Compare commits
9 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 cloudinit-bot
|
ab43befdaf | ||
|
cloudinit-bot
|
349453ecd9 | ||
|
cloudinit-bot
|
2ef3f2e39f | ||
|
cloudinit-bot
|
e493216b8a | ||
|
cloudinit-bot
|
d09c6132b1 | ||
|
cloudinit-bot
|
fa4ee47bde | ||
|
cloudinit-bot
|
a780884379 | ||
|
cloudinit-bot
|
cb394cb516 | ||
|
cloudinit-bot
|
23de3c544b |
+10
-15
@@ -1,19 +1,14 @@
|
|||||||
{
|
{
|
||||||
"milestone": "v0.7",
|
"phase": 3,
|
||||||
"milestone_complete": false,
|
"stage": "complete",
|
||||||
"milestone_release_tag": null,
|
"milestone": "v0.3",
|
||||||
"release_id": 776,
|
"milestone_type": "feature",
|
||||||
|
"tag_base": "v0.2.x",
|
||||||
|
"phase_role": "execution",
|
||||||
"project": "oy",
|
"project": "oy",
|
||||||
"phase": 0,
|
|
||||||
"phase_role": "pre_execution",
|
|
||||||
"stage": "grill",
|
|
||||||
"attempts": 0,
|
"attempts": 0,
|
||||||
"updated_at": "2026-08-19T00:04:00Z",
|
"updated_at": "2026-08-18T00:20:00Z",
|
||||||
"next_milestone": null,
|
"milestone_complete": false,
|
||||||
"previous_milestone": {
|
"phase_release_tag": "v0.2.3",
|
||||||
"milestone": "v0.6",
|
"release_id": 736
|
||||||
"milestone_complete": true,
|
|
||||||
"milestone_release_tag": "v0.5.6",
|
|
||||||
"release_id": 776
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
@@ -6,9 +6,9 @@
|
|||||||
}
|
}
|
||||||
],
|
],
|
||||||
"active_project": "oy",
|
"active_project": "oy",
|
||||||
"milestone": "v0.6",
|
"milestone": "v0.3",
|
||||||
"milestone_type": "feature",
|
"milestone_type": "feature",
|
||||||
"tag_base": "v0.5.x",
|
"tag_base": "v0.2.x",
|
||||||
"autonomy": {
|
"autonomy": {
|
||||||
"level": "full",
|
"level": "full",
|
||||||
"escalation_hooks": ["deploy", "delete_data", "merge_to_main"],
|
"escalation_hooks": ["deploy", "delete_data", "merge_to_main"],
|
||||||
|
|||||||
+1
-427
@@ -1,4 +1,3 @@
|
|||||||
<!-- Auto-generated from .ciagent/oy/oy-spec — PO edits oy-spec, not this file; see oy-state for current shipped state. -->
|
|
||||||
# Architecture: OpenYield (oy) — Phase 0 Index
|
# Architecture: OpenYield (oy) — Phase 0 Index
|
||||||
|
|
||||||
## Source
|
## Source
|
||||||
@@ -184,429 +183,4 @@ module's production `.go` files).
|
|||||||
> this file) that discuss the banned terms by name for governance reasons — they
|
> this file) that discuss the banned terms by name for governance reasons — they
|
||||||
> are NOT user-facing docs and are explicitly excluded from the docs firewall
|
> are NOT user-facing docs and are explicitly excluded from the docs firewall
|
||||||
> scan. This mirrors how `lexicon_meta_test.go` excludes itself: the firewall's
|
> scan. This mirrors how `lexicon_meta_test.go` excludes itself: the firewall's
|
||||||
> own code is allowed to name the terms it bans.
|
> own code is allowed to name the terms it bans.
|
||||||
|
|
||||||
## v0.4 Architecture (Refinement — NFR)
|
|
||||||
|
|
||||||
v0.4 is a refinement-only NFR milestone (D-047): zero `feat:` phases, zero new
|
|
||||||
production types, zero behavioral changes. It lands durability fixes sourced
|
|
||||||
from v0.3 forward-references. Tags run on the `v0.3.x` patch line.
