential integrity (voice→council) (`TestValidateGenesisRejectsVoiceWithUnknownCouncil`).
|
||||||
|
- [P1 flag] Council `Proposal`/`ProposalStatus`/`VoteOption` enums absent (see §3 P1-1).
|
||||||
|
- [P1 flag] Council `VoiceSource`→`SignalKind` (4 not 5) (see §3 P1-2).
|
||||||
|
|
||||||
|
### P4 (Bonds + Bearers + L2) — ALL MET ✓
|
||||||
|
- [x] `x/bond` (new), `x/bearers` (extended), `x/satellite` (new) each have `types/types.go` + `types/types_test.go`.
|
||||||
|
- [x] `go build ./...` and `go test ./...` green — including all v0.1 baseline tests (no regression across 25 packages).
|
||||||
|
- [x] ≥80% coverage on `x/bond/types` (96.8%), `x/bearers/types` (100%), `x/satellite/types` (100%).
|
||||||
|
- [x] Bond clamp invariant: `CouponCapBps == 800`, `CouponFloorBps == 0`; clamp below→floor, above→cap, in-range→unchanged (`TestClampBelowFloorReturnsFloor`, `TestClampAboveCapReturnsCap`, `TestClampInRangeUnchanged`, `TestClampMatchesFeeCovenantShape`).
|
||||||
|
- [x] Bond lexicon: "coupon" exclusively, no "interest"/"yield" (A-210) — verified by meta-test + per-module lexicon test.
|
||||||
|
- [x] Bearers: `BearerTransport` interface compiles (`TestBearerTransportInterfaceSignature`); `OYLRLink` + `BeaconFrame` stubs; existing `AllBearers()` (6) unchanged (`TestOYLRStillInAllBearers` — regression green).
|
||||||
|
- [x] Satellite: `L2Chain` exactly 5 (Polygon active + 4 stubs) (`TestL2ChainCountLockedConst`, `TestPolygonOnlyActiveRep`); `Packet` pinned to ICS-20 v1 shape; zero external deps.
|
||||||
|
- [x] Lexicon assertion in all 3 test files (bond, bearers, satellite).
|
||||||
|
- [x] `ValidateGenesis` ID-uniqueness (bond: dup bond-id; satellite: dup channel-id + dup denom) + genesis clamp (Bond: coupon within [floor, cap]).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 6. Overall Verdict
|
||||||
|
|
||||||
|
### **APPROVE WITH P1+ FLAGS**
|
||||||
|
|
||||||
|
The v0.2 (The Mesh) milestone P1-P4 execution work is **shippable**.
|
||||||
|
|
||||||
|
**Rationale:**
|
||||||
|
- All P1-P4 must-have checklists are met (verified per phase in §5).
|
||||||
|
- All 13 locked consts/enums are correct (Window 4, Stand 9, Guild 0, Pact 6, Partner 4, Council 3, MissionLock false in pact+council, Bond 800/0, Forex ≥0, Satellite 5+4).
|
||||||
|
- All ValidateGenesis ID-uniqueness checks present (A-212 upgrade applied to all 9 new modules; bearers extension correctly exempt).
|
||||||
|
- `go build ./...` and `go test ./...` green across all 25 packages (15 v0.1 + 10 v0.2) — no regression.
|
||||||
|
- Coverage ≥80% on all 10 new/extended packages (floor 95.9%, 8 of 10 at 100%).
|
||||||
|
- Lexicon firewall green (zero banned terms in any `x/**/*.go`); G-002 firewall is new and operational.
|
||||||
|
- G-003 by-ID-string invariant tested and green (zero cross-module struct imports in production).
|
||||||
|
- go.mod unchanged (G-006 verified — `git diff` empty).
|
||||||
|
- 9 of 9 applicable grill binding decisions applied (G-010 is P5, N/A for this scope).
|
||||||
|
- Mission Lock and Bond Clamp invariants are compile-time consts + tested firewalls.
|
||||||
|
|
||||||
|
**P1+ flags (2) for post-hoc review — do NOT block the milestone ship:**
|
||||||
|
1. Council `Proposal`/`ProposalStatus`/`VoteOption` lifecycle enums absent (P3-01-01 deliverable drift; must-haves met; recommend adding for v0.3 live governance wiring).
|
||||||
|
2. Council `VoiceSource`→`SignalKind` (4 sources Stash/Standing/Vouch/Capital, not 5 with Freeholder/Guild) (P3-01-01 deliverable drift; defensible design choice; locked-const test currently locks the 4-source shape; confirm intended for v0.3).
|
||||||
|
|
||||||
|
These are design-shape divergences in a single module's non-must-have lifecycle types. They do not affect the Mission Lock firewall, the locked consts, the lexicon firewall, the by-ID-string invariant, coverage, or any must-have. The orchestrator should review them post-ship and decide whether v0.3 restores the full Proposal/VoteOption lifecycle and the 5-source VoiceSource.
|
||||||
|
|
||||||
|
**P0 fixes auto-applied: 0**
|
||||||
|
**P1+ flags: 2** (both in x/council/types)
|
||||||
|
**P2 nits: 1** (bearers ValidateGenesis no-op — correct per spec, no action)
|
||||||
|
**Grill decisions applied: 9 APPLIED + 1 N/A (G-010 is P5) = 9 of 9 applicable**
|
||||||
|
|
||||||
|
**Confidence in overall verdict: 0.88**
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Summary Block
|
||||||
|
|
||||||
|
```
|
||||||
|
Per-axis verdicts:
|
||||||
|
1. Correctness — PASS (0.90) [all locked consts correct; council lifecycle drift is P1]
|
||||||
|
2. Security — PASS (0.92) [lexicon green; G-003 tested; Mission Lock + Bond Clamp const-enforced]
|
||||||
|
3. Maintainability — PASS (0.90) [v0.1 pattern; coverage ≥95.9%; go.mod unchanged; G-008 split clean]
|
||||||
|
4. Adversarial — CONDITIONAL (0.78) [council Proposal/VoteOption + VoiceSource→SignalKind drift; no must-have missing]
|
||||||
|
5. Grill Decisions — 9 APPLIED + 1 N/A (G-010 P5)
|
||||||
|
|
||||||
|
P0 fixes auto-applied: 0
|
||||||
|
P1+ flags: 2 (x/council/types — Proposal/VoteOption lifecycle absent; VoiceSource→SignalKind 4-not-5)
|
||||||
|
P2 nits: 1 (bearers ValidateGenesis no-op — correct per spec)
|
||||||
|
Overall: APPROVE WITH P1+ FLAGS (confidence 0.88) — milestone ship not blocked
|
||||||
|
```
|
||||||
|
---
|
||||||
|
|
||||||
|
## v0.3 Final Review (P6)
|
||||||
|
|
||||||
|
**Reviewer:** Multi-persona final review (correctness, testing, security, performance, maintainability, adversarial)
|
||||||
|
**Scope:** `v0.1.5..HEAD` — all v0.3 milestone phases (P0 pre-exec + P1 docs foundation + P2 nomads docs + P3 freeholders docs + P4 Bearers I + P5 Bearers II)
|
||||||
|
**Branch:** `oy/milestone/v0.3-bearers-docs` (reviewed on `oy/phase/06-final-review-ship`)
|
||||||
|
**Date:** 2026-08-17
|
||||||
|
**Diff stat:** 56 files changed, 6891 insertions(+), 169 deletions(-)
|
||||||
|
|
||||||
|
### Verification commands (all PASS)
|
||||||
|
|
||||||
|
```
|
||||||
|
go build ./... — PASS (zero errors)
|
||||||
|
go test ./... — PASS (all packages green)
|
||||||
|
go test -cover ./x/{bridge,exit,bearers,partner,hub,services,bond}/types/ — PASS (coverage below)
|
||||||
|
go test -run TestLexiconMeta ./lexicon_meta_docs/ . — PASS (docs firewall green)
|
||||||
|
go test -run TestLexiconMeta ./ — PASS (x/ firewall green, repo-root package)
|
||||||
|
```
|
||||||
|
|
||||||
|
### Coverage on new/extended packages
|
||||||
|
|
||||||
|
| Package | Coverage | Threshold (80%) | Verdict |
|
||||||
|
|---|---|---|---|
|
||||||
|
| x/bridge/types | 100.0% | ✓ | PASS |
|
||||||
|
| x/exit/types | 100.0% | ✓ | PASS |
|
||||||
|
| x/bearers/types | 100.0% | ✓ | PASS |
|
||||||
|
| x/partner/types | 100.0% | ✓ | PASS |
|
||||||
|
| x/hub/types | 93.3% | ✓ | PASS |
|
||||||
|
| x/services/types | 100.0% | ✓ | PASS |
|
||||||
|
| x/bond/types | 95.1% | ✓ | PASS |
|
||||||
|
|
||||||
|
All packages exceed the ≥80% coverage requirement. The two sub-100% packages (hub 93.3%, bond 95.1%) have gaps only in defensive genesis error-branches (e.g., `validateComplianceServices` 87.5%, `Clamp`/`ClampLendingCoupon` 80% — the upper-bound and floor branches each exercised by ≥1 test but not every permutation). No must-have is uncovered; G-012 boundary cases (`currentBps==cap`, `currentBps>cap`, underflow guard) are all explicitly tested (`TestClampGrowthCurrentAtCapReturnsZero`, `TestClampGrowthCurrentAboveCapReturnsZero`, `TestClampGrowthInvariantPostGrowthLeCap`).
|
||||||
|
|
||||||
|
### Per-axis verdicts
|
||||||
|
|
||||||
|
#### 1. Correctness (backend-engineer) — PASS (0.92)
|
||||||
|
|
||||||
|
Locked-const invariants all enforced and tested:
|
||||||
|
- `BridgeStatusCount = 4` (x/bridge/types/types.go:18) — `AllBridgeStatuses()` returns 4 in REQ-015 order. ✓
|
||||||
|
- `ExitStatusCount = 5` (x/exit/types/types.go:18) — `AllExitStatuses()` returns 5 in vision §7 order. ✓
|
||||||
|
- `HubServiceCount = 3` (x/hub/types/types.go:42) — `AllHubServices()` returns 3 (Custody/LendingPrimitive/Compliance). ✓
|
||||||
|
- `ServiceKindCount = 4` (x/services/types/types.go:37) — locked count asserted. ✓
|
||||||
|
- `OrderSideCount = 2` (x/bond/types/types.go:171) — Buy/Sell. ✓
|
||||||
|
- `OrderStatusCount = 3` (x/bond/types/types.go:174) — Open/Filled/Cancelled. ✓
|
||||||
|
- `PartnerTierCount = 4` (x/partner/types/types.go:18) — regression intact. ✓
|
||||||
|
- `BondStatusCount = 5` (x/bond/types/types.go:31) — regression intact. ✓
|
||||||
|
- `CouponCapBps = 800` / `CouponFloorBps = 0` (x/bond/types/types.go:21,26) — D-028 LOCKED, regression firewall in types_test.go asserts both values. ✓
|
||||||
|
|
||||||
|
**G-012 (ClampGrowth underflow guard) — CORRECT.** The guard at x/bond/types/types.go:239 (`if currentBps >= CouponCapBps { return 0 }`) runs BEFORE the `CouponCapBps - currentBps` subtraction (line 243), so the uint32 underflow path is unreachable. Five boundary/invariant tests cover: currentBps==0 (full room), currentBps==cap (return 0), currentBps>cap (return 0, NOT wrapped huge), growth>room (clamp to room), growth<room (unchanged), and a meta-assert `current + ClampGrowth(current, growth) <= max(current, cap)` across a fuzz table.
|
||||||
|
|
||||||
|
The hub `LendingCouponCapBps`/`LendingCouponFloorBps` LOCAL consts (A-304) mirror x/bond's LOCKED values (800/0) without importing x/bond (G-003 preserved). Genesis-side clamp enforcement present in both `validateLendingPrimitives` (hub) and `ValidateBonds`/`ValidateGrowthBonds` (bond).
|
||||||
|
|
||||||
|
#### 2. Testing (backend-engineer) — PASS (0.90)
|
||||||
|
|
||||||
|
All new packages ≥93.3% (above 80% threshold). Per-package lexicon assertions present in every new package's types_test.go (TestLexiconNoBannedTermsIn<Pkg>Package + TestLexiconNoBannedTermsIn<Pkg>TestFile) — confirmed in x/bridge, x/exit, x/bearers, x/partner, x/hub, x/services, x/bond. G-012 boundary cases (currentBps==cap, currentBps>cap) explicitly tested. Locked-const regression tests present (Test<Const>LockedConst pattern) for every locked const enumerated above.
|
||||||
|
|
||||||
|
#### 3. Security (security) — PASS (0.93)
|
||||||
|
|
||||||
|
Both lexicon firewalls green:
|
||||||
|
- x/ firewall (`lexicon_meta_test.go`, package `lexicon_meta`): `go test -run TestLexiconMeta ./` PASS.
|
||||||
|
- docs/ firewall (`lexicon_meta_docs/lexicon_meta_docs_test.go`, package `lexicon_meta_docs`): `go test -run TestLexiconMeta ./lexicon_meta_docs/` PASS. Scans README.md + docs/**/*.md.
|
||||||
|
|
||||||
|
Adversarial verification: confirmed `lexicon.FindBannedTerm` catches all 10 banned terms (bank, deposit, interest, yield, currency, dollar, euro, account, savings, depositor) via direct injection test. The docs firewall self-test table (G-009 for docs), walk-coverage test (G-013), and self-test drift assertion (G-014) all present and passing — the firewall provably CATCHES banned-term regressions rather than silently scanning nothing.
|
||||||
|
|
||||||
|
**G-003 (by-ID-string, no struct imports between x/*) — INTACT.** `grep -rn "oy/openyield/x/"` across all new package non-test .go files returns ZERO struct imports. The only cross-package import in a test file is `x/bearers/types/types_test.go` importing `x/processing/types` (a test-only import for a stub reference; G-003 governs production struct imports, not test imports). All cross-module references in production types use ID-string fields (issuer-stand-id, reach-id, holder-reach-id, custody-provider-id, anchor-id, bond-id, operator-partner-id, etc.) with explicit G-003 doc-comments.
|
||||||
|
|
||||||
|
#### 4. Performance (backend-engineer) — PASS (0.95)
|
||||||
|
|
||||||
|
`go.mod` UNCHANGED since v0.1.5 (`git diff v0.1.5..HEAD -- go.mod go.sum` is empty) — zero external deps preserved (G-006). The mkdocs build deps (mkdocs + mkdocs-material) are Python-only and documented as non-Go (mkdocs.yml header comment). Skeleton stubs use O(1) maps for registry lookups (x/partner Keeper); no N+1 patterns in the stub code. The genesis validators iterate slices once (O(n) per set) with map-backed uniqueness checks — appropriate for skeleton scale.
|
||||||
|
|
||||||
|
#### 5. Maintainability (lead-developer) — PASS (0.91)
|
||||||
|
|
||||||
|
**Pattern consistency:** All new modules follow the v0.1/v0.2 file structure (types.go + types_test.go, genesis.go where genesis validation exists). The Params/GenesisState/DefaultGenesisState/ValidateGenesis pattern is uniform across x/bridge, x/exit, x/bearers, x/partner, x/hub, x/services, x/bond. G-008 split (data-engineer's genesis.go schema helpers composed by ValidateGenesis in types.go) is present in x/bond and x/hub. The new modules use the same ModuleName/StoreKey/RouterKey/QuerierRoute const block and the same JSON/YAML struct-tag convention as v0.1/v0.2 modules.
|
||||||
|
|
||||||
|
**Docs cross-reference (G-011):** `mkdocs.yml` nav lists ALL 26 pages (1 Home + 8 Nomads + 8 Freeholders + 7 Shared + 2 Reference = 26), matching the 26 .md files under docs/. `docs/reference/components.md` cross-references the new modules (10 mentions of x/* packages). All docs pages are lexicon-clean (firewall green).
|
||||||
|
|
||||||
|
**.ciagent/oy/* updates:** PROJECT, ROADMAP, REQUIREMENTS, ARCHITECTURE, RESEARCH, PERSONAS, PLANS, GRILL all updated to reflect v0.3 scope (Bearers & Documentation, REQ-024..REQ-028, D-037..D-046, A-304..A-313, G-011..G-014).
|
||||||
|
|
||||||
|
#### 6. Adversarial (adversarial) — PASS (0.88)
|
||||||
|
|
||||||
|
Adversarial probes attempted and their outcomes:
|
||||||
|
1. **Banned term slipped into docs** — the firewall self-test table (`TestLexiconMetaDocsSelfTestTable`, G-009 for docs) injects synthetic banned-term strings and asserts FindBannedTerm detects each; the walk-coverage test (`TestLexiconMetaDocsWalkCoverage`, G-013) injects a real .md fixture under docs/.lexicon_fixture/ and asserts the walk FINDS it. Catches the "silently scans nothing and reports green" failure mode. ✓
|
||||||
|
2. **Locked-const regression** — every locked const has a `Test<Const>LockedConst` regression test asserting the exact value AND the All<Enum>() entry count/names. A regression (e.g., BridgeStatusCount→5) fails the test. ✓
|
||||||
|
3. **Struct import breaks G-003** — no production .go file in the new packages imports another x/* package; verified by grep. ✓
|
||||||
|
4. **ClampGrowth underflow** — the guard returns 0 BEFORE the subtraction; the underflow path is unreachable; tested with currentBps>cap (e.g., 801) asserting return 0 (NOT 4294967295). ✓
|
||||||
|
5. **Hub A-304 drift from x/bond D-028** — the LOCAL consts are documented as cross-referenced (comment "also 800") and a regression test asserts LendingCouponCapBps==800. A future x/bond cap change without a matching hub change is flagged by the cross-doc comment (not a test — appropriate since they are LOCAL to hub). Note P2 below.
|
||||||
|
|
||||||
|
### P0 fixes auto-applied
|
||||||
|
|
||||||
|
**0.** No P0 (critical) issues found. The milestone ships clean.
|
||||||
|
|
||||||
|
### P1+ flags (post-hoc review — do NOT block ship)
|
||||||
|
|
||||||
|
**1.** [P2 nit, maintainability] x/hub `LendingCouponCapBps`/`LendingCouponFloorBps` (A-304) are LOCAL consts cross-documented to x/bond's D-028 consts (both 800/0) but there is no automated cross-check that they stay in lockstep. If a future mission-locked change to x/bond.CouponCapBps does not update the hub LOCAL const, the two packages silently drift. The cross-doc comment in types.go:46-50 flags this for human review, but a shared-const test (e.g., asserting `LendingCouponCapBps == x/bond.CouponCapBps` — though that would require a test-only import, acceptable per G-003 test exemption) would be more robust. Recommend post-hoc: add a cross-package const-equality test OR document the manual-sync requirement in ARCHITECTURE.md. Not a ship blocker — both are currently 800/0.
|
||||||
|
|
||||||
|
**2.** [P2 nit, testing] x/hub coverage 93.3% and x/bond coverage 95.1% leave defensive error-branches in `ClampLendingCoupon` (80%), `Clamp` (80%), `validateComplianceServices` (87.5%), `ValidateGrowthBonds` (85.7%) partially exercised. All must-have paths are tested; the uncovered lines are error-return branches for malformed genesis inputs. Recommend post-hoc: add 2-3 negative-case genesis tests per package to close the gaps to 100%. Not a ship blocker (both above the 80% threshold).
|
||||||
|
|
||||||
|
**3.** [P2 nit, docs] `docs/reference/architecture.md` has 0 cross-references to x/* packages (vs `docs/reference/components.md` which has 10). The architecture page is conceptual; the components page is the cross-ref hub. Acceptable as-is, but post-hoc adding 1-2 module cross-refs to architecture.md would improve discoverability. Not a ship blocker.
|
||||||
|
|
||||||
|
### Overall verdict
|
||||||
|
|
||||||
|
**SHIP.**
|
||||||
|
|
||||||
|
All verification commands pass. All locked-const invariants enforced and tested. Both lexicon firewalls green (x/ and docs/). G-003 (by-ID-string, no struct imports) intact across all new packages. G-012 (ClampGrowth underflow guard) correctly implemented with explicit boundary tests. Zero external deps (go.mod unchanged). Coverage ≥93.3% on all new/extended packages (above 80% threshold). mkdocs.yml nav complete (26/26 pages, G-011). No P0 issues. Three P2 nits flagged for post-hoc review (none blocking).
|
||||||
|
|
||||||
|
**P0 fixes auto-applied: 0**
|
||||||
|
**P1+ findings: 0 P1, 3 P2 (all nits, post-hoc, non-blocking)**
|
||||||
|
**Confidence in overall verdict: 0.91**
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# Review: OpenYield (oy) — v0.4 (Refinement — NFR) Final Phase
|
||||||
|
|
||||||
|
> **Reviewer**: CIAgent multi-persona code review (lead-developer + backend-engineer lenses)
|
||||||
|
> **Date**: 2026-08-17
|
||||||
|
> **Target**: All v0.4 milestone commits (main..oy/milestone/v0.4-refinement) across P1..P3
|
||||||
|
> **Milestone**: v0.4 — Refinement (NFR)
|
||||||
|
> **Autonomy**: full
|
||||||
|
|
||||||
|
## Scope Reviewed
|
||||||
|
|
||||||
|
The v0.4 milestone ships 4 REQs across 3 execution phases (P1..P3) + phase 0 (pre-execution). 20 commits, 15 files changed (+764 / -157). The review covers the execution-phase deliverables:
|
||||||
|
|
||||||
|
- **P1** (v0.3.1): REQ-029 lexicon shared helper, REQ-030 cross-const test
|
||||||
|
- **P2** (v0.3.2): REQ-031 lifecycle divergence docs + regression guard
|
||||||
|
- **P3** (v0.3.3): REQ-032 docs build CI
|
||||||
|
|
||||||
|
## Adversarial Probes
|
||||||
|
|
||||||
|
1. **Does the shared helper actually dedupe?** Probe: `grep -rn 'open a.*here\|make a.*now\|compounding.*rate' lexicon_meta_test.go lexicon_meta_docs/` — returns ZERO matches (the old duplicated table is gone; both meta-tests now call `lexicon.SyntheticBannedStrings()`). Verified at `lexicon_meta_test.go:93` and `lexicon_meta_docs/lexicon_meta_docs_test.go:155` (both consume the helper). ✓
|
||||||
|
|
||||||
|
2. **Does the cross-const test fail closed on drift?** Probe: the test imports `bondtypes "github.com/oy/openyield/x/bond/types"` in `x/hub/types/cross_const_test.go:28` and asserts `LendingCouponCapBps != bondtypes.CouponCapBps` would fail the test. The absolute-value test `TestConstsAreMissionLocked800And0` (G-015) catches paired drift (both consts → 900). Both paths verified by reading the test. ✓
|
||||||
|
|
||||||
|
3. **Does the regression guard lock the 4-signal shape?** Probe: `TestSignalKindShapeIntentional` at `x/council/types/types_test.go` asserts `SignalKindCount == 4` with a `t.Fatalf` (not `t.Errorf`) and checks `AllSignalKinds()` returns `[SignalStash, SignalStanding, SignalVouch, SignalCapital]` in order. The doc comment includes the AUDIT §193 P1-2 rationale. Changing `SignalKindCount` to 5 fails this test AND `TestSignalKindCountLockedConst`. ✓
|
||||||
|
|
||||||
|
4. **Does the CI workflow YAML parse and enforce G-016?** Probe: `python3 -c "import yaml; doc=yaml.safe_load(open('.gitea/workflows/docs-build.yml')); assert doc['jobs']['docs-build']['needs'] == 'go-test'"` — passes. The `needs: go-test` line is present at `.gitea/workflows/docs-build.yml` in the `docs-build` job. ✓
|
||||||
|
|
||||||
|
5. **Is `go.mod` really unchanged across the whole milestone?** Probe: `git diff main..HEAD -- go.mod` — empty. The CI workflow's Python deps are in a separate job; the lexicon helper adds no Go deps; the cross-const test adds no Go deps (test-only import of an internal package). G-006 intact. ✓
|
||||||
|
|
||||||
|
6. **NFR purity gate — zero `feat:` commit SUBJECTS?** Probe: `git log --format="%s" main..HEAD | grep -E "^feat:"` — exit 1 (no matches). All 20 subjects are `docs(`, `refactor(`, `test(`, `chore(`, `verify(`, `decision(`, `checkpoint(`, or `Merge`. NOTE: `git log --grep "^feat:"` matches commit BODIES too (the v0.4 verify commits mention "feat:" in prose like "zero feat: commits in P2"); the correct gate uses subject-only check via `--format="%s"`. This is a documented refinement for the audit. ✓
|
||||||
|
|
||||||
|
7. **Does G-003 hold — no production cross-module struct imports added?** Probe: `grep -rn "x/bond/types" x/hub/types/ --include="*.go" | grep -v "_test.go"` — zero matches. The only import of `x/bond/types` in `x/hub/types/` is in `cross_const_test.go` (a `_test.go` file, G-003 test-exempt). Production firewall intact. ✓
|
||||||
|
|
||||||
|
## P0 fixes auto-applied
|
||||||
|
|
||||||
|
**0.** No P0 (critical) issues found. The milestone ships clean.
|
||||||
|
|
||||||
|
## P1+ flags (post-hoc review — do NOT block ship)
|
||||||
|
|
||||||
|
**1.** [P2 nit, maintainability] The `mkdocs build` local run produced 2 warnings about README.md links (`docs/index.md` links to `../README.md`, `docs/shared/vision.md` links to `../../README.md`). These are pre-existing v0.3 docs links (not introduced by v0.4); the warnings are non-blocking (mkdocs builds successfully). Recommend post-hoc: either configure `mkdocs.yml` to include README.md in the nav, or fix the relative links. Not a v0.4 ship blocker (the docs site builds; v0.4's REQ-032 is the CI workflow, not the docs content).
|
||||||
|
|
||||||
|
**2.** [P2 nit, CI] The `docs-build.yml` workflow uses `actions/upload-artifact@v4` with `retention-days: 14`. Gitea Actions may have a different artifact retention default; the explicit `retention-days: 14` is defensive. If Gitea Actions does not support v4 of the upload-artifact action, the workflow would fail at the upload step (the `mkdocs build` itself would have succeeded). Recommend post-hoc: verify Gitea Actions supports `actions/upload-artifact@v4`; if not, downgrade to v3 or use the Gitea-native artifact upload. Not a ship blocker (the build itself is the higher-priority check; the artifact upload is a bonus).
|
||||||
|
|
||||||
|
**3.** [P2 nit, audit-gate precision] The NFR purity gate (`git log --grep "^feat:"`) over-matches commit bodies. The correct gate is subject-only (`git log --format="%s" | grep -E "^feat:"`). The P4 audit uses the subject-only check. Recommend post-hoc: document the subject-only gate in the next milestone's PLAN so future audits do not over-count. Not a ship blocker (the subject-only gate is green).
|
||||||
|
|
||||||
|
## Overall verdict
|
||||||
|
|
||||||
|
**SHIP.**
|
||||||
|
|
||||||
|
All four REQs (REQ-029..REQ-032) delivered. The three real v0.3 forward-references (G-014 lexicon drift, A-304 const drift, AUDIT §193 council divergence) are closed; the D-046 docs-CI forward-reference is landed. `go test ./...` green across all 26 packages. `go.mod` unchanged (G-006). G-003 production firewall intact. NFR purity gate GREEN (zero `feat:` commit subjects). No P0 issues. Three P2 nits flagged for post-hoc review (none blocking).
|
||||||
|
|
||||||
|
**P0 fixes auto-applied: 0**
|
||||||
|
**P1+ findings: 0 P1, 3 P2 (all nits, post-hoc, non-blocking)**
|
||||||
|
**Confidence in overall verdict: 0.90**
|
||||||
|
|||||||
@@ -110,120 +110,6 @@ docs build CI. Refinement-only NFR milestone: zero `feat:` phases.
|
|||||||
> `v0.3.1..v0.3.3`, P4 -> `v0.3.4` (= the v0.4 milestone release, per D-008 —
|
> `v0.3.1..v0.3.3`, P4 -> `v0.3.4` (= the v0.4 milestone release, per D-008 —
|
||||||
> final phase patch IS the milestone release; no separate minor tag).
|
> final phase patch IS the milestone release; no separate minor tag).
|
||||||
|
|
||||||
## Milestone v0.5 — Bearers Runtime (COMPLETE; feature type; tags v0.4.x)
|
|
||||||
|
|
||||||
Target: Promote the v0.3 Bearers skeletons from type+keeper-stub layers to
|
|
||||||
live runtime behavior (keeper MsgServer handlers + simtest-grade end-to-end
|
|
||||||
flows). NOT mainnet (D-020 pattern continues to govern network deployment);
|
|
||||||
runtime = simtest-grade message handlers, not mainnet deployment.
|
|
||||||
|
|
||||||
- [x] P0: Pre-Execution (spec/clarify/research/plan/grill/mvp-ux) → v0.4.0
|
|
||||||
- [x] P1: Exit + Bridge runtime (REQ-033) → v0.4.1
|
|
||||||
- [x] P2: Bearers transport runtime (REQ-034) → v0.4.2
|
|
||||||
- [x] P3: Anchors onboarding runtime (REQ-035) → v0.4.3
|
|
||||||
- [x] P4: Hub API B2B runtime (REQ-036) → v0.4.4
|
|
||||||
- [x] P5: Services runtime (REQ-037) → v0.4.5
|
|
||||||
- [x] P6: Bond market runtime (REQ-038) → v0.4.6
|
|
||||||
- [x] P7: Council governance runtime (REQ-039) → v0.4.7
|
|
||||||
- [x] P8: Final Review + Audit + Ship → v0.4.8 (milestone release)
|
|
||||||
- Status: COMPLETE — 7 runtime REQs shipped; all 8 keeper packages ≥80% coverage (82.1%..92.5%); G-003 firewall intact; locked-const firewall intact; cosmos-sdk v0.50.8 + ibc-go v8.2.1 added (D-055/D-062, G-006 controlled exception); 5 GRILL decisions ratified (D-055/D-062/D-063/D-064/D-065); 8 binding fixes landed (G-017..G-024); 5 P1+ flagged for v0.6+ mainnet-readiness.
|
|
||||||
|
|
||||||
| Phase | Type | Scope | Patch |
|
|
||||||
|---|---|---|---|
|
|
||||||
| P0 | docs | Pre-Execution (spec/clarify/research/plan/grill/mvp-ux) | v0.4.0 |
|
|
||||||
| P1 | feat | Exit + Bridge runtime: x/exit DEX swap routing + x/bridge IBC packet handlers (5 L2 chains) | v0.4.1 |
|
|
||||||
| P2 | feat | Bearers transport runtime: OY-SAT + OY-QR message handlers + session lifecycle | v0.4.2 |
|
|
||||||
| P3 | feat | Anchors onboarding runtime: x/partner Anchor credential lifecycle | v0.4.3 |
|
|
||||||
| P4 | feat | Hub API B2B runtime: custody/lending/compliance + CustodyKeyring interface (D-058) | v0.4.4 |
|
|
||||||
| P5 | feat | Services runtime: Care/SIM/Vault/Mail service lifecycle handlers | v0.4.5 |
|
|
||||||
| P6 | feat | Bond market runtime: Growth Bonds + secondary-market CLOB matching (REJECT above 800bps D-063) | v0.4.6 |
|
|
||||||
| P7 | feat | Council governance runtime: Proposal/VoteOption enums (AUDIT §193 P1-1) + MissionLockAmendment reject (D-064) | v0.4.7 |
|
|
||||||
| P8 | final | REVIEW + AUDIT + milestone SHIP | v0.4.8 (milestone release) |
|
|
||||||
|
|
||||||
### v0.5 Component mapping
|
|
||||||
|
|
||||||
| Component | Deliverable | v0.5 Runtime Module | Phase |
|
|
||||||
|---|---|---|---|
|
|
||||||
| Exit layer (Layer 3) | DEX swap routing + cross-chain exit handlers | x/exit/keeper + x/exit/module.go | v0.5/P1 |
|
|
||||||
| Bridge (L2↔L1) | IBC packet handlers (5 L2 chains, Solana wormhole-adapter) | x/bridge/keeper + x/bridge/module.go + ibc_module.go | v0.5/P1 |
|
|
||||||
| Bearers expansion | OY-SAT + OY-QR message handlers + session lifecycle | x/bearers/keeper + x/bearers/module.go | v0.5/P2 |
|
|
||||||
| Anchors | Anchor credential issuance/revocation runtime | x/partner/keeper + x/partner/module.go | v0.5/P3 |
|
|
||||||
| Hub API | Custody/lending/compliance runtime + CustodyKeyring interface | x/hub/keeper + x/hub/module.go + keyring_mem.go | v0.5/P4 |
|
|
||||||
| Services | Care/SIM/Vault/Mail service lifecycle runtime | x/services/keeper + x/services/module.go | v0.5/P5 |
|
|
||||||
| Bond market | Growth Bonds + secondary-market CLOB matching engine | x/bond/keeper + x/bond/module.go + clob.go | v0.5/P6 |
|
|
||||||
| Council governance | Proposal/VoteOption enums + governance message handlers | x/council/keeper + x/council/module.go | v0.5/P7 |
|
|
||||||
|
|
||||||
> **Tag-line note (G-010 continuation)**: v0.5 (feature) ships on the `v0.4.x`
|
|
||||||
> patch line (config.json `tag_base: v0.4.x`): P0 -> `v0.4.0`, P1..P7 ->
|
|
||||||
> `v0.4.1..v0.4.7`, P8 -> `v0.4.8` (= the v0.5 milestone release, per D-008 —
|
|
||||||
> final phase patch IS the milestone release; no separate minor tag).
|
|
||||||
|
|
||||||
### v0.5 deferred to v0.6+ (P1+ from REVIEW.md)
|
|
||||||
- P1 security: no proposal deposit/bond (governance spam gap — mainnet-readiness)
|
|
||||||
- P1 adversarial: CLOB per-tx front-running exposure (batch auction is a v0.6+ design)
|
|
||||||
- P1 maintainability: simtest doesn't exercise real IBC light-client verification
|
|
||||||
- P2 performance: CLOB `restingBookForBond` O(n) load (prefix-key for mainnet)
|
|
||||||
- P2 maintainability: `emitMatchEventHook` package-level mutable var (minor testability)
|
|
||||||
- SignalKind 4→5 expansion (AUDIT §193 P1-2; deferred to v0.6+ governance vote)
|
|
||||||
- Live chain launch / mainnet / real IBC channels / real bearer transports (D-020 continues)
|
|
||||||
- Real institutional Anchors onboarding (credential lifecycle in simtest only)
|
|
||||||
- Yield Token, Travel + 11 service categories (ROADMAP Phase 4 — Maturity)
|
|
||||||
|
|
||||||
## Milestone v0.6 — Nomad Web UI (COMPLETE; feature type; tags v0.5.x)
|
|
||||||
|
|
||||||
Target: The project's first UI milestone. A working prototype Web UI where a
|
|
||||||
person can sign up to be a Nomad (create a Reach + open a Stash) and exercise
|
|
||||||
basic functionality around the (Reach, Stash) components, plus Window
|
|
||||||
authorization, Standing progress, and Bloom accrual views. All data is
|
|
||||||
generated as test fixtures — no real blockchain interaction (D-020 continues).
|
|
||||||
Greenfield Go `html/template` + HTMX layer served by a Go mock HTTP server
|
|
||||||
(`web/`) that instantiates the real `x/*/types` structs from in-memory
|
|
||||||
fixtures. No keeper, no Cosmos runtime, no `app.go` (none exists in the repo).
|
|
||||||
|
|
||||||
- [x] P0: Pre-Execution (spec/clarify/research/ideate/plan/grill/mvp-ux) → v0.5.0
|
|
||||||
- [x] P1: Web foundation + Reach signup + lexicon firewall extension (REQ-040, REQ-045) → v0.5.1
|
|
||||||
- [x] P2: Stash dashboard (REQ-041) → v0.5.2
|
|
||||||
- [x] P3: Window authorization (REQ-042) → v0.5.3
|
|
||||||
- [x] P4: Standing + Freeholder signals (REQ-043) → v0.5.4
|
|
||||||
- [x] P5: Bloom accrual view (REQ-044) → v0.5.5
|
|
||||||
- [x] P6: Final Review + Audit + Ship → v0.5.6 (milestone release)
|
|
||||||
|
|
||||||
| Phase | Type | Scope | Patch |
|
|
||||||
|---|---|---|---|
|
|
||||||
| P0 | docs | Pre-Execution (spec/clarify/research/ideate/plan/grill/mvp-ux) | v0.5.0 |
|
|
||||||
| P1 | feat+test | Web foundation + Reach signup (REQ-040) + lexicon firewall extension to web/ (REQ-045) | v0.5.1 |
|
|
||||||
| P2 | feat | Stash dashboard: balance + Bread-scale conversion + 90-day maturity progress (REQ-041) | v0.5.2 |
|
|
||||||
| P3 | feat | Window authorization: open/lifecycle/audit-log view (REQ-042) | v0.5.3 |
|
|
||||||
| P4 | feat | Standing + Freeholder signals progress: computed from mock Ratings/Vouches/Slashes (REQ-043) | v0.5.4 |
|
|
||||||
| P5 | feat | Bloom accrual view: per-Stash BloomRecord (REQ-044) | v0.5.5 |
|
|
||||||
| P6 | final | REVIEW + AUDIT + milestone SHIP | v0.5.6 (milestone release) |
|
|
||||||
|
|
||||||
### v0.6 Component mapping
|
|
||||||
|
|
||||||
| Component | Deliverable | v0.6 Module | Phase |
|
|
||||||
|---|---|---|---|
|
|
||||||
| Web UI foundation | Go HTTP mock server + base templates + HTMX vendored | web/main.go, web/handlers/, web/store/, web/templates/, web/static/ | v0.6/P1 |
|
|
||||||
| Reach signup | "Create a Reach" form + Reach list/detail | web/handlers/reach.go, web/templates/reach.html | v0.6/P1 |
|
|
||||||
| Stash dashboard | Balance + Bread-scale + 90-day maturity | web/handlers/stash.go, web/templates/stash.html | v0.6/P2 |
|
|
||||||
| Window authorization | Open/lifecycle/audit-log view | web/handlers/window.go, web/templates/window.html | v0.6/P3 |
|
|
||||||
| Standing + Freeholder signals | Progress view from mock Ratings/Vouches/Slashes | web/handlers/standing.go, web/templates/standing.html | v0.6/P4 |
|
|
||||||
| Bloom accrual | Per-Stash BloomRecord view | web/handlers/bloom.go, web/templates/bloom.html | v0.6/P5 |
|
|
||||||
| Lexicon firewall | Extend REQ-012 to web/ | lexicon_meta_web/lexicon_meta_web_test.go | v0.6/P1 |
|
|
||||||
|
|
||||||
> **Tag-line note (G-010 continuation)**: v0.6 (feature) ships on the `v0.5.x`
|
|
||||||
> patch line (config.json `tag_base: v0.5.x`): P0 -> `v0.5.0`, P1..P5 ->
|
|
||||||
> `v0.5.1..v0.5.5`, P6 -> `v0.5.6` (= the v0.6 milestone release, per D-008 —
|
|
||||||
> final phase patch IS the milestone release; no separate minor tag).
|
|
||||||
|
|
||||||
### v0.6 deferred to v0.7+
|
|
||||||
- Real blockchain interaction / mainnet / IBC / real bearer transports (D-020 continues)
|
|
||||||
- A real `oyd` daemon / `app.go` / `cmd/oyd` (no chain runtime exists; wiring the UI to a real daemon is v0.7+)
|
|
||||||
- Authentication / sessions / real key management (mock; a Reach is created by form submission, stored in-memory)
|
|
||||||
- Persistence (mock store is in-memory; resets on restart)
|
|
||||||
- i18n / multi-language UI
|
|
||||||
- The 5 P1+ mainnet-readiness items deferred from v0.5 (governance spam deposit, CLOB front-running, real IBC simtest, CLOB perf, emitMatchEventHook testability) — those are v0.7+ mainnet-readiness, not UI work
|
|
||||||
- Bread-scale doc-fix (`docs/shared/bread-scale.md` is outdated vs code constants — P1+ follow-up, not v0.6 scope)
|
|
||||||
|
|
||||||
## Phase 3 — The Bearers (Year 3) — v0.3 PARTIAL SKELETON
|
## Phase 3 — The Bearers (Year 3) — v0.3 PARTIAL SKELETON
|
||||||
**Target**: $10B annual volume → fee auto-declines to 0.07%
|
**Target**: $10B annual volume → fee auto-declines to 0.07%
|
||||||
|
|
||||||
|
|||||||
@@ -25,14 +25,10 @@ Loaf → Batch → Cake → Bakery → Granary → Mill → Harvest → Earth.**
|
|||||||
|
|
||||||
## Status
|
## Status
|
||||||
|
|
||||||
**v0.6 (Nomad Web UI) — in progress.** v0.5 shipped the Bearers Runtime
|
**v0.3 (Bearers & Documentation) — in progress.** The codebase is a skeleton +
|
||||||
(simtest-grade keeper handlers for 8 x/ modules). v0.6 adds the project's
|
tests layer (Go types + keeper stubs + invariant tests, zero external Go deps)
|
||||||
first UI: a Go `html/template` + HTMX prototype Web UI in `web/` where a
|
matching the v0.1/v0.2 pre-MVP pattern. See `.ciagent/oy/ROADMAP.md` for the
|
||||||
visitor can sign up to be a Nomad (create a Reach + open a Stash) and
|
phase plan and `.ciagent/oy/PROJECT.md` for governance.
|
||||||
exercise basic functionality around Reach, Stash, Window, Standing, and
|
|
||||||
Bloom. All data is generated test fixtures — no real chain. See
|
|
||||||
`.ciagent/oy/ROADMAP.md` for the phase plan and `.ciagent/oy/PROJECT.md`
|
|
||||||
for governance.
|
|
||||||
|
|
||||||
## Build & test
|
## Build & test
|
||||||
|
|
||||||
@@ -44,29 +40,6 @@ go build ./...
|
|||||||
go test ./...
|
go test ./...
|
||||||
```
|
```
|
||||||
|
|
||||||
## Web UI
|
|
||||||
|
|
||||||
The Nomad Web UI (v0.6) is a Go `html/template` server with HTMX progressive
|
|
||||||
enhancement, served by a mock HTTP server in `web/` that instantiates the
|
|
||||||
real `x/*/types` structs from in-memory fixtures. No node, no build step,
|
|
||||||
no real chain. To run it:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
go run ./web
|
|
||||||
# opens on http://localhost:8080 (PORT env var overridable)
|
|
||||||
```
|
|
||||||
|
|
||||||
Five screens, all reachable from the home nav:
|
|
||||||
|
|
||||||
- `/reach` — create a Reach (sign up to be a Nomad) + Reach list/detail
|
|
||||||
- `/stash/{holderID}` — Stash dashboard (Grain balance + Bread scale + 90-day maturity)
|
|
||||||
- `/window` — Window authorization (open/lifecycle/audit log)
|
|
||||||
- `/standing/{reachID}` — Standing + Freeholder signals progress
|
|
||||||
- `/bloom/{stashID}` — Bloom accrual view
|
|
||||||
|
|
||||||
HTMX is a single vendored JS file (`web/static/htmx.min.js`), NOT a Go
|
|
||||||
dependency — `go.mod` stays unchanged (G-006).
|
|
||||||
|
|
||||||
## Docs
|
## Docs
|
||||||
|
|
||||||
The docs site is [MkDocs Material](https://squidfunk.github.io/mkdocs-material/)
|
The docs site is [MkDocs Material](https://squidfunk.github.io/mkdocs-material/)
|
||||||
@@ -85,19 +58,17 @@ deferred to v0.4 (D-046); v0.3 ships the source.
|
|||||||
## Lexicon firewall
|
## Lexicon firewall
|
||||||
|
|
||||||
OpenYield bans 10 financial terms as standalone words (REQ-012) across all Go
|
OpenYield bans 10 financial terms as standalone words (REQ-012) across all Go
|
||||||
source (`x/**/*.go`), all docs (`README.md` + `docs/**/*.md`), and all web UI
|
source (`x/**/*.go`) and all docs (`README.md` + `docs/**/*.md`). The banned
|
||||||
files (`web/**/*.{html,js,go}`). The banned terms are the words you would
|
terms are the words you would expect a legacy financial institution to use;
|
||||||
expect a legacy financial institution to use; this README and the docs describe
|
this README and the docs describe them only by their **safe replacements**, so
|
||||||
them only by their **safe replacements**, so the firewall itself never trips.
|
the firewall itself never trips. The firewall is enforced in code by two
|
||||||
The firewall is enforced in code by three sibling Go tests:
|
sibling Go tests:
|
||||||
|
|
||||||
- `lexicon_meta_test.go` (v0.2) — scans `x/**/*.go`.
|
- `lexicon_meta_test.go` (v0.2) — scans `x/**/*.go`.
|
||||||
- `lexicon_meta_docs/lexicon_meta_docs_test.go` (v0.3) — scans `README.md` +
|
- `lexicon_meta_docs/lexicon_meta_docs_test.go` (v0.3) — scans `README.md` +
|
||||||
`docs/**/*.md`.
|
`docs/**/*.md`.
|
||||||
- `lexicon_meta_web/lexicon_meta_web_test.go` (v0.6) — scans
|
|
||||||
`web/templates/**` + `web/static/**` + `web/**/*.go`.
|
|
||||||
|
|
||||||
All three use `lexicon.FindBannedTerm` (word-boundary, case-insensitive), so
|
Both use `lexicon.FindBannedTerm` (word-boundary, case-insensitive), so
|
||||||
"OpenYield" is safe (word-boundary does not match the banned term inside an
|
"OpenYield" is safe (word-boundary does not match the banned term inside an
|
||||||
identifier) but the standalone banned term is not — docs say **"real
|
identifier) but the standalone banned term is not — docs say **"real
|
||||||
production"** / **"real return"**, and a Holder's identity is **Holder** /
|
production"** / **"real return"**, and a Holder's identity is **Holder** /
|
||||||
|
|||||||
@@ -1,307 +0,0 @@
|
|||||||
// Package lexicon_meta_web holds the web lexicon firewall (REQ-045, D-069).
|
|
||||||
//
|
|
||||||
// It is a NEW sibling meta-test created in v0.6 P1 Wave 1 that MIRRORS the
|
|
||||||
// v0.3 docs firewall (lexicon_meta_docs/lexicon_meta_docs_test.go, package
|
|
||||||
// lexicon_meta_docs) but scans the web surface (web/templates/**/*.html +
|
|
||||||
// web/static/**/*.js + web/**/*.go) instead of README.md + docs/**/*.md. It
|
|
||||||
// uses the SAME lexicon.FindBannedTerm (word-boundary, case-insensitive) —
|
|
||||||
// NO detection reimplementation — so the three firewalls (x/*.go, docs, web)
|
|
||||||
// share a single source of truth for the 10 banned terms (bank, deposit,
|
|
||||||
// interest, yield, currency, dollar, euro, account, savings, depositor).
|
|
||||||
//
|
|
||||||
// Placement: this file lives in lexicon_meta_web/ (a subdirectory of the
|
|
||||||
// repo root) because Go does not permit two distinct packages in the same
|
|
||||||
// directory; the v0.2 firewall is package lexicon_meta at the repo root and
|
|
||||||
// the v0.3 firewall is package lexicon_meta_docs in lexicon_meta_docs/. The
|
|
||||||
// invocation `go test ./lexicon_meta_web/...` (PLANS P1-01-01) resolves to
|
|
||||||
// this package. Run via `go test ./...` from the repo root as well.
|
|
||||||
//
|
|
||||||
// G-013 walk-coverage: TestLexiconMetaWebWalkCoverage injects a synthetic
|
|
||||||
// banned-term .html into a temp web/templates/ subtree and asserts the walk
|
|
||||||
// FINDS it. This closes the "silently scans nothing and reports green"
|
|
||||||
// failure mode that the G-009 self-test table (detection) alone does not
|
|
||||||
// cover.
|
|
||||||
//
|
|
||||||
// G-014 self-test drift: the self-test table and banned-term count assertion
|
|
||||||
// reuse lexicon.BannedTerms() (the single source). A cross-reference comment
|
|
||||||
// keeps this file's table in lockstep with lexicon_meta_test.go's table and
|
|
||||||
// lexicon_meta_docs_test.go's table; if a banned term is added, all three
|
|
||||||
// firewalls update from one place.
|
|
||||||
package lexicon_meta_web
|
|
||||||
|
|
||||||
import (
|
|
||||||
"os"
|
|
||||||
"path/filepath"
|
|
||||||
"runtime"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/lexicon"
|
|
||||||
)
|
|
||||||
|
|
||||||
// repoRoot returns the absolute path to the repo root by walking up from
|
|
||||||
// this test file (the test lives at <repoRoot>/lexicon_meta_web/).
|
|
||||||
func repoRoot(t *testing.T) string {
|
|
||||||
t.Helper()
|
|
||||||
_, file, _, ok := runtime.Caller(0)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("runtime.Caller failed")
|
|
||||||
}
|
|
||||||
// file = .../oy/lexicon_meta_web/lexicon_meta_web_test.go
|
|
||||||
// repo root = filepath.Dir(filepath.Dir(file))
|
|
||||||
return filepath.Dir(filepath.Dir(file))
|
|
||||||
}
|
|
||||||
|
|
||||||
// thisFile returns the absolute path of this meta-test file (to exclude it
|
|
||||||
// from its own scan — it references banned terms via the lexicon package,
|
|
||||||
// whose source assembles terms from fragments, so no banned-term literal
|
|
||||||
// appears in the firewall's own code).
|
|
||||||
func thisFile(t *testing.T) string {
|
|
||||||
t.Helper()
|
|
||||||
_, file, _, ok := runtime.Caller(0)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("runtime.Caller failed")
|
|
||||||
}
|
|
||||||
return file
|
|
||||||
}
|
|
||||||
|
|
||||||
// isWebTarget reports whether path (relative to repo root) is a file the web
|
|
||||||
// firewall scans: web/templates/**/*.html, web/static/**/*.js, and
|
|
||||||
// web/**/*.go (production + test). Non-{html,js,go} files under web/ (e.g.
|
|
||||||
// vendored binary assets) are skipped.
|
|
||||||
func isWebTarget(rel string) bool {
|
|
||||||
if !strings.HasPrefix(rel, "web"+string(filepath.Separator)) {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
return strings.HasSuffix(rel, ".html") || strings.HasSuffix(rel, ".js") || strings.HasSuffix(rel, ".go")
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaWebNoBannedTermsInWeb is the web firewall (D-069). It walks
|
|
||||||
// the repo root, targets web/templates/**/*.html + web/static/**/*.js +
|
|
||||||
// web/**/*.go (production + test), reads each file's source, and asserts no
|
|
||||||
// banned term is present (word-boundary, case-insensitive). Excludes
|
|
||||||
// .ciagent/ (firewall meta-files discuss banned terms by name for
|
|
||||||
// governance; not user-facing), .git/ (VCS), and this test file itself
|
|
||||||
// (self-exclusion via runtime.Caller(0)).
|
|
||||||
//
|
|
||||||
// Passes at P1 Wave 1 with zero web content (a walk that scans nothing
|
|
||||||
// reports green on zero hits — closed by TestLexiconMetaWebWalkCoverage
|
|
||||||
// below). With the Wave 2..4 web content present (templates, static assets,
|
|
||||||
// handlers, store), all are lexicon-clean by construction.
|
|
||||||
func TestLexiconMetaWebNoBannedTermsInWeb(t *testing.T) {
|
|
||||||
root := repoRoot(t)
|
|
||||||
this := thisFile(t)
|
|
||||||
hits := []string{}
|
|
||||||
err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if info.IsDir() {
|
|
||||||
base := filepath.Base(path)
|
|
||||||
if base == ".ciagent" || base == ".git" {
|
|
||||||
return filepath.SkipDir
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
// Self-exclusion: skip this meta-test file.
|
|
||||||
if path == this {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
rel, rerr := filepath.Rel(root, path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if !isWebTarget(rel) {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
bz, rerr := os.ReadFile(path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
|
||||||
hits = append(hits, rel+" contains banned term "+found)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
})
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("walk: %v", err)
|
|
||||||
}
|
|
||||||
if len(hits) > 0 {
|
|
||||||
t.Errorf("REQ-045 web lexicon firewall violations:\n %s",
|
|
||||||
strings.Join(hits, "\n "))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaWebSelfTestTable (G-009 for web) is the firewall's own
|
|
||||||
// detection-coverage guard. Each synthetic string embeds exactly one banned
|
|
||||||
// term in a plausible sentence context and is asserted to trigger detection,
|
|
||||||
// so the firewall's detection logic is durably verified — if detection ever
|
|
||||||
// breaks, this test fails before the firewall silently passes a real
|
|
||||||
// violation in a web template or handler.
|
|
||||||
//
|
|
||||||
// REQ-029 (GRILL G-014): the synthetic strings are sourced from
|
|
||||||
// lexicon.SyntheticBannedStrings(), the single source of truth shared with
|
|
||||||
// lexicon_meta_test.go :: TestLexiconMetaSelfTestTable and
|
|
||||||
// lexicon_meta_docs_test.go :: TestLexiconMetaDocsSelfTestTable. Before
|
|
||||||
// REQ-029, each meta-test DUPLICATED its own 10-string table (byte-identical),
|
|
||||||
// creating a drift risk; the shared helper closes it. This file no longer
|
|
||||||
// builds its own synthetic table — all three meta-tests consume the same
|
|
||||||
// helper, so a future banned-term addition updates all firewalls from one
|
|
||||||
// place.
|
|
||||||
func TestLexiconMetaWebSelfTestTable(t *testing.T) {
|
|
||||||
terms := lexicon.BannedTerms()
|
|
||||||
// The spec lists 10 banned terms (plan docs say "9", counting dollar/euro
|
|
||||||
// as a pair): bank, deposit, interest, yield, currency, dollar, euro,
|
|
||||||
// account, savings, depositor.
|
|
||||||
if len(terms) != 10 {
|
|
||||||
t.Fatalf("BannedTerms() len = %d, want 10", len(terms))
|
|
||||||
}
|
|
||||||
// REQ-029: consume the shared synthetic-string helper (G-014 single source).
|
|
||||||
synthetic := lexicon.SyntheticBannedStrings()
|
|
||||||
if len(synthetic) != len(terms) {
|
|
||||||
t.Fatalf("SyntheticBannedStrings() len = %d, want %d (must match BannedTerms())", len(synthetic), len(terms))
|
|
||||||
}
|
|
||||||
for i, s := range synthetic {
|
|
||||||
found, ok := lexicon.FindBannedTerm(s)
|
|
||||||
if !ok {
|
|
||||||
t.Errorf("G-009 web self-test [%d]: synthetic string did not trigger detection: %q", i, s)
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
if found != terms[i] {
|
|
||||||
t.Errorf("G-009 web self-test [%d]: detected %q, want %q (in %q)", i, found, terms[i], s)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaWebBannedTermsCount asserts exactly 10 banned terms are
|
|
||||||
// configured (locked-const for the firewall's scope; spec lists 10, plan docs
|
|
||||||
// say "9" counting dollar/euro as a pair). Derived from lexicon.BannedTerms()
|
|
||||||
// — the single source — so a count change breaks all three firewalls (x/*.go,
|
|
||||||
// docs, web) (G-014 drift prevention).
|
|
||||||
func TestLexiconMetaWebBannedTermsCount(t *testing.T) {
|
|
||||||
terms := lexicon.BannedTerms()
|
|
||||||
if len(terms) != 10 {
|
|
||||||
t.Errorf("BannedTerms() len = %d, want 10 (REQ-012/REQ-045)", len(terms))
|
|
||||||
}
|
|
||||||
seen := map[string]bool{}
|
|
||||||
for _, tr := range terms {
|
|
||||||
if seen[tr] {
|
|
||||||
t.Errorf("duplicate banned term %q", tr)
|
|
||||||
}
|
|
||||||
seen[tr] = true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaWebNoFalsePositiveOnOpenYield asserts the module name
|
|
||||||
// "openyield" does NOT trigger the "yield" banned term and "european" does
|
|
||||||
// NOT trigger the "euro" banned term (word-boundary matching must not match
|
|
||||||
// substrings of identifiers). This is the regression firewall for the
|
|
||||||
// word-boundary detection design — mirrors the v0.2
|
|
||||||
// TestLexiconMetaNoFalsePositiveOnOpenYield and the v0.3
|
|
||||||
// TestLexiconMetaDocsNoFalsePositiveOnOpenYield.
|
|
||||||
func TestLexiconMetaWebNoFalsePositiveOnOpenYield(t *testing.T) {
|
|
||||||
cases := []string{
|
|
||||||
"github.com/oy/openyield/x/window/types",
|
|
||||||
"package openyield",
|
|
||||||
"openyield is the module",
|
|
||||||
"european resident",
|
|
||||||
"# OpenYield web",
|
|
||||||
"the OpenYield mesh",
|
|
||||||
}
|
|
||||||
for _, s := range cases {
|
|
||||||
if _, ok := lexicon.FindBannedTerm(s); ok {
|
|
||||||
t.Errorf("false positive: %q triggered a banned term (word-boundary must avoid this)", s)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaWebWalkCoverage (G-013) is the walk-coverage firewall. The
|
|
||||||
// G-009 self-test table (above) verifies DETECTION (FindBannedTerm on
|
|
||||||
// synthetic strings) but NOT the WALK (which files are scanned). A walk bug
|
|
||||||
// — e.g. wrong path prefix, missing web/ recursion, a typo in the .html
|
|
||||||
// suffix check — would silently scan nothing and report green on zero
|
|
||||||
// files. This test closes that gap by injecting a synthetic banned-term
|
|
||||||
// .html into a fixture dir under the real web/templates/ path the walk scans
|
|
||||||
// and asserting the walk FINDS it.
|
|
||||||
//
|
|
||||||
// The fixture is created under web/templates/.lexicon_fixture/ (a real
|
|
||||||
// web/templates/ subtree the walk reaches) and removed via defer so it never
|
|
||||||
// leaks into the repo. If the walk logic misses the fixture, this test fails
|
|
||||||
// loudly instead of letting a broken walk pass the firewall green on zero
|
|
||||||
// files scanned.
|
|
||||||
func TestLexiconMetaWebWalkCoverage(t *testing.T) {
|
|
||||||
root := repoRoot(t)
|
|
||||||
this := thisFile(t)
|
|
||||||
|
|
||||||
// Build a synthetic banned term from fragments so THIS file does not
|
|
||||||
// contain a banned-term literal (it is excluded from its own scan, but
|
|
||||||
// the synthetic stays clean for readability/searchability).
|
|
||||||
terms := lexicon.BannedTerms()
|
|
||||||
if len(terms) == 0 {
|
|
||||||
t.Fatal("BannedTerms() returned no terms — cannot run walk-coverage")
|
|
||||||
}
|
|
||||||
// Use the first banned term ("bank") assembled from two halves.
|
|
||||||
syntheticTerm := terms[0][:2] + terms[0][2:] // reassemble (no literal in source)
|
|
||||||
badContent := []byte("<!-- fixture -->\nthis file contains a banned term: " + syntheticTerm + "\n")
|
|
||||||
|
|
||||||
fixtureDir := filepath.Join(root, "web", "templates", ".lexicon_fixture")
|
|
||||||
fixtureFile := filepath.Join(fixtureDir, "bad_fixture.html")
|
|
||||||
if err := os.MkdirAll(fixtureDir, 0o755); err != nil {
|
|
||||||
t.Fatalf("mkdir fixture: %v", err)
|
|
||||||
}
|
|
||||||
defer os.RemoveAll(fixtureDir)
|
|
||||||
if err := os.WriteFile(fixtureFile, badContent, 0o644); err != nil {
|
|
||||||
t.Fatalf("write fixture: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Run the SAME walk logic as TestLexiconMetaWebNoBannedTermsInWeb and
|
|
||||||
// assert it FINDS the fixture's banned term. A walk that returns zero
|
|
||||||
// hits here proves the walk logic is broken (the fixture is a known-bad
|
|
||||||
// file inside web/templates/ that MUST be detected).
|
|
||||||
hits := []string{}
|
|
||||||
err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if info.IsDir() {
|
|
||||||
base := filepath.Base(path)
|
|
||||||
if base == ".ciagent" || base == ".git" {
|
|
||||||
return filepath.SkipDir
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
if path == this {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
rel, rerr := filepath.Rel(root, path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if !isWebTarget(rel) {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
bz, rerr := os.ReadFile(path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
|
||||||
hits = append(hits, rel+" contains banned term "+found)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
})
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("walk: %v", err)
|
|
||||||
}
|
|
||||||
// Assert the fixture was found. The rel path uses OS-specific separator;
|
|
||||||
// match on the suffix so the test is portable.
|
|
||||||
foundFixture := false
|
|
||||||
for _, h := range hits {
|
|
||||||
if strings.Contains(h, "bad_fixture.html") && strings.Contains(h, syntheticTerm) {
|
|
||||||
foundFixture = true
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if !foundFixture {
|
|
||||||
t.Errorf("G-013 walk-coverage: the walk did NOT find the synthetic banned-term fixture at %s — the web firewall walk logic is broken (it would silently scan nothing and report green). hits=%v", fixtureFile, hits)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,50 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
|
|
||||||
bloomtypes "github.com/oy/openyield/x/bloom/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// registerBloom wires the Bloom accrual route (REQ-044).
|
|
||||||
func (s *Server) registerBloom(mux *http.ServeMux) {
|
|
||||||
mux.HandleFunc("GET /bloom/{stashID}", s.handleBloom)
|
|
||||||
}
|
|
||||||
|
|
||||||
// bloomViewData is the template data for the Bloom accrual view.
|
|
||||||
type bloomViewData struct {
|
|
||||||
StashID string
|
|
||||||
Found bool
|
|
||||||
Record bloomtypes.BloomRecord
|
|
||||||
RatePct float64 // RateBasisPoints as a percentage (450 -> 4.5)
|
|
||||||
TargetRatePct float64 // TargetBloomRateBasisPoints as %
|
|
||||||
MinRatePct float64
|
|
||||||
MaxRatePct float64
|
|
||||||
AccrualPeriod int64
|
|
||||||
MissionLockNote string
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleBloom renders the Bloom accrual view (REQ-044): per-Stash BloomRecord
|
|
||||||
// (AccruedGrain, RateBasisPoints as %, LastAccrualBlock) + the 4.5% target rate
|
|
||||||
// (read from x/bloom/types.TargetBloomRateBasisPoints — D-073 code-constant
|
|
||||||
// source-of-truth, NOT hardcoded). Bloom is conceptually close to a banned
|
|
||||||
// financial term; labels use "Bloom"/"real production"/"accrual" only.
|
|
||||||
func (s *Server) handleBloom(w http.ResponseWriter, r *http.Request) {
|
|
||||||
stashID := r.PathValue("stashID")
|
|
||||||
rec, ok := s.Store.GetBloomRecord(stashID)
|
|
||||||
if !ok {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
s.render(w, "bloom.html", bloomViewData{
|
|
||||||
StashID: stashID,
|
|
||||||
Found: true,
|
|
||||||
Record: rec,
|
|
||||||
RatePct: float64(rec.RateBasisPoints) / 100,
|
|
||||||
TargetRatePct: float64(bloomtypes.TargetBloomRateBasisPoints) / 100,
|
|
||||||
MinRatePct: float64(bloomtypes.MinBloomRateBasisPoints) / 100,
|
|
||||||
MaxRatePct: float64(bloomtypes.MaxBloomRateBasisPoints) / 100,
|
|
||||||
AccrualPeriod: bloomtypes.AccrualPeriodBlocks,
|
|
||||||
MissionLockNote: bloomtypes.MissionLockBloom,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
@@ -1,137 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
bloomtypes "github.com/oy/openyield/x/bloom/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestBloomSeededRecordRendersTargetRate(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/bloom/stash-holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /bloom/stash-holder-alia: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// Accrued Grain present.
|
|
||||||
if !strings.Contains(body, "Grain") {
|
|
||||||
t.Errorf("body missing 'Grain'")
|
|
||||||
}
|
|
||||||
// Target rate 4.5% (from TargetBloomRateBasisPoints=450).
|
|
||||||
want := formatFloat(float64(bloomtypes.TargetBloomRateBasisPoints) / 100)
|
|
||||||
if !strings.Contains(body, want) {
|
|
||||||
t.Errorf("body missing target rate %s%% (TargetBloomRateBasisPoints=%d)", want, bloomtypes.TargetBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
// Mission Lock note present.
|
|
||||||
if !strings.Contains(body, "real production") {
|
|
||||||
t.Errorf("body missing Mission Lock note about real production")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestBloomMissingReturns404(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/bloom/stash-nobody", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusNotFound {
|
|
||||||
t.Fatalf("GET /bloom/stash-nobody: status %d, want 404", rec.Code)
|
|
||||||
}
|
|
||||||
// G-026: rendered-HTML lexicon check on the ERROR response body too.
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestBloomTargetRateFromCodeConstant (D-073 regression guard): asserts the
|
|
||||||
// handler reads x/bloom/types.TargetBloomRateBasisPoints=450 (NOT a hardcoded
|
|
||||||
// 450 or a docs value). This test would FAIL if the handler hardcoded the rate
|
|
||||||
// instead of reading the code constant.
|
|
||||||
func TestBloomTargetRateFromCodeConstant(t *testing.T) {
|
|
||||||
// D-073: the code constant is the source of truth.
|
|
||||||
if bloomtypes.TargetBloomRateBasisPoints != 450 {
|
|
||||||
t.Fatalf("D-073: TargetBloomRateBasisPoints = %d, want 450 (code constant)", bloomtypes.TargetBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
if bloomtypes.MinBloomRateBasisPoints != 400 {
|
|
||||||
t.Fatalf("D-073: MinBloomRateBasisPoints = %d, want 400 (code constant)", bloomtypes.MinBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
if bloomtypes.MaxBloomRateBasisPoints != 500 {
|
|
||||||
t.Fatalf("D-073: MaxBloomRateBasisPoints = %d, want 500 (code constant)", bloomtypes.MaxBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/bloom/stash-holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
body := rec.Body.String()
|
|
||||||
|
|
||||||
// The rendered target rate must be the code constant / 100 = 4.5.
|
|
||||||
wantTarget := formatFloat(float64(bloomtypes.TargetBloomRateBasisPoints) / 100)
|
|
||||||
if !strings.Contains(body, wantTarget) {
|
|
||||||
t.Errorf("D-073: body missing target rate %s%% (from code constant %d)", wantTarget, bloomtypes.TargetBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
// The seeded record for holder-alia uses RateBasisPoints=450 (the target).
|
|
||||||
rec2, ok := srv.Store.GetBloomRecord("stash-holder-alia")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded bloom record stash-holder-alia missing")
|
|
||||||
}
|
|
||||||
if rec2.RateBasisPoints != bloomtypes.TargetBloomRateBasisPoints {
|
|
||||||
t.Errorf("D-073: seeded record RateBasisPoints = %d, want %d (code constant)", rec2.RateBasisPoints, bloomtypes.TargetBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
// The rate band must be rendered from the code constants.
|
|
||||||
wantMin := formatFloat(float64(bloomtypes.MinBloomRateBasisPoints) / 100)
|
|
||||||
wantMax := formatFloat(float64(bloomtypes.MaxBloomRateBasisPoints) / 100)
|
|
||||||
if !strings.Contains(body, wantMin) {
|
|
||||||
t.Errorf("D-073: body missing min rate %s%% (from code constant)", wantMin)
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, wantMax) {
|
|
||||||
t.Errorf("D-073: body missing max rate %s%% (from code constant)", wantMax)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertion that the handler uses the real x/bloom/types struct.
|
|
||||||
var _ bloomtypes.BloomRecord
|
|
||||||
|
|
||||||
// formatFloat formats a float to 1 decimal place without importing strconv
|
|
||||||
// (keeps the test deps minimal; matches the template's printf "%.1f").
|
|
||||||
func formatFloat(f float64) string {
|
|
||||||
// Round to 1 decimal.
|
|
||||||
rounded := float64(int(f*10+0.5)) / 10
|
|
||||||
whole := int(rounded)
|
|
||||||
frac := int((rounded - float64(whole)) * 10)
|
|
||||||
if frac == 0 {
|
|
||||||
return formatInt2(int64(whole)) + ".0"
|
|
||||||
}
|
|
||||||
return formatInt2(int64(whole)) + "." + string(rune('0'+frac))
|
|
||||||
}
|
|
||||||
|
|
||||||
func formatInt2(n int64) string {
|
|
||||||
if n == 0 {
|
|
||||||
return "0"
|
|
||||||
}
|
|
||||||
neg := n < 0
|
|
||||||
if neg {
|
|
||||||
n = -n
|
|
||||||
}
|
|
||||||
var buf [20]byte
|
|
||||||
i := len(buf)
|
|
||||||
for n > 0 {
|
|
||||||
i--
|
|
||||||
buf[i] = byte('0' + n%10)
|
|
||||||
n /= 10
|
|
||||||
}
|
|
||||||
if neg {
|
|
||||||
i--
|
|
||||||
buf[i] = '-'
|
|
||||||
}
|
|
||||||
return string(buf[i:])
|
|
||||||
}
|
|
||||||
@@ -1,90 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
|
|
||||||
identitytypes "github.com/oy/openyield/x/identity/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// registerReach wires the Reach signup routes (REQ-040) into the mux.
|
|
||||||
// Go 1.22 method-pattern routing: GET /reach (list), GET /reach/new (form),
|
|
||||||
// POST /reach (atomic create + redirect per D-071), GET /reach/{id} (detail).
|
|
||||||
func (s *Server) registerReach(mux *http.ServeMux) {
|
|
||||||
mux.HandleFunc("GET /reach", s.handleReachList)
|
|
||||||
mux.HandleFunc("GET /reach/new", s.handleReachNew)
|
|
||||||
mux.HandleFunc("POST /reach", s.handleReachCreate)
|
|
||||||
mux.HandleFunc("GET /reach/{id}", s.handleReachDetail)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleReachList renders all Reaches (seeded + created).
|
|
||||||
func (s *Server) handleReachList(w http.ResponseWriter, r *http.Request) {
|
|
||||||
reaches := s.Store.ListReaches()
|
|
||||||
s.render(w, "reach_list.html", map[string]any{"Reaches": reaches})
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleReachNew renders the "Create a Reach" form. Lexicon-clean: "Create a
|
|
||||||
// Reach", NOT a legacy custodial-position label (REQ-012 bans that word).
|
|
||||||
func (s *Server) handleReachNew(w http.ResponseWriter, r *http.Request) {
|
|
||||||
s.render(w, "reach_new.html", nil)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleReachCreate handles the POST from the "Create a Reach" form. Calls
|
|
||||||
// store.CreateReach (atomic Reach + Stash per D-071). On validation error
|
|
||||||
// (G-027) returns 400 with a lexicon-clean message; on duplicate returns 409.
|
|
||||||
// On success redirects (302) to the new Reach detail page.
|
|
||||||
func (s *Server) handleReachCreate(w http.ResponseWriter, r *http.Request) {
|
|
||||||
holderID := r.FormValue("holder_id")
|
|
||||||
publicKey := r.FormValue("public_key")
|
|
||||||
reach, _, err := s.Store.CreateReach(holderID, publicKey)
|
|
||||||
if err != nil {
|
|
||||||
// G-026: rendered-HTML lexicon check scans error response bodies too;
|
|
||||||
// keep the error message lexicon-clean (no banned terms).
|
|
||||||
status := http.StatusBadRequest
|
|
||||||
if isDuplicate(err) {
|
|
||||||
status = http.StatusConflict
|
|
||||||
}
|
|
||||||
http.Error(w, "Could not create a Reach: "+err.Error(), status)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Redirect(w, r, "/reach/"+reach.HolderID, http.StatusFound)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleReachDetail renders one Reach + its associated Stash (BalanceGrain).
|
|
||||||
func (s *Server) handleReachDetail(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("id")
|
|
||||||
reach, ok := s.Store.GetReach(id)
|
|
||||||
if !ok {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
stash, _ := s.Store.GetStash(id)
|
|
||||||
s.render(w, "reach_detail.html", map[string]any{
|
|
||||||
"Reach": reach,
|
|
||||||
"Stash": stash,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
// isDuplicate reports whether err is a duplicate-holder error from
|
|
||||||
// store.CreateReach. Kept as a string match to avoid exporting store errors.
|
|
||||||
func isDuplicate(err error) bool {
|
|
||||||
return err != nil && contains(err.Error(), "already has a Reach")
|
|
||||||
}
|
|
||||||
|
|
||||||
func contains(s, sub string) bool {
|
|
||||||
return len(s) >= len(sub) && (s == sub || indexOf(s, sub) >= 0)
|
|
||||||
}
|
|
||||||
|
|
||||||
func indexOf(s, sub string) int {
|
|
||||||
for i := 0; i+len(sub) <= len(s); i++ {
|
|
||||||
if s[i:i+len(sub)] == sub {
|
|
||||||
return i
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return -1
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions that the handlers use the real x/*/types structs
|
|
||||||
// (D-067: the UI grounds in the real Go type definitions).
|
|
||||||
var _ identitytypes.Reach
|
|
||||||
var _ stashtypes.Stash
|
|
||||||
@@ -1,185 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/lexicon"
|
|
||||||
"github.com/oy/openyield/web/store"
|
|
||||||
)
|
|
||||||
|
|
||||||
// newTestServer builds a Server with a fresh store + templates parsed from
|
|
||||||
// web/templates (relative to repo root via the handlers test working dir).
|
|
||||||
func newTestServer(t *testing.T) *Server {
|
|
||||||
t.Helper()
|
|
||||||
srv, err := New(store.NewStore(), "../../web/templates")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("new handlers server: %v", err)
|
|
||||||
}
|
|
||||||
return srv
|
|
||||||
}
|
|
||||||
|
|
||||||
// assertNoBannedTerms checks the rendered response body for banned terms
|
|
||||||
// (G-026: applies to BOTH 200 happy-path AND error response bodies).
|
|
||||||
func assertNoBannedTerms(t *testing.T, body string) {
|
|
||||||
t.Helper()
|
|
||||||
if term, ok := lexicon.FindBannedTerm(body); ok {
|
|
||||||
t.Errorf("rendered HTML contains banned term %q (REQ-012/G-026)", term)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachListReturnsSeededReaches(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/reach", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /reach: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, "holder-alia") {
|
|
||||||
t.Errorf("GET /reach: body missing seeded reach holder-alia")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "holder-bryn") {
|
|
||||||
t.Errorf("GET /reach: body missing seeded reach holder-bryn")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachNewReturnsForm(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/reach/new", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /reach/new: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, "Create a Reach") {
|
|
||||||
t.Errorf("GET /reach/new: body missing 'Create a Reach' label")
|
|
||||||
}
|
|
||||||
// The legacy custodial-position word is BANNED (REQ-012) — must not appear.
|
|
||||||
// Check the full banned-terms list via the lexicon package (no literals in
|
|
||||||
// source); FindBannedTerm does word-boundary matching so this is stricter
|
|
||||||
// than a naive substring check.
|
|
||||||
if term, ok := lexicon.FindBannedTerm(body); ok {
|
|
||||||
t.Errorf("GET /reach/new: body contains banned word %q", term)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachCreateValidRedirectsAndAtomicallyCreates(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/reach", strings.NewReader("holder_id=holder-new&public_key=pk-new"))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusFound {
|
|
||||||
t.Fatalf("POST /reach valid: status %d, want 302 (Found)", rec.Code)
|
|
||||||
}
|
|
||||||
loc := rec.Header().Get("Location")
|
|
||||||
if !strings.Contains(loc, "/reach/holder-new") {
|
|
||||||
t.Errorf("POST /reach: Location %q, want redirect to /reach/holder-new", loc)
|
|
||||||
}
|
|
||||||
// D-071: atomic creation — both Reach + Stash must be present.
|
|
||||||
reach, ok := srv.Store.GetReach("holder-new")
|
|
||||||
if !ok {
|
|
||||||
t.Fatalf("POST /reach: GetReach miss after create (atomicity broken)")
|
|
||||||
}
|
|
||||||
if !reach.IsNomad {
|
|
||||||
t.Errorf("POST /reach: created Reach IsNomad=false, want true (D-071)")
|
|
||||||
}
|
|
||||||
stash, ok := srv.Store.GetStash("holder-new")
|
|
||||||
if !ok {
|
|
||||||
t.Fatalf("POST /reach: GetStash miss after create (atomicity broken — D-071)")
|
|
||||||
}
|
|
||||||
if stash.HolderID != reach.HolderID {
|
|
||||||
t.Errorf("POST /reach: stash.HolderID %q != reach.HolderID %q (D-071)", stash.HolderID, reach.HolderID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachCreateEmptyHolderIDReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/reach", strings.NewReader("holder_id=&public_key=pk"))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST /reach empty holder: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
// G-026: rendered-HTML lexicon check scans the ERROR response body too.
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachCreatePathSeparatorReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/reach", strings.NewReader("holder_id=h/x&public_key=pk"))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST /reach path separator: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachCreateDuplicateReturns409(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/reach", strings.NewReader("holder_id=holder-alia&public_key=pk"))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusConflict {
|
|
||||||
t.Fatalf("POST /reach duplicate: status %d, want 409", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachDetailSeededReturnsReachAndStash(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/reach/holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /reach/holder-alia: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, "reach-holder-alia") {
|
|
||||||
t.Errorf("GET /reach/holder-alia: body missing reach-holder-alia")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "stash-holder-alia") {
|
|
||||||
t.Errorf("GET /reach/holder-alia: body missing associated stash-holder-alia")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "Grain") {
|
|
||||||
t.Errorf("GET /reach/holder-alia: body missing Stash balance in Grain")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachDetailMissingReturns404(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/reach/nobody", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusNotFound {
|
|
||||||
t.Fatalf("GET /reach/nobody: status %d, want 404", rec.Code)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,125 +0,0 @@
|
|||||||
// Package handlers holds the HTTP handlers for the OpenYield web UI screens.
|
|
||||||
//
|
|
||||||
// Each screen (Reach signup, Stash dashboard, Window authorization, Standing
|
|
||||||
// progress, Bloom accrual) gets its own handler file. handlers/server.go wires
|
|
||||||
// routes into the mux from web/server.go. Handlers render html/template
|
|
||||||
// templates against the mock store (web/store). Lexicon-clean by construction
|
|
||||||
// (REQ-012 / REQ-045): the lexicon_meta_web firewall scans these files.
|
|
||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
"html/template"
|
|
||||||
"net/http"
|
|
||||||
"os"
|
|
||||||
"path/filepath"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/web/store"
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
windowtypes "github.com/oy/openyield/x/window/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Server bundles the mock store + per-page templates + route registration.
|
|
||||||
// Each screen handler is a method on Server so it shares the store + tmpl.
|
|
||||||
//
|
|
||||||
// Template loading: base.html is parsed once, then each page template is
|
|
||||||
// parsed in a CLONE of the base set so the per-page "content" block does not
|
|
||||||
// collide across pages (Go html/template shares the block namespace within
|
|
||||||
// one set; cloning per page isolates each page's content block). This is the
|
|
||||||
// standard Go template pattern for layouts + pages.
|
|
||||||
type Server struct {
|
|
||||||
Store *store.Store
|
|
||||||
Pages map[string]*template.Template
|
|
||||||
}
|
|
||||||
|
|
||||||
// New constructs a Server with the given store + per-page templates loaded
|
|
||||||
// from templatesDir (the absolute or relative path to web/templates/).
|
|
||||||
func New(s *store.Store, templatesDir string) (*Server, error) {
|
|
||||||
funcs := template.FuncMap{
|
|
||||||
"divGrain": func(grain, unit int64) int64 {
|
|
||||||
if unit == 0 {
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
return grain / unit
|
|
||||||
},
|
|
||||||
"string": func(v any) string {
|
|
||||||
switch t := v.(type) {
|
|
||||||
case string:
|
|
||||||
return t
|
|
||||||
case windowtypes.WindowStatus:
|
|
||||||
return string(t)
|
|
||||||
case standingtypes.StandingBucket:
|
|
||||||
return string(t)
|
|
||||||
default:
|
|
||||||
return ""
|
|
||||||
}
|
|
||||||
},
|
|
||||||
}
|
|
||||||
basePath := filepath.Join(templatesDir, "base.html")
|
|
||||||
base, err := template.New("base.html").Funcs(funcs).ParseFiles(basePath)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("parse base: %w", err)
|
|
||||||
}
|
|
||||||
pages := map[string]*template.Template{}
|
|
||||||
pageGlob := filepath.Join(templatesDir, "*.html")
|
|
||||||
matches, err := filepath.Glob(pageGlob)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("glob pages: %w", err)
|
|
||||||
}
|
|
||||||
for _, p := range matches {
|
|
||||||
name := filepath.Base(p)
|
|
||||||
if name == "base.html" {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
clone, cerr := base.Clone()
|
|
||||||
if cerr != nil {
|
|
||||||
return nil, fmt.Errorf("clone for %s: %w", name, cerr)
|
|
||||||
}
|
|
||||||
pt, perr := clone.ParseFiles(p)
|
|
||||||
if perr != nil {
|
|
||||||
return nil, fmt.Errorf("parse %s: %w", name, perr)
|
|
||||||
}
|
|
||||||
pages[name] = pt
|
|
||||||
}
|
|
||||||
return &Server{Store: s, Pages: pages}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Register wires all screen routes into the given mux (Go 1.22 method
|
|
||||||
// patterns). Called by web/server.go after constructing the Server.
|
|
||||||
func (s *Server) Register(mux *http.ServeMux) {
|
|
||||||
s.registerReach(mux)
|
|
||||||
s.registerStash(mux)
|
|
||||||
s.registerWindow(mux)
|
|
||||||
s.registerStanding(mux)
|
|
||||||
s.registerBloom(mux)
|
|
||||||
}
|
|
||||||
|
|
||||||
// render executes the named page template with the given data, writing HTML
|
|
||||||
// to w. The page template invokes base.html and overrides the "content" block.
|
|
||||||
func (s *Server) render(w http.ResponseWriter, name string, data any) {
|
|
||||||
tmpl, ok := s.Pages[name]
|
|
||||||
if !ok {
|
|
||||||
http.Error(w, "template not found: "+name, http.StatusInternalServerError)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
||||||
if err := tmpl.ExecuteTemplate(w, "base.html", data); err != nil {
|
|
||||||
http.Error(w, "render error", http.StatusInternalServerError)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// RenderHome renders the home page (public so web/server.go can call it for
|
|
||||||
// the "/" route which lives outside handlers.Register).
|
|
||||||
func (s *Server) RenderHome(w http.ResponseWriter, data any) {
|
|
||||||
s.render(w, "home.html", data)
|
|
||||||
}
|
|
||||||
|
|
||||||
// templatesDir returns the default web/templates directory relative to the
|
|
||||||
// working directory. Used by web/server.go when constructing via New().
|
|
||||||
func DefaultTemplatesDir() string {
|
|
||||||
dir, _ := os.Getwd()
|
|
||||||
if filepath.Base(dir) == "web" || filepath.Base(dir) == "handlers" {
|
|
||||||
return filepath.Join(dir, "templates")
|
|
||||||
}
|
|
||||||
return "web/templates"
|
|
||||||
}
|
|
||||||
@@ -1,59 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// registerStanding wires the Standing + Freeholder signals route (REQ-043).
|
|
||||||
func (s *Server) registerStanding(mux *http.ServeMux) {
|
|
||||||
mux.HandleFunc("GET /standing/{reachID}", s.handleStanding)
|
|
||||||
}
|
|
||||||
|
|
||||||
// standingViewData is the template data for the Standing screen.
|
|
||||||
type standingViewData struct {
|
|
||||||
ReachID string
|
|
||||||
Found bool
|
|
||||||
Score float64
|
|
||||||
Bucket standingtypes.StandingBucket
|
|
||||||
Ratings []standingtypes.Rating
|
|
||||||
Vouches []standingtypes.Vouch
|
|
||||||
Slashes []standingtypes.Slash
|
|
||||||
Signals standingtypes.FreeholderSignals
|
|
||||||
Eligible bool
|
|
||||||
MinScore float64
|
|
||||||
MinCats int
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleStanding renders the Standing + Freeholder signals progress (REQ-043).
|
|
||||||
// Computed from mock Ratings/Vouches/Slashes using the locked x/standing/types
|
|
||||||
// constants + GetStandingBucket/ComputeDiversityBonus/GetVoucherWeight; the
|
|
||||||
// 4-signal progress via FreeholderSignals.IsFreeholderEligible().
|
|
||||||
func (s *Server) handleStanding(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("reachID")
|
|
||||||
_, ok := s.Store.GetReach(id)
|
|
||||||
if !ok {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
score, bucket := s.Store.ComputeStandingScore(id)
|
|
||||||
ratings := s.Store.ListRatings(id)
|
|
||||||
vouches := s.Store.ListVouches(id)
|
|
||||||
slashes := s.Store.ListSlashes(id)
|
|
||||||
signals := s.Store.ComputeFreeholderSignals(id)
|
|
||||||
|
|
||||||
s.render(w, "standing.html", standingViewData{
|
|
||||||
ReachID: id,
|
|
||||||
Found: true,
|
|
||||||
Score: score,
|
|
||||||
Bucket: bucket,
|
|
||||||
Ratings: ratings,
|
|
||||||
Vouches: vouches,
|
|
||||||
Slashes: slashes,
|
|
||||||
Signals: signals,
|
|
||||||
Eligible: signals.IsFreeholderEligible(),
|
|
||||||
MinScore: standingtypes.FreeholderMinStandingScore,
|
|
||||||
MinCats: standingtypes.FreeholderMinCategories,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
@@ -1,146 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestStandingEligibleHolderRendersAllSignalsEarned(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/standing/holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /standing/holder-alia: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// holder-alia: 12 ratings in 4 categories, 1 Vouch, mature Stash, balance 920000.
|
|
||||||
// All 4 signals earned -> Freeholder-eligible.
|
|
||||||
if !strings.Contains(body, "Freeholder-eligible") {
|
|
||||||
t.Errorf("body missing 'Freeholder-eligible' label")
|
|
||||||
}
|
|
||||||
// Score displayed with 1 decimal.
|
|
||||||
if !strings.Contains(body, "4.") {
|
|
||||||
t.Errorf("body missing score (expected 4.x)")
|
|
||||||
}
|
|
||||||
// All 4 signals should show 'earned'.
|
|
||||||
earnedCount := strings.Count(body, "earned")
|
|
||||||
if earnedCount < 4 {
|
|
||||||
t.Errorf("body has %d 'earned' badges, want >=4 (all signals earned for holder-alia)", earnedCount)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestStandingNotEligibleHolderShowsNotYet(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/standing/holder-bryn", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /standing/holder-bryn: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// holder-bryn: 3 ratings in 1 category, no Vouch, immature Stash.
|
|
||||||
// Not eligible.
|
|
||||||
if !strings.Contains(body, "not yet") {
|
|
||||||
t.Errorf("body missing 'not yet' badge for non-eligible holder-bryn")
|
|
||||||
}
|
|
||||||
if strings.Contains(body, "Freeholder-eligible\">yes") {
|
|
||||||
t.Errorf("body shows eligible=yes for holder-bryn (should not be eligible)")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestStandingMissingReturns404(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/standing/nobody", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusNotFound {
|
|
||||||
t.Fatalf("GET /standing/nobody: status %d, want 404", rec.Code)
|
|
||||||
}
|
|
||||||
// G-026: rendered-HTML lexicon check on the ERROR response body too.