|
|
||||||
|
|
||||||
### v0.4 Research Findings
|
|
||||||
|
|
||||||
**R-029 — Lexicon firewall shared helper (REQ-029, GRILL G-014).**
|
|
||||||
|
|
||||||
Verified during v0.4 RESEARCH: `lexicon_meta_test.go` (`TestLexiconMetaSelfTestTable`, lines 83-118) and `lexicon_meta_docs/lexicon_meta_docs_test.go` (`TestLexiconMetaDocsSelfTestTable`, lines 147-182) contain byte-identical duplicate synthetic self-test tables — both build the same 10-string slice by indexing `lexicon.BannedTerms()`. This is exactly the G-014 drift risk: if a future banned-term addition updates one table and not the other, the docs firewall silently loses coverage. The fix is a new `lexicon.SyntheticBannedStrings() []string` helper in `lexicon/lexicon.go` that returns the 10 synthetic strings; both meta-tests consume it instead of building their own copy. The helper's source uses `lexicon.BannedTerms()` (already fragment-assembled) so the lexicon package's own source stays lexicon-clean. Both meta-tests already assert `len(terms) == 10` from `lexicon.BannedTerms()` (the G-014 minimum); the helper closes the drift fully. No behavioral change to detection (`FindBannedTerm` unchanged); refactor + test only.
|
|
||||||
|
|
||||||
**R-030 — Cross-package const-equality test (REQ-030, REVIEW P2 / A-304).**
|
|
||||||
|
|
||||||
Verified during v0.4 RESEARCH: `x/hub/types/types.go:51,56` defines LOCAL consts `LendingCouponCapBps = uint32(800)` and `LendingCouponFloorBps = uint32(0)`, cross-documented (comment lines 46-55) to `x/bond/types/types.go:21,26` consts `CouponCapBps = 800` and `CouponFloorBps = 0` (D-028 mission-locked). The cross-doc comment flags drift for human review but no automated check exists. The fix is a new test file `x/hub/types/cross_const_test.go` (package `types`) that imports `github.com/oy/openyield/x/bond/types` (test-only, G-003 exempt per the test-import exemption documented in v0.2 GRILL G-003) and asserts `hub.LendingCouponCapBps == bond.CouponCapBps` and `hub.LendingCouponFloorBps == bond.CouponFloorBps`. The test fails closed if either const drifts. No production import is added (G-003 production firewall intact); test-only import only.
|
|
||||||
|
|
||||||
**R-031 — Lifecycle type shape-divergence review (REQ-031, AUDIT §193).**
|
|
||||||
|
|
||||||
Verified during v0.4 RESEARCH: AUDIT §193 flags two P1 council divergences and one P2 bearers nit:
|
|
||||||
- **P1-1**: `x/council/types` lacks `Proposal`/`ProposalStatus`/`VoteOption` enums (AUDIT says add "in v0.3 when wiring the council keeper to a live governance runtime"). Adding these is a `feat:`-class addition (new enum types) → REJECTED by D-001 filter for v0.4. Deferred to v0.5+ governance runtime.
|
|
||||||
- **P1-2**: `SignalKind` has 4 sources (Stash/Standing/Vouch/Capital) vs spec's `VoiceSource` 5 sources (Stash/Standing/Vouch/Freeholder/Guild). AUDIT code rationale: Freeholder is an eligibility property (upstream in `x/standing`), Guild is a council tier, Capital is committed-capital (vision §9.1) — defensible refinement. Changing `SignalKindCount` 4→5 is a locked-const change → REJECTED by D-001 filter for v0.4.
|
|
||||||
- **P2**: `x/bearers/types` `ValidateGenesis` no-op is CORRECT per spec (AUDIT explicitly notes "no action").
|
|
||||||
|
|
||||||
v0.4 REQ-031 scope (D-050): DOCUMENT the divergence decisions in this ARCHITECTURE.md section + add a regression-guard test asserting the current `SignalKindCount==4` shape is intentional (an intent-assertion test, not a shape change). No enum additions, no locked-const changes. The existing `TestSignalKindCountLockedConst` in `x/council/types/types_test.go:102` already asserts the count; REQ-031 adds an intent comment + a test documenting WHY the shape is 4-not-5 (the AUDIT rationale), so a future agent does not "fix" the divergence by silently changing the locked const.