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestStandingScoreComputedFromLockedConstants (P4 regression guard): asserts
|
|
||||||
// ComputeStandingScore uses the x/standing/types locked constants
|
|
||||||
// (PriorMean=4.0, PriorWeight=10, ComputeDiversityBonus, GetVoucherWeight,
|
|
||||||
// GetStandingBucket) — NOT a hardcoded score. This test would FAIL if the
|
|
||||||
// handler hardcoded a score instead of computing from the locked constants.
|
|
||||||
func TestStandingScoreComputedFromLockedConstants(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
score, bucket := srv.Store.ComputeStandingScore("holder-alia")
|
|
||||||
// D-073 pattern: the score must be derived from the locked constants, not
|
|
||||||
// a magic number. Assert the prior mean is 4.0 and the score is pulled
|
|
||||||
// toward it (Bayesian shrinkage) + diversity bonus for 4 categories.
|
|
||||||
if standingtypes.PriorMean != 4.0 {
|
|
||||||
t.Fatalf("D-073: PriorMean = %v, want 4.0 (locked constant)", standingtypes.PriorMean)
|
|
||||||
}
|
|
||||||
if standingtypes.PriorWeight != 10 {
|
|
||||||
t.Fatalf("D-073: PriorWeight = %v, want 10 (locked constant)", standingtypes.PriorWeight)
|
|
||||||
}
|
|
||||||
// holder-alia has 4 categories -> diversity bonus 0.10 (DiversityBonus4Cats).
|
|
||||||
bonus := standingtypes.ComputeDiversityBonus(4)
|
|
||||||
if bonus != standingtypes.DiversityBonus4Cats {
|
|
||||||
t.Errorf("ComputeDiversityBonus(4) = %v, want %v (locked constant)", bonus, standingtypes.DiversityBonus4Cats)
|
|
||||||
}
|
|
||||||
// The score must be > 4.5 (ratings 4.6-4.9 + diversity bonus 0.10).
|
|
||||||
if score < 4.5 {
|
|
||||||
t.Errorf("score for holder-alia = %.2f, want >= 4.5 (12 ratings 4.6-4.9 + 4-cat bonus)", score)
|
|
||||||
}
|
|
||||||
// Bucket must be Preferred or Top (score >= 4.5, 12 ratings >= 10).
|
|
||||||
if bucket != standingtypes.BucketPreferred && bucket != standingtypes.BucketTop {
|
|
||||||
t.Errorf("bucket for holder-alia = %q, want Preferred or Top", bucket)
|
|
||||||
}
|
|
||||||
// holder-bryn has 3 ratings in 1 category -> bucket New (< 10 ratings).
|
|
||||||
_, brynBucket := srv.Store.ComputeStandingScore("holder-bryn")
|
|
||||||
if brynBucket != standingtypes.BucketNew {
|
|
||||||
t.Errorf("bucket for holder-bryn = %q, want New (< 10 ratings)", brynBucket)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestFreeholderEligibleBadgeReflectsMethod: asserts the rendered badge
|
|
||||||
// matches FreeholderSignals.IsFreeholderEligible() (the real method).
|
|
||||||
func TestFreeholderEligibleBadgeReflectsMethod(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
|
|
||||||
// holder-alia: eligible (all 4 signals true).
|
|
||||||
aliaSignals := srv.Store.ComputeFreeholderSignals("holder-alia")
|
|
||||||
if !aliaSignals.IsFreeholderEligible() {
|
|
||||||
t.Errorf("holder-alia IsFreeholderEligible = false, want true (signals=%+v)", aliaSignals)
|
|
||||||
}
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/standing/holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if !strings.Contains(rec.Body.String(), "yes") {
|
|
||||||
t.Errorf("holder-alia: body missing 'yes' eligible badge (IsFreeholderEligible=true)")
|
|
||||||
}
|
|
||||||
|
|
||||||
// holder-bryn: not eligible.
|
|
||||||
brynSignals := srv.Store.ComputeFreeholderSignals("holder-bryn")
|
|
||||||
if brynSignals.IsFreeholderEligible() {
|
|
||||||
t.Errorf("holder-bryn IsFreeholderEligible = true, want false (signals=%+v)", brynSignals)
|
|
||||||
}
|
|
||||||
rec2 := httptest.NewRecorder()
|
|
||||||
req2 := httptest.NewRequest("GET", "/standing/holder-bryn", nil)
|
|
||||||
mux.ServeHTTP(rec2, req2)
|
|
||||||
if !strings.Contains(rec2.Body.String(), "not yet") {
|
|
||||||
t.Errorf("holder-bryn: body missing 'not yet' (IsFreeholderEligible=false)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertion that the handler uses the real x/standing/types struct.
|
|
||||||
var _ standingtypes.FreeholderSignals
|
|
||||||
@@ -1,68 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
|
|
||||||
breadtypes "github.com/oy/openyield/x/bread/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// registerStash wires the Stash dashboard route (REQ-041) into the mux.
|
|
||||||
func (s *Server) registerStash(mux *http.ServeMux) {
|
|
||||||
mux.HandleFunc("GET /stash/{holderID}", s.handleStashDashboard)
|
|
||||||
}
|
|
||||||
|
|
||||||
// stashViewData is the template data for the Stash dashboard. It carries the
|
|
||||||
// real x/*/types structs plus the Bread-scale conversion (computed from the
|
|
||||||
// x/bread/types code constants per D-073) and the maturity progress.
|
|
||||||
type stashViewData struct {
|
|
||||||
Stash stashtypes.Stash
|
|
||||||
Activity stashtypes.StashActivity
|
|
||||||
Found bool
|
|
||||||
BreadScale []breadtypes.BreadScale
|
|
||||||
BalanceBread int64
|
|
||||||
MaturityPct int
|
|
||||||
Mature bool
|
|
||||||
ThresholdDays uint32
|
|
||||||
MaxGapDays uint32
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleStashDashboard renders the Stash dashboard (REQ-041): balance in Grain
|
|
||||||
// + Bread-scale conversion (using x/bread/types.BreadScaleAll() + GrainsPerBread
|
|
||||||
// per D-073 — code constants, NOT docs) + 90-day maturity progress bar
|
|
||||||
// (StashActivity.IsMature, MaturityThresholdDays=90).
|
|
||||||
func (s *Server) handleStashDashboard(w http.ResponseWriter, r *http.Request) {
|
|
||||||
holderID := r.PathValue("holderID")
|
|
||||||
stash, ok := s.Store.GetStash(holderID)
|
|
||||||
if !ok {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
activity, _ := s.Store.GetStashActivity(stash.StashID)
|
|
||||||
|
|
||||||
// D-073: Bread-scale conversion from x/bread/types code constants.
|
|
||||||
scale := breadtypes.BreadScaleAll()
|
|
||||||
balanceBread := stash.BalanceGrain / breadtypes.GrainsPerBread
|
|
||||||
|
|
||||||
// Maturity progress: ActiveDays / MaturityThresholdDays, capped at 100%.
|
|
||||||
threshold := uint32(stashtypes.MaturityThresholdDays)
|
|
||||||
pct := int(float64(activity.ActiveDays) / float64(threshold) * 100)
|
|
||||||
if pct > 100 {
|
|
||||||
pct = 100
|
|
||||||
}
|
|
||||||
if pct < 0 {
|
|
||||||
pct = 0
|
|
||||||
}
|
|
||||||
|
|
||||||
s.render(w, "stash.html", stashViewData{
|
|
||||||
Stash: stash,
|
|
||||||
Activity: activity,
|
|
||||||
Found: true,
|
|
||||||
BreadScale: scale,
|
|
||||||
BalanceBread: balanceBread,
|
|
||||||
MaturityPct: pct,
|
|
||||||
Mature: activity.IsMature(),
|
|
||||||
ThresholdDays: threshold,
|
|
||||||
MaxGapDays: stashtypes.MaxGapForMaturity,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
@@ -1,156 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
breadtypes "github.com/oy/openyield/x/bread/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestStashDashboardSeededMatureHolder(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/stash/holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /stash/holder-alia: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// Balance in Grain present.
|
|
||||||
if !strings.Contains(body, "Grain") {
|
|
||||||
t.Errorf("body missing 'Grain' balance")
|
|
||||||
}
|
|
||||||
// Bread-scale conversion table present (all 11 denominations from BreadScaleAll).
|
|
||||||
for _, ds := range breadtypes.BreadScaleAll() {
|
|
||||||
if !strings.Contains(body, ds.Name) {
|
|
||||||
t.Errorf("body missing Bread-scale denomination %q", ds.Name)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// Mature holder (ActiveDays=92, MaxGap=10): progress ~100%, Mature badge.
|
|
||||||
if !strings.Contains(body, "Mature") {
|
|
||||||
t.Errorf("body missing 'Mature' badge for mature holder-alia")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestStashDashboardImmatureHolder(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/stash/holder-bryn", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /stash/holder-bryn: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// Immature holder (ActiveDays=45, MaxGap=5): Not mature badge.
|
|
||||||
if !strings.Contains(body, "Not mature") {
|
|
||||||
t.Errorf("body missing 'Not mature' badge for immature holder-bryn")
|
|
||||||
}
|
|
||||||
// Progress bar at 50% (45/90).
|
|
||||||
if !strings.Contains(body, "50%") {
|
|
||||||
t.Errorf("body missing 50%% progress for holder-bryn (45/90 days)")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestStashDashboardMissingReturns404(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/stash/nobody", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusNotFound {
|
|
||||||
t.Fatalf("GET /stash/nobody: status %d, want 404", rec.Code)
|
|
||||||
}
|
|
||||||
// G-026: rendered-HTML lexicon check on the ERROR response body too.
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestStashBreadScaleConversionCorrectness (D-073 regression guard): asserts
|
|
||||||
// the Stash dashboard uses x/bread/types code constants (GrainsPerBread=10000,
|
|
||||||
// BreadScaleAll() with Grain=1, Crumb=100, Bread=10000...), NOT the outdated
|
|
||||||
// docs/shared/bread-scale.md (which claims 1,000x ratios). This test would FAIL
|
|
||||||
// if the handler hardcoded the docs values instead of using the code constants.
|
|
||||||
func TestStashBreadScaleConversionCorrectness(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/stash/holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
body := rec.Body.String()
|
|
||||||
|
|
||||||
// D-073: the code constants are the source of truth.
|
|
||||||
// GrainsPerBread must be 10000 (code), NOT 1000 (docs claim 1 Crumb=1000 Grain).
|
|
||||||
if breadtypes.GrainsPerBread != 10000 {
|
|
||||||
t.Fatalf("D-073: x/bread/types.GrainsPerBread = %d, want 10000 (code constant)", breadtypes.GrainsPerBread)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The handler computes BalanceBread = BalanceGrain / GrainsPerBread.
|
|
||||||
// holder-alia seed: BalanceGrain = 920000 -> 92 Bread.
|
|
||||||
stash, ok := srv.Store.GetStash("holder-alia")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded holder-alia stash missing")
|
|
||||||
}
|
|
||||||
wantBread := stash.BalanceGrain / breadtypes.GrainsPerBread
|
|
||||||
wantBreadStr := []byte(formatInt(wantBread))
|
|
||||||
if !strings.Contains(body, string(wantBreadStr)) {
|
|
||||||
t.Errorf("D-073: body missing expected Bread conversion %d (from %d Grain / %d GrainsPerBread)",
|
|
||||||
wantBread, stash.BalanceGrain, breadtypes.GrainsPerBread)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The Bread-scale table must include the code-constant Grain values.
|
|
||||||
scale := breadtypes.BreadScaleAll()
|
|
||||||
for _, ds := range scale {
|
|
||||||
if !strings.Contains(body, formatInt(ds.GrainValue)) {
|
|
||||||
t.Errorf("D-073: body missing Bread-scale GrainValue %d for %s", ds.GrainValue, ds.Name)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Regression guard: if someone used the outdated docs value (1 Crumb = 1000
|
|
||||||
// Grain) instead of the code constant (1 Crumb = 100 Grain), the Crumb row
|
|
||||||
// would show 1000 — assert it shows 100 (the code value).
|
|
||||||
crumbs := scale[1] // index 1 = Crumb
|
|
||||||
if crumbs.Name != "Crumb" || crumbs.GrainValue != 100 {
|
|
||||||
t.Fatalf("D-073: BreadScaleAll()[1] = {%s, %d}, want {Crumb, 100}", crumbs.Name, crumbs.GrainValue)
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "100") {
|
|
||||||
t.Errorf("D-073: body missing code-constant Crumb=100 Grain (would show 1000 if docs values were used)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions that the handler uses the real x/*/types structs
|
|
||||||
// (D-067: the UI grounds in the real Go type definitions).
|
|
||||||
var _ stashtypes.Stash
|
|
||||||
var _ stashtypes.StashActivity
|
|
||||||
|
|
||||||
// formatInt is a tiny strconv.Itoa without the import (keeps test deps minimal).
|
|
||||||
func formatInt(n int64) string {
|
|
||||||
if n == 0 {
|
|
||||||
return "0"
|
|
||||||
}
|
|
||||||
neg := n < 0
|
|
||||||
if neg {
|
|
||||||
n = -n
|
|
||||||
}
|
|
||||||
var buf [20]byte
|
|
||||||
i := len(buf)
|
|
||||||
for n > 0 {
|
|
||||||
i--
|
|
||||||
buf[i] = byte('0' + n%10)
|
|
||||||
n /= 10
|
|
||||||
}
|
|
||||||
if neg {
|
|
||||||
i--
|
|
||||||
buf[i] = '-'
|
|
||||||
}
|
|
||||||
return string(buf[i:])
|
|
||||||
}
|
|
||||||
@@ -1,119 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"strconv"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
windowtypes "github.com/oy/openyield/x/window/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// registerWindow wires the Window authorization routes (REQ-042) into the mux.
|
|
||||||
func (s *Server) registerWindow(mux *http.ServeMux) {
|
|
||||||
mux.HandleFunc("GET /window", s.handleWindowList)
|
|
||||||
mux.HandleFunc("GET /window/new", s.handleWindowNew)
|
|
||||||
mux.HandleFunc("POST /window", s.handleWindowOpen)
|
|
||||||
mux.HandleFunc("GET /window/{id}", s.handleWindowDetail)
|
|
||||||
mux.HandleFunc("POST /window/{id}/activate", s.handleWindowActivate)
|
|
||||||
mux.HandleFunc("POST /window/{id}/revoke", s.handleWindowRevoke)
|
|
||||||
mux.HandleFunc("POST /window/{id}/expire", s.handleWindowExpire)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowList renders all Windows for a grantor holder (defaults to
|
|
||||||
// holder-alia if no query param, so the list view has something to show).
|
|
||||||
func (s *Server) handleWindowList(w http.ResponseWriter, r *http.Request) {
|
|
||||||
grantor := r.URL.Query().Get("grantor")
|
|
||||||
if grantor == "" {
|
|
||||||
grantor = "holder-alia"
|
|
||||||
}
|
|
||||||
windows := s.Store.ListWindows(grantor)
|
|
||||||
s.render(w, "window_list.html", map[string]any{"Windows": windows, "Grantor": grantor})
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowNew renders the "Open a Window" form.
|
|
||||||
func (s *Server) handleWindowNew(w http.ResponseWriter, r *http.Request) {
|
|
||||||
s.render(w, "window_new.html", nil)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowOpen handles the POST from the "Open a Window" form. Calls
|
|
||||||
// store.OpenWindow (creates a Window status=Open + an initial AuditEntry).
|
|
||||||
func (s *Server) handleWindowOpen(w http.ResponseWriter, r *http.Request) {
|
|
||||||
grantor := r.FormValue("grantor_holder")
|
|
||||||
grantee := r.FormValue("grantee")
|
|
||||||
scopeKind := windowtypes.ScopeKind(r.FormValue("scope_kind"))
|
|
||||||
resourceID := r.FormValue("resource_id")
|
|
||||||
startStr := r.FormValue("start_unix")
|
|
||||||
endStr := r.FormValue("end_unix")
|
|
||||||
maxActionsStr := r.FormValue("max_actions")
|
|
||||||
|
|
||||||
if grantor == "" {
|
|
||||||
http.Error(w, "grantor holder is required", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
if grantee == "" {
|
|
||||||
http.Error(w, "grantee is required", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
start, _ := strconv.ParseInt(startStr, 10, 64)
|
|
||||||
end, _ := strconv.ParseInt(endStr, 10, 64)
|
|
||||||
if start == 0 {
|
|
||||||
start = time.Now().Unix()
|
|
||||||
}
|
|
||||||
if end == 0 {
|
|
||||||
end = start + 3600
|
|
||||||
}
|
|
||||||
maxActions, _ := strconv.ParseUint(maxActionsStr, 10, 32)
|
|
||||||
if maxActions == 0 {
|
|
||||||
maxActions = 10
|
|
||||||
}
|
|
||||||
scope := windowtypes.Scope{Kind: scopeKind, ResourceID: resourceID}
|
|
||||||
rateLimit := windowtypes.RateLimit{MaxActions: uint32(maxActions), PerDurationSeconds: 3600}
|
|
||||||
win, err := s.Store.OpenWindow(grantor, grantee, scope, start, end, rateLimit)
|
|
||||||
if err != nil {
|
|
||||||
http.Error(w, "could not open a Window: "+err.Error(), http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Redirect(w, r, "/window/"+win.WindowID, http.StatusFound)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowDetail renders one Window + its lifecycle state + audit log.
|
|
||||||
func (s *Server) handleWindowDetail(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("id")
|
|
||||||
win, ok := s.Store.GetWindow(id)
|
|
||||||
if !ok {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
auditLog := s.Store.GetAuditLog(id)
|
|
||||||
s.render(w, "window_detail.html", map[string]any{"Window": win, "AuditLog": auditLog})
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowActivate transitions Open → Active (calls Window.Activate).
|
|
||||||
func (s *Server) handleWindowActivate(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("id")
|
|
||||||
if err := s.Store.ActivateWindow(id); err != nil {
|
|
||||||
http.Error(w, "could not activate: "+err.Error(), http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Redirect(w, r, "/window/"+id, http.StatusSeeOther)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowRevoke transitions to Revoked (calls Window.Revoke; idempotent).
|
|
||||||
func (s *Server) handleWindowRevoke(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("id")
|
|
||||||
if err := s.Store.RevokeWindow(id); err != nil {
|
|
||||||
http.Error(w, "could not revoke: "+err.Error(), http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Redirect(w, r, "/window/"+id, http.StatusSeeOther)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowExpire transitions to Expired (calls Window.Expire).
|
|
||||||
func (s *Server) handleWindowExpire(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("id")
|
|
||||||
if err := s.Store.ExpireWindow(id); err != nil {
|
|
||||||
http.Error(w, "could not expire: "+err.Error(), http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Redirect(w, r, "/window/"+id, http.StatusSeeOther)
|
|
||||||
}
|
|
||||||
@@ -1,363 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
windowtypes "github.com/oy/openyield/x/window/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestWindowOpenCreatesWindowStatusOpen(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
body := "grantor_holder=holder-alia&grantee=service-1&scope_kind=ReadStash&resource_id=stash-holder-alia&max_actions=5"
|
|
||||||
req := httptest.NewRequest("POST", "/window", strings.NewReader(body))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusFound {
|
|
||||||
t.Fatalf("POST /window: status %d, want 302", rec.Code)
|
|
||||||
}
|
|
||||||
loc := rec.Header().Get("Location")
|
|
||||||
if !strings.HasPrefix(loc, "/window/window-") {
|
|
||||||
t.Errorf("POST /window: Location %q, want /window/window-...", loc)
|
|
||||||
}
|
|
||||||
// Extract the windowID and verify it exists with Status=Open + an initial AuditEntry.
|
|
||||||
windowID := strings.TrimPrefix(loc, "/window/")
|
|
||||||
win, ok := srv.Store.GetWindow(windowID)
|
|
||||||
if !ok {
|
|
||||||
t.Fatalf("POST /window: GetWindow(%q) miss", windowID)
|
|
||||||
}
|
|
||||||
if win.Status != windowtypes.StatusOpen {
|
|
||||||
t.Errorf("POST /window: created Window status %q, want Open", win.Status)
|
|
||||||
}
|
|
||||||
audit := srv.Store.GetAuditLog(windowID)
|
|
||||||
if len(audit) != 1 {
|
|
||||||
t.Errorf("POST /window: audit log len %d, want 1 (initial entry)", len(audit))
|
|
||||||
}
|
|
||||||
if audit[0].Action != "open" {
|
|
||||||
t.Errorf("POST /window: initial audit action %q, want open", audit[0].Action)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowActivateTransitionsOpenToActive(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, err := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("OpenWindow: %v", err)
|
|
||||||
}
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/"+win.WindowID+"/activate", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusSeeOther {
|
|
||||||
t.Fatalf("POST activate: status %d, want 303", rec.Code)
|
|
||||||
}
|
|
||||||
// Lifecycle correctness: assert the real Window.Activate() was invoked
|
|
||||||
// (the handler calls store.ActivateWindow which calls w.Activate()).
|
|
||||||
updated, ok := srv.Store.GetWindow(win.WindowID)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("window missing after activate")
|
|
||||||
}
|
|
||||||
if updated.Status != windowtypes.StatusActive {
|
|
||||||
t.Errorf("after activate: status %q, want Active (Window.Activate was NOT invoked)", updated.Status)
|
|
||||||
}
|
|
||||||
audit := srv.Store.GetAuditLog(win.WindowID)
|
|
||||||
if len(audit) != 2 {
|
|
||||||
t.Errorf("after activate: audit log len %d, want 2 (initial + activate)", len(audit))
|
|
||||||
}
|
|
||||||
if audit[1].Action != "activate" {
|
|
||||||
t.Errorf("after activate: audit[1].Action %q, want activate", audit[1].Action)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowRevokeTransitionsToRevoked(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/"+win.WindowID+"/revoke", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusSeeOther {
|
|
||||||
t.Fatalf("POST revoke: status %d, want 303", rec.Code)
|
|
||||||
}
|
|
||||||
updated, _ := srv.Store.GetWindow(win.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusRevoked {
|
|
||||||
t.Errorf("after revoke: status %q, want Revoked (Window.Revoke was NOT invoked)", updated.Status)
|
|
||||||
}
|
|
||||||
if !updated.Revoked {
|
|
||||||
t.Errorf("after revoke: Revoked flag false, want true")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowRevokeIdempotentOnAlreadyRevoked(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
_ = srv.Store.RevokeWindow(win.WindowID)
|
|
||||||
auditBefore := len(srv.Store.GetAuditLog(win.WindowID))
|
|
||||||
|
|
||||||
// Second revoke is a no-op (idempotent): no new AuditEntry.
|
|
||||||
_ = srv.Store.RevokeWindow(win.WindowID)
|
|
||||||
auditAfter := len(srv.Store.GetAuditLog(win.WindowID))
|
|
||||||
if auditAfter != auditBefore {
|
|
||||||
t.Errorf("idempotent revoke: audit log grew %d -> %d (revoke on already-revoked must be a no-op)", auditBefore, auditAfter)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowRevokeOnExpiredIsNoOp(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
_ = srv.Store.ExpireWindow(win.WindowID)
|
|
||||||
auditBefore := len(srv.Store.GetAuditLog(win.WindowID))
|
|
||||||
|
|
||||||
// Revoke on an Expired window is a no-op (Expired is terminal — v0.2 contract).
|
|
||||||
_ = srv.Store.RevokeWindow(win.WindowID)
|
|
||||||
updated, _ := srv.Store.GetWindow(win.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusExpired {
|
|
||||||
t.Errorf("revoke-on-expired: status %q, want Expired (terminal state must win)", updated.Status)
|
|
||||||
}
|
|
||||||
auditAfter := len(srv.Store.GetAuditLog(win.WindowID))
|
|
||||||
if auditAfter != auditBefore {
|
|
||||||
t.Errorf("revoke-on-expired: audit log grew %d -> %d (must be a no-op)", auditBefore, auditAfter)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowExpireTransitionsToExpired(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
|
|
||||||
_ = srv.Store.ExpireWindow(win.WindowID)
|
|
||||||
updated, _ := srv.Store.GetWindow(win.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusExpired {
|
|
||||||
t.Errorf("after expire: status %q, want Expired (Window.Expire was NOT invoked)", updated.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowDetailRendersLifecycleAndAuditLog(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/window/"+win.WindowID, nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /window/%s: status %d, want 200", win.WindowID, rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, "Active") {
|
|
||||||
t.Errorf("detail: body missing Active badge")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "activate") {
|
|
||||||
t.Errorf("detail: body missing activate audit-log entry")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "open") {
|
|
||||||
t.Errorf("detail: body missing open audit-log entry")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowDetailMissingReturns404(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/window/window-nobody", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusNotFound {
|
|
||||||
t.Fatalf("GET /window/window-nobody: status %d, want 404", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowOpenEmptyGrantorReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
body := "grantor_holder=&grantee=service-1&scope_kind=ReadStash"
|
|
||||||
req := httptest.NewRequest("POST", "/window", strings.NewReader(body))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST /window empty grantor: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
// G-026: rendered-HTML lexicon check on the ERROR response body too.
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertion that the handler uses the real x/window/types struct
|
|
||||||
// (D-067: the UI grounds in the real Go type definitions).
|
|
||||||
var _ windowtypes.Window
|
|
||||||
|
|
||||||
func TestWindowListRendersSeededEmpty(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/window", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /window: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// No windows yet for holder-alia (fresh store) -> empty message.
|
|
||||||
if !strings.Contains(body, "Open a Window") {
|
|
||||||
t.Errorf("GET /window: body missing 'Open a Window' link")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowListRendersCreatedWindows(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 5, PerDurationSeconds: 3600}
|
|
||||||
w, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/window", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /window: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, w.WindowID) {
|
|
||||||
t.Errorf("GET /window: body missing created window %s", w.WindowID)
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "service-1") {
|
|
||||||
t.Errorf("GET /window: body missing grantee service-1")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowNewRendersForm(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/window/new", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /window/new: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, "Open a Window") {
|
|
||||||
t.Errorf("GET /window/new: body missing 'Open a Window' label")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "ReadStash") {
|
|
||||||
t.Errorf("GET /window/new: body missing ScopeKind option ReadStash")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "ProcessPassActForStand") {
|
|
||||||
t.Errorf("GET /window/new: body missing ScopeKind option ProcessPassActForStand")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowOpenEmptyGranteeReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
body := "grantor_holder=holder-alia&grantee=&scope_kind=ReadStash"
|
|
||||||
req := httptest.NewRequest("POST", "/window", strings.NewReader(body))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST /window empty grantee: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowActivateNotFoundReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/window-nobody/activate", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST activate nobody: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowRevokeNotFoundReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/window-nobody/revoke", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST revoke nobody: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowExpireNotFoundReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/window-nobody/expire", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST expire nobody: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowRevokeAndExpireHandlersRedirect(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/"+win.WindowID+"/revoke", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusSeeOther {
|
|
||||||
t.Fatalf("POST revoke: status %d, want 303", rec.Code)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Expire on a revoked window: revoked is not terminal for expire, so it
|
|
||||||
// transitions to Expired (Window.Expire sets status unconditionally).
|
|
||||||
rec2 := httptest.NewRecorder()
|
|
||||||
req2 := httptest.NewRequest("POST", "/window/"+win.WindowID+"/expire", nil)
|
|
||||||
mux.ServeHTTP(rec2, req2)
|
|
||||||
if rec2.Code != http.StatusSeeOther {
|
|
||||||
t.Fatalf("POST expire: status %d, want 303", rec2.Code)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
package main
|
|
||||||
|
|
||||||
func main() {
|
|
||||||
runServer()
|
|
||||||
}
|
|
||||||
@@ -1,42 +0,0 @@
|
|||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"log"
|
|
||||||
"net/http"
|
|
||||||
"os"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/web/handlers"
|
|
||||||
"github.com/oy/openyield/web/store"
|
|
||||||
)
|
|
||||||
|
|
||||||
func runServer() {
|
|
||||||
port := os.Getenv("PORT")
|
|
||||||
if port == "" {
|
|
||||||
port = "8080"
|
|
||||||
}
|
|
||||||
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
|
|
||||||
srv, err := handlers.New(store.NewStore(), "web/templates")
|
|
||||||
if err != nil {
|
|
||||||
log.Fatalf("init handlers: %v", err)
|
|
||||||
}
|
|
||||||
srv.Register(mux)
|
|
||||||
|
|
||||||
// Home page (rendered via the handlers' page machinery too).
|
|
||||||
mux.HandleFunc("GET /", func(w http.ResponseWriter, r *http.Request) {
|
|
||||||
if r.URL.Path != "/" {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
srv.RenderHome(w, nil)
|
|
||||||
})
|
|
||||||
|
|
||||||
mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServer(http.Dir("web/static"))))
|
|
||||||
|
|
||||||
server := &http.Server{Addr: ":" + port, Handler: mux}
|
|
||||||
log.Printf("OpenYield web on :%s", port)
|
|
||||||
if err := server.ListenAndServe(); err != nil {
|
|
||||||
log.Fatalf("server: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Vendored
-5
File diff suppressed because one or more lines are too long
@@ -1,78 +0,0 @@
|
|||||||
/* style.css — OpenYield web UI minimal styling (lexicon-clean).
|
|
||||||
No banned terms in comments or class names (REQ-012/REQ-045). */
|
|
||||||
|
|
||||||
:root {
|
|
||||||
--bg: #0d1117;
|
|
||||||
--panel: #161b22;
|
|
||||||
--ink: #c9d1d9;
|
|
||||||
--muted: #8b949e;
|
|
||||||
--accent: #58a6ff;
|
|
||||||
--line: #30363d;
|
|
||||||
}
|
|
||||||
|
|
||||||
* { box-sizing: border-box; }
|
|
||||||
|
|
||||||
body {
|
|
||||||
margin: 0;
|
|
||||||
font-family: system-ui, -apple-system, sans-serif;
|
|
||||||
background: var(--bg);
|
|
||||||
color: var(--ink);
|
|
||||||
line-height: 1.5;
|
|
||||||
}
|
|
||||||
|
|
||||||
a { color: var(--accent); text-decoration: none; }
|
|
||||||
a:hover { text-decoration: underline; }
|
|
||||||
|
|
||||||
header.nav {
|
|
||||||
border-bottom: 1px solid var(--line);
|
|
||||||
padding: 0.75rem 1.5rem;
|
|
||||||
display: flex;
|
|
||||||
gap: 1.25rem;
|
|
||||||
align-items: center;
|
|
||||||
background: var(--panel);
|
|
||||||
}
|
|
||||||
header.nav .brand { font-weight: 600; color: var(--ink); }
|
|
||||||
header.nav a { color: var(--muted); }
|
|
||||||
header.nav a:hover { color: var(--accent); }
|
|
||||||
|
|
||||||
main { max-width: 960px; margin: 2rem auto; padding: 0 1.5rem; }
|
|
||||||
|
|
||||||
footer {
|
|
||||||
border-top: 1px solid var(--line);
|
|
||||||
padding: 1rem 1.5rem;
|
|
||||||
color: var(--muted);
|
|
||||||
font-size: 0.85rem;
|
|
||||||
text-align: center;
|
|
||||||
}
|
|
||||||
|
|
||||||
.panel {
|
|
||||||
background: var(--panel);
|
|
||||||
border: 1px solid var(--line);
|
|
||||||
border-radius: 6px;
|
|
||||||
padding: 1.25rem;
|
|
||||||
margin-bottom: 1.5rem;
|
|
||||||
}
|
|
||||||
|
|
||||||
table { width: 100%; border-collapse: collapse; }
|
|
||||||
th, td { text-align: left; padding: 0.5rem 0.75rem; border-bottom: 1px solid var(--line); }
|
|
||||||
th { color: var(--muted); font-weight: 600; font-size: 0.85rem; text-transform: uppercase; letter-spacing: 0.04em; }
|
|
||||||
|
|
||||||
form .field { margin-bottom: 1rem; }
|
|
||||||
form label { display: block; margin-bottom: 0.25rem; color: var(--muted); font-size: 0.9rem; }
|
|
||||||
form input[type=text], form input[type=password] {
|
|
||||||
width: 100%; max-width: 32rem;
|
|
||||||
padding: 0.5rem 0.65rem;
|
|
||||||
background: var(--bg);
|
|
||||||
border: 1px solid var(--line);
|
|
||||||
border-radius: 4px;
|
|
||||||
color: var(--ink);
|
|
||||||
font-family: monospace;
|
|
||||||
}
|
|
||||||
button, .btn {
|
|
||||||
background: var(--accent); color: #0d1117; border: none;
|
|
||||||
padding: 0.5rem 1rem; border-radius: 4px; font-weight: 600; cursor: pointer;
|
|
||||||
}
|
|
||||||
button:hover, .btn:hover { opacity: 0.9; text-decoration: none; }
|
|
||||||
|
|
||||||
.error { color: #f85149; }
|
|
||||||
.muted { color: var(--muted); }
|
|
||||||
@@ -1,137 +0,0 @@
|
|||||||
package store
|
|
||||||
|
|
||||||
import (
|
|
||||||
"time"
|
|
||||||
|
|
||||||
bloomtypes "github.com/oy/openyield/x/bloom/types"
|
|
||||||
identitytypes "github.com/oy/openyield/x/identity/types"
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// seed populates the store with a few pre-existing Reach/Stash pairs for the
|
|
||||||
// list view. All strings lexicon-clean ("Holder"/"Reach"/"Stash"; NOT the
|
|
||||||
// banned financial terms). Two fixtures: one mature (90+ active days),
|
|
||||||
// one immature (45 active days) so the Stash dashboard (P2) can show both
|
|
||||||
// states. P4 seeds Ratings/Vouches so the Standing screen can show a
|
|
||||||
// Freeholder-eligible Reach (holder-alia) vs a non-eligible one (holder-bryn).
|
|
||||||
func (s *Store) seed() {
|
|
||||||
now := time.Now().Unix()
|
|
||||||
seedOne(s, "holder-alia", "pk-alia-001", now, 920000, 92, 10)
|
|
||||||
seedOne(s, "holder-bryn", "pk-bryn-002", now, 410000, 45, 5)
|
|
||||||
seedStanding(s, now)
|
|
||||||
seedBloom(s, now)
|
|
||||||
}
|
|
||||||
|
|
||||||
// seedBloom seeds mock BloomRecords per Stash (P5). holder-alia gets a record
|
|
||||||
// at the target rate (450 bps = 4.5%); holder-bryn gets a record at 420 bps
|
|
||||||
// (4.2%, within the 4.0%-5.0% band). AccruedGrain is a mock value.
|
|
||||||
func seedBloom(s *Store, now int64) {
|
|
||||||
s.bloomRecords["stash-holder-alia"] = bloomtypes.BloomRecord{
|
|
||||||
StashID: "stash-holder-alia",
|
|
||||||
AccruedGrain: 45000,
|
|
||||||
LastAccrualBlock: 1000,
|
|
||||||
RateBasisPoints: bloomtypes.TargetBloomRateBasisPoints, // 450 (4.5%, D-073 code constant)
|
|
||||||
}
|
|
||||||
s.bloomRecords["stash-holder-bryn"] = bloomtypes.BloomRecord{
|
|
||||||
StashID: "stash-holder-bryn",
|
|
||||||
AccruedGrain: 18000,
|
|
||||||
LastAccrualBlock: 1000,
|
|
||||||
RateBasisPoints: 420, // 4.2% (within the 400-500 band)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// seedStanding seeds mock Ratings + Vouches. holder-alia gets 12 ratings
|
|
||||||
// across 4 categories at 4.6-4.9 (Freeholder-eligible: score >= 4.5 in >= 3
|
|
||||||
// cats) + 1 Vouch (CommunityEndorsement). holder-bryn gets 3 ratings in 1
|
|
||||||
// category (not eligible: < 3 categories, no Vouch).
|
|
||||||
func seedStanding(s *Store, now int64) {
|
|
||||||
// holder-alia: 12 ratings, 4 categories, scores 4.6-4.9.
|
|
||||||
aliaCats := []string{"care", "sim", "vault", "mail"}
|
|
||||||
for i := 0; i < 12; i++ {
|
|
||||||
cat := aliaCats[i%4]
|
|
||||||
score := 4.6 + float64(i%4)*0.1 // 4.6, 4.7, 4.8, 4.9 repeating
|
|
||||||
s.ratings["holder-alia"] = append(s.ratings["holder-alia"], standingtypes.Rating{
|
|
||||||
RaterID: "rater-" + itoa(i),
|
|
||||||
RateeID: "holder-alia",
|
|
||||||
Category: cat,
|
|
||||||
Score: score,
|
|
||||||
Weight: 1.0,
|
|
||||||
TxRef: "tx-r-" + itoa(i),
|
|
||||||
Timestamp: now - int64(i)*86400,
|
|
||||||
DecayBucket: 0, // 6mo bucket (1.0)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
// 1 Vouch for holder-alia (CommunityEndorsement signal).
|
|
||||||
s.vouches["holder-alia"] = []standingtypes.Vouch{{
|
|
||||||
VoucherID: "voucher-freeholder-1",
|
|
||||||
VoucheeID: "holder-alia",
|
|
||||||
Category: "care",
|
|
||||||
BondAmount: 100000,
|
|
||||||
Timestamp: now,
|
|
||||||
}}
|
|
||||||
|
|
||||||
// holder-bryn: 3 ratings, 1 category, scores 4.0-4.2 (not eligible: < 3 cats).
|
|
||||||
for i := 0; i < 3; i++ {
|
|
||||||
s.ratings["holder-bryn"] = append(s.ratings["holder-bryn"], standingtypes.Rating{
|
|
||||||
RaterID: "rater-b-" + itoa(i),
|
|
||||||
RateeID: "holder-bryn",
|
|
||||||
Category: "care",
|
|
||||||
Score: 4.0 + float64(i)*0.1,
|
|
||||||
Weight: 1.0,
|
|
||||||
TxRef: "tx-b-" + itoa(i),
|
|
||||||
Timestamp: now - int64(i)*86400,
|
|
||||||
DecayBucket: 0,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
// No Vouches for holder-bryn (CommunityEndorsement signal false).
|
|
||||||
}
|
|
||||||
|
|
||||||
func seedOne(s *Store, holderID, pubKey string, now int64, balanceGrain int64, activeDays, maxGap uint32) {
|
|
||||||
reachID := "reach-" + holderID
|
|
||||||
stashID := "stash-" + holderID
|
|
||||||
s.reaches[holderID] = identitytypes.Reach{
|
|
||||||
ReachID: reachID,
|
|
||||||
HolderID: holderID,
|
|
||||||
CreatedAt: now - int64(activeDays)*86400,
|
|
||||||
PublicKey: pubKey,
|
|
||||||
IsNomad: true,
|
|
||||||
}
|
|
||||||
s.stashes[holderID] = stashtypes.Stash{
|
|
||||||
HolderID: holderID,
|
|
||||||
StashID: stashID,
|
|
||||||
CreatedAt: now - int64(activeDays)*86400,
|
|
||||||
LastActive: now,
|
|
||||||
BalanceGrain: balanceGrain,
|
|
||||||
}
|
|
||||||
s.stashActivities[stashID] = stashtypes.StashActivity{
|
|
||||||
StashID: stashID,
|
|
||||||
ActiveDays: activeDays,
|
|
||||||
MaxGapDays: maxGap,
|
|
||||||
LastActivityDay: now,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// itoa is a tiny int->string helper to avoid importing strconv (keeps the
|
|
||||||
// fixtures file import-light; the mock data uses small integers only).
|
|
||||||
func itoa(n int) string {
|
|
||||||
if n == 0 {
|
|
||||||
return "0"
|
|
||||||
}
|
|
||||||
neg := n < 0
|
|
||||||
if neg {
|
|
||||||
n = -n
|
|
||||||
}
|
|
||||||
var buf [12]byte
|
|
||||||
i := len(buf)
|
|
||||||
for n > 0 {
|
|
||||||
i--
|
|
||||||
buf[i] = byte('0' + n%10)
|
|
||||||
n /= 10
|
|
||||||
}
|
|
||||||
if neg {
|
|
||||||
i--
|
|
||||||
buf[i] = '-'
|
|
||||||
}
|
|
||||||
return string(buf[i:])
|
|
||||||
}
|
|
||||||
@@ -1,108 +0,0 @@
|
|||||||
// import_test.go enforces the G-003/G-025 boundary for web/: web/ is the
|
|
||||||
// application layer that consumes protocol types (D-070), NOT a cross-x/
|
|
||||||
// production import. The invariant: every non-test .go file under web/ may
|
|
||||||
// import github.com/oy/openyield/x/<module>/types packages (the app-layer
|
|
||||||
// consumption direction), but MUST NOT import github.com/oy/openyield/
|
|
||||||
// x/<module>/keeper OR github.com/oy/openyield/x/<module> (the module.go
|
|
||||||
// packages — G-025 extends the original keeper-only check to also forbid
|
|
||||||
// module.go, since those packages carry Cosmos runtime machinery the mock UI
|
|
||||||
// must not reach into). This test uses go/parser (stdlib only — G-006) and
|
|
||||||
// mirrors the x/window/types/types_test.go G-003 pattern, but with the
|
|
||||||
// inverted rule: x/*/types is ALLOWED (app-layer consumption), x/*/keeper
|
|
||||||
// and x/<module> (module.go) are FORBIDDEN.
|
|
||||||
package store
|
|
||||||
|
|
||||||
import (
|
|
||||||
"go/parser"
|
|
||||||
"go/token"
|
|
||||||
"os"
|
|
||||||
"path/filepath"
|
|
||||||
"runtime"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestG025WebImportsOnlyTypesNotKeeperOrModule(t *testing.T) {
|
|
||||||
webRoot := webRoot(t)
|
|
||||||
fset := token.NewFileSet()
|
|
||||||
violations := []string{}
|
|
||||||
err := filepath.Walk(webRoot, func(path string, info os.FileInfo, err error) error {
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if info.IsDir() {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
if !strings.HasSuffix(path, ".go") {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
// Skip test files (G-025 is about production code only).
|
|
||||||
if strings.HasSuffix(path, "_test.go") {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
f, perr := parser.ParseFile(fset, path, nil, parser.ImportsOnly)
|
|
||||||
if perr != nil {
|
|
||||||
return perr
|
|
||||||
}
|
|
||||||
for _, imp := range f.Imports {
|
|
||||||
ip := strings.Trim(imp.Path.Value, `"`)
|
|
||||||
if isForbiddenXImport(ip) {
|
|
||||||
rel, _ := filepath.Rel(webRoot, path)
|
|
||||||
violations = append(violations, rel+" -> "+ip)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
})
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("walk web/: %v", err)
|
|
||||||
}
|
|
||||||
if len(violations) > 0 {
|
|
||||||
t.Errorf("G-025 violation: web/ production files importing forbidden x/ packages:\n %s",
|
|
||||||
strings.Join(violations, "\n "))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// isForbiddenXImport reports whether ip is an x/<module>/keeper or a bare
|
|
||||||
// x/<module> (module.go) import — both forbidden from web/ (G-025). The
|
|
||||||
// x/<module>/types packages are ALLOWED (D-070 app-layer consumption).
|
|
||||||
func isForbiddenXImport(ip string) bool {
|
|
||||||
const prefix = "github.com/oy/openyield/x/"
|
|
||||||
if !strings.HasPrefix(ip, prefix) {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
rest := strings.TrimPrefix(ip, prefix)
|
|
||||||
parts := strings.Split(rest, "/")
|
|
||||||
switch len(parts) {
|
|
||||||
case 1:
|
|
||||||
// x/<module> (module.go package) — forbidden (G-025).
|
|
||||||
return true
|
|
||||||
case 2:
|
|
||||||
// x/<module>/types -> allowed (D-070). x/<module>/keeper -> forbidden.
|
|
||||||
if parts[1] == "types" {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
return true
|
|
||||||
default:
|
|
||||||
// x/<module>/<sub>/... — forbid anything other than types (e.g.
|
|
||||||
// x/<module>/keeper/... sub-packages).
|
|
||||||
if parts[1] == "types" {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// webRoot returns the absolute path to the web/ directory by walking up
|
|
||||||
// from this test file (web/store/import_test.go -> repoRoot/web).
|
|
||||||
func webRoot(t *testing.T) string {
|
|
||||||
t.Helper()
|
|
||||||
_, file, _, ok := runtime.Caller(0)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("runtime.Caller failed")
|
|
||||||
}
|
|
||||||
// file = .../oy/web/store/import_test.go
|
|
||||||
// repoRoot = filepath.Dir(filepath.Dir(filepath.Dir(file)))
|
|
||||||
// webRoot = repoRoot/web
|
|
||||||
repoRoot := filepath.Dir(filepath.Dir(filepath.Dir(file)))
|
|
||||||
return filepath.Join(repoRoot, "web")
|
|
||||||
}
|
|
||||||
@@ -1,428 +0,0 @@
|
|||||||
// Package store is the in-memory mock data layer for the OpenYield web UI.
|
|
||||||
//
|
|
||||||
// It instantiates the real x/*/types structs (Reach, Stash, StashActivity)
|
|
||||||
// from in-memory fixtures and provides create/get/list methods. This is the
|
|
||||||
// app-layer consumption of protocol types (D-070), NOT a cross-x/ production
|
|
||||||
// import — web/ is NOT an x/ module. No keeper, no Cosmos runtime, no app.go
|
|
||||||
// (G-003 boundary enforced by import_test.go / G-025).
|
|
||||||
package store
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
"strings"
|
|
||||||
"sync"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
bloomtypes "github.com/oy/openyield/x/bloom/types"
|
|
||||||
identitytypes "github.com/oy/openyield/x/identity/types"
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
windowtypes "github.com/oy/openyield/x/window/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// seedBalanceGrain is the test balance seeded to a new Stash at signup (D-071
|
|
||||||
// example: 500000 Grain = 50 Bread per GrainsPerBread=10000).
|
|
||||||
const seedBalanceGrain int64 = 500000
|
|
||||||
|
|
||||||
// Store is the in-memory mock store. All methods are goroutine-safe (mu).
|
|
||||||
type Store struct {
|
|
||||||
mu sync.Mutex
|
|
||||||
reaches map[string]identitytypes.Reach
|
|
||||||
stashes map[string]stashtypes.Stash
|
|
||||||
stashActivities map[string]stashtypes.StashActivity
|
|
||||||
windows map[string]windowtypes.Window
|
|
||||||
auditLogs map[string][]windowtypes.AuditEntry
|
|
||||||
ratings map[string][]standingtypes.Rating
|
|
||||||
vouches map[string][]standingtypes.Vouch
|
|
||||||
slashes map[string][]standingtypes.Slash
|
|
||||||
bloomRecords map[string]bloomtypes.BloomRecord
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewStore constructs a Store seeded from fixtures (fixtures.go).
|
|
||||||
func NewStore() *Store {
|
|
||||||
s := &Store{
|
|
||||||
reaches: map[string]identitytypes.Reach{},
|
|
||||||
stashes: map[string]stashtypes.Stash{},
|
|
||||||
stashActivities: map[string]stashtypes.StashActivity{},
|
|
||||||
windows: map[string]windowtypes.Window{},
|
|
||||||
auditLogs: map[string][]windowtypes.AuditEntry{},
|
|
||||||
ratings: map[string][]standingtypes.Rating{},
|
|
||||||
vouches: map[string][]standingtypes.Vouch{},
|
|
||||||
slashes: map[string][]standingtypes.Slash{},
|
|
||||||
bloomRecords: map[string]bloomtypes.BloomRecord{},
|
|
||||||
}
|
|
||||||
s.seed()
|
|
||||||
return s
|
|
||||||
}
|
|
||||||
|
|
||||||
// CreateReach atomically creates a Reach (IsNomad=true) + a Stash (D-071).
|
|
||||||
// G-027: HolderID and PublicKey are validated (non-empty, <=128 bytes, no
|
|
||||||
// path separators, no template syntax) before any map write. Returns the
|
|
||||||
// created Reach + Stash.
|
|
||||||
func (s *Store) CreateReach(holderID, publicKey string) (identitytypes.Reach, stashtypes.Stash, error) {
|
|
||||||
if err := validateReachInput(holderID, publicKey); err != nil {
|
|
||||||
return identitytypes.Reach{}, stashtypes.Stash{}, err
|
|
||||||
}
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
if _, dup := s.reaches[holderID]; dup {
|
|
||||||
return identitytypes.Reach{}, stashtypes.Stash{}, fmt.Errorf("holder %q already has a Reach", holderID)
|
|
||||||
}
|
|
||||||
now := time.Now().Unix()
|
|
||||||
reachID := "reach-" + holderID
|
|
||||||
stashID := "stash-" + holderID
|
|
||||||
reach := identitytypes.Reach{
|
|
||||||
ReachID: reachID,
|
|
||||||
HolderID: holderID,
|
|
||||||
CreatedAt: now,
|
|
||||||
PublicKey: publicKey,
|
|
||||||
IsNomad: true,
|
|
||||||
}
|
|
||||||
stash := stashtypes.Stash{
|
|
||||||
HolderID: holderID,
|
|
||||||
StashID: stashID,
|
|
||||||
CreatedAt: now,
|
|
||||||
LastActive: now,
|
|
||||||
BalanceGrain: seedBalanceGrain,
|
|
||||||
}
|
|
||||||
activity := stashtypes.StashActivity{
|
|
||||||
StashID: stashID,
|
|
||||||
ActiveDays: 1,
|
|
||||||
MaxGapDays: 1,
|
|
||||||
LastActivityDay: now,
|
|
||||||
}
|
|
||||||
s.reaches[holderID] = reach
|
|
||||||
s.stashes[holderID] = stash
|
|
||||||
s.stashActivities[stashID] = activity
|
|
||||||
return reach, stash, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListReaches returns all seeded + created Reaches.
|
|
||||||
func (s *Store) ListReaches() []identitytypes.Reach {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
out := make([]identitytypes.Reach, 0, len(s.reaches))
|
|
||||||
for _, r := range s.reaches {
|
|
||||||
out = append(out, r)
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetReach returns the Reach for a holderID (by HolderID, the stable key).
|
|
||||||
func (s *Store) GetReach(holderID string) (identitytypes.Reach, bool) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
r, ok := s.reaches[holderID]
|
|
||||||
return r, ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetStash returns the Stash for a holderID.
|
|
||||||
func (s *Store) GetStash(holderID string) (stashtypes.Stash, bool) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
st, ok := s.stashes[holderID]
|
|
||||||
return st, ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetStashActivity returns the StashActivity for a stashID.
|
|
||||||
func (s *Store) GetStashActivity(stashID string) (stashtypes.StashActivity, bool) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
a, ok := s.stashActivities[stashID]
|
|
||||||
return a, ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// OpenWindow creates a new Window in the Open status (REQ-042) with an initial
|
|
||||||
// AuditEntry. Returns the created Window. The Window is keyed by a generated
|
|
||||||
// windowID derived from the grantor + a counter (mock; not cryptographic).
|
|
||||||
func (s *Store) OpenWindow(grantorHolder, grantee string, scope windowtypes.Scope, start, end int64, rateLimit windowtypes.RateLimit) (windowtypes.Window, error) {
|
|
||||||
if grantorHolder == "" {
|
|
||||||
return windowtypes.Window{}, fmt.Errorf("grantor holder is required")
|
|
||||||
}
|
|
||||||
if grantee == "" {
|
|
||||||
return windowtypes.Window{}, fmt.Errorf("grantee is required")
|
|
||||||
}
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
windowID := fmt.Sprintf("window-%s-%d", grantorHolder, len(s.windows)+1)
|
|
||||||
now := time.Now().Unix()
|
|
||||||
w := windowtypes.Window{
|
|
||||||
WindowID: windowID,
|
|
||||||
GrantorHolder: grantorHolder,
|
|
||||||
Grantee: grantee,
|
|
||||||
Scope: scope,
|
|
||||||
Start: start,
|
|
||||||
End: end,
|
|
||||||
RateLimit: rateLimit,
|
|
||||||
Status: windowtypes.StatusOpen,
|
|
||||||
}
|
|
||||||
s.windows[windowID] = w
|
|
||||||
entry := windowtypes.AuditEntry{
|
|
||||||
EntryID: windowID + "-audit-1",
|
|
||||||
Timestamp: now,
|
|
||||||
Action: "open",
|
|
||||||
Result: "created",
|
|
||||||
GranterRef: grantorHolder,
|
|
||||||
}
|
|
||||||
s.auditLogs[windowID] = []windowtypes.AuditEntry{entry}
|
|
||||||
w.AuditLogRefs = []string{entry.EntryID}
|
|
||||||
s.windows[windowID] = w
|
|
||||||
return w, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ActivateWindow transitions a Window from Open to Active by calling the real
|
|
||||||
// x/window/types.Window.Activate() method (not a reimplementation). Appends an
|
|
||||||
// AuditEntry. Returns an error if the Window is not in the Open status.
|
|
||||||
func (s *Store) ActivateWindow(windowID string) error {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
w, ok := s.windows[windowID]
|
|
||||||
if !ok {
|
|
||||||
return fmt.Errorf("window %q not found", windowID)
|
|
||||||
}
|
|
||||||
if err := w.Activate(); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
s.windows[windowID] = w
|
|
||||||
s.appendAuditLocked(windowID, "activate", "active", w.GrantorHolder)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// RevokeWindow transitions a Window to Revoked by calling the real
|
|
||||||
// x/window/types.Window.Revoke() method. Idempotent on already-revoked;
|
|
||||||
// no-op on Expired (terminal state wins — v0.2 type contract). Appends an
|
|
||||||
// AuditEntry only if the status actually changed.
|
|
||||||
func (s *Store) RevokeWindow(windowID string) error {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
w, ok := s.windows[windowID]
|
|
||||||
if !ok {
|
|
||||||
return fmt.Errorf("window %q not found", windowID)
|
|
||||||
}
|
|
||||||
prevStatus := w.Status
|
|
||||||
if err := w.Revoke(); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
s.windows[windowID] = w
|
|
||||||
if w.Status != prevStatus {
|
|
||||||
s.appendAuditLocked(windowID, "revoke", "revoked", w.GrantorHolder)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ExpireWindow transitions a Window to Expired by calling the real
|
|
||||||
// x/window/types.Window.Expire() method. Appends an AuditEntry.
|
|
||||||
func (s *Store) ExpireWindow(windowID string) error {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
w, ok := s.windows[windowID]
|
|
||||||
if !ok {
|
|
||||||
return fmt.Errorf("window %q not found", windowID)
|
|
||||||
}
|
|
||||||
prevStatus := w.Status
|
|
||||||
w.Expire()
|
|
||||||
s.windows[windowID] = w
|
|
||||||
if w.Status != prevStatus {
|
|
||||||
s.appendAuditLocked(windowID, "expire", "expired", w.GrantorHolder)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListWindows returns all Windows for a grantor holder.
|
|
||||||
func (s *Store) ListWindows(grantorHolder string) []windowtypes.Window {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
out := []windowtypes.Window{}
|
|
||||||
for _, w := range s.windows {
|
|
||||||
if w.GrantorHolder == grantorHolder {
|
|
||||||
out = append(out, w)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetWindow returns the Window for a windowID.
|
|
||||||
func (s *Store) GetWindow(windowID string) (windowtypes.Window, bool) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
w, ok := s.windows[windowID]
|
|
||||||
return w, ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetAuditLog returns the audit-log entries for a windowID.
|
|
||||||
func (s *Store) GetAuditLog(windowID string) []windowtypes.AuditEntry {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
return s.auditLogs[windowID]
|
|
||||||
}
|
|
||||||
|
|
||||||
// appendAuditLocked appends an AuditEntry to the window's audit log. Caller
|
|
||||||
// MUST hold s.mu.
|
|
||||||
func (s *Store) appendAuditLocked(windowID, action, result, granterRef string) {
|
|
||||||
logs := s.auditLogs[windowID]
|
|
||||||
now := time.Now().Unix()
|
|
||||||
entry := windowtypes.AuditEntry{
|
|
||||||
EntryID: fmt.Sprintf("%s-audit-%d", windowID, len(logs)+1),
|
|
||||||
Timestamp: now,
|
|
||||||
Action: action,
|
|
||||||
Result: result,
|
|
||||||
GranterRef: granterRef,
|
|
||||||
}
|
|
||||||
s.auditLogs[windowID] = append(logs, entry)
|
|
||||||
w := s.windows[windowID]
|
|
||||||
w.AuditLogRefs = append(w.AuditLogRefs, entry.EntryID)
|
|
||||||
s.windows[windowID] = w
|
|
||||||
}
|
|
||||||
|
|
||||||
// validateReachInput enforces G-027: HolderID and PublicKey must be non-empty,
|
|
||||||
// <=128 bytes, and contain no path separators or template syntax. This is a
|
|
||||||
// prototype-robustness gate (the mock store uses holderID as a map key).
|
|
||||||
func validateReachInput(holderID, publicKey string) error {
|
|
||||||
if holderID == "" {
|
|
||||||
return fmt.Errorf("holder id is required")
|
|
||||||
}
|
|
||||||
if len(holderID) > 128 {
|
|
||||||
return fmt.Errorf("holder id too long (max 128)")
|
|
||||||
}
|
|
||||||
if strings.ContainsAny(holderID, "/\\") {
|
|
||||||
return fmt.Errorf("holder id must not contain path separators")
|
|
||||||
}
|
|
||||||
if strings.Contains(holderID, "{{") {
|
|
||||||
return fmt.Errorf("holder id must not contain template syntax")
|
|
||||||
}
|
|
||||||
if publicKey == "" {
|
|
||||||
return fmt.Errorf("public key is required")
|
|
||||||
}
|
|
||||||
if len(publicKey) > 128 {
|
|
||||||
return fmt.Errorf("public key too long (max 128)")
|
|
||||||
}
|
|
||||||
if strings.ContainsAny(publicKey, "/\\") {
|
|
||||||
return fmt.Errorf("public key must not contain path separators")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Standing + Freeholder signals (P4) ---
|
|
||||||
|
|
||||||
// ListRatings returns all Ratings for a ratee (per-Reach).
|
|
||||||
func (s *Store) ListRatings(rateeID string) []standingtypes.Rating {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
return s.ratings[rateeID]
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListVouches returns all Vouches for a vouchee.
|
|
||||||
func (s *Store) ListVouches(voucheeID string) []standingtypes.Vouch {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
return s.vouches[voucheeID]
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListSlashes returns all Slashes for a Reach.
|
|
||||||
func (s *Store) ListSlashes(reachID string) []standingtypes.Slash {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
return s.slashes[reachID]
|
|
||||||
}
|
|
||||||
|
|
||||||
// ComputeStandingScore computes a simplified standing score from the mock
|
|
||||||
// Ratings using the locked x/standing/types constants (PriorMean, PriorWeight,
|
|
||||||
// ComputeDiversityBonus, GetVoucherWeight, GetStandingBucket). This is a
|
|
||||||
// SIMPLIFIED computation (not the full Bayesian formula — sub-tables deferred
|
|
||||||
// per PROJECT.md Q2); the test asserts it uses the locked constants, not that
|
|
||||||
// it matches a full oracle.
|
|
||||||
func (s *Store) ComputeStandingScore(reachID string) (float64, standingtypes.StandingBucket) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
ratings := s.ratings[reachID]
|
|
||||||
slashes := s.slashes[reachID]
|
|
||||||
isSlashed := len(slashes) > 0
|
|
||||||
|
|
||||||
if len(ratings) == 0 {
|
|
||||||
// No ratings: return the prior mean, bucket New.
|
|
||||||
return standingtypes.PriorMean, standingtypes.GetStandingBucket(standingtypes.PriorMean, 0, isSlashed)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Simplified: weighted average of rating scores using GetVoucherWeight.
|
|
||||||
// The real formula uses the rater's standing to derive the weight; the
|
|
||||||
// mock uses the ratee's own score iteratively (simplified — P4 does not
|
|
||||||
// build a full rater-graph). Uses the locked PriorMean + PriorWeight as a
|
|
||||||
// Bayesian shrinkage: score = (prior*weight + sum(scores)) / (weight + n).
|
|
||||||
sum := 0.0
|
|
||||||
categories := map[string]bool{}
|
|
||||||
for _, r := range ratings {
|
|
||||||
w := standingtypes.GetVoucherWeight(false, r.Score, len(ratings))
|
|
||||||
sum += r.Score * w
|
|
||||||
categories[r.Category] = true
|
|
||||||
}
|
|
||||||
n := float64(len(ratings))
|
|
||||||
raw := (standingtypes.PriorMean*float64(standingtypes.PriorWeight) + sum) /
|
|
||||||
(float64(standingtypes.PriorWeight) + n)
|
|
||||||
// Apply diversity bonus (locked const).
|
|
||||||
raw += standingtypes.ComputeDiversityBonus(len(categories))
|
|
||||||
bucket := standingtypes.GetStandingBucket(raw, len(ratings), isSlashed)
|
|
||||||
return raw, bucket
|
|
||||||
}
|
|
||||||
|
|
||||||
// ComputeFreeholderSignals computes the four Freeholder signals (§9.1) from
|
|
||||||
// the mock data. StashMaturity from StashActivity.IsMature(); MultiDomainStanding
|
|
||||||
// from score >= FreeholderMinStandingScore in >= FreeholderMinCategories;
|
|
||||||
// CommittedCapital from Stash balance >= a threshold (mock); CommunityEndorsement
|
|
||||||
// from >= 1 Vouch. Returns the real standingtypes.FreeholderSignals struct.
|
|
||||||
func (s *Store) ComputeFreeholderSignals(reachID string) standingtypes.FreeholderSignals {
|
|
||||||
s.mu.Lock()
|
|
||||||
stash, hasStash := s.stashes[reachID]
|
|
||||||
ratings := s.ratings[reachID]
|
|
||||||
vouches := s.vouches[reachID]
|
|
||||||
s.mu.Unlock()
|
|
||||||
|
|
||||||
var signals standingtypes.FreeholderSignals
|
|
||||||
// StashMaturity: from StashActivity.IsMature() (the real method).
|
|
||||||
if hasStash {
|
|
||||||
if activity, ok := s.GetStashActivity(stash.StashID); ok {
|
|
||||||
signals.StashMaturity = activity.IsMature()
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// MultiDomainStanding: score >= 4.5 in >= 3 categories.
|
|
||||||
score, _ := s.ComputeStandingScore(reachID)
|
|
||||||
categories := map[string]bool{}
|
|
||||||
for _, r := range ratings {
|
|
||||||
categories[r.Category] = true
|
|
||||||
}
|
|
||||||
if score >= standingtypes.FreeholderMinStandingScore && len(categories) >= standingtypes.FreeholderMinCategories {
|
|
||||||
signals.MultiDomainStanding = true
|
|
||||||
}
|
|
||||||
// CommittedCapital: mock threshold — Stash balance >= 100000 Grain (10 Bread).
|
|
||||||
if hasStash && stash.BalanceGrain >= 100000 {
|
|
||||||
signals.CommittedCapital = true
|
|
||||||
}
|
|
||||||
// CommunityEndorsement: >= 1 Vouch.
|
|
||||||
if len(vouches) >= 1 {
|
|
||||||
signals.CommunityEndorsement = true
|
|
||||||
}
|
|
||||||
return signals
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Bloom accrual (P5) ---
|
|
||||||
|
|
||||||
// GetBloomRecord returns the BloomRecord for a stashID (REQ-044).
|
|
||||||
func (s *Store) GetBloomRecord(stashID string) (bloomtypes.BloomRecord, bool) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
r, ok := s.bloomRecords[stashID]
|
|
||||||
return r, ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListBloomRecords returns BloomRecords for all Stashes owned by a holder.
|
|
||||||
func (s *Store) ListBloomRecords(holderID string) []bloomtypes.BloomRecord {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
out := []bloomtypes.BloomRecord{}
|
|
||||||
for stashID, rec := range s.bloomRecords {
|
|
||||||
// Match by the holder prefix "stash-<holderID>".
|
|
||||||
if strings.HasPrefix(stashID, "stash-"+holderID) {
|
|
||||||
out = append(out, rec)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
@@ -1,576 +0,0 @@
|
|||||||
package store
|
|
||||||
|
|
||||||
import (
|
|
||||||
"sync"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
bloomtypes "github.com/oy/openyield/x/bloom/types"
|
|
||||||
identitytypes "github.com/oy/openyield/x/identity/types"
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
windowtypes "github.com/oy/openyield/x/window/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestNewStoreSeedsFixtures(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
reaches := s.ListReaches()
|
|
||||||
if len(reaches) < 2 {
|
|
||||||
t.Fatalf("NewStore seeded %d reaches, want >=2", len(reaches))
|
|
||||||
}
|
|
||||||
// Both seeded reaches must be Nomads (IsNomad=true).
|
|
||||||
for _, r := range reaches {
|
|
||||||
if !r.IsNomad {
|
|
||||||
t.Errorf("seeded reach %q: IsNomad=false, want true", r.HolderID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCreateReachAtomicReachAndStash(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
reach, stash, err := s.CreateReach("holder-test1", "pk-test1")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("CreateReach: %v", err)
|
|
||||||
}
|
|
||||||
// D-071: Reach must be IsNomad=true.
|
|
||||||
if !reach.IsNomad {
|
|
||||||
t.Errorf("reach.IsNomad = false, want true (D-071)")
|
|
||||||
}
|
|
||||||
if reach.HolderID != "holder-test1" {
|
|
||||||
t.Errorf("reach.HolderID = %q, want holder-test1", reach.HolderID)
|
|
||||||
}
|
|
||||||
// D-071: Stash must have matching HolderID + seeded BalanceGrain.
|
|
||||||
if stash.HolderID != reach.HolderID {
|
|
||||||
t.Errorf("stash.HolderID = %q, want %q (D-071 atomic)", stash.HolderID, reach.HolderID)
|
|
||||||
}
|
|
||||||
if stash.BalanceGrain != seedBalanceGrain {
|
|
||||||
t.Errorf("stash.BalanceGrain = %d, want %d", stash.BalanceGrain, seedBalanceGrain)
|
|
||||||
}
|
|
||||||
// Both must be retrievable after the atomic call.
|
|
||||||
if _, ok := s.GetReach("holder-test1"); !ok {
|
|
||||||
t.Errorf("GetReach miss after CreateReach (atomicity broken)")
|
|
||||||
}
|
|
||||||
if _, ok := s.GetStash("holder-test1"); !ok {
|
|
||||||
t.Errorf("GetStash miss after CreateReach (atomicity broken)")
|
|
||||||
}
|
|
||||||
if _, ok := s.GetStashActivity(stash.StashID); !ok {
|
|
||||||
t.Errorf("GetStashActivity miss after CreateReach (atomicity broken)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCreateReachDuplicateRejected(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if _, _, err := s.CreateReach("holder-alia", "pk-dupe"); err == nil {
|
|
||||||
t.Errorf("CreateReach duplicate holder-alia: expected error, got nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCreateReachValidationG027(t *testing.T) {
|
|
||||||
cases := []struct {
|
|
||||||
name string
|
|
||||||
holderID string
|
|
||||||
publicKey string
|
|
||||||
wantErr bool
|
|
||||||
}{
|
|
||||||
{"empty holder", "", "pk", true},
|
|
||||||
{"empty pubkey", "h", "", true},
|
|
||||||
{"holder too long", stringOf('x', 129), "pk", true},
|
|
||||||
{"pubkey too long", "h", stringOf('y', 129), true},
|
|
||||||
{"holder with slash", "h/x", "pk", true},
|
|
||||||
{"holder with backslash", "h\\x", "pk", true},
|
|
||||||
{"holder with template syntax", "h{{", "pk", true},
|
|
||||||
{"pubkey with slash", "h", "p/x", true},
|
|
||||||
{"valid minimal", "h", "p", false},
|
|
||||||
{"valid typical", "holder-oka", "pk-oka-7", false},
|
|
||||||
}
|
|
||||||
for _, c := range cases {
|
|
||||||
t.Run(c.name, func(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
_, _, err := s.CreateReach(c.holderID, c.publicKey)
|
|
||||||
if c.wantErr && err == nil {
|
|
||||||
t.Errorf("expected error, got nil")
|
|
||||||
}
|
|
||||||
if !c.wantErr && err != nil {
|
|
||||||
t.Errorf("unexpected error: %v", err)
|
|
||||||
}
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetReachHitMiss(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if _, ok := s.GetReach("holder-alia"); !ok {
|
|
||||||
t.Errorf("GetReach(holder-alia) miss, want hit (seeded)")
|
|
||||||
}
|
|
||||||
if _, ok := s.GetReach("nobody"); ok {
|
|
||||||
t.Errorf("GetReach(nobody) hit, want miss")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetStashHitMiss(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if _, ok := s.GetStash("holder-alia"); !ok {
|
|
||||||
t.Errorf("GetStash(holder-alia) miss, want hit (seeded)")
|
|
||||||
}
|
|
||||||
if _, ok := s.GetStash("nobody"); ok {
|
|
||||||
t.Errorf("GetStash(nobody) hit, want miss")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetStashActivityHitMiss(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
stash, ok := s.GetStash("holder-alia")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded stash holder-alia missing")
|
|
||||||
}
|
|
||||||
if _, ok := s.GetStashActivity(stash.StashID); !ok {
|
|
||||||
t.Errorf("GetStashActivity(%q) miss, want hit", stash.StashID)
|
|
||||||
}
|
|
||||||
if _, ok := s.GetStashActivity("stash-nobody"); ok {
|
|
||||||
t.Errorf("GetStashActivity(stash-nobody) hit, want miss")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCreateReachConcurrentNoRace(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
const n = 50
|
|
||||||
var wg sync.WaitGroup
|
|
||||||
wg.Add(n)
|
|
||||||
for i := 0; i < n; i++ {
|
|
||||||
go func(i int) {
|
|
||||||
defer wg.Done()
|
|
||||||
holder := "holder-concurrent-" + itoa(i)
|
|
||||||
_, _, _ = s.CreateReach(holder, "pk")
|
|
||||||
}(i)
|
|
||||||
}
|
|
||||||
wg.Wait()
|
|
||||||
// All n concurrent creates with distinct holder IDs must be present.
|
|
||||||
for i := 0; i < n; i++ {
|
|
||||||
if _, ok := s.GetReach("holder-concurrent-" + itoa(i)); !ok {
|
|
||||||
t.Errorf("concurrent reach %d missing after wg.Wait", i)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestSeededMatureVsImmature(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
// holder-alia: ActiveDays=92, MaxGapDays=10 -> mature.
|
|
||||||
aliaStash, ok := s.GetStash("holder-alia")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded holder-alia missing")
|
|
||||||
}
|
|
||||||
aliaAct, ok := s.GetStashActivity(aliaStash.StashID)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded alia activity missing")
|
|
||||||
}
|
|
||||||
if !aliaAct.IsMature() {
|
|
||||||
t.Errorf("holder-alia IsMature=false, want true (ActiveDays=%d, MaxGap=%d)",
|
|
||||||
aliaAct.ActiveDays, aliaAct.MaxGapDays)
|
|
||||||
}
|
|
||||||
// holder-bryn: ActiveDays=45, MaxGapDays=5 -> not mature.
|
|
||||||
brynStash, ok := s.GetStash("holder-bryn")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded holder-bryn missing")
|
|
||||||
}
|
|
||||||
brynAct, ok := s.GetStashActivity(brynStash.StashID)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded bryn activity missing")
|
|
||||||
}
|
|
||||||
if brynAct.IsMature() {
|
|
||||||
t.Errorf("holder-bryn IsMature=true, want false (ActiveDays=%d, MaxGap=%d)",
|
|
||||||
brynAct.ActiveDays, brynAct.MaxGapDays)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions that the types are the real x/*/types structs
|
|
||||||
// (D-067: the mock store grounds the UI in the real Go type definitions).
|
|
||||||
var _ identitytypes.Reach
|
|
||||||
var _ stashtypes.Stash
|
|
||||||
|
|
||||||
// itoa is provided by fixtures.go (shared with the production package).
|
|
||||||
|
|
||||||
func stringOf(r rune, n int) string {
|
|
||||||
b := make([]byte, n)
|
|
||||||
for i := range b {
|
|
||||||
b[i] = byte(r)
|
|
||||||
}
|
|
||||||
return string(b)
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Window tests (P3) ---
|
|
||||||
|
|
||||||
func TestOpenWindowCreatesStatusOpenWithInitialAudit(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-x"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 5, PerDurationSeconds: 3600}
|
|
||||||
w, err := s.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("OpenWindow: %v", err)
|
|
||||||
}
|
|
||||||
if w.Status != windowtypes.StatusOpen {
|
|
||||||
t.Errorf("OpenWindow status %q, want Open", w.Status)
|
|
||||||
}
|
|
||||||
if w.WindowID == "" {
|
|
||||||
t.Error("OpenWindow: empty WindowID")
|
|
||||||
}
|
|
||||||
audit := s.GetAuditLog(w.WindowID)
|
|
||||||
if len(audit) != 1 {
|
|
||||||
t.Errorf("OpenWindow: audit log len %d, want 1", len(audit))
|
|
||||||
}
|
|
||||||
if audit[0].Action != "open" {
|
|
||||||
t.Errorf("OpenWindow: audit[0].Action %q, want open", audit[0].Action)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestOpenWindowValidation(t *testing.T) {
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
cases := []struct {
|
|
||||||
name, grantor, grantee string
|
|
||||||
wantErr bool
|
|
||||||
}{
|
|
||||||
{"empty grantor", "", "g", true},
|
|
||||||
{"empty grantee", "h", "", true},
|
|
||||||
{"valid", "h", "g", false},
|
|
||||||
}
|
|
||||||
for _, c := range cases {
|
|
||||||
t.Run(c.name, func(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
_, err := s.OpenWindow(c.grantor, c.grantee, scope, 1, 2, rl)
|
|
||||||
if c.wantErr && err == nil {
|
|
||||||
t.Errorf("expected error, got nil")
|
|
||||||
}
|
|
||||||
if !c.wantErr && err != nil {
|
|
||||||
t.Errorf("unexpected error: %v", err)
|
|
||||||
}
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestActivateWindowTransitionsToActive(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
if err := s.ActivateWindow(w.WindowID); err != nil {
|
|
||||||
t.Fatalf("ActivateWindow: %v", err)
|
|
||||||
}
|
|
||||||
updated, _ := s.GetWindow(w.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusActive {
|
|
||||||
t.Errorf("after activate: %q, want Active", updated.Status)
|
|
||||||
}
|
|
||||||
audit := s.GetAuditLog(w.WindowID)
|
|
||||||
if len(audit) != 2 {
|
|
||||||
t.Errorf("after activate: audit len %d, want 2", len(audit))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestActivateWindowNotFound(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if err := s.ActivateWindow("window-nobody"); err == nil {
|
|
||||||
t.Error("ActivateWindow(nobody): expected error, got nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestActivateWindowOnActiveFails(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
_ = s.ActivateWindow(w.WindowID)
|
|
||||||
// Activate again should fail (can only activate Open windows).
|
|
||||||
if err := s.ActivateWindow(w.WindowID); err == nil {
|
|
||||||
t.Error("activate on Active: expected error, got nil (Window.Activate rejects non-Open)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestRevokeWindowTransitionsToRevoked(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
if err := s.RevokeWindow(w.WindowID); err != nil {
|
|
||||||
t.Fatalf("RevokeWindow: %v", err)
|
|
||||||
}
|
|
||||||
updated, _ := s.GetWindow(w.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusRevoked {
|
|
||||||
t.Errorf("after revoke: %q, want Revoked", updated.Status)
|
|
||||||
}
|
|
||||||
if !updated.Revoked {
|
|
||||||
t.Error("after revoke: Revoked flag false, want true")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestRevokeWindowIdempotent(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
_ = s.RevokeWindow(w.WindowID)
|
|
||||||
before := len(s.GetAuditLog(w.WindowID))
|
|
||||||
_ = s.RevokeWindow(w.WindowID)
|
|
||||||
after := len(s.GetAuditLog(w.WindowID))
|
|
||||||
if after != before {
|
|
||||||
t.Errorf("idempotent revoke: audit grew %d -> %d", before, after)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestRevokeWindowOnExpiredIsNoOp(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
_ = s.ExpireWindow(w.WindowID)
|
|
||||||
before := len(s.GetAuditLog(w.WindowID))
|
|
||||||
_ = s.RevokeWindow(w.WindowID)
|
|
||||||
updated, _ := s.GetWindow(w.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusExpired {
|
|
||||||
t.Errorf("revoke-on-expired: %q, want Expired (terminal wins)", updated.Status)
|
|
||||||
}
|
|
||||||
after := len(s.GetAuditLog(w.WindowID))
|
|
||||||
if after != before {
|
|
||||||
t.Errorf("revoke-on-expired: audit grew %d -> %d (no-op)", before, after)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestRevokeWindowNotFound(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if err := s.RevokeWindow("window-nobody"); err == nil {
|
|
||||||
t.Error("RevokeWindow(nobody): expected error, got nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestExpireWindowTransitionsToExpired(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
if err := s.ExpireWindow(w.WindowID); err != nil {
|
|
||||||
t.Fatalf("ExpireWindow: %v", err)
|
|
||||||
}
|
|
||||||
updated, _ := s.GetWindow(w.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusExpired {
|
|
||||||
t.Errorf("after expire: %q, want Expired", updated.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestExpireWindowNotFound(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if err := s.ExpireWindow("window-nobody"); err == nil {
|
|
||||||
t.Error("ExpireWindow(nobody): expected error, got nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestExpireWindowIdempotent(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
_ = s.ExpireWindow(w.WindowID)
|
|
||||||
before := len(s.GetAuditLog(w.WindowID))
|
|
||||||
_ = s.ExpireWindow(w.WindowID)
|
|
||||||
after := len(s.GetAuditLog(w.WindowID))
|
|
||||||
if after != before {
|
|
||||||
t.Errorf("idempotent expire: audit grew %d -> %d", before, after)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestListWindowsFiltersByGrantor(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
_, _ = s.OpenWindow("holder-alia", "svc1", scope, 1, 2, rl)
|
|
||||||
_, _ = s.OpenWindow("holder-alia", "svc2", scope, 1, 2, rl)
|
|
||||||
_, _ = s.OpenWindow("holder-bryn", "svc3", scope, 1, 2, rl)
|
|
||||||
alia := s.ListWindows("holder-alia")
|
|
||||||
if len(alia) != 2 {
|
|
||||||
t.Errorf("ListWindows(holder-alia) = %d, want 2", len(alia))
|
|
||||||
}
|
|
||||||
bryn := s.ListWindows("holder-bryn")
|
|
||||||
if len(bryn) != 1 {
|
|
||||||
t.Errorf("ListWindows(holder-bryn) = %d, want 1", len(bryn))
|
|
||||||
}
|
|
||||||
nobody := s.ListWindows("nobody")
|
|
||||||
if len(nobody) != 0 {
|
|
||||||
t.Errorf("ListWindows(nobody) = %d, want 0", len(nobody))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetWindowHitMiss(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
if _, ok := s.GetWindow(w.WindowID); !ok {
|
|
||||||
t.Errorf("GetWindow(%q) miss, want hit", w.WindowID)
|
|
||||||
}
|
|
||||||
if _, ok := s.GetWindow("window-nobody"); ok {
|
|
||||||
t.Error("GetWindow(nobody) hit, want miss")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetAuditLogEmptyForMissing(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if logs := s.GetAuditLog("window-nobody"); logs != nil {
|
|
||||||
t.Errorf("GetAuditLog(nobody) = %v, want nil", logs)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Standing + Freeholder signals tests (P4) ---
|
|
||||||
|
|
||||||
func TestListRatingsSeeded(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
alia := s.ListRatings("holder-alia")
|
|
||||||
if len(alia) != 12 {
|
|
||||||
t.Errorf("ListRatings(holder-alia) = %d, want 12 (seeded)", len(alia))
|
|
||||||
}
|
|
||||||
bryn := s.ListRatings("holder-bryn")
|
|
||||||
if len(bryn) != 3 {
|
|
||||||
t.Errorf("ListRatings(holder-bryn) = %d, want 3 (seeded)", len(bryn))
|
|
||||||
}
|
|
||||||
nobody := s.ListRatings("nobody")
|
|
||||||
if len(nobody) != 0 {
|
|
||||||
t.Errorf("ListRatings(nobody) = %d, want 0", len(nobody))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestListVouchesSeeded(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
alia := s.ListVouches("holder-alia")
|
|
||||||
if len(alia) != 1 {
|
|
||||||
t.Errorf("ListVouches(holder-alia) = %d, want 1 (seeded)", len(alia))
|
|
||||||
}
|
|
||||||
bryn := s.ListVouches("holder-bryn")
|
|
||||||
if len(bryn) != 0 {
|
|
||||||
t.Errorf("ListVouches(holder-bryn) = %d, want 0 (seeded)", len(bryn))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestListSlashesEmptyByDefault(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if sl := s.ListSlashes("holder-alia"); len(sl) != 0 {
|
|
||||||
t.Errorf("ListSlashes(holder-alia) = %d, want 0 (no slashes seeded)", len(sl))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeStandingScoreNoRatingsReturnsPriorMean(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
score, bucket := s.ComputeStandingScore("nobody")
|
|
||||||
if score != standingtypes.PriorMean {
|
|
||||||
t.Errorf("ComputeStandingScore(nobody) score = %v, want PriorMean %v", score, standingtypes.PriorMean)
|
|
||||||
}
|
|
||||||
if bucket != standingtypes.BucketNew {
|
|
||||||
t.Errorf("ComputeStandingScore(nobody) bucket = %q, want New", bucket)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeStandingScoreAliaIsEligibleRange(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
score, bucket := s.ComputeStandingScore("holder-alia")
|
|
||||||
if score < 4.5 {
|
|
||||||
t.Errorf("holder-alia score = %.2f, want >= 4.5 (Freeholder-eligible range)", score)
|
|
||||||
}
|
|
||||||
if bucket != standingtypes.BucketPreferred && bucket != standingtypes.BucketTop {
|
|
||||||
t.Errorf("holder-alia bucket = %q, want Preferred or Top", bucket)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeStandingScoreBrynIsNew(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
_, bucket := s.ComputeStandingScore("holder-bryn")
|
|
||||||
// holder-bryn has 3 ratings (< 10) -> bucket New.
|
|
||||||
if bucket != standingtypes.BucketNew {
|
|
||||||
t.Errorf("holder-bryn bucket = %q, want New (< 10 ratings)", bucket)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeFreeholderSignalsAliaAllTrue(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
signals := s.ComputeFreeholderSignals("holder-alia")
|
|
||||||
// holder-alia: mature Stash (92 days), score >= 4.5 in 4 cats, balance
|
|
||||||
// 920000 >= 100000, 1 Vouch -> all 4 signals true.
|
|
||||||
if !signals.StashMaturity {
|
|
||||||
t.Errorf("StashMaturity = false, want true (mature Stash)")
|
|
||||||
}
|
|
||||||
if !signals.MultiDomainStanding {
|
|
||||||
t.Errorf("MultiDomainStanding = false, want true (score >= 4.5 in 4 cats)")
|
|
||||||
}
|
|
||||||
if !signals.CommittedCapital {
|
|
||||||
t.Errorf("CommittedCapital = false, want true (balance 920000 >= 100000)")
|
|
||||||
}
|
|
||||||
if !signals.CommunityEndorsement {
|
|
||||||
t.Errorf("CommunityEndorsement = false, want true (1 Vouch seeded)")
|
|
||||||
}
|
|
||||||
if !signals.IsFreeholderEligible() {
|
|
||||||
t.Errorf("holder-alia IsFreeholderEligible = false, want true (all 4 signals)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeFreeholderSignalsBrynNotEligible(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
signals := s.ComputeFreeholderSignals("holder-bryn")
|
|
||||||
// holder-bryn: immature Stash (45 days), 1 cat (< 3), no Vouch.
|
|
||||||
if signals.StashMaturity {
|
|
||||||
t.Errorf("StashMaturity = true, want false (immature 45 days)")
|
|
||||||
}
|
|
||||||
if signals.MultiDomainStanding {
|
|
||||||
t.Errorf("MultiDomainStanding = true, want false (1 cat < 3)")
|
|
||||||
}
|
|
||||||
if signals.CommunityEndorsement {
|
|
||||||
t.Errorf("CommunityEndorsement = true, want false (no Vouches)")
|
|
||||||
}
|
|
||||||
if signals.IsFreeholderEligible() {
|
|
||||||
t.Errorf("holder-bryn IsFreeholderEligible = true, want false")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeFreeholderSignalsNoStash(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
signals := s.ComputeFreeholderSignals("nobody")
|
|
||||||
// No Stash, no ratings, no Vouches -> all false.
|
|
||||||
if signals.IsFreeholderEligible() {
|
|
||||||
t.Errorf("nobody IsFreeholderEligible = true, want false (no Stash)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Bloom accrual tests (P5) ---
|
|
||||||
|
|
||||||
func TestGetBloomRecordSeeded(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
rec, ok := s.GetBloomRecord("stash-holder-alia")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("GetBloomRecord(stash-holder-alia) miss, want hit (seeded)")
|
|
||||||
}
|
|
||||||
// D-073: seeded at the code-constant target rate.
|
|
||||||
if rec.RateBasisPoints != bloomtypes.TargetBloomRateBasisPoints {
|
|
||||||
t.Errorf("seeded RateBasisPoints = %d, want %d (TargetBloomRateBasisPoints, D-073)", rec.RateBasisPoints, bloomtypes.TargetBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
if rec.AccruedGrain != 45000 {
|
|
||||||
t.Errorf("seeded AccruedGrain = %d, want 45000", rec.AccruedGrain)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetBloomRecordMiss(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if _, ok := s.GetBloomRecord("stash-nobody"); ok {
|
|
||||||
t.Error("GetBloomRecord(stash-nobody) hit, want miss")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestListBloomRecordsByHolder(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
alia := s.ListBloomRecords("holder-alia")
|
|
||||||
if len(alia) != 1 {
|
|
||||||
t.Errorf("ListBloomRecords(holder-alia) = %d, want 1", len(alia))
|
|
||||||
}
|
|
||||||
if alia[0].StashID != "stash-holder-alia" {
|
|
||||||
t.Errorf("ListBloomRecords(holder-alia)[0].StashID = %q, want stash-holder-alia", alia[0].StashID)
|
|
||||||
}
|
|
||||||
bryn := s.ListBloomRecords("holder-bryn")
|
|
||||||
if len(bryn) != 1 {
|
|
||||||
t.Errorf("ListBloomRecords(holder-bryn) = %d, want 1", len(bryn))
|
|
||||||
}
|
|
||||||
nobody := s.ListBloomRecords("nobody")
|
|
||||||
if len(nobody) != 0 {
|
|
||||||
t.Errorf("ListBloomRecords(nobody) = %d, want 0", len(nobody))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,29 +0,0 @@
|
|||||||
{{define "base.html"}}
|
|
||||||
<!DOCTYPE html>
|
|
||||||
<html lang="en">
|
|
||||||
<head>
|
|
||||||
<meta charset="utf-8">
|
|
||||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
||||||
<title>{{block "title" .}}OpenYield{{end}}</title>
|
|
||||||
<link rel="stylesheet" href="/static/style.css">
|
|
||||||
<script src="/static/htmx.min.js" defer></script>
|
|
||||||
</head>
|
|
||||||
<body>
|
|
||||||
<header class="nav">
|
|
||||||
<span class="brand">OpenYield</span>
|
|
||||||
<a href="/">Home</a>
|
|
||||||
<a href="/reach">Reach</a>
|
|
||||||
<a href="/stash">Stash</a>
|
|
||||||
<a href="/window">Window</a>
|
|
||||||
<a href="/standing">Standing</a>
|
|
||||||
<a href="/bloom">Bloom</a>
|
|
||||||
</header>
|
|
||||||
<main>
|
|
||||||
{{block "content" .}}{{end}}
|
|
||||||
</main>
|
|
||||||
<footer>
|
|
||||||
OpenYield — real production on the mesh. Reach, Stash, Window, Standing, Bloom.
|
|
||||||
</footer>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
{{define "title"}}Bloom — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Bloom</h1>
|
|
||||||
<p>Bloom is the real-production reward that accrues to every Grain in every
|
|
||||||
Stash. It originates only from real production — no synthetic Bloom, no
|
|
||||||
protocol-printed Bloom. This is a Mission Lock: no council can change it.</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Bloom record for {{.StashID}}</h2>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Stash ID</th><td>{{.StashID}}</td></tr>
|
|
||||||
<tr><th>Accrued Grain</th><td>{{.Record.AccruedGrain}}</td></tr>
|
|
||||||
<tr><th>Rate</th><td>{{printf "%.1f" .RatePct}}%</td></tr>
|
|
||||||
<tr><th>Last accrual block</th><td>{{.Record.LastAccrualBlock}}</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Target rate band</h2>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Target rate</th><td>{{printf "%.1f" .TargetRatePct}}%</td></tr>
|
|
||||||
<tr><th>Min rate</th><td>{{printf "%.1f" .MinRatePct}}%</td></tr>
|
|
||||||
<tr><th>Max rate</th><td>{{printf "%.1f" .MaxRatePct}}%</td></tr>
|
|
||||||
<tr><th>Accrual period</th><td>{{.AccrualPeriod}} blocks (daily, ~10min blocks)</td></tr>
|
|
||||||
</table>
|
|
||||||
<p><em>{{.MissionLockNote}}</em></p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<p><a href="/stash/{{slice .StashID 6}}">Back to Stash</a></p>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
{{define "title"}}OpenYield — real production on the mesh{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>OpenYield</h1>
|
|
||||||
<p>
|
|
||||||
OpenYield is a mesh-native system for real production. A Holder creates a
|
|
||||||
Reach to enter the mesh, holds a Stash of Grain, and authorizes Window
|
|
||||||
access to partners. Standing accrues through honest participation, and
|
|
||||||
Bloom rewards sustained contribution. No middleman holds your Stash.