|
|
||||||
|
|
||||||
**R-032 — Docs build CI (REQ-032, D-046).**
|
|
||||||
|
|
||||||
Verified during v0.4 RESEARCH: no `.github/workflows/` directory exists; Gitea Actions uses `.gitea/workflows/`. `mkdocs.yml` is present at repo root (buildable locally via `mkdocs build`). v0.4 REQ-032 ships a `.gitea/workflows/docs-build.yml` workflow that: (1) runs `go test ./...` (the lexicon firewall + all x/* tests) on push; (2) installs mkdocs + mkdocs-material (build-only Python deps in a separate job/step — does NOT touch `go.mod`, G-006 intact); (3) runs `mkdocs build` to produce `site/`; (4) uploads `site/` as a CI artifact. Full Gitea Pages publishing is DEFERRED (no hosting target configured in v0.4 per D-051). The workflow file is `chore` (CI config), not `feat:` — passes the D-001 filter. The workflow runs on every push to any branch (not just main) so the lexicon firewall + docs build are checked on every change.
|
|
||||||
|
|
||||||
### v0.4 Component Map (no new modules)
|
|
||||||
|
|
||||||
v0.4 touches NO new `x/*` modules. The touched files are:
|
|
||||||
- `lexicon/lexicon.go` (add `SyntheticBannedStrings()`) — REQ-029
|
|
||||||
- `lexicon_meta_test.go` (refactor to consume helper) — REQ-029
|
|
||||||
- `lexicon_meta_docs/lexicon_meta_docs_test.go` (refactor to consume helper) — REQ-029
|
|
||||||
- `x/hub/types/cross_const_test.go` (NEW test file) — REQ-030
|
|
||||||
- `x/council/types/types_test.go` (add intent-assertion test + comment) — REQ-031
|
|
||||||
- `.ciagent/oy/ARCHITECTURE.md` (this section) — REQ-031
|
|
||||||
- `.gitea/workflows/docs-build.yml` (NEW CI workflow) — REQ-032
|
|
||||||
|
|
||||||
### v0.4 Interface Contracts (unchanged from v0.3)
|
|
||||||
|
|
||||||
v0.4 does not change any cross-component interface. The 6 cross-component interfaces (Standing, Forge/Fold, Mirror, Window, Fee Covenant, Voice/Council) are unchanged. REQ-031 documents a divergence in the Voice/Council interface surface (SignalKind shape) but does not change it.
|
|
||||||
|
|
||||||
### Council Voice/Council Interface — Lifecycle Type Divergence Decisions (v0.4, REQ-031)
|
|
||||||
|
|
||||||
This section documents the lifecycle type shape-divergences flagged by AUDIT.md §193 for the Council/Voice interface surface. v0.4 is a refinement-only NFR milestone (D-047): the D-001 filter REJECTS `feat:`-class enum additions and locked-const shape changes, so these divergences are DOCUMENTED here, not fixed in code. A regression-guard test (`TestSignalKindShapeIntentional` in `x/council/types/types_test.go`) locks the current shape so a future agent does not silently "fix" a divergence by changing a locked const.
|
|
||||||
|
|
||||||
**Divergence P1-1 (AUDIT §193): `Proposal`/`ProposalStatus`/`VoteOption` enums absent from `x/council/types`.**
|
|
||||||
|
|
||||||
- **Spec source**: P3-01-01 deliverable recommended `Proposal`, `ProposalStatus` (5 states), `VoteOption` (3 options) enums mirroring OZ Governor / `x/gov`.
|
|
||||||
- **Implemented**: `Council`, `CouncilMember`, `Voice`, `SignalKind`, `TallyResult` — no `Proposal`/`ProposalStatus`/`VoteOption` lifecycle types.
|
|
||||||
- **Must-have impact**: NONE. The v0.2 P3 must-haves (3 councils, Mission Lock, `TallyResult` x/gov shape, no veto) are all met without the Proposal lifecycle.
|
|
||||||
- **Decision (v0.4, D-050)**: ADDING `Proposal`/`ProposalStatus`/`VoteOption` is a `feat:`-class addition (new enum types). REJECTED by the D-001 refinement-only filter. **Deferred to v0.5+** when the council keeper is wired to a live governance runtime (the AUDIT's own recommendation: "add in v0.3 when wiring the council keeper to a live governance runtime"). The skeleton council keeper in v0.2 does not consume a Proposal lifecycle; adding the types without the runtime would be dead code.
|
|
||||||
- **Severity (AUDIT)**: P1 (spec drift from deliverable text, not a must-have, not blocking).
|
|
||||||
- **v0.4 action**: DOCUMENT only (this section). No code change.
|
|
||||||
|
|
||||||
**Divergence P1-2 (AUDIT §193): `SignalKind` 4 sources vs spec `VoiceSource` 5 sources.**
|
|
||||||
|
|
||||||
- **Spec source**: P3-01-01 deliverable specified `VoiceSource` with 5 sources (Stash/Standing/Vouch/Freeholder/Guild).