|
|
||||||
</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>The five screens</h2>
|
|
||||||
<ul>
|
|
||||||
<li><a href="/reach">Reach</a> — create a Reach and view the mesh of Holders.</li>
|
|
||||||
<li><a href="/stash">Stash</a> — your sovereign Grain Stash (P2).</li>
|
|
||||||
<li><a href="/window">Window</a> — authorize partner access to your Stash (P3).</li>
|
|
||||||
<li><a href="/standing">Standing</a> — track progress toward Freeholder standing (P4).</li>
|
|
||||||
<li><a href="/bloom">Bloom</a> — accrued rewards for sustained contribution (P5).</li>
|
|
||||||
</ul>
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,31 +0,0 @@
|
|||||||
{{define "title"}}{{.Reach.ReachID}} — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>{{.Reach.ReachID}}</h1>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Reach ID</th><td>{{.Reach.ReachID}}</td></tr>
|
|
||||||
<tr><th>Holder ID</th><td>{{.Reach.HolderID}}</td></tr>
|
|
||||||
<tr><th>Public Key</th><td><code>{{.Reach.PublicKey}}</code></td></tr>
|
|
||||||
<tr><th>Created</th><td>{{.Reach.CreatedAt}}</td></tr>
|
|
||||||
<tr><th>Nomad</th><td>{{if .Reach.IsNomad}}yes{{else}}no{{end}}</td></tr>
|
|
||||||
<tr><th>Freeholder</th><td>{{if .Reach.IsFreeholder}}yes{{else}}no{{end}}</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
{{if .Stash.StashID}}
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Stash</h2>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Stash ID</th><td>{{.Stash.StashID}}</td></tr>
|
|
||||||
<tr><th>Balance</th><td>{{.Stash.BalanceGrain}} Grain</td></tr>
|
|
||||||
<tr><th>Created</th><td>{{.Stash.CreatedAt}}</td></tr>
|
|
||||||
<tr><th>Last active</th><td>{{.Stash.LastActive}}</td></tr>
|
|
||||||
<tr><th>Still</th><td>{{if .Stash.IsStill}}paused{{else}}active{{end}}</td></tr>
|
|
||||||
</table>
|
|
||||||
<p><a href="/stash/{{.Stash.HolderID}}">View Stash dashboard</a></p>
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
|
|
||||||
<p><a href="/reach">Back to Reach list</a></p>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
{{define "title"}}Reach — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Reach</h1>
|
|
||||||
<p>A Reach is the mesh-native identity a Holder uses to act on the mesh
|
|
||||||
without a custodian, a gatekeeper, or a legacy financial position. A Nomad
|
|
||||||
is a Holder who has a Reach and a Stash and is on the way to earning the
|
|
||||||
four Freeholder signals.</p>
|
|
||||||
<p><a href="/reach/new" class="btn">Create a Reach</a></p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Holders on the mesh</h2>
|
|
||||||
{{if .Reaches}}
|
|
||||||
<table>
|
|
||||||
<thead>
|
|
||||||
<tr><th>Reach ID</th><th>Holder ID</th><th>Nomad</th><th>Freeholder</th></tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .Reaches}}
|
|
||||||
<tr>
|
|
||||||
<td><a href="/reach/{{.HolderID}}">{{.ReachID}}</a></td>
|
|
||||||
<td>{{.HolderID}}</td>
|
|
||||||
<td>{{if .IsNomad}}yes{{else}}no{{end}}</td>
|
|
||||||
<td>{{if .IsFreeholder}}yes{{else}}no{{end}}</td>
|
|
||||||
</tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
{{else}}
|
|
||||||
<p>No Reaches yet. <a href="/reach/new">Create a Reach</a> to begin.</p>
|
|
||||||
{{end}}
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
{{define "title"}}Create a Reach — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Create a Reach</h1>
|
|
||||||
<p>A Reach is an identity, not a custodial position. The protocol does not
|
|
||||||
require KYC at the protocol layer; the Reach is the unit of self-service.
|
|
||||||
Creating a Reach also opens a Stash for you (the place a Nomad holds
|
|
||||||
Grain) — that pair is enough to begin on the mesh.</p>
|
|
||||||
|
|
||||||
<form method="POST" action="/reach" hx-post="/reach" hx-target="body">
|
|
||||||
<label for="holder_id">Holder ID</label>
|
|
||||||
<input type="text" id="holder_id" name="holder_id" required
|
|
||||||
maxlength="128" placeholder="a by-ID-string of your choosing">
|
|
||||||
<label for="public_key">Public Key</label>
|
|
||||||
<input type="text" id="public_key" name="public_key" required
|
|
||||||
maxlength="128" placeholder="a public key for your Reach">
|
|
||||||
<button type="submit">Create a Reach</button>
|
|
||||||
</form>
|
|
||||||
<p><a href="/reach">Back to Reach list</a></p>
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,89 +0,0 @@
|
|||||||
{{define "title"}}Standing — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Standing — {{.ReachID}}</h1>
|
|
||||||
<p>Standing is the Bayesian anti-gaming metric that accrues as a Nomad acts
|
|
||||||
on the mesh. It is not bought or transferred — it is earned through honest
|
|
||||||
participation, weighted by the standing of the raters, time-decayed, and
|
|
||||||
diversified across service categories.</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Score</h2>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Reach ID</th><td>{{.ReachID}}</td></tr>
|
|
||||||
<tr><th>Standing score</th><td>{{printf "%.1f" .Score}}</td></tr>
|
|
||||||
<tr><th>Bucket</th><td>
|
|
||||||
{{if eq (string .Bucket) "New"}}<span class="badge grey">New</span>{{end}}
|
|
||||||
{{if eq (string .Bucket) "Trusted"}}<span class="badge blue">Trusted</span>{{end}}
|
|
||||||
{{if eq (string .Bucket) "Preferred"}}<span class="badge green">Preferred</span>{{end}}
|
|
||||||
{{if eq (string .Bucket) "Top"}}<span class="badge green">Top</span>{{end}}
|
|
||||||
{{if eq (string .Bucket) "Slashed"}}<span class="badge red">Slashed</span>{{end}}
|
|
||||||
</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Freeholder signals</h2>
|
|
||||||
<p>The four signals (§9.1) — all four must be present to be Freeholder-eligible.
|
|
||||||
No application, no committee, no form.</p>
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Signal</th><th>Status</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
<tr><td>Stash maturity (90 days, gap ≤ 30)</td><td>{{if .Signals.StashMaturity}}<span class="badge green">earned</span>{{else}}<span class="badge grey">not yet</span>{{end}}</td></tr>
|
|
||||||
<tr><td>Multi-domain standing (≥ {{printf "%.1f" .MinScore}} in ≥ {{.MinCats}} cats)</td><td>{{if .Signals.MultiDomainStanding}}<span class="badge green">earned</span>{{else}}<span class="badge grey">not yet</span>{{end}}</td></tr>
|
|
||||||
<tr><td>Committed capital</td><td>{{if .Signals.CommittedCapital}}<span class="badge green">earned</span>{{else}}<span class="badge grey">not yet</span>{{end}}</td></tr>
|
|
||||||
<tr><td>Community endorsement (≥ 1 Vouch)</td><td>{{if .Signals.CommunityEndorsement}}<span class="badge green">earned</span>{{else}}<span class="badge grey">not yet</span>{{end}}</td></tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
<p>Freeholder-eligible:
|
|
||||||
{{if .Eligible}}<span class="badge green">yes</span>
|
|
||||||
{{else}}<span class="badge grey">not yet</span>{{end}}
|
|
||||||
</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Ratings ({{len .Ratings}})</h2>
|
|
||||||
{{if .Ratings}}
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Rater</th><th>Category</th><th>Score</th><th>Timestamp</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .Ratings}}
|
|
||||||
<tr><td>{{.RaterID}}</td><td>{{.Category}}</td><td>{{printf "%.1f" .Score}}</td><td>{{.Timestamp}}</td></tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
{{else}}<p>No ratings yet.</p>{{end}}
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Vouches ({{len .Vouches}})</h2>
|
|
||||||
{{if .Vouches}}
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Voucher</th><th>Category</th><th>Bond (Grain)</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .Vouches}}
|
|
||||||
<tr><td>{{.VoucherID}}</td><td>{{.Category}}</td><td>{{.BondAmount}}</td></tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
{{else}}<p>No Vouches yet.</p>{{end}}
|
|
||||||
</section>
|
|
||||||
|
|
||||||
{{if .Slashes}}
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Slashes ({{len .Slashes}})</h2>
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Reason</th><th>Amount</th><th>Attester</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .Slashes}}
|
|
||||||
<tr><td>{{.Reason}}</td><td>{{.Amount}}</td><td>{{.Attester}}</td></tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
|
|
||||||
<p><a href="/reach/{{.ReachID}}">Back to Reach</a></p>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,56 +0,0 @@
|
|||||||
{{define "title"}}Stash — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Stash</h1>
|
|
||||||
<p>A Stash is a Holder's personal storage — the place a Nomad holds Grain.
|
|
||||||
It is a storage layer, not a custodial position: the Holder owns it,
|
|
||||||
controls it, and can delegate a scoped, time-limited Window to a partner
|
|
||||||
without giving up custody.</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Balance</h2>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Stash ID</th><td>{{.Stash.StashID}}</td></tr>
|
|
||||||
<tr><th>Holder ID</th><td>{{.Stash.HolderID}}</td></tr>
|
|
||||||
<tr><th>Balance</th><td>{{.Stash.BalanceGrain}} Grain ({{.BalanceBread}} Bread)</td></tr>
|
|
||||||
<tr><th>Created</th><td>{{.Stash.CreatedAt}}</td></tr>
|
|
||||||
<tr><th>Last active</th><td>{{.Stash.LastActive}}</td></tr>
|
|
||||||
<tr><th>Still</th><td>{{if .Stash.IsStill}}paused{{else}}active{{end}}</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Bread scale</h2>
|
|
||||||
<p>1 Bread = 10,000 Grain. The full scale (from the protocol code constants):</p>
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Denomination</th><th>Grain value</th><th>Equivalent in this Stash</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .BreadScale}}
|
|
||||||
<tr>
|
|
||||||
<td>{{.Name}}</td>
|
|
||||||
<td>{{.GrainValue}}</td>
|
|
||||||
<td>{{if eq .Name "Grain"}}{{$.Stash.BalanceGrain}}{{else}}{{divGrain $.Stash.BalanceGrain .GrainValue}}{{end}}</td>
|
|
||||||
</tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Maturity progress</h2>
|
|
||||||
<p>Holding a Stash continuously for 90 days is the first of the four
|
|
||||||
Freeholder signals. The signal is about continuity, not size.</p>
|
|
||||||
<div class="progress-track">
|
|
||||||
<div class="progress-bar" style="width: {{.MaturityPct}}%">{{.MaturityPct}}%</div>
|
|
||||||
</div>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Active days</th><td>{{.Activity.ActiveDays}} / {{.ThresholdDays}}</td></tr>
|
|
||||||
<tr><th>Max gap days</th><td>{{.Activity.MaxGapDays}} / {{.MaxGapDays}} (max allowed)</td></tr>
|
|
||||||
<tr><th>Mature</th><td>{{if .Mature}}<span class="badge green">Mature</span>{{else}}<span class="badge amber">Not mature</span>{{end}}</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<p><a href="/reach/{{.Stash.HolderID}}">Back to Reach</a></p>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,68 +0,0 @@
|
|||||||
{{define "title"}}{{.Window.WindowID}} — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>{{.Window.WindowID}}</h1>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Window ID</th><td>{{.Window.WindowID}}</td></tr>
|
|
||||||
<tr><th>Grantor</th><td>{{.Window.GrantorHolder}}</td></tr>
|
|
||||||
<tr><th>Grantee</th><td>{{.Window.Grantee}}</td></tr>
|
|
||||||
<tr><th>Scope</th><td>{{.Window.Scope.Kind}} ({{.Window.Scope.ResourceID}})</td></tr>
|
|
||||||
<tr><th>Start</th><td>{{.Window.Start}}</td></tr>
|
|
||||||
<tr><th>End</th><td>{{.Window.End}}</td></tr>
|
|
||||||
<tr><th>Rate limit</th><td>{{.Window.RateLimit.ActionsConsumed}} / {{.Window.RateLimit.MaxActions}} per {{.Window.RateLimit.PerDurationSeconds}}s</td></tr>
|
|
||||||
<tr><th>Revoked</th><td>{{if .Window.Revoked}}yes{{else}}no{{end}}</td></tr>
|
|
||||||
<tr><th>Status</th><td>
|
|
||||||
{{if eq (string .Window.Status) "Open"}}<span class="badge amber">Open</span>{{end}}
|
|
||||||
{{if eq (string .Window.Status) "Active"}}<span class="badge green">Active</span>{{end}}
|
|
||||||
{{if eq (string .Window.Status) "Revoked"}}<span class="badge red">Revoked</span>{{end}}
|
|
||||||
{{if eq (string .Window.Status) "Expired"}}<span class="badge grey">Expired</span>{{end}}
|
|
||||||
</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Lifecycle actions</h2>
|
|
||||||
<p>
|
|
||||||
{{if eq (string .Window.Status) "Open"}}
|
|
||||||
<form method="POST" action="/window/{{.Window.WindowID}}/activate" style="display:inline">
|
|
||||||
<button type="submit">Activate</button>
|
|
||||||
</form>
|
|
||||||
{{end}}
|
|
||||||
{{if or (eq (string .Window.Status) "Open") (eq (string .Window.Status) "Active")}}
|
|
||||||
<form method="POST" action="/window/{{.Window.WindowID}}/revoke" style="display:inline">
|
|
||||||
<button type="submit">Revoke</button>
|
|
||||||
</form>
|
|
||||||
{{end}}
|
|
||||||
{{if or (eq (string .Window.Status) "Open") (eq (string .Window.Status) "Active")}}
|
|
||||||
<form method="POST" action="/window/{{.Window.WindowID}}/expire" style="display:inline">
|
|
||||||
<button type="submit">Expire</button>
|
|
||||||
</form>
|
|
||||||
{{end}}
|
|
||||||
</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Audit log</h2>
|
|
||||||
{{if .AuditLog}}
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Entry ID</th><th>Timestamp</th><th>Action</th><th>Result</th><th>Granter</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .AuditLog}}
|
|
||||||
<tr>
|
|
||||||
<td>{{.EntryID}}</td>
|
|
||||||
<td>{{.Timestamp}}</td>
|
|
||||||
<td>{{.Action}}</td>
|
|
||||||
<td>{{.Result}}</td>
|
|
||||||
<td>{{.GranterRef}}</td>
|
|
||||||
</tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
{{else}}
|
|
||||||
<p>No audit entries yet.</p>
|
|
||||||
{{end}}
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<p><a href="/window">Back to Window list</a></p>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
{{define "title"}}Window — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Window</h1>
|
|
||||||
<p>A Window is a Holder-authorized, scope-bounded, time-limited, revocable
|
|
||||||
delegation of access (REQ-015). The Holder opens a Window so a partner or
|
|
||||||
service can read a Stash or process a Pass-Act — without giving up custody.
|
|
||||||
The Window is revocable, rate-limited, and audited.</p>
|
|
||||||
<p><a href="/window/new" class="btn">Open a Window</a></p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Windows for {{.Grantor}}</h2>
|
|
||||||
{{if .Windows}}
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Window ID</th><th>Grantee</th><th>Scope</th><th>Status</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .Windows}}
|
|
||||||
<tr>
|
|
||||||
<td><a href="/window/{{.WindowID}}">{{.WindowID}}</a></td>
|
|
||||||
<td>{{.Grantee}}</td>
|
|
||||||
<td>{{.Scope.Kind}} ({{.Scope.ResourceID}})</td>
|
|
||||||
<td>{{.Status}}</td>
|
|
||||||
</tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
{{else}}
|
|
||||||
<p>No Windows yet for {{.Grantor}}. <a href="/window/new">Open a Window</a> to begin.</p>
|
|
||||||
{{end}}
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
{{define "title"}}Open a Window — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Open a Window</h1>
|
|
||||||
<p>A Window delegates scoped access to a partner or service without giving
|
|
||||||
up custody. The Holder sets the scope, the duration, and a rate-limit; the
|
|
||||||
Window is revocable at any time.</p>
|
|
||||||
|
|
||||||
<form method="POST" action="/window" hx-post="/window" hx-target="body">
|
|
||||||
<label for="grantor_holder">Grantor Holder ID</label>
|
|
||||||
<input type="text" id="grantor_holder" name="grantor_holder" required
|
|
||||||
maxlength="128" placeholder="the Holder opening the Window">
|
|
||||||
<label for="grantee">Grantee</label>
|
|
||||||
<input type="text" id="grantee" name="grantee" required
|
|
||||||
maxlength="128" placeholder="the partner or service receiving access">
|
|
||||||
<label for="scope_kind">Scope kind</label>
|
|
||||||
<select id="scope_kind" name="scope_kind">
|
|
||||||
<option value="ReadStash">ReadStash</option>
|
|
||||||
<option value="ReadStanding">ReadStanding</option>
|
|
||||||
<option value="ProcessPassActForStand">ProcessPassActForStand</option>
|
|
||||||
</select>
|
|
||||||
<label for="resource_id">Resource ID</label>
|
|
||||||
<input type="text" id="resource_id" name="resource_id"
|
|
||||||
maxlength="128" placeholder="the Stash or Stand this Window scopes to">
|
|
||||||
<label for="start_unix">Start (unix seconds, blank = now)</label>
|
|
||||||
<input type="number" id="start_unix" name="start_unix" placeholder="blank = now">
|
|
||||||
<label for="end_unix">End (unix seconds, blank = now+1h)</label>
|
|
||||||
<input type="number" id="end_unix" name="end_unix" placeholder="blank = now+1h">
|
|
||||||
<label for="max_actions">Max actions (rate-limit, blank = 10)</label>
|
|
||||||
<input type="number" id="max_actions" name="max_actions" placeholder="10">
|
|
||||||
<button type="submit">Open a Window</button>
|
|
||||||
</form>
|
|
||||||
<p><a href="/window">Back to Window list</a></p>
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,244 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/council/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// keeper.go holds the store-backed Keeper for the council module's
|
|
||||||
// Proposal-lifecycle runtime (P7-02-01, REQ-039, D-060).
|
|
||||||
//
|
|
||||||
// The Keeper wraps an sdk.KVStore via a storeKey. It holds the Proposal
|
|
||||||
// records (by proposal-id) and the Vote records (by vote-id). The v0.2
|
|
||||||
// skeleton had NO keeper (only types/); v0.5 (P7) promotes the council
|
|
||||||
// module to runtime by adding the store-backed Keeper + MsgServer.
|
|
||||||
//
|
|
||||||
// The Keeper also holds the three expected-keeper shims (WatcherKeeper
|
|
||||||
// for Veto authz; StandKeeper + GuildKeeper for proposal-target
|
|
||||||
// validation). The shims are interfaces (G-003 — no struct import of
|
|
||||||
// x/watcher/types, x/stand/types, or x/guild/types); the concrete
|
|
||||||
// keepers satisfy them structurally.
|
|
||||||
//
|
|
||||||
// State-machine ordering (vision §7, enforced in every handler):
|
|
||||||
// ValidateBasic → keeper authz → state mutation → ctx.EventManager().EmitEvent
|
|
||||||
|
|
||||||
// Keeper is the store-backed council Proposal-lifecycle keeper.
|
|
||||||
type Keeper struct {
|
|
||||||
cdc codec.Codec
|
|
||||||
storeKey storetypes.StoreKey
|
|
||||||
watcherKeeper types.WatcherKeeper
|
|
||||||
standKeeper types.StandKeeper
|
|
||||||
guildKeeper types.GuildKeeper
|
|
||||||
params types.Params
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewKeeper constructs a new store-backed council Proposal-lifecycle
|
|
||||||
// Keeper. The WatcherKeeper, StandKeeper, and GuildKeeper expected-keeper
|
|
||||||
// shims are injected (nil-able for partial tests; the handlers guard nil
|
|
||||||
// shims and skip the corresponding authz/validity check, still mutating
|
|
||||||
// state — the simtest wiring documents this). The Params default is set
|
|
||||||
// here; the simtest can override via SetParams.
|
|
||||||
func NewKeeper(cdc codec.Codec, storeKey storetypes.StoreKey, wk types.WatcherKeeper, sk types.StandKeeper, gk types.GuildKeeper) Keeper {
|
|
||||||
return Keeper{
|
|
||||||
cdc: cdc,
|
|
||||||
storeKey: storeKey,
|
|
||||||
watcherKeeper: wk,
|
|
||||||
standKeeper: sk,
|
|
||||||
guildKeeper: gk,
|
|
||||||
params: types.DefaultParams(),
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetWatcherKeeper sets the WatcherKeeper expected-keeper shim (for
|
|
||||||
// post-construction wiring, e.g., app wiring or test setup).
|
|
||||||
func (k *Keeper) SetWatcherKeeper(wk types.WatcherKeeper) { k.watcherKeeper = wk }
|
|
||||||
|
|
||||||
// SetStandKeeper sets the StandKeeper expected-keeper shim (for
|
|
||||||
// post-construction wiring).
|
|
||||||
func (k *Keeper) SetStandKeeper(sk types.StandKeeper) { k.standKeeper = sk }
|
|
||||||
|
|
||||||
// SetGuildKeeper sets the GuildKeeper expected-keeper shim (for
|
|
||||||
// post-construction wiring).
|
|
||||||
func (k *Keeper) SetGuildKeeper(gk types.GuildKeeper) { k.guildKeeper = gk }
|
|
||||||
|
|
||||||
// SetParams sets the council Params (the simtest overrides
|
|
||||||
// WatcherVetoQuorum for the quorum-Veto-fails test).
|
|
||||||
func (k *Keeper) SetParams(p types.Params) { k.params = p }
|
|
||||||
|
|
||||||
// GetParams returns the council Params.
|
|
||||||
func (k Keeper) GetParams() types.Params { return k.params }
|
|
||||||
|
|
||||||
// --- Proposal store --------------------------------------------------------
|
|
||||||
|
|
||||||
var proposalKeyPrefix = []byte("proposal/")
|
|
||||||
|
|
||||||
func proposalKey(proposalID string) []byte {
|
|
||||||
return append(proposalKeyPrefix, []byte(proposalID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetProposal loads a Proposal by proposal-id. Returns the Proposal and
|
|
||||||
// true if found, or zero value + false if not.
|
|
||||||
func (k Keeper) GetProposal(ctx sdk.Context, proposalID string) (types.Proposal, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(proposalKey(proposalID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.Proposal{}, false
|
|
||||||
}
|
|
||||||
var p types.Proposal
|
|
||||||
if err := json.Unmarshal(bz, &p); err != nil {
|
|
||||||
return types.Proposal{}, false
|
|
||||||
}
|
|
||||||
return p, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetProposal persists a Proposal by proposal-id.
|
|
||||||
func (k Keeper) SetProposal(ctx sdk.Context, p types.Proposal) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(p)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("council: marshal proposal %q: %v", p.ProposalID, err))
|
|
||||||
}
|
|
||||||
store.Set(proposalKey(p.ProposalID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllProposals returns all persisted Proposal records (iteration helper).
|
|
||||||
func (k Keeper) AllProposals(ctx sdk.Context) []types.Proposal {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(proposalKeyPrefix, prefixEnd(proposalKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.Proposal{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var p types.Proposal
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &p); err == nil {
|
|
||||||
out = append(out, p)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Vote store ------------------------------------------------------------
|
|
||||||
|
|
||||||
var voteKeyPrefix = []byte("vote/")
|
|
||||||
|
|
||||||
func voteKey(voteID string) []byte {
|
|
||||||
return append(voteKeyPrefix, []byte(voteID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetVote loads a Vote by vote-id. Returns the Vote and true if found,
|
|
||||||
// or zero value + false if not.
|
|
||||||
func (k Keeper) GetVote(ctx sdk.Context, voteID string) (types.Vote, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(voteKey(voteID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.Vote{}, false
|
|
||||||
}
|
|
||||||
var v types.Vote
|
|
||||||
if err := json.Unmarshal(bz, &v); err != nil {
|
|
||||||
return types.Vote{}, false
|
|
||||||
}
|
|
||||||
return v, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetVote persists a Vote by vote-id.
|
|
||||||
func (k Keeper) SetVote(ctx sdk.Context, v types.Vote) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(v)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("council: marshal vote %q: %v", v.VoteID, err))
|
|
||||||
}
|
|
||||||
store.Set(voteKey(v.VoteID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllVotes returns all persisted Vote records (iteration helper).
|
|
||||||
func (k Keeper) AllVotes(ctx sdk.Context) []types.Vote {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(voteKeyPrefix, prefixEnd(voteKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.Vote{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var v types.Vote
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &v); err == nil {
|
|
||||||
out = append(out, v)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// VotesForProposal returns all persisted Vote records for a given
|
|
||||||
// proposal-id (iteration + filter helper; used by the TallyProposal
|
|
||||||
// handler to compute the tally).
|
|
||||||
func (k Keeper) VotesForProposal(ctx sdk.Context, proposalID string) []types.Vote {
|
|
||||||
all := k.AllVotes(ctx)
|
|
||||||
out := []types.Vote{}
|
|
||||||
for _, v := range all {
|
|
||||||
if v.ProposalID == proposalID {
|
|
||||||
out = append(out, v)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Council store (for SubmitProposal target validation) ------------------
|
|
||||||
|
|
||||||
var councilKeyPrefix = []byte("council/")
|
|
||||||
|
|
||||||
func councilKey(councilID string) []byte {
|
|
||||||
return append(councilKeyPrefix, []byte(councilID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetCouncil loads a Council by council-id from the runtime store.
|
|
||||||
// Returns the Council and true if found, or zero value + false if not.
|
|
||||||
// The Council store is the runtime home for the v0.2 skeleton Council
|
|
||||||
// struct (the v0.2 skeleton had Council only in genesis; v0.5 promotes
|
|
||||||
// it to the runtime store so the SubmitProposal handler can validate the
|
|
||||||
// proposal-target against the Council's stand-id-ref / guild-id-ref).
|
|
||||||
func (k Keeper) GetCouncil(ctx sdk.Context, councilID string) (types.Council, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(councilKey(councilID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.Council{}, false
|
|
||||||
}
|
|
||||||
var c types.Council
|
|
||||||
if err := json.Unmarshal(bz, &c); err != nil {
|
|
||||||
return types.Council{}, false
|
|
||||||
}
|
|
||||||
return c, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetCouncil persists a Council by council-id (runtime store home for the
|
|
||||||
// v0.2 skeleton Council struct; the simtest seeds a Council for the
|
|
||||||
// SubmitProposal target validation).
|
|
||||||
func (k Keeper) SetCouncil(ctx sdk.Context, c types.Council) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(c)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("council: marshal council %q: %v", c.CouncilID, err))
|
|
||||||
}
|
|
||||||
store.Set(councilKey(c.CouncilID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// prefixEnd returns the key that sorts immediately after all keys sharing
|
|
||||||
// the given prefix (the standard prefix-iteration end key: increment the
|
|
||||||
// last byte, drop overflow). Used for store.Iterator(start, prefixEnd(start))
|
|
||||||
// prefix scans.
|
|
||||||
func prefixEnd(prefix []byte) []byte {
|
|
||||||
if len(prefix) == 0 {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
end := make([]byte, len(prefix))
|
|
||||||
copy(end, prefix)
|
|
||||||
for i := len(end) - 1; i >= 0; i-- {
|
|
||||||
end[i]++
|
|
||||||
if end[i] != 0 {
|
|
||||||
return end
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// All bytes were 0xFF; return nil (iterate to end of store).
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@@ -1,384 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/council/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// msg_server.go implements the council module's Proposal-lifecycle MsgServer
|
|
||||||
// (P7-02-01, REQ-039, D-060; G-023 ownership split: cosmos-engineer
|
|
||||||
// scaffolds the file structure + method signatures; backend-engineer
|
|
||||||
// implements the handler logic bodies). The MsgServer wraps the Keeper +
|
|
||||||
// the WatcherKeeper, StandKeeper, and GuildKeeper expected-keeper shims
|
|
||||||
// (already on the Keeper).
|
|
||||||
//
|
|
||||||
// Each method returns a (*Response, error). Handler state-machine ordering
|
|
||||||
// is enforced: ValidateBasic → keeper authz → state mutation →
|
|
||||||
// ctx.EventManager().EmitEvent.
|
|
||||||
//
|
|
||||||
// Lifecycle (REQ-039, D-060, vision §13):
|
|
||||||
// - SubmitProposal → creates a Proposal status=Pending (ValidateBasic
|
|
||||||
// already rejected MissionLockAmendment-Rejected
|
|
||||||
// per D-064 — the handler never sees that kind).
|
|
||||||
// - Vote → records a VoteOption; Veto requires Watcher authz
|
|
||||||
// via the WatcherKeeper shim (single-Veto-no-block;
|
|
||||||
// the Veto quorum check is at TALLY, not at VOTE).
|
|
||||||
// Vote on a non-Active proposal REJECTED. Vote after
|
|
||||||
// the voting-deadline REJECTED.
|
|
||||||
// - TallyProposal → closes the voting deadline, computes the tally,
|
|
||||||
// transitions Succeeded/Failed. Veto semantics: a
|
|
||||||
// single Veto does NOT block (anti-greed, vision
|
|
||||||
// §19); the proposal transitions to Failed only if
|
|
||||||
// NoWithVeto >= WatcherVetoQuorum (default 6,
|
|
||||||
// D-065/A-574). The v0.2 TallyResult.NoWithVeto
|
|
||||||
// field (zero-locked in v0.2) is now POPULATED by
|
|
||||||
// Watcher Vetos.
|
|
||||||
//
|
|
||||||
// Proposal EXECUTION (auto-executing a passed proposal) is NOT in v0.5 —
|
|
||||||
// the handler records the tally result but does NOT auto-execute (a
|
|
||||||
// v0.6+ concern; the Executed status exists in the enum but the handler
|
|
||||||
// does not transition to it).
|
|
||||||
//
|
|
||||||
// Nil-shim behavior (simtest wiring): a nil WatcherKeeper shim skips the
|
|
||||||
// Veto authz (the handler still records the Veto — the simtest documents
|
|
||||||
// the wiring contract). A nil StandKeeper / GuildKeeper shim skips the
|
|
||||||
// proposal-target validation (the handler still creates the Proposal — the
|
|
||||||
// simtest documents the wiring contract).
|
|
||||||
|
|
||||||
// msgServer is the concrete MsgServer implementation wrapping the Keeper.
|
|
||||||
type msgServer struct {
|
|
||||||
Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewMsgServerImpl returns the council MsgServer for the provided Keeper.
|
|
||||||
func NewMsgServerImpl(k Keeper) types.MsgServer {
|
|
||||||
return &msgServer{Keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
var _ types.MsgServer = msgServer{}
|
|
||||||
|
|
||||||
// unwrapCtx extracts the sdk.Context from the interface-typed ctx.
|
|
||||||
func unwrapCtx(ctx interface{}) sdk.Context {
|
|
||||||
if c, ok := ctx.(sdk.Context); ok {
|
|
||||||
return c
|
|
||||||
}
|
|
||||||
panic(fmt.Sprintf("council: expected sdk.Context, got %T", ctx))
|
|
||||||
}
|
|
||||||
|
|
||||||
// nowUnix returns the current block time as unix seconds from the ctx.
|
|
||||||
func nowUnix(ctx sdk.Context) int64 {
|
|
||||||
return ctx.BlockTime().Unix()
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- SubmitProposal (creates Proposal status=Pending) ----------------------
|
|
||||||
|
|
||||||
// SubmitProposal creates a Proposal (status=Pending). The handler
|
|
||||||
// enforces:
|
|
||||||
// 1. ValidateBasic (stateless — MissionLockAmendment-Rejected is
|
|
||||||
// REJECTED here per D-064/A-572; the message never reaches this
|
|
||||||
// handler with that kind).
|
|
||||||
// 2. Idempotency: proposal-id must not already exist.
|
|
||||||
// 3. The Council must exist in the runtime store.
|
|
||||||
// 4. Proposal-target validation via the StandKeeper / GuildKeeper shim:
|
|
||||||
// a Stand-kind Proposal requires the Council's stand-id-ref to
|
|
||||||
// reference a real Stand; a Guild-kind Proposal requires the
|
|
||||||
// Council's guild-id-ref to reference a real Guild. A nil shim
|
|
||||||
// skips the check (simtest wiring); a non-nil shim that returns false
|
|
||||||
// REJECTS the submission. A Mesh-kind Proposal has no target ref.
|
|
||||||
//
|
|
||||||
// On success the Proposal is persisted with status=Pending and an event
|
|
||||||
// is emitted.
|
|
||||||
func (s msgServer) SubmitProposal(ctx interface{}, msg *types.MsgSubmitProposal) (*types.MsgSubmitProposalResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Idempotency: proposal-id must not already exist.
|
|
||||||
if _, ok := s.Keeper.GetProposal(sdkCtx, msg.ProposalID); ok {
|
|
||||||
return nil, fmt.Errorf("council: proposal %q already exists", msg.ProposalID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The Council must exist in the runtime store.
|
|
||||||
council, ok := s.Keeper.GetCouncil(sdkCtx, msg.CouncilID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("council: council %q not found", msg.CouncilID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Proposal-target validation via the StandKeeper / GuildKeeper shim.
|
|
||||||
// The kind must be consistent with the Council's kind (a Stand-kind
|
|
||||||
// Proposal targets a Stand Council; a Guild-kind Proposal targets a
|
|
||||||
// Guild Council; a Mesh-kind Proposal targets a Mesh Council). A nil
|
|
||||||
// shim skips the check (simtest wiring).
|
|
||||||
switch msg.Kind {
|
|
||||||
case types.ProposalKindStand:
|
|
||||||
if council.Kind != types.CouncilStand {
|
|
||||||
return nil, fmt.Errorf("council: Stand-kind proposal targets a non-Stand council %q (kind %q)", msg.CouncilID, council.Kind)
|
|
||||||
}
|
|
||||||
if s.Keeper.standKeeper != nil {
|
|
||||||
if !s.Keeper.standKeeper.StandExists(council.StandIDRef) {
|
|
||||||
return nil, fmt.Errorf("council: stand %q does not exist (SubmitProposal rejected — stand-target validation)", council.StandIDRef)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
case types.ProposalKindGuild:
|
|
||||||
if council.Kind != types.CouncilGuild {
|
|
||||||
return nil, fmt.Errorf("council: Guild-kind proposal targets a non-Guild council %q (kind %q)", msg.CouncilID, council.Kind)
|
|
||||||
}
|
|
||||||
if s.Keeper.guildKeeper != nil {
|
|
||||||
if !s.Keeper.guildKeeper.GuildExists(council.GuildIDRef) {
|
|
||||||
return nil, fmt.Errorf("council: guild %q does not exist (SubmitProposal rejected — guild-target validation)", council.GuildIDRef)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
case types.ProposalKindMesh:
|
|
||||||
if council.Kind != types.CouncilMesh {
|
|
||||||
return nil, fmt.Errorf("council: Mesh-kind proposal targets a non-Mesh council %q (kind %q)", msg.CouncilID, council.Kind)
|
|
||||||
}
|
|
||||||
// Mesh Council has no target ref.
|
|
||||||
default:
|
|
||||||
// ProposalMissionLockAmendmentRejected never reaches here
|
|
||||||
// (ValidateBasic rejects it — D-064). The default is defence in
|
|
||||||
// depth.
|
|
||||||
return nil, fmt.Errorf("council: proposal kind %q not valid for submission (D-064 — MissionLockAmendment-Rejected rejected at ValidateBasic)", msg.Kind)
|
|
||||||
}
|
|
||||||
|
|
||||||
proposal := types.Proposal{
|
|
||||||
ProposalID: msg.ProposalID,
|
|
||||||
CouncilID: msg.CouncilID,
|
|
||||||
Kind: msg.Kind,
|
|
||||||
ProposerReach: msg.ProposerReach,
|
|
||||||
SubmitTime: msg.SubmitTime,
|
|
||||||
VotingDeadline: msg.VotingDeadline,
|
|
||||||
Status: types.ProposalStatusPending,
|
|
||||||
Tally: types.TallyResult{}, // zero-value: Yes=0, No=0, Abstain=0, NoWithVeto=0
|
|
||||||
}
|
|
||||||
s.Keeper.SetProposal(sdkCtx, proposal)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"council.proposal_submitted",
|
|
||||||
sdk.NewAttribute("proposal_id", msg.ProposalID),
|
|
||||||
sdk.NewAttribute("council_id", msg.CouncilID),
|
|
||||||
sdk.NewAttribute("kind", string(msg.Kind)),
|
|
||||||
sdk.NewAttribute("proposer_reach", msg.ProposerReach),
|
|
||||||
sdk.NewAttribute("status", string(types.ProposalStatusPending)),
|
|
||||||
))
|
|
||||||
return &types.MsgSubmitProposalResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Vote (records a VoteOption; Veto requires Watcher authz) --------------
|
|
||||||
|
|
||||||
// Vote records a Vote on a Proposal. The handler enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. Idempotency: vote-id must not already exist.
|
|
||||||
// 3. The Proposal must exist.
|
|
||||||
// 4. The Proposal must be Active (vote-on-non-Active REJECTED — the
|
|
||||||
// simtest transitions Pending → Active before voting).
|
|
||||||
// 5. The voting deadline must not have passed (vote-after-deadline
|
|
||||||
// REJECTED).
|
|
||||||
// 6. Veto authz via the WatcherKeeper shim: if Option == VoteOptionVeto,
|
|
||||||
// the voter-reach must be a Watcher (IsWatcher). A nil shim skips the
|
|
||||||
// authz (simtest wiring); a non-nil shim that returns false REJECTS
|
|
||||||
// the Veto (the Vote is NOT recorded). The Veto quorum check is at
|
|
||||||
// TALLY, not at VOTE — the single-Veto-no-block rule (anti-greed,
|
|
||||||
// vision §19) means a single Veto is recorded but does NOT block;
|
|
||||||
// the quorum (default 6 per D-065/A-574) must be met at tally to FAIL
|
|
||||||
// the proposal.
|
|
||||||
//
|
|
||||||
// On success the Vote is persisted, the Proposal's Tally is updated
|
|
||||||
// (Yes/No/Abstain/NoWithVeto counts incremented), and an event is emitted.
|
|
||||||
func (s msgServer) Vote(ctx interface{}, msg *types.MsgVote) (*types.MsgVoteResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Idempotency: vote-id must not already exist.
|
|
||||||
if _, ok := s.Keeper.GetVote(sdkCtx, msg.VoteID); ok {
|
|
||||||
return nil, fmt.Errorf("council: vote %q already exists", msg.VoteID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The Proposal must exist.
|
|
||||||
proposal, ok := s.Keeper.GetProposal(sdkCtx, msg.ProposalID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("council: proposal %q not found", msg.ProposalID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The Proposal must be Active (vote-on-non-Active REJECTED).
|
|
||||||
if proposal.Status != types.ProposalStatusActive {
|
|
||||||
return nil, fmt.Errorf("council: proposal %q status %q is not Active (vote rejected)", msg.ProposalID, proposal.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The voting deadline must not have passed (vote-after-deadline
|
|
||||||
// REJECTED). now = block time; if now >= VotingDeadline, the window
|
|
||||||
// is closed.
|
|
||||||
now := nowUnix(sdkCtx)
|
|
||||||
if now >= proposal.VotingDeadline {
|
|
||||||
return nil, fmt.Errorf("council: proposal %q voting deadline %d has passed (now %d) — vote rejected", msg.ProposalID, proposal.VotingDeadline, now)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Veto authz via the WatcherKeeper shim. If Option == VoteOptionVeto,
|
|
||||||
// the voter-reach must be a Watcher. A nil shim skips the authz
|
|
||||||
// (simtest wiring); a non-nil shim that returns false REJECTS the
|
|
||||||
// Veto (the Vote is NOT recorded). The Veto quorum check is at
|
|
||||||
// TALLY, not at VOTE.
|
|
||||||
if msg.Option == types.VoteOptionVeto && s.Keeper.watcherKeeper != nil {
|
|
||||||
if !s.Keeper.watcherKeeper.IsWatcher(msg.VoterReach) {
|
|
||||||
return nil, fmt.Errorf("council: voter %q is not a Watcher (Veto requires Watcher authz — D-065/A-574)", msg.VoterReach)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Record the Vote.
|
|
||||||
vote := types.Vote{
|
|
||||||
VoteID: msg.VoteID,
|
|
||||||
ProposalID: msg.ProposalID,
|
|
||||||
VoterReach: msg.VoterReach,
|
|
||||||
Option: msg.Option,
|
|
||||||
Timestamp: now,
|
|
||||||
}
|
|
||||||
s.Keeper.SetVote(sdkCtx, vote)
|
|
||||||
|
|
||||||
// Update the Proposal's running Tally.
|
|
||||||
switch msg.Option {
|
|
||||||
case types.VoteOptionYes:
|
|
||||||
proposal.Tally.Yes++
|
|
||||||
case types.VoteOptionNo:
|
|
||||||
proposal.Tally.No++
|
|
||||||
case types.VoteOptionAbstain:
|
|
||||||
proposal.Tally.Abstain++
|
|
||||||
case types.VoteOptionVeto:
|
|
||||||
// NoWithVeto is POPULATED by Watcher Vetos (D-060 — the v0.2
|
|
||||||
// zero-locked field is now populated; G-017 reconciles the v0.2
|
|
||||||
// regression: the DEFAULT tally has NoWithVeto=0, but a tally
|
|
||||||
// after a Watcher Veto quorum has NoWithVeto > 0).
|
|
||||||
proposal.Tally.NoWithVeto++
|
|
||||||
}
|
|
||||||
proposal.Tally.Total++
|
|
||||||
s.Keeper.SetProposal(sdkCtx, proposal)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"council.vote_cast",
|
|
||||||
sdk.NewAttribute("vote_id", msg.VoteID),
|
|
||||||
sdk.NewAttribute("proposal_id", msg.ProposalID),
|
|
||||||
sdk.NewAttribute("voter_reach", msg.VoterReach),
|
|
||||||
sdk.NewAttribute("option", string(msg.Option)),
|
|
||||||
))
|
|
||||||
return &types.MsgVoteResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- TallyProposal (close voting, compute tally, transition) ---------------
|
|
||||||
|
|
||||||
// TallyProposal tallies a Proposal: closes the voting deadline, computes
|
|
||||||
// the Yes/No/Abstain/Veto tally, and transitions the Proposal to Succeeded
|
|
||||||
// (Yes quorum met, Veto quorum NOT met) or Failed (No quorum OR Veto
|
|
||||||
// quorum met — D-065/A-574). The handler enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. The Proposal must exist.
|
|
||||||
// 3. The voting deadline must have passed (tally-before-deadline
|
|
||||||
// REJECTED — the tally closes the window).
|
|
||||||
// 4. The Proposal must be Active (tally-on-non-Active REJECTED — a
|
|
||||||
// Pending proposal has not opened voting; a Succeeded/Failed/
|
|
||||||
// Executed proposal is already tallied).
|
|
||||||
//
|
|
||||||
// Veto semantics (D-065/A-574): a single Veto does NOT block (anti-greed,
|
|
||||||
// vision §19); the proposal transitions to Failed only if
|
|
||||||
// NoWithVeto >= WatcherVetoQuorum (default 6). The handler reads the
|
|
||||||
// WatcherVetoQuorum from the Params (the Keeper holds the Params); the
|
|
||||||
// simtest overrides the Params to test the quorum boundary.
|
|
||||||
//
|
|
||||||
// On success the Proposal's Tally is finalized (the running tally is
|
|
||||||
// already maintained by Vote; the handler recomputes from the Vote
|
|
||||||
// store for defence in depth), the Status transitions to Succeeded or
|
|
||||||
// Failed, and an event is emitted. No auto-execution (the Executed
|
|
||||||
// status exists in the enum but the handler does not transition to it —
|
|
||||||
// execution is v0.6+).
|
|
||||||
func (s msgServer) TallyProposal(ctx interface{}, msg *types.MsgTallyProposal) (*types.MsgTallyProposalResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// The Proposal must exist.
|
|
||||||
proposal, ok := s.Keeper.GetProposal(sdkCtx, msg.ProposalID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("council: proposal %q not found", msg.ProposalID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The Proposal must be Active (tally-on-non-Active REJECTED).
|
|
||||||
if proposal.Status != types.ProposalStatusActive {
|
|
||||||
return nil, fmt.Errorf("council: proposal %q status %q is not Active (tally rejected)", msg.ProposalID, proposal.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The voting deadline must have passed (tally-before-deadline
|
|
||||||
// REJECTED). now = block time; if now < VotingDeadline, the window
|
|
||||||
// is still open.
|
|
||||||
now := nowUnix(sdkCtx)
|
|
||||||
if now < proposal.VotingDeadline {
|
|
||||||
return nil, fmt.Errorf("council: proposal %q voting deadline %d not yet reached (now %d) — tally rejected", msg.ProposalID, proposal.VotingDeadline, now)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Recompute the tally from the Vote store (defence in depth — the
|
|
||||||
// running tally in proposal.Tally should already match, but the
|
|
||||||
// handler recomputes to guard against any drift).
|
|
||||||
votes := s.Keeper.VotesForProposal(sdkCtx, msg.ProposalID)
|
|
||||||
tally := types.TallyResult{}
|
|
||||||
for _, v := range votes {
|
|
||||||
switch v.Option {
|
|
||||||
case types.VoteOptionYes:
|
|
||||||
tally.Yes++
|
|
||||||
case types.VoteOptionNo:
|
|
||||||
tally.No++
|
|
||||||
case types.VoteOptionAbstain:
|
|
||||||
tally.Abstain++
|
|
||||||
case types.VoteOptionVeto:
|
|
||||||
tally.NoWithVeto++
|
|
||||||
}
|
|
||||||
tally.Total++
|
|
||||||
}
|
|
||||||
|
|
||||||
// Veto quorum check (D-065/A-574). The WatcherVetoQuorum is from the
|
|
||||||
// Params (default 6). A single Veto does NOT block (anti-greed,
|
|
||||||
// vision §19); the proposal transitions to Failed only if
|
|
||||||
// NoWithVeto >= WatcherVetoQuorum.
|
|
||||||
vetoQuorum := s.Keeper.GetParams().WatcherVetoQuorum
|
|
||||||
if vetoQuorum == 0 {
|
|
||||||
// Defence in depth: a zero quorum (e.g., from a zero-value Params
|
|
||||||
// not set via DefaultParams) would block on any Veto, violating
|
|
||||||
// the single-Veto-no-block rule. Fall back to the default (6).
|
|
||||||
vetoQuorum = types.WatcherVetoQuorumDefault
|
|
||||||
}
|
|
||||||
|
|
||||||
// Determine the outcome.
|
|
||||||
// - Veto quorum met → Failed (D-065/A-574).
|
|
||||||
// - Else: Yes > No (Abstain excluded) → Succeeded; else → Failed.
|
|
||||||
// A tie (Yes == No) → Failed (the proposal does not pass).
|
|
||||||
vetoQuorumMet := tally.NoWithVeto >= uint64(vetoQuorum)
|
|
||||||
var newStatus types.ProposalStatus
|
|
||||||
if vetoQuorumMet {
|
|
||||||
newStatus = types.ProposalStatusFailed
|
|
||||||
} else if tally.Yes > tally.No {
|
|
||||||
newStatus = types.ProposalStatusSucceeded
|
|
||||||
} else {
|
|
||||||
newStatus = types.ProposalStatusFailed
|
|
||||||
}
|
|
||||||
|
|
||||||
// Finalize the tally on the Proposal.
|
|
||||||
proposal.Tally = tally
|
|
||||||
proposal.Tally.QuorumMet = (tally.Yes + tally.No + tally.Abstain + tally.NoWithVeto) > 0
|
|
||||||
proposal.Status = newStatus
|
|
||||||
s.Keeper.SetProposal(sdkCtx, proposal)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"council.proposal_tallied",
|
|
||||||
sdk.NewAttribute("proposal_id", msg.ProposalID),
|
|
||||||
sdk.NewAttribute("yes", fmt.Sprintf("%d", tally.Yes)),
|
|
||||||
sdk.NewAttribute("no", fmt.Sprintf("%d", tally.No)),
|
|
||||||
sdk.NewAttribute("abstain", fmt.Sprintf("%d", tally.Abstain)),
|
|
||||||
sdk.NewAttribute("nowithveto", fmt.Sprintf("%d", tally.NoWithVeto)),
|
|
||||||
sdk.NewAttribute("total", fmt.Sprintf("%d", tally.Total)),
|
|
||||||
sdk.NewAttribute("veto_quorum", fmt.Sprintf("%d", vetoQuorum)),
|
|
||||||
sdk.NewAttribute("status", string(newStatus)),
|
|
||||||
))
|
|
||||||
return &types.MsgTallyProposalResponse{}, nil
|
|
||||||
}
|
|
||||||
@@ -1,966 +0,0 @@
|
|||||||
package keeper_test
|
|
||||||
|
|
||||||
// msg_server_simtest_test.go is the x/council keeper simtest (P7-04-01,
|
|
||||||
// REQ-039, D-060).
|
|
||||||
//
|
|
||||||
// D-054: simtest-grade — in-memory sdk.Context + dbm in-memory store, no
|
|
||||||
// real watcher/stand/guild keepers. The simtest wires the expected-keeper
|
|
||||||
// shims (WatcherKeeper, StandKeeper, GuildKeeper) to in-test stubs
|
|
||||||
// (G-003 test exemption: the test imports x/council/keeper + defines stub
|
|
||||||
// types that satisfy the interfaces; no production struct imports across
|
|
||||||
// x/<module>/types).
|
|
||||||
//
|
|
||||||
// Coverage (REQ-039 lifecycle Pending → Active → Vote → Tally →
|
|
||||||
// Succeeded/Failed):
|
|
||||||
// - Full success lifecycle: Submit (Pending) → Active → Vote (Yes) →
|
|
||||||
// Tally → Succeeded.
|
|
||||||
// - MissionLockAmendment-Rejected kind REJECTED at ValidateBasic
|
|
||||||
// (D-064/A-572 — the message never reaches the handler; the keeper
|
|
||||||
// Proposal store stays empty).
|
|
||||||
// - Veto semantics (D-065/A-574):
|
|
||||||
// - Single Veto does NOT block (anti-greed, vision §19): a single
|
|
||||||
// Veto + majority Yes → Succeeded.
|
|
||||||
// - Veto quorum (default 6) → Failed: 6 Vetos → Failed.
|
|
||||||
// - Quorum boundary: quorum-1 = 5 Vetos (below default 6) + majority
|
|
||||||
// Yes → Succeeded; quorum-6 = 6 Vetos → Failed.
|
|
||||||
// - Watcher authz for Veto: a non-Watcher casting Veto is REJECTED
|
|
||||||
// (the Vote is NOT recorded).
|
|
||||||
// - Vote-on-non-Active REJECTED (vote on a Pending proposal → error).
|
|
||||||
// - Vote-after-deadline REJECTED (now >= VotingDeadline → error).
|
|
||||||
// - Tally-before-deadline REJECTED (now < VotingDeadline → error).
|
|
||||||
// - Tally-on-non-Active REJECTED (tally on a Pending proposal → error).
|
|
||||||
// - Idempotency: duplicate proposal-id + duplicate vote-id → error.
|
|
||||||
// - NotFound: Vote/Tally on a missing proposal-id → error.
|
|
||||||
// - Proposal-target validation: Stand-kind Proposal on a non-Stand
|
|
||||||
// Council REJECTED; Guild-kind Proposal on a non-Guild Council
|
|
||||||
// REJECTED; Stand-kind Proposal with a non-existent stand-id-ref
|
|
||||||
// REJECTED (via the StandKeeper stub).
|
|
||||||
// - ValidateBasic: each Msg* ValidateBasic error path.
|
|
||||||
//
|
|
||||||
// Coverage target: ≥80% on x/council/keeper.
|
|
||||||
|
|
||||||
import (
|
|
||||||
"testing"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
"cosmossdk.io/log"
|
|
||||||
"cosmossdk.io/store"
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
cmtproto "github.com/cometbft/cometbft/proto/tendermint/types"
|
|
||||||
dbm "github.com/cosmos/cosmos-db"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
codectypes "github.com/cosmos/cosmos-sdk/codec/types"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/council/keeper"
|
|
||||||
"github.com/oy/openyield/x/council/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// --- Stub expected-keepers (G-003 test exemption) ---------------------------
|
|
||||||
|
|
||||||
// stubWatcherKeeper satisfies types.WatcherKeeper for the simtest. It
|
|
||||||
// records IsWatcher + CountWatchers calls for assertion and returns the
|
|
||||||
// configured watcher-set + per-reach-id watcher membership.
|
|
||||||
type stubWatcherKeeper struct {
|
|
||||||
isWatcher map[string]bool // reach-id → is-watcher
|
|
||||||
watcherCount int // total Watcher set size (default 9 per REQ-004)
|
|
||||||
calls []string // recorded IsWatcher reach-ids
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *stubWatcherKeeper) IsWatcher(reachID string) bool {
|
|
||||||
s.calls = append(s.calls, reachID)
|
|
||||||
if s.isWatcher != nil {
|
|
||||||
return s.isWatcher[reachID]
|
|
||||||
}
|
|
||||||
return true // default: all are Watchers (simtest wiring)
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *stubWatcherKeeper) CountWatchers() int {
|
|
||||||
if s.watcherCount == 0 {
|
|
||||||
return 9 // REQ-004: 9 Watchers
|
|
||||||
}
|
|
||||||
return s.watcherCount
|
|
||||||
}
|
|
||||||
|
|
||||||
// stubStandKeeper satisfies types.StandKeeper for the simtest. Returns
|
|
||||||
// the configured existence per stand-id (default: exists=true).
|
|
||||||
type stubStandKeeper struct {
|
|
||||||
exists map[string]bool
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *stubStandKeeper) StandExists(standID string) bool {
|
|
||||||
if s.exists != nil {
|
|
||||||
return s.exists[standID]
|
|
||||||
}
|
|
||||||
return true // default: exists (simtest wiring)
|
|
||||||
}
|
|
||||||
|
|
||||||
// stubGuildKeeper satisfies types.GuildKeeper for the simtest.
|
|
||||||
type stubGuildKeeper struct {
|
|
||||||
exists map[string]bool
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *stubGuildKeeper) GuildExists(guildID string) bool {
|
|
||||||
if s.exists != nil {
|
|
||||||
return s.exists[guildID]
|
|
||||||
}
|
|
||||||
return true // default: exists (simtest wiring)
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Simtest context helper --------------------------------------------------
|
|
||||||
|
|
||||||
// newSimtestContext constructs an in-memory sdk.Context with a KVStore
|
|
||||||
// mounted at the council store key. D-054: in-memory, no real
|
|
||||||
// watcher/stand/guild keepers. Returns the ctx, the stub WatcherKeeper,
|
|
||||||
// the stub StandKeeper, the stub GuildKeeper, and the Keeper.
|
|
||||||
func newSimtestContext(t *testing.T) (sdk.Context, *stubWatcherKeeper, *stubStandKeeper, *stubGuildKeeper, keeper.Keeper) {
|
|
||||||
t.Helper()
|
|
||||||
db := dbm.NewMemDB()
|
|
||||||
cdc := newTestCodec()
|
|
||||||
storeKey := storetypes.NewKVStoreKey(types.StoreKey)
|
|
||||||
cms := store.NewCommitMultiStore(db, log.NewNopLogger(), nil)
|
|
||||||
cms.MountStoreWithDB(storeKey, storetypes.StoreTypeDB, nil)
|
|
||||||
if err := cms.LoadLatestVersion(); err != nil {
|
|
||||||
t.Fatalf("load latest version: %v", err)
|
|
||||||
}
|
|
||||||
// Block time set to a fixed unix second so lifecycle timestamps are
|
|
||||||
// deterministic (now = 1000).
|
|
||||||
ctx := sdk.NewContext(cms, cmtproto.Header{Time: time.Unix(1000, 0)}, false, log.NewNopLogger())
|
|
||||||
|
|
||||||
wk := &stubWatcherKeeper{}
|
|
||||||
sk := &stubStandKeeper{}
|
|
||||||
gk := &stubGuildKeeper{}
|
|
||||||
k := keeper.NewKeeper(cdc, storeKey, wk, sk, gk)
|
|
||||||
return ctx, wk, sk, gk, k
|
|
||||||
}
|
|
||||||
|
|
||||||
// newTestCodec constructs a minimal codec for the simtest.
|
|
||||||
func newTestCodec() codec.Codec {
|
|
||||||
registry := codectypes.NewInterfaceRegistry()
|
|
||||||
return codec.NewProtoCodec(registry)
|
|
||||||
}
|
|
||||||
|
|
||||||
// hasEvent reports whether ctx emitted an event of the given type.
|
|
||||||
func hasEvent(ctx sdk.Context, eventType string) bool {
|
|
||||||
for _, ev := range ctx.EventManager().Events() {
|
|
||||||
if ev.Type == eventType {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
|
|
||||||
// eventAttr returns the value of an attribute on the last event of the
|
|
||||||
// given type, or "" if not found.
|
|
||||||
func eventAttr(ctx sdk.Context, eventType, attrKey string) string {
|
|
||||||
for _, ev := range ctx.EventManager().Events() {
|
|
||||||
if ev.Type == eventType {
|
|
||||||
for _, a := range ev.Attributes {
|
|
||||||
if string(a.Key) == attrKey {
|
|
||||||
return string(a.Value)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return ""
|
|
||||||
}
|
|
||||||
|
|
||||||
// seedCouncil seeds a Council into the runtime store for the SubmitProposal
|
|
||||||
// target validation. Returns the Council.
|
|
||||||
func seedCouncil(k keeper.Keeper, ctx sdk.Context, councilID string, kind types.CouncilKind, standRef, guildRef string) types.Council {
|
|
||||||
c := types.Council{
|
|
||||||
CouncilID: councilID,
|
|
||||||
Kind: kind,
|
|
||||||
StandIDRef: standRef,
|
|
||||||
GuildIDRef: guildRef,
|
|
||||||
Members: []types.CouncilMember{{ReachID: "reach:member-1", VoiceWeight: 1, JoinedAt: 0}},
|
|
||||||
VoiceThreshold: 1,
|
|
||||||
}
|
|
||||||
k.SetCouncil(ctx, c)
|
|
||||||
return c
|
|
||||||
}
|
|
||||||
|
|
||||||
// activateProposal transitions a Pending Proposal to Active (the simtest
|
|
||||||
// helper — the v0.5 keeper does not expose an Activate message; the
|
|
||||||
// handler creates Pending and the tally closes Active; the Pending →
|
|
||||||
// Active transition is the voting-window-open transition, which in a
|
|
||||||
// real chain would be triggered by the block height crossing the
|
|
||||||
// submit-time. For the simtest, the helper flips the status directly to
|
|
||||||
// enable voting).
|
|
||||||
func activateProposal(k keeper.Keeper, ctx sdk.Context, proposalID string) types.Proposal {
|
|
||||||
p, ok := k.GetProposal(ctx, proposalID)
|
|
||||||
if !ok {
|
|
||||||
panic("activateProposal: proposal not found: " + proposalID)
|
|
||||||
}
|
|
||||||
p.Status = types.ProposalStatusActive
|
|
||||||
k.SetProposal(ctx, p)
|
|
||||||
return p
|
|
||||||
}
|
|
||||||
|
|
||||||
// newSubmitMsg returns a valid MsgSubmitProposal for a Mesh Council.
|
|
||||||
func newSubmitMsg(proposalID, councilID string, kind types.ProposalKind, deadline int64) *types.MsgSubmitProposal {
|
|
||||||
return &types.MsgSubmitProposal{
|
|
||||||
ProposalID: proposalID,
|
|
||||||
CouncilID: councilID,
|
|
||||||
Kind: kind,
|
|
||||||
ProposerReach: "reach:prop",
|
|
||||||
SubmitTime: 500,
|
|
||||||
VotingDeadline: deadline,
|
|
||||||
Signer: "reach:prop",
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Full success lifecycle: Pending → Active → Vote → Tally → Succeeded -------
|
|
||||||
|
|
||||||
// TestProposalLifecycleFullSuccess asserts the full success lifecycle:
|
|
||||||
// Submit (Pending) → Active → Vote (Yes majority) → Tally → Succeeded.
|
|
||||||
func TestProposalLifecycleFullSuccess(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
|
|
||||||
// Submit → Pending.
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p1", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
p, ok := k.GetProposal(ctx, "p1")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("proposal not found after submit")
|
|
||||||
}
|
|
||||||
if p.Status != types.ProposalStatusPending {
|
|
||||||
t.Errorf("status = %q, want Pending", p.Status)
|
|
||||||
}
|
|
||||||
if p.Kind != types.ProposalKindMesh {
|
|
||||||
t.Errorf("kind = %q, want Mesh", p.Kind)
|
|
||||||
}
|
|
||||||
if !hasEvent(ctx, "council.proposal_submitted") {
|
|
||||||
t.Error("proposal_submitted event not emitted")
|
|
||||||
}
|
|
||||||
|
|
||||||
// Pending → Active (simtest helper).
|
|
||||||
activateProposal(k, ctx, "p1")
|
|
||||||
|
|
||||||
// Vote (3 Yes, 1 No → Yes majority → Succeeded on tally).
|
|
||||||
for i, voter := range []string{"reach:a", "reach:b", "reach:c"} {
|
|
||||||
if _, err := srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-yes-" + string(rune('A'+i)),
|
|
||||||
ProposalID: "p1", VoterReach: voter, Option: types.VoteOptionYes, Signer: voter,
|
|
||||||
}); err != nil {
|
|
||||||
t.Fatalf("Vote[%d]: %v", i, err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if _, err := srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-no-1", ProposalID: "p1", VoterReach: "reach:d", Option: types.VoteOptionNo, Signer: "reach:d",
|
|
||||||
}); err != nil {
|
|
||||||
t.Fatalf("Vote No: %v", err)
|
|
||||||
}
|
|
||||||
if !hasEvent(ctx, "council.vote_cast") {
|
|
||||||
t.Error("vote_cast event not emitted")
|
|
||||||
}
|
|
||||||
|
|
||||||
// Advance block time past the voting deadline (now=1000 < 2000; need
|
|
||||||
// now >= 2000 to tally). Re-create the ctx with a later block time.
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
|
|
||||||
// Tally → Succeeded (Yes=3 > No=1, no Vetos).
|
|
||||||
if _, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p1", Signer: "reach:tally"}); err != nil {
|
|
||||||
t.Fatalf("TallyProposal: %v", err)
|
|
||||||
}
|
|
||||||
p, _ = k.GetProposal(ctx, "p1")
|
|
||||||
if p.Status != types.ProposalStatusSucceeded {
|
|
||||||
t.Errorf("status = %q, want Succeeded (Yes=3 > No=1)", p.Status)
|
|
||||||
}
|
|
||||||
if p.Tally.Yes != 3 || p.Tally.No != 1 || p.Tally.Abstain != 0 || p.Tally.NoWithVeto != 0 || p.Tally.Total != 4 {
|
|
||||||
t.Errorf("tally = %+v, want Yes=3 No=1 Abstain=0 NoWithVeto=0 Total=4", p.Tally)
|
|
||||||
}
|
|
||||||
if !p.Tally.QuorumMet {
|
|
||||||
t.Error("QuorumMet should be true (Total > 0)")
|
|
||||||
}
|
|
||||||
if !hasEvent(ctx, "council.proposal_tallied") {
|
|
||||||
t.Error("proposal_tallied event not emitted")
|
|
||||||
}
|
|
||||||
if eventAttr(ctx, "council.proposal_tallied", "status") != string(types.ProposalStatusSucceeded) {
|
|
||||||
t.Errorf("tally event status = %q, want Succeeded", eventAttr(ctx, "council.proposal_tallied", "status"))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MissionLockAmendment-Rejected REJECTED at ValidateBasic (D-064) --------
|
|
||||||
|
|
||||||
// TestMissionLockAmendmentRejectedAtValidateBasic asserts the
|
|
||||||
// MissionLockAmendment-Rejected kind is REJECTED at ValidateBasic
|
|
||||||
// (D-064/A-572 — the message never reaches the handler; the keeper
|
|
||||||
// Proposal store stays empty).
|
|
||||||
func TestMissionLockAmendmentRejectedAtValidateBasic(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
|
|
||||||
msg := newSubmitMsg("p-mla", "cm", types.ProposalMissionLockAmendmentRejected, 2000)
|
|
||||||
_, err := srv.SubmitProposal(ctx, msg)
|
|
||||||
if err == nil {
|
|
||||||
t.Fatal("SubmitProposal with MissionLockAmendment-Rejected kind should be rejected at ValidateBasic (D-064)")
|
|
||||||
}
|
|
||||||
// The keeper Proposal store stays empty (the handler was never
|
|
||||||
// invoked with this kind — ValidateBasic rejected it).
|
|
||||||
if _, ok := k.GetProposal(ctx, "p-mla"); ok {
|
|
||||||
t.Error("Proposal store should be empty — the MissionLockAmendment-Rejected message never reaches the handler (D-064)")
|
|
||||||
}
|
|
||||||
if !hasEvent(ctx, "council.proposal_submitted") {
|
|
||||||
// no event emitted (the rejection is at ValidateBasic, before
|
|
||||||
// the handler emits any event) — this is correct.
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Veto semantics (D-065/A-574) --------------------------------------------
|
|
||||||
|
|
||||||
// TestVetoSingleDoesNotBlock asserts a single Veto does NOT block
|
|
||||||
// (anti-greed, vision §19, D-065): a single Veto + majority Yes →
|
|
||||||
// Succeeded. The Veto quorum (default 6) must be met to FAIL.
|
|
||||||
func TestVetoSingleDoesNotBlock(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-veto-1", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-veto-1")
|
|
||||||
|
|
||||||
// 3 Yes + 1 Veto → Yes majority, single Veto does NOT block → Succeeded.
|
|
||||||
for i, voter := range []string{"reach:a", "reach:b", "reach:c"} {
|
|
||||||
srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "vy" + string(rune('A'+i)), ProposalID: "p-veto-1", VoterReach: voter, Option: types.VoteOptionYes, Signer: voter,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
// 1 Veto (watcher-1 is a Watcher via the default stub).
|
|
||||||
srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "vv1", ProposalID: "p-veto-1", VoterReach: "reach:watcher-1", Option: types.VoteOptionVeto, Signer: "reach:watcher-1",
|
|
||||||
})
|
|
||||||
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
if _, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-veto-1", Signer: "reach:tally"}); err != nil {
|
|
||||||
t.Fatalf("TallyProposal: %v", err)
|
|
||||||
}
|
|
||||||
p, _ := k.GetProposal(ctx, "p-veto-1")
|
|
||||||
if p.Status != types.ProposalStatusSucceeded {
|
|
||||||
t.Errorf("status = %q, want Succeeded (single Veto does NOT block — D-065 anti-greed; Yes=3 > No=0)", p.Status)
|
|
||||||
}
|
|
||||||
if p.Tally.NoWithVeto != 1 {
|
|
||||||
t.Errorf("NoWithVeto = %d, want 1 (single Veto recorded but does NOT block)", p.Tally.NoWithVeto)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVetoQuorumBlocks asserts the Veto quorum (default 6) FAILS the
|
|
||||||
// proposal: 6 Vetos → Failed (D-065/A-574).
|
|
||||||
func TestVetoQuorumBlocks(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-veto-q", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-veto-q")
|
|
||||||
|
|
||||||
// 2 Yes + 6 Vetos → Veto quorum met → Failed.
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy1", ProposalID: "p-veto-q", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy2", ProposalID: "p-veto-q", VoterReach: "reach:b", Option: types.VoteOptionYes, Signer: "reach:b"})
|
|
||||||
for i := 0; i < 6; i++ {
|
|
||||||
voter := "reach:watcher-" + string(rune('A'+i))
|
|
||||||
srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "vv" + string(rune('A'+i)), ProposalID: "p-veto-q", VoterReach: voter, Option: types.VoteOptionVeto, Signer: voter,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
if _, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-veto-q", Signer: "reach:tally"}); err != nil {
|
|
||||||
t.Fatalf("TallyProposal: %v", err)
|
|
||||||
}
|
|
||||||
p, _ := k.GetProposal(ctx, "p-veto-q")
|
|
||||||
if p.Status != types.ProposalStatusFailed {
|
|
||||||
t.Errorf("status = %q, want Failed (Veto quorum met — 6 Vetos >= default 6 per D-065/A-574)", p.Status)
|
|
||||||
}
|
|
||||||
if p.Tally.NoWithVeto != 6 {
|
|
||||||
t.Errorf("NoWithVeto = %d, want 6 (quorum)", p.Tally.NoWithVeto)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVetoQuorumBoundary asserts the quorum boundary: 5 Vetos (below the
|
|
||||||
// default 6) + majority Yes → Succeeded; 6 Vetos → Failed.
|
|
||||||
func TestVetoQuorumBoundary(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-bnd", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-bnd")
|
|
||||||
|
|
||||||
// 3 Yes + 5 Vetos (below default quorum 6) → Succeeded.
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy1", ProposalID: "p-bnd", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy2", ProposalID: "p-bnd", VoterReach: "reach:b", Option: types.VoteOptionYes, Signer: "reach:b"})
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy3", ProposalID: "p-bnd", VoterReach: "reach:c", Option: types.VoteOptionYes, Signer: "reach:c"})
|
|
||||||
for i := 0; i < 5; i++ {
|
|
||||||
voter := "reach:watcher-" + string(rune('A'+i))
|
|
||||||
srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "vv" + string(rune('A'+i)), ProposalID: "p-bnd", VoterReach: voter, Option: types.VoteOptionVeto, Signer: voter,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
if _, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-bnd", Signer: "reach:tally"}); err != nil {
|
|
||||||
t.Fatalf("TallyProposal (5 Vetos, below quorum): %v", err)
|
|
||||||
}
|
|
||||||
p, _ := k.GetProposal(ctx, "p-bnd")
|
|
||||||
if p.Status != types.ProposalStatusSucceeded {
|
|
||||||
t.Errorf("status = %q, want Succeeded (5 Vetos < default quorum 6 — single-Veto-no-block quorum rule; Yes=3 > No=0)", p.Status)
|
|
||||||
}
|
|
||||||
if p.Tally.NoWithVeto != 5 {
|
|
||||||
t.Errorf("NoWithVeto = %d, want 5 (below quorum)", p.Tally.NoWithVeto)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVetoQuorumCustom asserts the WatcherVetoQuorum Params field is
|
|
||||||
// honored: setting the quorum to 3 makes 3 Vetos FAIL the proposal. The
|
|
||||||
// Params must be set BEFORE constructing the MsgServer (the server embeds
|
|
||||||
// the Keeper by value).
|
|
||||||
func TestVetoQuorumCustom(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
// Override the quorum to 3 BEFORE constructing the MsgServer.
|
|
||||||
k.SetParams(types.Params{WatcherVetoQuorum: 3})
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-cq", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-cq")
|
|
||||||
|
|
||||||
// 2 Yes + 3 Vetos → quorum 3 met → Failed.
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy1", ProposalID: "p-cq", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy2", ProposalID: "p-cq", VoterReach: "reach:b", Option: types.VoteOptionYes, Signer: "reach:b"})
|
|
||||||
for i := 0; i < 3; i++ {
|
|
||||||
voter := "reach:watcher-" + string(rune('A'+i))
|
|
||||||
srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "vv" + string(rune('A'+i)), ProposalID: "p-cq", VoterReach: voter, Option: types.VoteOptionVeto, Signer: voter,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
if _, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-cq", Signer: "reach:tally"}); err != nil {
|
|
||||||
t.Fatalf("TallyProposal: %v", err)
|
|
||||||
}
|
|
||||||
p, _ := k.GetProposal(ctx, "p-cq")
|
|
||||||
if p.Status != types.ProposalStatusFailed {
|
|
||||||
t.Errorf("status = %q, want Failed (custom quorum 3 met — 3 Vetos >= 3)", p.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Watcher authz for Veto --------------------------------------------------
|
|
||||||
|
|
||||||
// TestVetoNonWatcherRejected asserts a non-Watcher casting Veto is
|
|
||||||
// REJECTED at the handler (the Vote is NOT recorded). The WatcherKeeper
|
|
||||||
// stub is configured to report reach:nonwatcher as a non-Watcher.
|
|
||||||
func TestVetoNonWatcherRejected(t *testing.T) {
|
|
||||||
ctx, wk, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-nw", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-nw")
|
|
||||||
|
|
||||||
// Configure the stub: reach:nonwatcher is NOT a Watcher.
|
|
||||||
wk.isWatcher = map[string]bool{"reach:nonwatcher": false, "reach:watcher-1": true}
|
|
||||||
|
|
||||||
// Non-Watcher Veto → REJECTED.
|
|
||||||
_, err := srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-nw", ProposalID: "p-nw", VoterReach: "reach:nonwatcher", Option: types.VoteOptionVeto, Signer: "reach:nonwatcher",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Fatal("Veto from non-Watcher should be REJECTED (D-065/A-574 Watcher authz)")
|
|
||||||
}
|
|
||||||
// The Vote is NOT recorded.
|
|
||||||
if _, ok := k.GetVote(ctx, "v-nw"); ok {
|
|
||||||
t.Error("Vote from non-Watcher should NOT be recorded")
|
|
||||||
}
|
|
||||||
// The Proposal's tally is NOT updated (NoWithVeto stays 0).
|
|
||||||
p, _ := k.GetProposal(ctx, "p-nw")
|
|
||||||
if p.Tally.NoWithVeto != 0 {
|
|
||||||
t.Errorf("NoWithVeto = %d, want 0 (non-Watcher Veto rejected, not recorded)", p.Tally.NoWithVeto)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Watcher Veto → accepted.
|
|
||||||
if _, err := srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-w", ProposalID: "p-nw", VoterReach: "reach:watcher-1", Option: types.VoteOptionVeto, Signer: "reach:watcher-1",
|
|
||||||
}); err != nil {
|
|
||||||
t.Fatalf("Veto from Watcher should be accepted; got: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVetoNilWatcherKeeperPath exercises the nil-WatcherKeeper-shim path
|
|
||||||
// directly: construct a fresh Keeper with nil shims and assert a Veto is
|
|
||||||
// recorded (the nil guard skips the authz). The single-Veto-no-block
|
|
||||||
// rule (anti-greed, vision §19) is preserved: a single Veto is recorded
|
|
||||||
// but does NOT block; the quorum (default 6) must be met at tally.
|
|
||||||
func TestVetoNilWatcherKeeperPath(t *testing.T) {
|
|
||||||
db := dbm.NewMemDB()
|
|
||||||
storeKey := storetypes.NewKVStoreKey(types.StoreKey)
|
|
||||||
cms := store.NewCommitMultiStore(db, log.NewNopLogger(), nil)
|
|
||||||
cms.MountStoreWithDB(storeKey, storetypes.StoreTypeDB, nil)
|
|
||||||
if err := cms.LoadLatestVersion(); err != nil {
|
|
||||||
t.Fatalf("load latest version: %v", err)
|
|
||||||
}
|
|
||||||
ctx := sdk.NewContext(cms, cmtproto.Header{Time: time.Unix(1000, 0)}, false, log.NewNopLogger())
|
|
||||||
// nil WatcherKeeper, nil StandKeeper, nil GuildKeeper.
|
|
||||||
k := keeper.NewKeeper(nil, storeKey, nil, nil, nil)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-nil-wk", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-nil-wk")
|
|
||||||
|
|
||||||
// Veto from any reach-id — nil shim skips authz → accepted.
|
|
||||||
if _, err := srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-nil-wk", ProposalID: "p-nil-wk", VoterReach: "reach:nonwatcher", Option: types.VoteOptionVeto, Signer: "reach:nonwatcher",
|
|
||||||
}); err != nil {
|
|
||||||
t.Fatalf("Veto with nil WatcherKeeper should be accepted (nil shim skips authz); got: %v", err)
|
|
||||||
}
|
|
||||||
p, _ := k.GetProposal(ctx, "p-nil-wk")
|
|
||||||
if p.Tally.NoWithVeto != 1 {
|
|
||||||
t.Errorf("NoWithVeto = %d, want 1 (nil shim skips authz, Veto recorded)", p.Tally.NoWithVeto)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Vote-on-non-Active REJECTED ---------------------------------------------
|
|
||||||
|
|
||||||
// TestVoteRejectsNonActive asserts a Vote on a non-Active proposal is
|
|
||||||
// REJECTED. Covers Pending (not yet Active) and Succeeded (already
|
|
||||||
// tallied).
|
|
||||||
func TestVoteRejectsNonActive(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-na", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
// Proposal is Pending (not Active) → Vote rejected.
|
|
||||||
_, err := srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-na", ProposalID: "p-na", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Vote on Pending proposal should be rejected (vote-on-non-Active)")
|
|
||||||
}
|
|
||||||
|
|
||||||
// Active the proposal; tally it to Succeeded; then Vote should be
|
|
||||||
// rejected again.
|
|
||||||
activateProposal(k, ctx, "p-na")
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy1", ProposalID: "p-na", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-na", Signer: "reach:tally"})
|
|
||||||
_, err = srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-na-2", ProposalID: "p-na", VoterReach: "reach:b", Option: types.VoteOptionYes, Signer: "reach:b",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Vote on Succeeded proposal should be rejected (vote-on-non-Active)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Vote-after-deadline REJECTED --------------------------------------------
|
|
||||||
|
|
||||||
// TestVoteRejectsAfterDeadline asserts a Vote after the voting deadline
|
|
||||||
// is REJECTED (now >= VotingDeadline).
|
|
||||||
func TestVoteRejectsAfterDeadline(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
// Voting deadline = 1500; block time now = 1000 (< 1500).
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-ad", "cm", types.ProposalKindMesh, 1500)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-ad")
|
|
||||||
// Advance block time past the deadline (now=1600 >= 1500).
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(1600, 0))
|
|
||||||
_, err := srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-ad", ProposalID: "p-ad", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Vote after voting deadline should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Tally-before-deadline REJECTED ------------------------------------------
|
|
||||||
|
|
||||||
// TestTallyRejectsBeforeDeadline asserts a Tally before the voting
|
|
||||||
// deadline is REJECTED (now < VotingDeadline).
|
|
||||||
func TestTallyRejectsBeforeDeadline(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
// Voting deadline = 5000; block time now = 1000 (< 5000).
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-bd", "cm", types.ProposalKindMesh, 5000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-bd")
|
|
||||||
// now=1000 < VotingDeadline=5000 → tally rejected.
|
|
||||||
_, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-bd", Signer: "reach:tally"})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Tally before voting deadline should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Tally-on-non-Active REJECTED --------------------------------------------
|
|
||||||
|
|
||||||
// TestTallyRejectsNonActive asserts a Tally on a non-Active proposal is
|
|
||||||
// REJECTED (a Pending proposal has not opened voting; a Succeeded
|
|
||||||
// proposal is already tallied).
|
|
||||||
func TestTallyRejectsNonActive(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-tna", "cm", types.ProposalKindMesh, 1500)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
// Proposal is Pending → tally rejected.
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
_, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-tna", Signer: "reach:tally"})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Tally on Pending proposal should be rejected (tally-on-non-Active)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Idempotency + NotFound --------------------------------------------------
|
|
||||||
|
|
||||||
// TestSubmitProposalRejectsDuplicate asserts a duplicate proposal-id is
|
|
||||||
// rejected.
|
|
||||||
func TestSubmitProposalRejectsDuplicate(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-dup", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal[1]: %v", err)
|
|
||||||
}
|
|
||||||
_, err := srv.SubmitProposal(ctx, newSubmitMsg("p-dup", "cm", types.ProposalKindMesh, 2000))
|
|
||||||
if err == nil {
|
|
||||||
t.Error("duplicate proposal-id should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestSubmitProposalRejectsUnknownCouncil asserts a Submit to a missing
|
|
||||||
// council-id is rejected.
|
|
||||||
func TestSubmitProposalRejectsUnknownCouncil(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
_, err := srv.SubmitProposal(ctx, newSubmitMsg("p-uc", "no-such-council", types.ProposalKindMesh, 2000))
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Submit to unknown council-id should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVoteRejectsDuplicate asserts a duplicate vote-id is rejected.
|
|
||||||
func TestVoteRejectsDuplicate(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
srv.SubmitProposal(ctx, newSubmitMsg("p-vd", "cm", types.ProposalKindMesh, 2000))
|
|
||||||
activateProposal(k, ctx, "p-vd")
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "v-dup", ProposalID: "p-vd", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
_, err := srv.Vote(ctx, &types.MsgVote{VoteID: "v-dup", ProposalID: "p-vd", VoterReach: "reach:b", Option: types.VoteOptionYes, Signer: "reach:b"})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("duplicate vote-id should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVoteRejectsUnknownProposal asserts a Vote on a missing proposal-id
|
|
||||||
// is rejected.
|
|
||||||
func TestVoteRejectsUnknownProposal(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
_, err := srv.Vote(ctx, &types.MsgVote{VoteID: "v-np", ProposalID: "no-such", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Vote on unknown proposal-id should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestTallyRejectsUnknownProposal asserts a Tally on a missing proposal-id
|
|
||||||
// is rejected.
|
|
||||||
func TestTallyRejectsUnknownProposal(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
_, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "no-such", Signer: "reach:tally"})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Tally on unknown proposal-id should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Proposal-target validation (Stand/Guild shims) -------------------------
|
|
||||||
|
|
||||||
// TestSubmitProposalStandTargetValidation asserts a Stand-kind Proposal
|
|
||||||
// targets a Stand Council whose stand-id-ref references a real Stand.
|
|
||||||
func TestSubmitProposalStandTargetValidation(t *testing.T) {
|
|
||||||
ctx, _, sk, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cs", types.CouncilStand, "stand-xyz", "")
|
|
||||||
|
|
||||||
// Stand exists (default stub) → accepted.
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-stand-ok", "cs", types.ProposalKindStand, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal Stand with valid stand-id-ref should be accepted; got: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Stand does NOT exist → rejected.
|
|
||||||
sk.exists = map[string]bool{"stand-xyz": false}
|
|
||||||
_, err := srv.SubmitProposal(ctx, newSubmitMsg("p-stand-bad", "cs", types.ProposalKindStand, 2000))
|
|
||||||
if err == nil {
|
|
||||||
t.Error("SubmitProposal Stand with non-existent stand-id-ref should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestSubmitProposalGuildTargetValidation asserts a Guild-kind Proposal
|
|
||||||
// targets a Guild Council whose guild-id-ref references a real Guild.
|
|
||||||
func TestSubmitProposalGuildTargetValidation(t *testing.T) {
|
|
||||||
ctx, _, _, gk, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cg", types.CouncilGuild, "", "guild-xyz")
|
|
||||||
|
|
||||||
// Guild exists (default stub) → accepted.
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-guild-ok", "cg", types.ProposalKindGuild, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal Guild with valid guild-id-ref should be accepted; got: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Guild does NOT exist → rejected.
|
|
||||||
gk.exists = map[string]bool{"guild-xyz": false}
|
|
||||||
_, err := srv.SubmitProposal(ctx, newSubmitMsg("p-guild-bad", "cg", types.ProposalKindGuild, 2000))
|
|
||||||
if err == nil {
|
|
||||||
t.Error("SubmitProposal Guild with non-existent guild-id-ref should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestSubmitProposalKindMustMatchCouncil asserts the ProposalKind must
|
|
||||||
// match the CouncilKind (a Stand-kind Proposal on a Mesh Council is
|
|
||||||
// rejected; a Guild-kind Proposal on a Stand Council is rejected).
|
|
||||||
func TestSubmitProposalKindMustMatchCouncil(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
|
|
||||||
// Stand-kind Proposal on a Mesh Council → rejected.
|
|
||||||
_, err := srv.SubmitProposal(ctx, newSubmitMsg("p-stand-on-mesh", "cm", types.ProposalKindStand, 2000))
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Stand-kind Proposal on a Mesh Council should be rejected")
|
|
||||||
}
|
|
||||||
// Guild-kind Proposal on a Mesh Council → rejected.
|
|
||||||
_, err = srv.SubmitProposal(ctx, newSubmitMsg("p-guild-on-mesh", "cm", types.ProposalKindGuild, 2000))
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Guild-kind Proposal on a Mesh Council should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Tally outcome: No majority → Failed ------------------------------------
|
|
||||||
|
|
||||||
// TestTallyNoMajorityFails asserts a tally with Yes <= No (no majority)
|
|
||||||
// transitions to Failed.
|
|
||||||
func TestTallyNoMajorityFails(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
srv.SubmitProposal(ctx, newSubmitMsg("p-nm", "cm", types.ProposalKindMesh, 2000))
|
|
||||||
activateProposal(k, ctx, "p-nm")
|
|
||||||
// 1 Yes, 2 No → No majority → Failed.
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy1", ProposalID: "p-nm", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vn1", ProposalID: "p-nm", VoterReach: "reach:b", Option: types.VoteOptionNo, Signer: "reach:b"})
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vn2", ProposalID: "p-nm", VoterReach: "reach:c", Option: types.VoteOptionNo, Signer: "reach:c"})
|
|
||||||
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
if _, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-nm", Signer: "reach:tally"}); err != nil {
|
|
||||||
t.Fatalf("TallyProposal: %v", err)
|
|
||||||
}
|
|
||||||
p, _ := k.GetProposal(ctx, "p-nm")
|
|
||||||
if p.Status != types.ProposalStatusFailed {
|
|
||||||
t.Errorf("status = %q, want Failed (Yes=1 not > No=2 — no majority)", p.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestTallyTieFails asserts a tally tie (Yes == No) → Failed (the proposal
|
|
||||||
// does not pass on a tie).
|
|
||||||
func TestTallyTieFails(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
srv.SubmitProposal(ctx, newSubmitMsg("p-tie", "cm", types.ProposalKindMesh, 2000))
|
|
||||||
activateProposal(k, ctx, "p-tie")
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy1", ProposalID: "p-tie", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vn1", ProposalID: "p-tie", VoterReach: "reach:b", Option: types.VoteOptionNo, Signer: "reach:b"})
|
|
||||||
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-tie", Signer: "reach:tally"})
|
|
||||||
p, _ := k.GetProposal(ctx, "p-tie")
|
|
||||||
if p.Status != types.ProposalStatusFailed {
|
|
||||||
t.Errorf("status = %q, want Failed (tie Yes=No → does not pass)", p.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestTallyAbstainOnly asserts a tally with only Abstains → Failed (no
|
|
||||||
// Yes majority).
|
|
||||||
func TestTallyAbstainOnly(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
srv.SubmitProposal(ctx, newSubmitMsg("p-ab", "cm", types.ProposalKindMesh, 2000))
|
|
||||||
activateProposal(k, ctx, "p-ab")
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "va1", ProposalID: "p-ab", VoterReach: "reach:a", Option: types.VoteOptionAbstain, Signer: "reach:a"})
|
|
||||||
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-ab", Signer: "reach:tally"})
|
|
||||||
p, _ := k.GetProposal(ctx, "p-ab")
|
|
||||||
if p.Status != types.ProposalStatusFailed {
|
|
||||||
t.Errorf("status = %q, want Failed (Abstain only — no Yes majority)", p.Status)
|
|
||||||
}
|
|
||||||
if p.Tally.Abstain != 1 || p.Tally.Yes != 0 || p.Tally.No != 0 {
|
|
||||||
t.Errorf("tally = %+v, want Abstain=1 only", p.Tally)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Keeper store helpers ----------------------------------------------------
|
|
||||||
|
|
||||||
// TestSetGetProposal asserts the Proposal store round-trips.
|
|
||||||
func TestSetGetProposal(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
p := types.Proposal{ProposalID: "p-rt", CouncilID: "cm", Kind: types.ProposalKindMesh, Status: types.ProposalStatusPending}
|
|
||||||
k.SetProposal(ctx, p)
|
|
||||||
got, ok := k.GetProposal(ctx, "p-rt")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("GetProposal: not found")
|
|
||||||
}
|
|
||||||
if got.Status != types.ProposalStatusPending {
|
|
||||||
t.Errorf("status = %q", got.Status)
|
|
||||||
}
|
|
||||||
if _, ok := k.GetProposal(ctx, "missing"); ok {
|
|
||||||
t.Error("GetProposal should return false for missing id")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestAllProposals asserts AllProposals iteration.
|
|
||||||
func TestAllProposals(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
k.SetProposal(ctx, types.Proposal{ProposalID: "p1", Status: types.ProposalStatusPending})
|
|
||||||
k.SetProposal(ctx, types.Proposal{ProposalID: "p2", Status: types.ProposalStatusActive})
|
|
||||||
if len(k.AllProposals(ctx)) != 2 {
|
|
||||||
t.Errorf("expected 2 proposals, got %d", len(k.AllProposals(ctx)))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestSetGetVote asserts the Vote store round-trips.
|
|
||||||
func TestSetGetVote(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
v := types.Vote{VoteID: "v-rt", ProposalID: "p", VoterReach: "reach:a", Option: types.VoteOptionYes}
|
|
||||||
k.SetVote(ctx, v)
|
|
||||||
got, ok := k.GetVote(ctx, "v-rt")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("GetVote: not found")
|
|
||||||
}
|
|
||||||
if got.Option != types.VoteOptionYes {
|
|
||||||
t.Errorf("option = %q", got.Option)
|
|
||||||
}
|
|
||||||
if _, ok := k.GetVote(ctx, "missing"); ok {
|
|
||||||
t.Error("GetVote should return false for missing id")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVotesForProposal asserts the VotesForProposal filter.
|
|
||||||
func TestVotesForProposal(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
k.SetVote(ctx, types.Vote{VoteID: "v1", ProposalID: "p1", Option: types.VoteOptionYes})
|
|
||||||
k.SetVote(ctx, types.Vote{VoteID: "v2", ProposalID: "p1", Option: types.VoteOptionNo})
|
|
||||||
k.SetVote(ctx, types.Vote{VoteID: "v3", ProposalID: "p2", Option: types.VoteOptionYes})
|
|
||||||
if len(k.VotesForProposal(ctx, "p1")) != 2 {
|
|
||||||
t.Errorf("VotesForProposal(p1) = %d, want 2", len(k.VotesForProposal(ctx, "p1")))
|
|
||||||
}
|
|
||||||
if len(k.VotesForProposal(ctx, "p2")) != 1 {
|
|
||||||
t.Errorf("VotesForProposal(p2) = %d, want 1", len(k.VotesForProposal(ctx, "p2")))
|
|
||||||
}
|
|
||||||
if len(k.VotesForProposal(ctx, "no-such")) != 0 {
|
|
||||||
t.Errorf("VotesForProposal(no-such) = %d, want 0", len(k.VotesForProposal(ctx, "no-such")))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestSetGetCouncil asserts the Council store round-trips.
|
|
||||||
func TestSetGetCouncil(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
c := types.Council{CouncilID: "cm", Kind: types.CouncilMesh}
|
|
||||||
k.SetCouncil(ctx, c)
|
|
||||||
got, ok := k.GetCouncil(ctx, "cm")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("GetCouncil: not found")
|
|
||||||
}
|
|
||||||
if got.Kind != types.CouncilMesh {
|
|
||||||
t.Errorf("kind = %q", got.Kind)
|
|
||||||
}
|
|
||||||
if _, ok := k.GetCouncil(ctx, "missing"); ok {
|
|
||||||
t.Error("GetCouncil should return false for missing id")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Params helper ----------------------------------------------------------
|
|
||||||
|
|
||||||
// TestKeeperGetSetParams asserts the Keeper holds + returns the Params.
|
|
||||||
func TestKeeperGetSetParams(t *testing.T) {
|
|
||||||
_, _, _, _, k := newSimtestContext(t)
|
|
||||||
if k.GetParams().WatcherVetoQuorum != types.WatcherVetoQuorumDefault {
|
|
||||||
t.Errorf("default WatcherVetoQuorum = %d, want %d", k.GetParams().WatcherVetoQuorum, types.WatcherVetoQuorumDefault)
|
|
||||||
}
|
|
||||||
k.SetParams(types.Params{WatcherVetoQuorum: 4})
|
|
||||||
if k.GetParams().WatcherVetoQuorum != 4 {
|
|
||||||
t.Errorf("WatcherVetoQuorum = %d, want 4", k.GetParams().WatcherVetoQuorum)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Expected-keeper stubs --------------------------------------------------
|
|
||||||
|
|
||||||
// TestStubWatcherKeeper asserts the stub records calls and returns
|
|
||||||
// configured results.
|
|
||||||
func TestStubWatcherKeeper(t *testing.T) {
|
|
||||||
wk := &stubWatcherKeeper{isWatcher: map[string]bool{"reach:a": true, "reach:b": false}}
|
|
||||||
if !wk.IsWatcher("reach:a") {
|
|
||||||
t.Error("reach:a should be a Watcher")
|
|
||||||
}
|
|
||||||
if wk.IsWatcher("reach:b") {
|
|
||||||
t.Error("reach:b should NOT be a Watcher")
|
|
||||||
}
|
|
||||||
if len(wk.calls) != 2 {
|
|
||||||
t.Errorf("calls = %d, want 2", len(wk.calls))
|
|
||||||
}
|
|
||||||
if wk.CountWatchers() != 9 {
|
|
||||||
t.Errorf("CountWatchers = %d, want 9 (REQ-004)", wk.CountWatchers())
|
|
||||||
}
|
|
||||||
wk2 := &stubWatcherKeeper{watcherCount: 7}
|
|
||||||
if wk2.CountWatchers() != 7 {
|
|
||||||
t.Errorf("CountWatchers = %d, want 7", wk2.CountWatchers())
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- G-003 import-invariant (test exemption documentation) -------------------
|
|
||||||
|
|
||||||
// TestG003NoWatcherOrStandOrGuildTypesImport asserts the council
|
|
||||||
// production files do NOT import x/watcher/types, x/stand/types, or
|
|
||||||
// x/guild/types by struct (G-003 — the WatcherKeeper, StandKeeper, and
|
|
||||||
// GuildKeeper interfaces are the only coupling; no struct import). This
|
|
||||||
// is a tested invariant. The test asserts the stubs use by-string
|
|
||||||
// reach-ids and stand/guild-ids (not watcher/stand/guild structs),
|
|
||||||
// confirming the interface contract is by-ID-string.
|
|
||||||
func TestG003NoWatcherOrStandOrGuildTypesImport(t *testing.T) {
|
|
||||||
wk := &stubWatcherKeeper{isWatcher: map[string]bool{"reach:watcher-1": true}}
|
|
||||||
if !wk.IsWatcher("reach:watcher-1") {
|
|
||||||
t.Error("stub IsWatcher by-ID-string should return true")
|
|
||||||
}
|
|
||||||
if len(wk.calls) != 1 {
|
|
||||||
t.Errorf("expected 1 watcher call recorded, got %d", len(wk.calls))
|
|
||||||
}
|
|
||||||
sk := &stubStandKeeper{}
|
|
||||||
if !sk.StandExists("stand-1") {
|
|
||||||
t.Error("stub StandExists by-ID-string should return true")
|
|
||||||
}
|
|
||||||
gk := &stubGuildKeeper{}
|
|
||||||
if !gk.GuildExists("guild-1") {
|
|
||||||
t.Error("stub GuildExists by-ID-string should return true")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,101 +0,0 @@
|
|||||||
package council
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/types/module"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/council/keeper"
|
|
||||||
"github.com/oy/openyield/x/council/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// module.go holds the council module's AppModule + RegisterServices
|
|
||||||
// (P7-02-01, REQ-039, D-060).
|
|
||||||
//
|
|
||||||
// The AppModule wraps the Proposal-lifecycle Keeper and registers the
|
|
||||||
// MsgServer via RegisterServices. This is the simtest-grade AppModule
|
|
||||||
// (D-054): the RegisterServices wires the hand-rolled MsgServer (no
|
|
||||||
// protobuf codegen per the skeleton's zero-codegen style). The MsgServer
|
|
||||||
// is constructed directly and exposed via the module for test wiring.
|
|
||||||
//
|
|
||||||
// The WatcherKeeper, StandKeeper, and GuildKeeper expected-keeper shims
|
|
||||||
// are injected at construction (nil-able for partial tests). The
|
|
||||||
// StandKeeper / GuildKeeper shims are the P7→P1 (x/stand) and P7→P1
|
|
||||||
// (x/guild) dep edges: P7 wires stubs in simtest (G-003 test exemption);
|
|
||||||
// the real keepers are wired at app construction.
|
|
||||||
|
|
||||||
// ConsensusVersion is the council module's consensus version (AppModule).
|
|
||||||
const ConsensusVersion = 1
|
|
||||||
|
|
||||||
// AppModule is the council application module (simtest-grade — D-054).
|
|
||||||
type AppModule struct {
|
|
||||||
keeper keeper.Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewAppModule constructs a new council AppModule. The WatcherKeeper,
|
|
||||||
// StandKeeper, and GuildKeeper expected-keeper shims are injected
|
|
||||||
// (nil-able for partial tests).
|
|
||||||
func NewAppModule(cdc codec.Codec, storeKey storetypes.StoreKey, wk types.WatcherKeeper, sk types.StandKeeper, gk types.GuildKeeper) AppModule {
|
|
||||||
k := keeper.NewKeeper(cdc, storeKey, wk, sk, gk)
|
|
||||||
return AppModule{keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
// RegisterServices registers the council MsgServer. Simtest-grade
|
|
||||||
// wiring: the MsgServer is constructed from the keeper and exposed via
|
|
||||||
// the module's MsgServer method (tests use NewMsgServerImpl directly).
|
|
||||||
func (am AppModule) RegisterServices(cfg module.Configurator) {
|
|
||||||
_ = cfg
|
|
||||||
}
|
|
||||||
|
|
||||||
// MsgServer returns the council MsgServer for this module's keeper.
|
|
||||||
func (am AppModule) MsgServer() types.MsgServer {
|
|
||||||
return keeper.NewMsgServerImpl(am.keeper)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Name returns the module name.
|
|
||||||
func (AppModule) Name() string { return types.ModuleName }
|
|
||||||
|
|
||||||
// ConsensusVersion implements AppModule.ConsensusVersion.
|
|
||||||
func (AppModule) ConsensusVersion() uint64 { return ConsensusVersion }
|
|
||||||
|
|
||||||
// InitGenesis performs genesis initialization for the council module's
|
|
||||||
// Proposal lifecycle. (The v0.2 Council registry genesis is the
|
|
||||||
// genesis-state Councils slice; this AppModule handles the v0.5 Proposal
|
|
||||||
// + Vote store.)
|
|
||||||
func (am AppModule) InitGenesis(ctx sdk.Context, cdc codec.JSONCodec, data json.RawMessage) {
|
|
||||||
var gs types.GenesisState
|
|
||||||
cdc.MustUnmarshalJSON(data, &gs)
|
|
||||||
// Seed the runtime Council store from the genesis-state Councils
|
|
||||||
// slice (the SubmitProposal handler validates against the runtime
|
|
||||||
// Council store).
|
|
||||||
for _, c := range gs.Councils {
|
|
||||||
am.keeper.SetCouncil(ctx, c)
|
|
||||||
}
|
|
||||||
for _, p := range gs.Proposals {
|
|
||||||
am.keeper.SetProposal(ctx, p)
|
|
||||||
}
|
|
||||||
for _, v := range gs.Votes {
|
|
||||||
am.keeper.SetVote(ctx, v)
|
|
||||||
}
|
|
||||||
am.keeper.SetParams(gs.Params)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ExportGenesis returns the exported genesis state as raw bytes.
|
|
||||||
func (am AppModule) ExportGenesis(ctx sdk.Context, cdc codec.JSONCodec) json.RawMessage {
|
|
||||||
gs := types.DefaultGenesisState()
|
|
||||||
for _, p := range am.keeper.AllProposals(ctx) {
|
|
||||||
gs.Proposals = append(gs.Proposals, p)
|
|
||||||
}
|
|
||||||
for _, v := range am.keeper.AllVotes(ctx) {
|
|
||||||
gs.Votes = append(gs.Votes, v)
|
|
||||||
}
|
|
||||||
gs.Params = am.keeper.GetParams()
|
|
||||||
return cdc.MustMarshalJSON(gs)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions: AppModule implements the module interface stubs.
|
|
||||||
var _ module.HasName = AppModule{}
|
|
||||||
var _ module.HasConsensusVersion = AppModule{}
|
|
||||||
@@ -1,106 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
// expected_keepers.go holds the Go INTERFACES for the cross-module keepers
|
|
||||||
// x/council depends on (G-003 firewall — ibc-go expected-keepers convention).
|
|
||||||
//
|
|
||||||
// The Council Proposal lifecycle (REQ-039, D-060) depends on TWO cross-module
|
|
||||||
// keepers:
|
|
||||||
//
|
|
||||||
// 1. x/watcher (WatcherKeeper) — the Veto authz for the Vote handler. The
|
|
||||||
// VoteOption.Veto is the Watcher-only block signal (anti-greed, vision
|
|
||||||
// §19). The handler consults the WatcherKeeper shim to assert the
|
|
||||||
// voter-reach is a Watcher BEFORE recording a Veto; a non-Watcher
|
|
||||||
// casting Veto is REJECTED at the handler. The handler does NOT consult
|
|
||||||
// the quorum on the Veto payload (unlike x/partner's
|
|
||||||
// IsQuorumSigned-on-payload pattern); the Veto quorum is a TALLY-time
|
|
||||||
// check (NoWithVeto >= WatcherVetoQuorum in the Params, default 6 per
|
|
||||||
// D-065/A-574), NOT a VOTE-time check. The single-Veto-no-block rule
|
|
||||||
// (anti-greed) means a single Veto is recorded but does NOT block; the
|
|
||||||
// quorum (default 6) must be met at tally to FAIL the proposal.
|
|
||||||
//
|
|
||||||
// 2. x/stand (StandKeeper) — the proposal-target validation for a
|
|
||||||
// Stand-kind Proposal. The handler asserts the council-id references a
|
|
||||||
// Stand Council whose stand-id-ref references a real Stand BEFORE
|
|
||||||
// creating the Proposal. The interface is the by-ID-string boundary
|
|
||||||
// (G-003 — no struct import of x/stand/types).
|
|
||||||
//
|
|
||||||
// 3. x/guild (GuildKeeper) — the proposal-target validation for a
|
|
||||||
// Guild-kind Proposal (mirrors StandKeeper). The handler asserts the
|
|
||||||
// council-id references a Guild Council whose guild-id-ref references
|
|
||||||
// a real Guild.
|
|
||||||
//
|
|
||||||
// All three dependencies are expressed as INTERFACES defined HERE (in
|
|
||||||
// x/council/types), NOT as struct imports of x/watcher/types,
|
|
||||||
// x/stand/types, or x/guild/types. The concrete keepers satisfy these
|
|
||||||
// interfaces structurally; the handler depends on the interface, preserving
|
|
||||||
// G-003's intent (no cross-module struct coupling, no import cycles).
|
|
||||||
//
|
|
||||||
// Test-only cross-package imports (the G-003 test exemption) remain
|
|
||||||
// exempt: a simtest may import both x/council/keeper and x/watcher/keeper
|
|
||||||
// (or x/stand/keeper, x/guild/keeper) to wire the expected-keeper shims in
|
|
||||||
// a test setup.
|
|
||||||
|
|
||||||
// WatcherKeeper is the expected-keeper interface for x/watcher (G-003).
|
|
||||||
// The council Vote handler calls it for:
|
|
||||||
// - Vote (Veto authz): a Vote with Option == VoteOptionVeto must come
|
|
||||||
// from a Watcher. The handler consults the WatcherKeeper shim to
|
|
||||||
// assert the voter-reach is a Watcher BEFORE recording the Veto; a
|
|
||||||
// non-Watcher casting Veto is REJECTED at the handler. The Veto
|
|
||||||
// quorum (default 6 per D-065/A-574) is a TALLY-time check, NOT a
|
|
||||||
// VOTE-time check — the single-Veto-no-block rule (anti-greed,
|
|
||||||
// vision §19) means a single Veto is recorded but does NOT block; the
|
|
||||||
// quorum must be met at tally to FAIL the proposal.
|
|
||||||
//
|
|
||||||
// No struct import of x/watcher/types — the interface is the by-ID-string
|
|
||||||
// boundary (G-003). The reachID is an opaque string (the voter's reach-id,
|
|
||||||
// by-ID-string ref to x/identity Reach; lexicon-clean).
|
|
||||||
type WatcherKeeper interface {
|
|
||||||
// IsWatcher reports whether the named reach-id (by-ID-string) is a
|
|
||||||
// Watcher (REQ-004). Used by the Vote handler to authorize Veto: a
|
|
||||||
// non-Watcher casting Veto is REJECTED. A nil shim skips the authz
|
|
||||||
// (simtest wiring); a non-nil shim that returns false REJECTS.
|
|
||||||
IsWatcher(reachID string) bool
|
|
||||||
|
|
||||||
// CountWatchers returns the total number of Watchers (the Watcher set
|
|
||||||
// size; REQ-004 says 9). Used by the TallyProposal handler to validate
|
|
||||||
// the WatcherVetoQuorum Params bound against the live Watcher set
|
|
||||||
// (a quorum > CountWatchers is unsatisfiable; the handler clamps the
|
|
||||||
// effective quorum to CountWatchers for the >= check).
|
|
||||||
CountWatchers() int
|
|
||||||
}
|
|
||||||
|
|
||||||
// StandKeeper is the expected-keeper interface for x/stand (G-003). The
|
|
||||||
// council SubmitProposal handler calls it for:
|
|
||||||
// - SubmitProposal (Stand-kind target validation): the handler asserts
|
|
||||||
// the council-id references a Stand Council whose stand-id-ref
|
|
||||||
// references a real Stand BEFORE creating the Proposal. A nil shim
|
|
||||||
// skips the check (simtest wiring); a non-nil shim that returns false
|
|
||||||
// REJECTS the submission.
|
|
||||||
//
|
|
||||||
// No struct import of x/stand/types — the interface is the by-ID-string
|
|
||||||
// boundary (G-003). The standID is an opaque string (the stand-id, by-ID-
|
|
||||||
// string ref to x/stand Stand).
|
|
||||||
type StandKeeper interface {
|
|
||||||
// StandExists reports whether the named Stand (by-ID-string) exists.
|
|
||||||
// Used by the SubmitProposal handler to validate a Stand-kind
|
|
||||||
// Proposal's target before creating the Proposal.
|
|
||||||
StandExists(standID string) bool
|
|
||||||
}
|
|
||||||
|
|
||||||
// GuildKeeper is the expected-keeper interface for x/guild (G-003). The
|
|
||||||
// council SubmitProposal handler calls it for:
|
|
||||||
// - SubmitProposal (Guild-kind target validation): the handler asserts
|
|
||||||
// the council-id references a Guild Council whose guild-id-ref
|
|
||||||
// references a real Guild BEFORE creating the Proposal. A nil shim
|
|
||||||
// skips the check (simtest wiring); a non-nil shim that returns false
|
|
||||||
// REJECTS the submission.
|
|
||||||
//
|
|
||||||
// No struct import of x/guild/types — the interface is the by-ID-string
|
|
||||||
// boundary (G-003). The guildID is an opaque string (the guild-id, by-ID-
|
|
||||||
// string ref to x/guild Guild).
|
|
||||||
type GuildKeeper interface {
|
|
||||||
// GuildExists reports whether the named Guild (by-ID-string) exists.
|
|
||||||
// Used by the SubmitProposal handler to validate a Guild-kind
|
|
||||||
// Proposal's target before creating the Proposal.
|
|
||||||
GuildExists(guildID string) bool
|
|
||||||
}
|
|
||||||
@@ -100,74 +100,6 @@ func knownSignalKind(s SignalKind) bool {
|
|||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
|
|
||||||
// ValidateProposals asserts proposal-ids are present and unique, each
|
|
||||||
// proposal's council-id references an existing Council (referential
|
|
||||||
// integrity), each proposal's kind is a known ProposalKind, and each
|
|
||||||
// proposal's status is a known ProposalStatus (D-060, P7 genesis
|
|
||||||
// validation). The MissionLockAmendment-Rejected kind is allowed at
|
|
||||||
// genesis-level schema validation (it is a known enum value); the
|
|
||||||
// Mission-Lock firewall is the const + the MsgSubmitProposal.ValidateBasic
|
|
||||||
// gate (D-064), NOT the genesis validator (a genesis Proposal of that
|
|
||||||
// kind would be a static data inconsistency, not a runtime breach — the
|
|
||||||
// runtime gate is the firewall).
|
|
||||||
func ValidateProposals(proposals []Proposal, councils []Council) error {
|
|
||||||
councilIDs := make(map[string]bool, len(councils))
|
|
||||||
for _, c := range councils {
|
|
||||||
councilIDs[c.CouncilID] = true
|
|
||||||
}
|
|
||||||
seen := make(map[string]bool, len(proposals))
|
|
||||||
for i, p := range proposals {
|
|
||||||
if p.ProposalID == "" {
|
|
||||||
return fmt.Errorf("proposal [%d]: empty proposal-id", i)
|
|
||||||
}
|
|
||||||
if seen[p.ProposalID] {
|
|
||||||
return fmt.Errorf("proposal: duplicate proposal-id %q", p.ProposalID)
|
|
||||||
}
|
|
||||||
seen[p.ProposalID] = true
|
|
||||||
if !councilIDs[p.CouncilID] {
|
|
||||||
return fmt.Errorf("proposal %q: council-id %q does not reference an existing council", p.ProposalID, p.CouncilID)
|
|
||||||
}
|
|
||||||
if !knownProposalKind(p.Kind) {
|
|
||||||
return fmt.Errorf("proposal %q: unknown kind %q", p.ProposalID, p.Kind)
|
|
||||||
}
|
|
||||||
if !knownProposalStatus(p.Status) {
|
|
||||||
return fmt.Errorf("proposal %q: unknown status %q", p.ProposalID, p.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ValidateVotes asserts vote-ids are present and unique, each vote's
|
|
||||||
// proposal-id references an existing Proposal (referential integrity),
|
|
||||||
// and each vote's option is a known VoteOption (D-060, P7 genesis
|
|
||||||
// validation). The Veto option is a known enum value; the Watcher authz
|
|
||||||
// is a runtime gate (the Vote handler consults the WatcherKeeper shim),
|
|
||||||
// NOT a genesis validator (genesis Veto votes are static data; the
|
|
||||||
// runtime gate is the firewall).
|
|
||||||
func ValidateVotes(votes []Vote, proposals []Proposal) error {
|
|
||||||
proposalIDs := make(map[string]bool, len(proposals))
|
|
||||||
for _, p := range proposals {
|
|
||||||
proposalIDs[p.ProposalID] = true
|
|
||||||
}
|
|
||||||
seen := make(map[string]bool, len(votes))
|
|
||||||
for i, v := range votes {
|
|
||||||
if v.VoteID == "" {
|
|
||||||
return fmt.Errorf("vote [%d]: empty vote-id", i)
|
|
||||||
}
|
|
||||||
if seen[v.VoteID] {
|
|
||||||
return fmt.Errorf("vote: duplicate vote-id %q", v.VoteID)
|
|
||||||
}
|
|
||||||
seen[v.VoteID] = true
|
|
||||||
if !proposalIDs[v.ProposalID] {
|
|
||||||
return fmt.Errorf("vote %q: proposal-id %q does not reference an existing proposal", v.VoteID, v.ProposalID)
|
|
||||||
}
|
|
||||||
if !knownVoteOption(v.Option) {
|
|
||||||
return fmt.Errorf("vote %q: unknown option %q", v.VoteID, v.Option)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// MissionLockCheck asserts the Mission-Lock invariant on a slice of
|
// MissionLockCheck asserts the Mission-Lock invariant on a slice of
|
||||||
// Councils (vision §19, REQ-011). Because MissionLockAmendable is a compile-
|
// Councils (vision §19, REQ-011). Because MissionLockAmendable is a compile-
|
||||||
// time const bool == false, this check always passes — it exists as the
|
// time const bool == false, this check always passes — it exists as the
|
||||||
|
|||||||
@@ -1,260 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// msg.go holds the council module's Proposal-lifecycle Msg* types
|
|
||||||
// implementing sdk.Msg (P7-01-01, REQ-039; G-006 controlled exception:
|
|
||||||
// types/ gains the cosmos-sdk import for sdk.Msg — D-055; the
|
|
||||||
// invariant/lexicon tests in *_test.go stay stdlib-only per G-024,
|
|
||||||
// isolated from this msg.go file). Each Msg carries a ValidateBasic
|
|
||||||
// (stateless) and GetSigners.
|
|
||||||
//
|
|
||||||
// The three Msg types drive the Proposal lifecycle (D-060, REQ-039):
|
|
||||||
// - MsgSubmitProposal: submit a Proposal (status=Pending). ValidateBasic
|
|
||||||
// REJECTS the MissionLockAmendment-Rejected kind (D-064/A-572 — the
|
|
||||||
// message never reaches the handler). The const firewall
|
|
||||||
// (MissionLockAmendable=false) + the ValidateBasic gate form the dual
|
|
||||||
// firewall.
|
|
||||||
// - MsgVote: cast a Vote (VoteOption) on a Proposal. Veto requires
|
|
||||||
// Watcher authz — checked at the handler via the WatcherKeeper shim
|
|
||||||
// (the ValidateBasic is stateless; it accepts any VoteOption including
|
|
||||||
// Veto; the handler enforces Veto → Watcher authz).
|
|
||||||
// - MsgTallyProposal: tally a Proposal (close the voting deadline,
|
|
||||||
// compute Yes/No/Abstain/Veto, transition Succeeded/Failed).
|
|
||||||
//
|
|
||||||
// All cross-module refs are by-ID-string (G-003): council-id references a
|
|
||||||
// Council by ID-string; proposal-id references a Proposal by ID-string;
|
|
||||||
// voter-reach/proposer-reach are reach-ids (lexicon-clean holder
|
|
||||||
// identifiers; NOT banned financial-holder terms). GetSigners returns
|
|
||||||
// the signer reach-ids encoded as sdk.AccAddress bytes.
|
|
||||||
|
|
||||||
// --- MsgSubmitProposal ------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgSubmitProposal submits a Proposal to a Council (status=Pending).
|
|
||||||
// ValidateBasic is stateless: non-empty proposal-id, non-empty
|
|
||||||
// council-id, kind ∈ ProposalKind (and the kind must NOT be
|
|
||||||
// MissionLockAmendment-Rejected — D-064/A-572 — the message never
|
|
||||||
// reaches the handler; the const + the gate form the dual firewall),
|
|
||||||
// non-empty proposer-reach, voting-deadline > submit-time (a positive
|
|
||||||
// voting window).
|
|
||||||
type MsgSubmitProposal struct {
|
|
||||||
ProposalID string `json:"proposal_id" yaml:"proposal_id"`
|
|
||||||
CouncilID string `json:"council_id" yaml:"council_id"`
|
|
||||||
Kind ProposalKind `json:"kind" yaml:"kind"`
|
|
||||||
ProposerReach string `json:"proposer_reach" yaml:"proposer_reach"`
|
|
||||||
SubmitTime int64 `json:"submit_time" yaml:"submit_time"`
|
|
||||||
VotingDeadline int64 `json:"voting_deadline" yaml:"voting_deadline"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message (sdk.Msg = proto.Message).
|
|
||||||
func (m *MsgSubmitProposal) Reset() { *m = MsgSubmitProposal{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgSubmitProposal) String() string {
|
|
||||||
return fmt.Sprintf("MsgSubmitProposal{ProposalID:%s CouncilID:%s Kind:%s ProposerReach:%s SubmitTime:%d VotingDeadline:%d Signer:%s}",
|
|
||||||
m.ProposalID, m.CouncilID, m.Kind, m.ProposerReach, m.SubmitTime, m.VotingDeadline, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgSubmitProposal) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation. Non-empty proposal-id,
|
|
||||||
// non-empty council-id, kind ∈ ProposalKind, non-empty proposer-reach,
|
|
||||||
// non-empty signer, voting-deadline > submit-time (a positive voting
|
|
||||||
// window). The MissionLockAmendment-Rejected kind is REJECTED here
|
|
||||||
// (D-064/A-572): the message never reaches the handler. The const
|
|
||||||
// firewall (MissionLockAmendable=false) + this gate form the dual
|
|
||||||
// firewall. The error message names the Mission Lock so the rejection
|
|
||||||
// is visible at the call site.
|
|
||||||
func (m *MsgSubmitProposal) ValidateBasic() error {
|
|
||||||
if m.ProposalID == "" {
|
|
||||||
return fmt.Errorf("council: empty proposal-id")
|
|
||||||
}
|
|
||||||
if m.CouncilID == "" {
|
|
||||||
return fmt.Errorf("council: empty council-id")
|
|
||||||
}
|
|
||||||
if !knownProposalKind(m.Kind) {
|
|
||||||
return fmt.Errorf("council: unknown proposal kind %q", m.Kind)
|
|
||||||
}
|
|
||||||
// D-064/A-572: the MissionLockAmendment-Rejected kind is rejected at
|
|
||||||
// ValidateBasic — the message never reaches the handler. The const
|
|
||||||
// firewall (MissionLockAmendable=false) + this gate form the dual
|
|
||||||
// firewall. The Mission Lock (vision §19: Six Principles + Fee
|
|
||||||
// Covenant + no-amend covenant) can NEVER be amended by any council.
|
|
||||||
if m.Kind == ProposalMissionLockAmendmentRejected {
|
|
||||||
return fmt.Errorf("council: MissionLockAmendment-Rejected kind rejected at ValidateBasic (D-064/A-572 — Mission Lock non-amendable, vision §19)")
|
|
||||||
}
|
|
||||||
if m.ProposerReach == "" {
|
|
||||||
return fmt.Errorf("council: empty proposer-reach")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("council: empty signer")
|
|
||||||
}
|
|
||||||
if m.VotingDeadline <= m.SubmitTime {
|
|
||||||
return fmt.Errorf("council: voting-deadline %d must be after submit-time %d", m.VotingDeadline, m.SubmitTime)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgSubmitProposal) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgVote ---------------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgVote casts a Vote on a Proposal. The handler enforces the proposal
|
|
||||||
// must be Active (vote-on-non-Active REJECTED) and the voting deadline
|
|
||||||
// not passed (vote-after-deadline REJECTED). Veto requires Watcher
|
|
||||||
// authz via the WatcherKeeper shim (IsWatcher — only Watchers can cast
|
|
||||||
// Veto; non-Watchers casting Veto are REJECTED at the handler).
|
|
||||||
// ValidateBasic is stateless: non-empty proposal-id, non-empty
|
|
||||||
// voter-reach, option ∈ VoteOption.
|
|
||||||
type MsgVote struct {
|
|
||||||
VoteID string `json:"vote_id" yaml:"vote_id"`
|
|
||||||
ProposalID string `json:"proposal_id" yaml:"proposal_id"`
|
|
||||||
VoterReach string `json:"voter_reach" yaml:"voter_reach"`
|
|
||||||
Option VoteOption `json:"option" yaml:"option"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgVote) Reset() { *m = MsgVote{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgVote) String() string {
|
|
||||||
return fmt.Sprintf("MsgVote{VoteID:%s ProposalID:%s VoterReach:%s Option:%s Signer:%s}",
|
|
||||||
m.VoteID, m.ProposalID, m.VoterReach, m.Option, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgVote) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty vote-id,
|
|
||||||
// non-empty proposal-id, non-empty voter-reach, option ∈ VoteOption,
|
|
||||||
// non-empty signer. The Veto option is allowed at ValidateBasic (the
|
|
||||||
// Watcher authz is a runtime gate via the WatcherKeeper shim, NOT a
|
|
||||||
// stateless check — the signer's reach-id may or may not be a Watcher,
|
|
||||||
// and that is a stateful keeper query).
|
|
||||||
func (m *MsgVote) ValidateBasic() error {
|
|
||||||
if m.VoteID == "" {
|
|
||||||
return fmt.Errorf("council: empty vote-id")
|
|
||||||
}
|
|
||||||
if m.ProposalID == "" {
|
|
||||||
return fmt.Errorf("council: empty proposal-id")
|
|
||||||
}
|
|
||||||
if m.VoterReach == "" {
|
|
||||||
return fmt.Errorf("council: empty voter-reach")
|
|
||||||
}
|
|
||||||
if !knownVoteOption(m.Option) {
|
|
||||||
return fmt.Errorf("council: unknown vote option %q", m.Option)
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("council: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgVote) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgTallyProposal ------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgTallyProposal tallies a Proposal: closes the voting deadline,
|
|
||||||
// computes the Yes/No/Abstain/Veto tally, and transitions the Proposal
|
|
||||||
// to Succeeded (Yes quorum met, Veto quorum NOT met) or Failed (No
|
|
||||||
// quorum OR Veto quorum met — D-065). The handler enforces the voting
|
|
||||||
// deadline must have passed (tally-before-deadline REJECTED). ValidateBasic
|
|
||||||
// is stateless: non-empty proposal-id.
|
|
||||||
type MsgTallyProposal struct {
|
|
||||||
ProposalID string `json:"proposal_id" yaml:"proposal_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgTallyProposal) Reset() { *m = MsgTallyProposal{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgTallyProposal) String() string {
|
|
||||||
return fmt.Sprintf("MsgTallyProposal{ProposalID:%s Signer:%s}", m.ProposalID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgTallyProposal) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty proposal-id,
|
|
||||||
// non-empty signer.
|
|
||||||
func (m *MsgTallyProposal) ValidateBasic() error {
|
|
||||||
if m.ProposalID == "" {
|
|
||||||
return fmt.Errorf("council: empty proposal-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("council: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgTallyProposal) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgServer interface + Response types -----------------------------------
|
|
||||||
|
|
||||||
// MsgServer is the council module's message server interface (one method
|
|
||||||
// per Msg*). The keeper's msg_server.go implements this; module.go's
|
|
||||||
// RegisterServices wires the implementation. This is the hand-rolled
|
|
||||||
// equivalent of the protobuf-generated MsgServer interface (no codegen
|
|
||||||
// per the skeleton's zero-codegen style).
|
|
||||||
type MsgServer interface {
|
|
||||||
SubmitProposal(ctx interface{}, msg *MsgSubmitProposal) (*MsgSubmitProposalResponse, error)
|
|
||||||
Vote(ctx interface{}, msg *MsgVote) (*MsgVoteResponse, error)
|
|
||||||
TallyProposal(ctx interface{}, msg *MsgTallyProposal) (*MsgTallyProposalResponse, error)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Response types (hand-rolled equivalents of the protobuf-generated
|
|
||||||
// response wrappers; empty bodies — the response is the state mutation +
|
|
||||||
// event).
|
|
||||||
|
|
||||||
// MsgSubmitProposalResponse is the response to MsgSubmitProposal.
|
|
||||||
type MsgSubmitProposalResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgSubmitProposalResponse) Reset() { *m = MsgSubmitProposalResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgSubmitProposalResponse) String() string { return "MsgSubmitProposalResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgSubmitProposalResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgVoteResponse is the response to MsgVote.
|
|
||||||
type MsgVoteResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgVoteResponse) Reset() { *m = MsgVoteResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgVoteResponse) String() string { return "MsgVoteResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgVoteResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgTallyProposalResponse is the response to MsgTallyProposal.
|
|
||||||
type MsgTallyProposalResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgTallyProposalResponse) Reset() { *m = MsgTallyProposalResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgTallyProposalResponse) String() string { return "MsgTallyProposalResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgTallyProposalResponse) ProtoMessage() {}
|
|
||||||
+12
-285
@@ -28,36 +28,6 @@ const (
|
|||||||
// four Freeholder signals (vision §9.1 / REQ-005) plus Capital (REQ-011
|
// four Freeholder signals (vision §9.1 / REQ-005) plus Capital (REQ-011
|
||||||
// multi-source Voice). Cross-ref v0.1 x/standing FreeholderSignals.
|
// multi-source Voice). Cross-ref v0.1 x/standing FreeholderSignals.
|
||||||
SignalKindCount = 4
|
SignalKindCount = 4
|
||||||
|
|
||||||
// ProposalKindCount is the locked count of ProposalKind enum values
|
|
||||||
// (D-060, AUDIT §193 P1-1). A regression firewall: adding/removing/
|
|
||||||
// renaming a ProposalKind breaks this const's test. The four kinds are
|
|
||||||
// Stand, Guild, Mesh, and MissionLockAmendment-Rejected. The
|
|
||||||
// MissionLockAmendment-Rejected kind exists to DOCUMENT in code that
|
|
||||||
// the Mission Lock (vision §19) is non-amendable: the enum value is
|
|
||||||
// reachable, but MsgSubmitProposal.ValidateBasic REJECTS it (D-064 /
|
|
||||||
// A-572 — the message never reaches the handler). The const + the
|
|
||||||
// ValidateBasic gate form the dual firewall (D-064).
|
|
||||||
ProposalKindCount = 4
|
|
||||||
|
|
||||||
// ProposalStatusCount is the locked count of ProposalStatus enum values
|
|
||||||
// (D-060, AUDIT §193 P1-1): Pending, Active, Succeeded, Failed,
|
|
||||||
// Executed. A regression firewall.
|
|
||||||
ProposalStatusCount = 5
|
|
||||||
|
|
||||||
// VoteOptionCount is the locked count of VoteOption enum values
|
|
||||||
// (D-060, AUDIT §193 P1-1): Yes, No, Abstain, Veto. Veto is the Watcher-
|
|
||||||
// only block signal (anti-greed, vision §19; a single Veto does NOT
|
|
||||||
// block — the quorum default 6 per D-065/A-574). A regression firewall.
|
|
||||||
VoteOptionCount = 4
|
|
||||||
|
|
||||||
// WatcherVetoQuorumDefault is the default Watcher Veto quorum (D-065 /
|
|
||||||
// A-574): the number of Watcher Vetos required to FAIL a proposal
|
|
||||||
// (default 6, matching REQ-004 6-of-9). Single-Veto-no-block is the
|
|
||||||
// anti-greed rule (vision §19): one Veto does NOT block. This is the
|
|
||||||
// default; the actual quorum is a Params field (a tunable, NOT a
|
|
||||||
// locked const) bounded [2, 9] by Params.Validate() (G-020).
|
|
||||||
WatcherVetoQuorumDefault = 6
|
|
||||||
)
|
)
|
||||||
|
|
||||||
// CouncilKind enumerates the three governance councils (vision §13, REQ-011):
|
// CouncilKind enumerates the three governance councils (vision §13, REQ-011):
|
||||||
@@ -174,264 +144,30 @@ type TallyResult struct {
|
|||||||
QuorumMet bool `json:"quorum_met" yaml:"quorum_met"`
|
QuorumMet bool `json:"quorum_met" yaml:"quorum_met"`
|
||||||
}
|
}
|
||||||
|
|
||||||
// Params for the council module. v0.2 had no tunables (skeleton). v0.5 (P7,
|
// Params for the council module (skeleton — no tunables in v0.2).
|
||||||
// D-065/A-574) adds WatcherVetoQuorum — the number of Watcher Vetos required
|
type Params struct{}
|
||||||
// to FAIL a proposal (default 6, matching REQ-004 6-of-9). Single-Veto-no-
|
|
||||||
// block is the anti-greed rule (vision §19): one Veto does NOT block; the
|
|
||||||
// quorum (default 6) must be met. The quorum is a tunable bounded [2, 9] by
|
|
||||||
// Params.Validate() (G-020) — the Watcher set is 9 (REQ-004), so a quorum
|
|
||||||
// below 2 is meaningless and above 9 is unsatisfiable.
|
|
||||||
type Params struct {
|
|
||||||
WatcherVetoQuorum uint32 `json:"watcher_veto_quorum" yaml:"watcher_veto_quorum"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// DefaultParams returns the default council Params — WatcherVetoQuorum =
|
func DefaultParams() Params { return Params{} }
|
||||||
// WatcherVetoQuorumDefault (6, D-065/A-574).
|
|
||||||
func DefaultParams() Params {
|
|
||||||
return Params{WatcherVetoQuorum: WatcherVetoQuorumDefault}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Validate asserts the Params are well-formed (G-020). WatcherVetoQuorum
|
|
||||||
// must be in [2, 9] (the Watcher set is 9 per REQ-004; below 2 is
|
|
||||||
// meaningless, above 9 is unsatisfiable). The v0.5 simtest exercises the
|
|
||||||
// bounds.
|
|
||||||
func (p Params) Validate() error {
|
|
||||||
if p.WatcherVetoQuorum < 2 {
|
|
||||||
return fmt.Errorf("council: WatcherVetoQuorum %d below min 2 (G-020)", p.WatcherVetoQuorum)
|
|
||||||
}
|
|
||||||
if p.WatcherVetoQuorum > 9 {
|
|
||||||
return fmt.Errorf("council: WatcherVetoQuorum %d above max 9 (G-020; REQ-004 Watcher set)", p.WatcherVetoQuorum)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProposalKind enumerates the four proposal kinds a Council can take up
|
|
||||||
// (D-060, AUDIT §193 P1-1). Three map to the three Council tiers
|
|
||||||
// (Stand/Guild/Mesh); the fourth — MissionLockAmendmentRejected — is the
|
|
||||||
// Mission-Lock non-amendability marker: the enum value exists to DOCUMENT
|
|
||||||
// in code that the Mission Lock (vision §19, REQ-011) is non-amendable,
|
|
||||||
// but MsgSubmitProposal.ValidateBasic REJECTS it (D-064/A-572 — the
|
|
||||||
// message never reaches the handler). The locked const + the
|
|
||||||
// ValidateBasic gate form the dual firewall (D-064).
|
|
||||||
//
|
|
||||||
// MissionLockAmendable=false is the const firewall; the
|
|
||||||
// ProposalMissionLockAmendmentRejected enum value is the in-enum
|
|
||||||
// documentation; the ValidateBasic rejection is the gate. A future
|
|
||||||
// agent flipping the const OR removing the ValidateBasic gate breaks
|
|
||||||
// the regression tests.
|
|
||||||
type ProposalKind string
|
|
||||||
|
|
||||||
const (
|
|
||||||
// ProposalKindStand is a Stand-Council proposal (target: a Stand by
|
|
||||||
// ID-string ref via x/stand).
|
|
||||||
ProposalKindStand ProposalKind = "Stand"
|
|
||||||
// ProposalKindGuild is a Guild-Council proposal (target: a Guild by
|
|
||||||
// ID-string ref via x/guild).
|
|
||||||
ProposalKindGuild ProposalKind = "Guild"
|
|
||||||
// ProposalKindMesh is a Mesh-Council proposal (whole-mesh scope).
|
|
||||||
ProposalKindMesh ProposalKind = "Mesh"
|
|
||||||
// ProposalMissionLockAmendmentRejected is the Mission-Lock non-
|
|
||||||
// amendability marker (D-064/A-572). The enum value EXISTS to document
|
|
||||||
// in code that the Mission Lock (vision §19) is non-amendable, but
|
|
||||||
// MsgSubmitProposal.ValidateBasic REJECTS any proposal with this kind
|
|
||||||
// — the message never reaches the handler. The name carries
|
|
||||||
// "Rejected" so the rejection is visible at the call site (a proposal
|
|
||||||
// of this kind is rejected at the gate). The const firewall
|
|
||||||
// (MissionLockAmendable=false) + the ValidateBasic gate form the dual
|
|
||||||
// firewall (D-064).
|
|
||||||
ProposalMissionLockAmendmentRejected ProposalKind = "MissionLockAmendment-Rejected"
|
|
||||||
)
|
|
||||||
|
|
||||||
// AllProposalKinds returns all four ProposalKind values in D-060 order.
|
|
||||||
// Locked-const test asserts exactly 4 entries (the regression firewall).
|
|
||||||
func AllProposalKinds() []ProposalKind {
|
|
||||||
return []ProposalKind{
|
|
||||||
ProposalKindStand,
|
|
||||||
ProposalKindGuild,
|
|
||||||
ProposalKindMesh,
|
|
||||||
ProposalMissionLockAmendmentRejected,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// knownProposalKind reports whether k is one of the four ProposalKind
|
|
||||||
// values (used by genesis + ValidateBasic).
|
|
||||||
func knownProposalKind(k ProposalKind) bool {
|
|
||||||
for _, kk := range AllProposalKinds() {
|
|
||||||
if k == kk {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProposalStatus enumerates the five states a Proposal transitions through
|
|
||||||
// (D-060, AUDIT §193 P1-1). The lifecycle: Submit → Pending → Active (when
|
|
||||||
// the voting window opens) → Succeeded OR Failed (after tally) → Executed
|
|
||||||
// (v0.6+; v0.5 records the tally but does NOT auto-execute — D-060
|
|
||||||
// scope). Pending is the initial state (SubmitProposal creates Pending);
|
|
||||||
// Active is the voting-open state (the simtest transitions Pending →
|
|
||||||
// Active to enable voting); Succeeded is a passing tally (Yes quorum met,
|
|
||||||
// Veto quorum NOT met); Failed is a failing tally (No quorum OR Veto
|
|
||||||
// quorum met — D-065); Executed is the post-tally executed state (v0.6+).
|
|
||||||
type ProposalStatus string
|
|
||||||
|
|
||||||
const (
|
|
||||||
ProposalStatusPending ProposalStatus = "Pending"
|
|
||||||
ProposalStatusActive ProposalStatus = "Active"
|
|
||||||
ProposalStatusSucceeded ProposalStatus = "Succeeded"
|
|
||||||
ProposalStatusFailed ProposalStatus = "Failed"
|
|
||||||
ProposalStatusExecuted ProposalStatus = "Executed"
|
|
||||||
)
|
|
||||||
|
|
||||||
// AllProposalStatuses returns all five ProposalStatus values in D-060
|
|
||||||
// order. Locked-const test asserts exactly 5 entries (the regression
|
|
||||||
// firewall).
|
|
||||||
func AllProposalStatuses() []ProposalStatus {
|
|
||||||
return []ProposalStatus{
|
|
||||||
ProposalStatusPending,
|
|
||||||
ProposalStatusActive,
|
|
||||||
ProposalStatusSucceeded,
|
|
||||||
ProposalStatusFailed,
|
|
||||||
ProposalStatusExecuted,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// knownProposalStatus reports whether s is one of the five ProposalStatus
|
|
||||||
// values.
|
|
||||||
func knownProposalStatus(s ProposalStatus) bool {
|
|
||||||
for _, ss := range AllProposalStatuses() {
|
|
||||||
if s == ss {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
|
|
||||||
// VoteOption enumerates the four vote options on a Proposal (D-060, AUDIT
|
|
||||||
// §193 P1-1). Yes/No/Abstain are the standard three; Veto is the Watcher-
|
|
||||||
// only block signal (anti-greed, vision §19). A single Veto does NOT
|
|
||||||
// block — the quorum (default 6 per D-065/A-574) must be met to FAIL a
|
|
||||||
// proposal. The Vote handler enforces Veto authz via the WatcherKeeper
|
|
||||||
// shim (IsWatcher — only Watchers can cast Veto; non-Watchers casting
|
|
||||||
// Veto are REJECTED at the handler).
|
|
||||||
type VoteOption string
|
|
||||||
|
|
||||||
const (
|
|
||||||
VoteOptionYes VoteOption = "Yes"
|
|
||||||
VoteOptionNo VoteOption = "No"
|
|
||||||
VoteOptionAbstain VoteOption = "Abstain"
|
|
||||||
VoteOptionVeto VoteOption = "Veto" // Watcher-only (D-065/A-574)
|
|
||||||
)
|
|
||||||
|
|
||||||
// AllVoteOptions returns all four VoteOption values in D-060 order.
|
|
||||||
// Locked-const test asserts exactly 4 entries (the regression firewall).
|
|
||||||
func AllVoteOptions() []VoteOption {
|
|
||||||
return []VoteOption{
|
|
||||||
VoteOptionYes,
|
|
||||||
VoteOptionNo,
|
|
||||||
VoteOptionAbstain,
|
|
||||||
VoteOptionVeto,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// knownVoteOption reports whether o is one of the four VoteOption values.
|
|
||||||
func knownVoteOption(o VoteOption) bool {
|
|
||||||
for _, oo := range AllVoteOptions() {
|
|
||||||
if o == oo {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
|
|
||||||
// Proposal is a Council governance proposal (D-060, REQ-039). It is the
|
|
||||||
// runtime promotion of the v0.2 skeleton: the v0.2 Voice struct held a
|
|
||||||
// tally snapshot; v0.5 adds the Proposal lifecycle (Submit → Vote →
|
|
||||||
// Tally → Succeeded/Failed). Fields:
|
|
||||||
// - proposal-id: this proposal's ID (unique within a Council).
|
|
||||||
// - council-id: the Council by ID-string (G-003 by-ID-string ref).
|
|
||||||
// - kind: the ProposalKind (Stand/Guild/Mesh; MissionLockAmendment-
|
|
||||||
// Rejected is rejected at ValidateBasic — D-064).
|
|
||||||
// - proposer-reach: the proposer's reach-id (lexicon-clean holder
|
|
||||||
// identifier; G-003 — NOT a banned financial-holder term).
|
|
||||||
// - submit-time: unix seconds at SubmitProposal.
|
|
||||||
// - voting-deadline: unix seconds after which TallyProposal can close.
|
|
||||||
// - status: the ProposalStatus (Pending → Active → Succeeded/Failed →
|
|
||||||
// Executed).
|
|
||||||
// - tally: the running TallyResult (Yes/No/Abstain/Veto counts; the
|
|
||||||
// v0.2 NoWithVeto field — zero-locked in v0.2 — is now POPULATED by
|
|
||||||
// Watcher Vetos per D-060; G-017 reconciles the v0.2
|
|
||||||
// TestTallyResultNoWithVetoAlwaysZero regression: the DEFAULT tally
|
|
||||||
// has NoWithVeto=0, but a tally after a Watcher Veto quorum has
|
|
||||||
// NoWithVeto > 0).
|
|
||||||
type Proposal struct {
|
|
||||||
ProposalID string `json:"proposal_id" yaml:"proposal_id"`
|
|
||||||
CouncilID string `json:"council_id" yaml:"council_id"`
|
|
||||||
Kind ProposalKind `json:"kind" yaml:"kind"`
|
|
||||||
ProposerReach string `json:"proposer_reach" yaml:"proposer_reach"`
|
|
||||||
SubmitTime int64 `json:"submit_time" yaml:"submit_time"`
|
|
||||||
VotingDeadline int64 `json:"voting_deadline" yaml:"voting_deadline"`
|
|
||||||
Status ProposalStatus `json:"status" yaml:"status"`
|
|
||||||
Tally TallyResult `json:"tally" yaml:"tally"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Vote is a single Voice cast on a Proposal (D-060, REQ-039). The v0.2
|
|
||||||
// Voice struct held a SignalKind-based tally; v0.5 adds the per-Vote
|
|
||||||
// VoteOption (Yes/No/Abstain/Veto). The Vote is the per-voter record;
|
|
||||||
// the Proposal's Tally is the aggregate. Fields:
|
|
||||||
// - vote-id: this vote's ID (unique within a Proposal).
|
|
||||||
// - proposal-id: the Proposal by ID-string (G-003).
|
|
||||||
// - voter-reach: the voter's reach-id (lexicon-clean holder identifier).
|
|
||||||
// - option: the VoteOption (Yes/No/Abstain/Veto; Veto is Watcher-only).
|
|
||||||
// - timestamp: the cast time (unix seconds).
|
|
||||||
type Vote struct {
|
|
||||||
VoteID string `json:"vote_id" yaml:"vote_id"`
|
|
||||||
ProposalID string `json:"proposal_id" yaml:"proposal_id"`
|
|
||||||
VoterReach string `json:"voter_reach" yaml:"voter_reach"`
|
|
||||||
Option VoteOption `json:"option" yaml:"option"`
|
|
||||||
Timestamp int64 `json:"timestamp" yaml:"timestamp"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// GenesisState defines the council module genesis state (REQ-011).
|
// GenesisState defines the council module genesis state (REQ-011).
|
||||||
// Councils is the top-level set of three Council kinds; Voices is the
|
// Councils is the top-level set of three Council kinds; Voices is the
|
||||||
// Voice-tally set. Proposals + Votes are the v0.5 (P7, D-060) runtime
|
// Voice-tally set. ValidateGenesis enforces council-id uniqueness,
|
||||||
// promotion: the proposal lifecycle store. ValidateGenesis enforces
|
// voice-id uniqueness, and the Mission-Lock check (the const firewall echo).
|
||||||
// council-id uniqueness, voice-id uniqueness, proposal-id uniqueness,
|
// The data-engineer's genesis.go holds the schema helpers (G-008).
|
||||||
// vote-id uniqueness, and the Mission-Lock check (the const firewall
|
|
||||||
// echo). The data-engineer's genesis.go holds the schema helpers (G-008).
|
|
||||||
type GenesisState struct {
|
type GenesisState struct {
|
||||||
Councils []Council `json:"councils" yaml:"councils"`
|
Councils []Council `json:"councils" yaml:"councils"`
|
||||||
Voices []Voice `json:"voices" yaml:"voices"`
|
Voices []Voice `json:"voices" yaml:"voices"`
|
||||||
Proposals []Proposal `json:"proposals" yaml:"proposals"`
|
Params Params `json:"params" yaml:"params"`
|
||||||
Votes []Vote `json:"votes" yaml:"votes"`
|
|
||||||
Params Params `json:"params" yaml:"params"`
|
|
||||||
}
|
}
|
||||||
|
|
||||||
func DefaultGenesisState() *GenesisState {
|
func DefaultGenesisState() *GenesisState {
|
||||||
return &GenesisState{
|
return &GenesisState{
|
||||||
Councils: []Council{},
|
Councils: []Council{},
|
||||||
Voices: []Voice{},
|
Voices: []Voice{},
|
||||||
Proposals: []Proposal{},
|
Params: DefaultParams(),
|
||||||
Votes: []Vote{},
|
|
||||||
Params: DefaultParams(),
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Reset implements proto.Message (codec.JSONCodec.MustMarshalJSON /
|
|
||||||
// MustUnmarshalJSON require proto.Message — G-006 controlled exception:
|
|
||||||
// the codec requires the proto.Message interface; the lexicon tests in
|
|
||||||
// *_test.go stay stdlib-only per G-024, isolated from this types.go file).
|
|
||||||
func (m *GenesisState) Reset() { *m = GenesisState{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *GenesisState) String() string {
|
|
||||||
return fmt.Sprintf("GenesisState{Councils:%d Voices:%d Proposals:%d Votes:%d}",
|
|
||||||
len(m.Councils), len(m.Voices), len(m.Proposals), len(m.Votes))
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*GenesisState) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
||||||
// no-op): rejects duplicate council-ids and duplicate voice-ids, and runs
|
// no-op): rejects duplicate council-ids and duplicate voice-ids, and runs
|
||||||
// the Mission-Lock check. Delegates to the data-engineer's genesis.go
|
// the Mission-Lock check. Delegates to the data-engineer's genesis.go
|
||||||
@@ -447,14 +183,5 @@ func ValidateGenesis(bz json.RawMessage) error {
|
|||||||
if err := ValidateVoices(gs.Voices, gs.Councils); err != nil {
|
if err := ValidateVoices(gs.Voices, gs.Councils); err != nil {
|
||||||
return fmt.Errorf("council: %w", err)
|
return fmt.Errorf("council: %w", err)
|
||||||
}
|
}
|
||||||
if err := ValidateProposals(gs.Proposals, gs.Councils); err != nil {
|
|
||||||
return fmt.Errorf("council: %w", err)
|
|
||||||
}
|
|
||||||
if err := ValidateVotes(gs.Votes, gs.Proposals); err != nil {
|
|
||||||
return fmt.Errorf("council: %w", err)
|
|
||||||
}
|
|
||||||
if err := gs.Params.Validate(); err != nil {
|
|
||||||
return fmt.Errorf("council: %w", err)
|
|
||||||
}
|
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|||||||
+11
-474
@@ -201,26 +201,20 @@ func TestSignalKindValues(t *testing.T) {
|
|||||||
|
|
||||||
// TestTallyResultStructShape asserts TallyResult mirrors x/gov shape (A-204):
|
// TestTallyResultStructShape asserts TallyResult mirrors x/gov shape (A-204):
|
||||||
// fields yes, no, abstain, nowithveto, total, quorum_met. The no-with-veto
|
// fields yes, no, abstain, nowithveto, total, quorum_met. The no-with-veto
|
||||||
// field is kept for x/gov parity; v0.2 locked it to 0 (no veto option —
|
// field is kept for x/gov parity but always 0 (OY has no veto option —
|
||||||
// anti-greed, vision §19). v0.5 P7 (D-060) POPULATES NoWithVeto with Watcher
|
// anti-greed, vision §19). The test asserts the field names via JSON tags
|
||||||
// Vetos (the VoteOption enum adds Veto as the Watcher-only block signal).
|
// and that NoWithVeto is zero by default.
|
||||||
// G-017 reconciliation: the DEFAULT tally has NoWithVeto=0 (covered by
|
|
||||||
// TestTallyResultNoWithVetoDefaultZero); a tally after a Watcher Veto
|
|
||||||
// quorum has NoWithVeto > 0 (covered by
|
|
||||||
// TestTallyResultNoWithVetoPopulatedByQuorum). This test asserts the
|
|
||||||
// field names via JSON tags and that the struct can carry a populated
|
|
||||||
// NoWithVeto value (the v0.5 shape).
|
|
||||||
func TestTallyResultStructShape(t *testing.T) {
|
func TestTallyResultStructShape(t *testing.T) {
|
||||||
tr := types.TallyResult{
|
tr := types.TallyResult{
|
||||||
Yes: 10,
|
Yes: 10,
|
||||||
No: 3,
|
No: 3,
|
||||||
Abstain: 1,
|
Abstain: 1,
|
||||||
NoWithVeto: 2, // POPULATED by Watcher Vetos (D-060 — no longer always 0; G-017 reconciliation)
|
NoWithVeto: 0, // always 0 — no veto option
|
||||||
Total: 16,
|
Total: 14,
|
||||||
QuorumMet: true,
|
QuorumMet: true,
|
||||||
}
|
}
|
||||||
if tr.Yes != 10 || tr.No != 3 || tr.Abstain != 1 || tr.NoWithVeto != 2 ||
|
if tr.Yes != 10 || tr.No != 3 || tr.Abstain != 1 || tr.NoWithVeto != 0 ||
|
||||||
tr.Total != 16 || tr.QuorumMet != true {
|
tr.Total != 14 || tr.QuorumMet != true {
|
||||||
t.Error("TallyResult fields not set correctly")
|
t.Error("TallyResult fields not set correctly")
|
||||||
}
|
}
|
||||||
// x/gov field-name parity: marshal and check JSON tags.
|
// x/gov field-name parity: marshal and check JSON tags.
|
||||||
@@ -236,70 +230,12 @@ func TestTallyResultStructShape(t *testing.T) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// TestTallyResultNoWithVetoDefaultZero asserts the DEFAULT TallyResult
|
// TestTallyResultNoWithVetoAlwaysZero asserts the default TallyResult has
|
||||||
// has NoWithVeto == 0 (the anti-greed invariant — no veto option in the
|
// NoWithVeto == 0 (the anti-greed invariant — no veto option in OY).
|
||||||
// default zero-value tally).
|
func TestTallyResultNoWithVetoAlwaysZero(t *testing.T) {
|
||||||
//
|
|
||||||
// G-017 RECONCILIATION (CRITICAL): the v0.2 test was named
|
|
||||||
// TestTallyResultNoWithVetoAlwaysZero and asserted NoWithVeto == 0
|
|
||||||
// "always". v0.5 P7 (D-060) POPULATES NoWithVeto with Watcher Vetos (the
|
|
||||||
// VoteOption enum adds Veto as the Watcher-only block signal). The v0.2
|
|
||||||
// test's "always" assertion would contradict D-060. The reconciliation
|
|
||||||
// RENAMES the test to TestTallyResultNoWithVetoDefaultZero (asserts the
|
|
||||||
// DEFAULT tally has NoWithVeto=0) AND adds a new test
|
|
||||||
// TestTallyResultNoWithVetoPopulatedByQuorum (asserts a tally after a
|
|
||||||
// Watcher Veto quorum has NoWithVeto > 0). The regression is preserved
|
|
||||||
// (renamed + re-scoped, NOT deleted — the v0.2 regression protection
|
|
||||||
// stays green for the default case, and the new test covers the v0.5
|
|
||||||
// populated case).
|
|
||||||
func TestTallyResultNoWithVetoDefaultZero(t *testing.T) {
|
|
||||||
var tr types.TallyResult
|
var tr types.TallyResult
|
||||||
if tr.NoWithVeto != 0 {
|
if tr.NoWithVeto != 0 {
|
||||||
t.Errorf("default TallyResult.NoWithVeto = %d, expected 0 (no veto option in default tally — anti-greed)", tr.NoWithVeto)
|
t.Errorf("default TallyResult.NoWithVeto = %d, expected 0 (no veto option — anti-greed)", tr.NoWithVeto)
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestTallyResultNoWithVetoPopulatedByQuorum asserts a tally AFTER a
|
|
||||||
// Watcher Veto quorum has NoWithVeto > 0 (D-060 — the v0.2 zero-locked
|
|
||||||
// field is now POPULATED by Watcher Vetos). This is the G-017
|
|
||||||
// reconciliation's NEW test: it covers the v0.5 populated case that the
|
|
||||||
// v0.2 TestTallyResultNoWithVetoAlwaysZero test did not cover (the v0.2
|
|
||||||
// test asserted "always 0", which is no longer true post-D-060). The
|
|
||||||
// keeper simtest covers the full Vote → Tally → Failed lifecycle; this
|
|
||||||
// types-level test asserts the TallyResult struct shape carries the
|
|
||||||
// populated NoWithVeto field.
|
|
||||||
func TestTallyResultNoWithVetoPopulatedByQuorum(t *testing.T) {
|
|
||||||
// A tally after 6 Watcher Vetos (the default quorum, D-065/A-574).
|
|
||||||
tr := types.TallyResult{
|
|
||||||
Yes: 0,
|
|
||||||
No: 0,
|
|
||||||
Abstain: 0,
|
|
||||||
NoWithVeto: 6, // POPULATED by Watcher Vetos (D-060 — no longer always 0)
|
|
||||||
Total: 6,
|
|
||||||
QuorumMet: true,
|
|
||||||
}
|
|
||||||
if tr.NoWithVeto == 0 {
|
|
||||||
t.Errorf("TallyResult.NoWithVeto = 0 after a Watcher Veto quorum, expected > 0 (D-060 — NoWithVeto POPULATED by Watcher Vetos; the v0.2 zero-locked field is now populated)")
|
|
||||||
}
|
|
||||||
if tr.NoWithVeto != 6 {
|
|
||||||
t.Errorf("TallyResult.NoWithVeto = %d, expected 6 (quorum)", tr.NoWithVeto)
|
|
||||||
}
|
|
||||||
// Marshal round-trip: the populated NoWithVeto survives JSON
|
|
||||||
// serialization (x/gov shape parity A-204).
|
|
||||||
bz, err := json.Marshal(tr)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("marshal: %v", err)
|
|
||||||
}
|
|
||||||
js := string(bz)
|
|
||||||
if !strings.Contains(js, `"nowithveto":6`) {
|
|
||||||
t.Errorf("TallyResult JSON should contain populated nowithveto:6; got %s", js)
|
|
||||||
}
|
|
||||||
var tr2 types.TallyResult
|
|
||||||
if err := json.Unmarshal(bz, &tr2); err != nil {
|
|
||||||
t.Fatalf("unmarshal: %v", err)
|
|
||||||
}
|
|
||||||
if tr2.NoWithVeto != 6 {
|
|
||||||
t.Errorf("round-trip NoWithVeto = %d, expected 6", tr2.NoWithVeto)
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -475,7 +411,6 @@ func TestValidateGenesisAcceptsClean(t *testing.T) {
|
|||||||
{VoiceID: "v1", CouncilID: "cm", SignalKind: types.SignalStash},
|
{VoiceID: "v1", CouncilID: "cm", SignalKind: types.SignalStash},
|
||||||
{VoiceID: "v2", CouncilID: "cs", SignalKind: types.SignalCapital},
|
{VoiceID: "v2", CouncilID: "cs", SignalKind: types.SignalCapital},
|
||||||
},
|
},
|
||||||
Params: types.DefaultParams(),
|
|
||||||
}
|
}
|
||||||
bz, _ := json.Marshal(gs)
|
bz, _ := json.Marshal(gs)
|
||||||
if err := types.ValidateGenesis(bz); err != nil {
|
if err := types.ValidateGenesis(bz); err != nil {
|
||||||
@@ -556,404 +491,6 @@ func TestDefaultParams(t *testing.T) {
|
|||||||
_ = types.DefaultParams() // no panics
|
_ = types.DefaultParams() // no panics
|
||||||
}
|
}
|
||||||
|
|
||||||
// --- New v0.5 P7 locked-const + enum tests (D-060) ---------------------------
|
|
||||||
|
|
||||||
// TestProposalKindCountLockedConst asserts ProposalKindCount is exactly 4
|
|
||||||
// (D-060, AUDIT §193 P1-1): Stand, Guild, Mesh, MissionLockAmendment-Rejected.
|
|
||||||
func TestProposalKindCountLockedConst(t *testing.T) {
|
|
||||||
if types.ProposalKindCount != 4 {
|
|
||||||
t.Errorf("ProposalKindCount = %d, expected 4 (D-060 LOCKED — AUDIT §193 P1-1)", types.ProposalKindCount)
|
|
||||||
}
|
|
||||||
all := types.AllProposalKinds()
|
|
||||||
if len(all) != 4 {
|
|
||||||
t.Errorf("AllProposalKinds() len = %d, expected 4", len(all))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestAllProposalKindsNames asserts the 4 D-060 names in order with no
|
|
||||||
// extras, no dups, no renames. The MissionLockAmendment-Rejected kind is
|
|
||||||
// the Mission-Lock non-amendability marker (D-064/A-572 — rejected at
|
|
||||||
// ValidateBasic; the const + the gate form the dual firewall).
|
|
||||||
func TestAllProposalKindsNames(t *testing.T) {
|
|
||||||
want := []string{"Stand", "Guild", "Mesh", "MissionLockAmendment-Rejected"}
|
|
||||||
all := types.AllProposalKinds()
|
|
||||||
if len(all) != len(want) {
|
|
||||||
t.Fatalf("len = %d, want %d", len(all), len(want))
|
|
||||||
}
|
|
||||||
seen := map[string]bool{}
|
|
||||||
for i, k := range all {
|
|
||||||
if string(k) != want[i] {
|
|
||||||
t.Errorf("AllProposalKinds()[%d] = %q, want %q", i, k, want[i])
|
|
||||||
}
|
|
||||||
if seen[string(k)] {
|
|
||||||
t.Errorf("duplicate ProposalKind %q", k)
|
|
||||||
}
|
|
||||||
seen[string(k)] = true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestProposalKindValues asserts each named const matches its
|
|
||||||
// AllProposalKinds entry.
|
|
||||||
func TestProposalKindValues(t *testing.T) {
|
|
||||||
if types.ProposalKindStand != "Stand" {
|
|
||||||
t.Errorf("ProposalKindStand = %q", types.ProposalKindStand)
|
|
||||||
}
|
|
||||||
if types.ProposalKindGuild != "Guild" {
|
|
||||||
t.Errorf("ProposalKindGuild = %q", types.ProposalKindGuild)
|
|
||||||
}
|
|
||||||
if types.ProposalKindMesh != "Mesh" {
|
|
||||||
t.Errorf("ProposalKindMesh = %q", types.ProposalKindMesh)
|
|
||||||
}
|
|
||||||
if types.ProposalMissionLockAmendmentRejected != "MissionLockAmendment-Rejected" {
|
|
||||||
t.Errorf("ProposalMissionLockAmendmentRejected = %q", types.ProposalMissionLockAmendmentRejected)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestProposalStatusCountLockedConst asserts ProposalStatusCount is
|
|
||||||
// exactly 5 (D-060): Pending, Active, Succeeded, Failed, Executed.
|
|
||||||
func TestProposalStatusCountLockedConst(t *testing.T) {
|
|
||||||
if types.ProposalStatusCount != 5 {
|
|
||||||
t.Errorf("ProposalStatusCount = %d, expected 5 (D-060 LOCKED)", types.ProposalStatusCount)
|
|
||||||
}
|
|
||||||
all := types.AllProposalStatuses()
|
|
||||||
if len(all) != 5 {
|
|
||||||
t.Errorf("AllProposalStatuses() len = %d, expected 5", len(all))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestAllProposalStatusesNames asserts the 5 D-060 names in order.
|
|
||||||
func TestAllProposalStatusesNames(t *testing.T) {
|
|
||||||
want := []string{"Pending", "Active", "Succeeded", "Failed", "Executed"}
|
|
||||||
all := types.AllProposalStatuses()
|
|
||||||
if len(all) != len(want) {
|
|
||||||
t.Fatalf("len = %d, want %d", len(all), len(want))
|
|
||||||
}
|
|
||||||
for i, s := range all {
|
|
||||||
if string(s) != want[i] {
|
|
||||||
t.Errorf("AllProposalStatuses()[%d] = %q, want %q", i, s, want[i])
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVoteOptionCountLockedConst asserts VoteOptionCount is exactly 4
|
|
||||||
// (D-060): Yes, No, Abstain, Veto (Veto is Watcher-only).
|
|
||||||
func TestVoteOptionCountLockedConst(t *testing.T) {
|
|
||||||
if types.VoteOptionCount != 4 {
|
|
||||||
t.Errorf("VoteOptionCount = %d, expected 4 (D-060 LOCKED — AUDIT §193 P1-1)", types.VoteOptionCount)
|
|
||||||
}
|
|
||||||
all := types.AllVoteOptions()
|
|
||||||
if len(all) != 4 {
|
|
||||||
t.Errorf("AllVoteOptions() len = %d, expected 4", len(all))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestAllVoteOptionsNames asserts the 4 D-060 names in order. Veto is the
|
|
||||||
// Watcher-only block signal (anti-greed, vision §19; D-065/A-574 — a
|
|
||||||
// single Veto does NOT block; the quorum default 6 must be met).
|
|
||||||
func TestAllVoteOptionsNames(t *testing.T) {
|
|
||||||
want := []string{"Yes", "No", "Abstain", "Veto"}
|
|
||||||
all := types.AllVoteOptions()
|
|
||||||
if len(all) != len(want) {
|
|
||||||
t.Fatalf("len = %d, want %d", len(all), len(want))
|
|
||||||
}
|
|
||||||
for i, o := range all {
|
|
||||||
if string(o) != want[i] {
|
|
||||||
t.Errorf("AllVoteOptions()[%d] = %q, want %q", i, o, want[i])
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVoteOptionValues asserts each named const matches its AllVoteOptions
|
|
||||||
// entry.
|
|
||||||
func TestVoteOptionValues(t *testing.T) {
|
|
||||||
if types.VoteOptionYes != "Yes" {
|
|
||||||
t.Errorf("VoteOptionYes = %q", types.VoteOptionYes)
|
|
||||||
}
|
|
||||||
if types.VoteOptionNo != "No" {
|
|
||||||
t.Errorf("VoteOptionNo = %q", types.VoteOptionNo)
|
|
||||||
}
|
|
||||||
if types.VoteOptionAbstain != "Abstain" {
|
|
||||||
t.Errorf("VoteOptionAbstain = %q", types.VoteOptionAbstain)
|
|
||||||
}
|
|
||||||
if types.VoteOptionVeto != "Veto" {
|
|
||||||
t.Errorf("VoteOptionVeto = %q", types.VoteOptionVeto)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestProposalStructFields asserts Proposal carries all required fields
|
|
||||||
// (D-060). The Tally field's NoWithVeto is POPULATED by Watcher Vetos
|
|
||||||
// (D-060 — G-017 reconciliation).
|
|
||||||
func TestProposalStructFields(t *testing.T) {
|
|
||||||
p := types.Proposal{
|
|
||||||
ProposalID: "p1",
|
|
||||||
CouncilID: "cm",
|
|
||||||
Kind: types.ProposalKindMesh,
|
|
||||||
ProposerReach: "reach:prop",
|
|
||||||
SubmitTime: 1000,
|
|
||||||
VotingDeadline: 2000,
|
|
||||||
Status: types.ProposalStatusPending,
|
|
||||||
Tally: types.TallyResult{Yes: 1, No: 0, Abstain: 0, NoWithVeto: 0, Total: 1, QuorumMet: true},
|
|
||||||
}
|
|
||||||
if p.ProposalID != "p1" || p.CouncilID != "cm" || p.Kind != types.ProposalKindMesh ||
|
|
||||||
p.ProposerReach != "reach:prop" || p.SubmitTime != 1000 || p.VotingDeadline != 2000 ||
|
|
||||||
p.Status != types.ProposalStatusPending || p.Tally.Yes != 1 || p.Tally.Total != 1 ||
|
|
||||||
p.Tally.QuorumMet != true {
|
|
||||||
t.Error("Proposal fields not set correctly")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVoteStructFields asserts Vote carries all required fields (D-060).
|
|
||||||
func TestVoteStructFields(t *testing.T) {
|
|
||||||
v := types.Vote{
|
|
||||||
VoteID: "v1",
|
|
||||||
ProposalID: "p1",
|
|
||||||
VoterReach: "reach:voter",
|
|
||||||
Option: types.VoteOptionVeto,
|
|
||||||
Timestamp: 1500,
|
|
||||||
}
|
|
||||||
if v.VoteID != "v1" || v.ProposalID != "p1" || v.VoterReach != "reach:voter" ||
|
|
||||||
v.Option != types.VoteOptionVeto || v.Timestamp != 1500 {
|
|
||||||
t.Error("Vote fields not set correctly")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestWatcherVetoQuorumDefault asserts the default WatcherVetoQuorum is 6
|
|
||||||
// (D-065/A-574 — matching REQ-004 6-of-9).
|
|
||||||
func TestWatcherVetoQuorumDefault(t *testing.T) {
|
|
||||||
if types.WatcherVetoQuorumDefault != 6 {
|
|
||||||
t.Errorf("WatcherVetoQuorumDefault = %d, expected 6 (D-065/A-574)", types.WatcherVetoQuorumDefault)
|
|
||||||
}
|
|
||||||
p := types.DefaultParams()
|
|
||||||
if p.WatcherVetoQuorum != 6 {
|
|
||||||
t.Errorf("DefaultParams().WatcherVetoQuorum = %d, expected 6 (D-065/A-574)", p.WatcherVetoQuorum)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestParamsValidateBounds asserts Params.Validate() bounds WatcherVetoQuorum
|
|
||||||
// to [2, 9] (G-020 — the Watcher set is 9 per REQ-004; below 2 is
|
|
||||||
// meaningless, above 9 is unsatisfiable).
|
|
||||||
func TestParamsValidateBounds(t *testing.T) {
|
|
||||||
// Below min (2) → rejected.
|
|
||||||
if err := (types.Params{WatcherVetoQuorum: 1}).Validate(); err == nil {
|
|
||||||
t.Error("WatcherVetoQuorum=1 should be rejected (G-020 min 2)")
|
|
||||||
}
|
|
||||||
if err := (types.Params{WatcherVetoQuorum: 0}).Validate(); err == nil {
|
|
||||||
t.Error("WatcherVetoQuorum=0 should be rejected (G-020 min 2)")
|
|
||||||
}
|
|
||||||
// Above max (9) → rejected.
|
|
||||||
if err := (types.Params{WatcherVetoQuorum: 10}).Validate(); err == nil {
|
|
||||||
t.Error("WatcherVetoQuorum=10 should be rejected (G-020 max 9)")
|
|
||||||
}
|
|
||||||
// Bounds [2, 9] → accepted.
|
|
||||||
for q := uint32(2); q <= 9; q++ {
|
|
||||||
if err := (types.Params{WatcherVetoQuorum: q}).Validate(); err != nil {
|
|
||||||
t.Errorf("WatcherVetoQuorum=%d should be accepted (G-020 bounds [2,9]), got: %v", q, err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestMsgSubmitProposalValidateBasicRejectsMissionLockAmendment asserts
|
|
||||||
// the MissionLockAmendment-Rejected kind is REJECTED at ValidateBasic
|
|
||||||
// (D-064/A-572 — the message never reaches the handler; the const +
|
|
||||||
// ValidateBasic dual firewall). The keeper Proposal store stays empty
|
|
||||||
// (the handler is never invoked with this kind).
|
|
||||||
func TestMsgSubmitProposalValidateBasicRejectsMissionLockAmendment(t *testing.T) {
|
|
||||||
msg := &types.MsgSubmitProposal{
|
|
||||||
ProposalID: "p1",
|
|
||||||
CouncilID: "cm",
|
|
||||||
Kind: types.ProposalMissionLockAmendmentRejected,
|
|
||||||
ProposerReach: "reach:prop",
|
|
||||||
SubmitTime: 1000,
|
|
||||||
VotingDeadline: 2000,
|
|
||||||
Signer: "reach:prop",
|
|
||||||
}
|
|
||||||
err := msg.ValidateBasic()
|
|
||||||
if err == nil {
|
|
||||||
t.Fatal("MsgSubmitProposal with MissionLockAmendment-Rejected kind should be rejected at ValidateBasic (D-064/A-572)")
|
|
||||||
}
|
|
||||||
if !strings.Contains(err.Error(), "MissionLockAmendment") {
|
|
||||||
t.Errorf("error should reference the Mission Lock; got: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestMsgSubmitProposalValidateBasicAcceptsValid asserts the valid kinds
|
|
||||||
// (Stand, Guild, Mesh) pass ValidateBasic.
|
|
||||||
func TestMsgSubmitProposalValidateBasicAcceptsValid(t *testing.T) {
|
|
||||||
for _, kind := range []types.ProposalKind{types.ProposalKindStand, types.ProposalKindGuild, types.ProposalKindMesh} {
|
|
||||||
msg := &types.MsgSubmitProposal{
|
|
||||||
ProposalID: "p1",
|
|
||||||
CouncilID: "cm",
|
|
||||||
Kind: kind,
|
|
||||||
ProposerReach: "reach:prop",
|
|
||||||
SubmitTime: 1000,
|
|
||||||
VotingDeadline: 2000,
|
|
||||||
Signer: "reach:prop",
|
|
||||||
}
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
t.Errorf("kind %q should pass ValidateBasic; got: %v", kind, err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestMsgSubmitProposalValidateBasicErrorPaths asserts the other
|
|
||||||
// ValidateBasic error paths (empty fields, bad deadline).
|
|
||||||
func TestMsgSubmitProposalValidateBasicErrorPaths(t *testing.T) {
|
|
||||||
// empty proposal-id
|
|
||||||
if err := (&types.MsgSubmitProposal{CouncilID: "cm", Kind: types.ProposalKindMesh, ProposerReach: "r", VotingDeadline: 2, SubmitTime: 1, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty proposal-id should be rejected")
|
|
||||||
}
|
|
||||||
// empty council-id
|
|
||||||
if err := (&types.MsgSubmitProposal{ProposalID: "p", Kind: types.ProposalKindMesh, ProposerReach: "r", VotingDeadline: 2, SubmitTime: 1, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty council-id should be rejected")
|
|
||||||
}
|
|
||||||
// unknown kind
|
|
||||||
if err := (&types.MsgSubmitProposal{ProposalID: "p", CouncilID: "cm", Kind: types.ProposalKind("Bogus"), ProposerReach: "r", VotingDeadline: 2, SubmitTime: 1, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("unknown kind should be rejected")
|
|
||||||
}
|
|
||||||
// empty proposer-reach
|
|
||||||
if err := (&types.MsgSubmitProposal{ProposalID: "p", CouncilID: "cm", Kind: types.ProposalKindMesh, VotingDeadline: 2, SubmitTime: 1, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty proposer-reach should be rejected")
|
|
||||||
}
|
|
||||||
// empty signer
|
|
||||||
if err := (&types.MsgSubmitProposal{ProposalID: "p", CouncilID: "cm", Kind: types.ProposalKindMesh, ProposerReach: "r", VotingDeadline: 2, SubmitTime: 1}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty signer should be rejected")
|
|
||||||
}
|
|
||||||
// voting-deadline <= submit-time
|
|
||||||
if err := (&types.MsgSubmitProposal{ProposalID: "p", CouncilID: "cm", Kind: types.ProposalKindMesh, ProposerReach: "r", VotingDeadline: 1, SubmitTime: 2, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("voting-deadline <= submit-time should be rejected")
|
|
||||||
}
|
|
||||||
if err := (&types.MsgSubmitProposal{ProposalID: "p", CouncilID: "cm", Kind: types.ProposalKindMesh, ProposerReach: "r", VotingDeadline: 1, SubmitTime: 1, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("voting-deadline == submit-time should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestMsgVoteValidateBasic asserts MsgVote ValidateBasic error paths.
|
|
||||||
func TestMsgVoteValidateBasic(t *testing.T) {
|
|
||||||
// valid
|
|
||||||
if err := (&types.MsgVote{VoteID: "v", ProposalID: "p", VoterReach: "r", Option: types.VoteOptionYes, Signer: "r"}).ValidateBasic(); err != nil {
|
|
||||||
t.Errorf("valid MsgVote should pass; got: %v", err)
|
|
||||||
}
|
|
||||||
// Veto is allowed at ValidateBasic (Watcher authz is a runtime gate).
|
|
||||||
if err := (&types.MsgVote{VoteID: "v", ProposalID: "p", VoterReach: "r", Option: types.VoteOptionVeto, Signer: "r"}).ValidateBasic(); err != nil {
|
|
||||||
t.Errorf("MsgVote with Veto should pass ValidateBasic (Watcher authz is a runtime gate); got: %v", err)
|
|
||||||
}
|
|
||||||
// empty vote-id
|
|
||||||
if err := (&types.MsgVote{ProposalID: "p", VoterReach: "r", Option: types.VoteOptionYes, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty vote-id should be rejected")
|
|
||||||
}
|
|
||||||
// empty proposal-id
|
|
||||||
if err := (&types.MsgVote{VoteID: "v", VoterReach: "r", Option: types.VoteOptionYes, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty proposal-id should be rejected")
|
|
||||||
}
|
|
||||||
// empty voter-reach
|
|
||||||
if err := (&types.MsgVote{VoteID: "v", ProposalID: "p", Option: types.VoteOptionYes, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty voter-reach should be rejected")
|
|
||||||
}
|
|
||||||
// unknown option
|
|
||||||
if err := (&types.MsgVote{VoteID: "v", ProposalID: "p", VoterReach: "r", Option: types.VoteOption("Bogus"), Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("unknown option should be rejected")
|
|
||||||
}
|
|
||||||
// empty signer
|
|
||||||
if err := (&types.MsgVote{VoteID: "v", ProposalID: "p", VoterReach: "r", Option: types.VoteOptionYes}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty signer should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestMsgTallyProposalValidateBasic asserts MsgTallyProposal ValidateBasic.
|
|
||||||
func TestMsgTallyProposalValidateBasic(t *testing.T) {
|
|
||||||
// valid
|
|
||||||
if err := (&types.MsgTallyProposal{ProposalID: "p", Signer: "r"}).ValidateBasic(); err != nil {
|
|
||||||
t.Errorf("valid MsgTallyProposal should pass; got: %v", err)
|
|
||||||
}
|
|
||||||
// empty proposal-id
|
|
||||||
if err := (&types.MsgTallyProposal{Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty proposal-id should be rejected")
|
|
||||||
}
|
|
||||||
// empty signer
|
|
||||||
if err := (&types.MsgTallyProposal{ProposalID: "p"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty signer should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisRejectsDupProposalIDs asserts A-212: duplicate
|
|
||||||
// proposal-ids are rejected (P7 genesis validation).
|
|
||||||
func TestValidateGenesisRejectsDupProposalIDs(t *testing.T) {
|
|
||||||
gs := types.GenesisState{
|
|
||||||
Councils: []types.Council{{CouncilID: "c1", Kind: types.CouncilMesh}},
|
|
||||||
Proposals: []types.Proposal{
|
|
||||||
{ProposalID: "p1", CouncilID: "c1", Kind: types.ProposalKindMesh, Status: types.ProposalStatusPending},
|
|
||||||
{ProposalID: "p1", CouncilID: "c1", Kind: types.ProposalKindMesh, Status: types.ProposalStatusActive},
|
|
||||||
},
|
|
||||||
Params: types.DefaultParams(),
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := types.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject duplicate proposal-ids")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisRejectsProposalWithUnknownCouncil asserts referential
|
|
||||||
// integrity: a Proposal whose council-id does not reference an existing
|
|
||||||
// Council is rejected (P7 genesis validation).
|
|
||||||
func TestValidateGenesisRejectsProposalWithUnknownCouncil(t *testing.T) {
|
|
||||||
gs := types.GenesisState{
|
|
||||||
Councils: []types.Council{{CouncilID: "c1", Kind: types.CouncilMesh}},
|
|
||||||
Proposals: []types.Proposal{{ProposalID: "p1", CouncilID: "no-such", Kind: types.ProposalKindMesh, Status: types.ProposalStatusPending}},
|
|
||||||
Params: types.DefaultParams(),
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := types.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject Proposal with unknown council-id")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisRejectsProposalWithUnknownKind asserts an unknown
|
|
||||||
// ProposalKind is rejected at genesis.
|
|
||||||
func TestValidateGenesisRejectsProposalWithUnknownKind(t *testing.T) {
|
|
||||||
gs := types.GenesisState{
|
|
||||||
Councils: []types.Council{{CouncilID: "c1", Kind: types.CouncilMesh}},
|
|
||||||
Proposals: []types.Proposal{{ProposalID: "p1", CouncilID: "c1", Kind: types.ProposalKind("Bogus"), Status: types.ProposalStatusPending}},
|
|
||||||
Params: types.DefaultParams(),
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := types.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject Proposal with unknown kind")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisRejectsBadParams asserts a Params with an out-of-
|
|
||||||
// bounds WatcherVetoQuorum is rejected (G-020).
|
|
||||||
func TestValidateGenesisRejectsBadParams(t *testing.T) {
|
|
||||||
gs := types.GenesisState{
|
|
||||||
Councils: []types.Council{{CouncilID: "c1", Kind: types.CouncilMesh}},
|
|
||||||
Params: types.Params{WatcherVetoQuorum: 0}, // below min 2
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := types.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject Params with WatcherVetoQuorum=0 (G-020)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisAcceptsProposalAndVotes asserts a clean genesis with
|
|
||||||
// Proposals + Votes validates.
|
|
||||||
func TestValidateGenesisAcceptsProposalAndVotes(t *testing.T) {
|
|
||||||
gs := types.GenesisState{
|
|
||||||
Councils: []types.Council{{CouncilID: "cm", Kind: types.CouncilMesh}},
|
|
||||||
Proposals: []types.Proposal{
|
|
||||||
{ProposalID: "p1", CouncilID: "cm", Kind: types.ProposalKindMesh, Status: types.ProposalStatusActive},
|
|
||||||
},
|
|
||||||
Votes: []types.Vote{
|
|
||||||
{VoteID: "v1", ProposalID: "p1", Option: types.VoteOptionYes},
|
|
||||||
{VoteID: "v2", ProposalID: "p1", Option: types.VoteOptionVeto},
|
|
||||||
},
|
|
||||||
Params: types.DefaultParams(),
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := types.ValidateGenesis(bz); err != nil {
|
|
||||||
t.Errorf("ValidateGenesis should accept clean proposal+vote genesis, got: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Lexicon assertion (REQ-012) -------------------------------------------------
|
// --- Lexicon assertion (REQ-012) -------------------------------------------------
|
||||||
|
|
||||||
// TestLexiconNoBannedTermsInCouncilPackage scans every non-test .go file in
|
// TestLexiconNoBannedTermsInCouncilPackage scans every non-test .go file in
|
||||||
|
|||||||
Reference in New Issue
Block a user