|
|
||||||
- **Implemented**: `SignalKind` with 4 sources: `SignalStash`, `SignalStanding`, `SignalVouch`, `SignalCapital` (`SignalKindCount = 4`, locked const).
|
|
||||||
- **Code rationale (AUDIT §193 P1-2)**: the 4-source shape is a defensible design refinement, not a defect:
|
|
||||||
- `Freeholder` is an ELIGIBILITY property (upstream in `x/standing`), not a voice signal. A Freeholder-eligible Reach is a precondition for voting, not a signal that feeds a vote's weight.
|
|
||||||
- `Guild` is a COUNCIL TIER (one of the three councils is the Guild Council), not a voice signal. Including Guild as a signal kind would conflate the council tier with the signal source.
|
|
||||||
- `Capital` is committed-capital (vision §9.1, one of the four Freeholder signals), which the spec's `VoiceSource` list omitted. Adding `Capital` corrects the spec list to match vision §9.1's four-signal definition (REQ-005: "Four Freeholder signals locked").
|
|
||||||
- **Must-have impact**: NONE. The v0.2 P3 must-haves did not enumerate `VoiceSource` coverage; the 4-signal shape matches REQ-005's "Four Freeholder signals locked" exactly.
|
|
||||||
- **Decision (v0.4, D-050)**: changing `SignalKindCount` 4→5 (to restore the spec's 5-source `VoiceSource`) is a LOCKED-CONST CHANGE. REJECTED by the D-001 refinement-only filter (changing a locked const is a behavioral change, not a refinement). The 4-source shape is the CORRECT shape per vision §9.1 and REQ-005; the spec deliverable text was wrong, not the implementation.
|
|
||||||
- **Severity (AUDIT)**: P1 (design-choice divergence, tested and self-consistent, not blocking).
|
|
||||||
- **v0.4 action**: DOCUMENT the rationale here + add `TestSignalKindShapeIntentional` (regression guard) so a future agent changing `SignalKindCount` from 4 to 5 must also update the intent-assertion test, surfacing the AUDIT rationale for review. No locked-const change.
|
|
||||||
|
|
||||||
**Divergence P2 (AUDIT §193): `x/bearers/types` `ValidateGenesis` no-op.**
|
|
||||||
|
|
||||||
- **Spec source**: P4-02-01 said "DefaultParams/GenesisState unchanged" (bearers is an EXTENSION in v0.2, not a new module; the A-212 `ValidateGenesis` upgrade was scoped to NEW modules only).
|
|
||||||
- **Implemented**: `ValidateGenesis` remains a no-op (`x/bearers/types/types.go:108` returns `nil` unconditionally).
|
|
||||||
- **Decision (v0.4)**: CORRECT per spec — no action (AUDIT explicitly notes "no action"). The A-212 upgrade applies to NEW modules (v0.2's `x/window`, `x/stand`, etc.), not to EXTENDED modules like `x/bearers`. Listed here for completeness; no code change, no test change.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## v0.5 Runtime Architecture (Bearers Runtime)
|
|
||||||
|
|
||||||
This section appends the v0.5 runtime architecture to the v0.1/v0.2/v0.3/v0.4
|
|
||||||
content above. It does NOT rewrite or supersede earlier sections. v0.5 is the
|
|
||||||
first **feature** milestone to ship executable behavior: the v0.3 Bearers
|
|
||||||
skeletons are promoted from types + in-memory keeper stubs + invariant tests
|
|
||||||
to **live keeper MsgServer message handlers + simtest-grade end-to-end flows**
|
|
||||||
(D-054). This is NOT mainnet — D-020 continues to govern network deployment;
|
|
||||||
runtime = simtest-grade handlers, not live chain. Tags run on the `v0.4.x`
|
|
||||||
patch line (config.json `tag_base`).
|
|
||||||
|
|
||||||
### v0.5 Skeleton→Runtime Promotion Pattern
|
|
||||||
|
|
||||||
The promotion is uniform across all 8 target modules. The v0.3 skeleton
|
|
||||||
baseline (verified against the current tree): each module has only a `types/`
|
|
||||||
subdir with `types.go` (pure-Go structs + locked consts + enums),
|
|
||||||
`genesis.go` (`ValidateGenesis`), and `*_test.go` (invariant + lexicon
|
|
||||||
tests). The in-memory `Keeper` stub lives INSIDE `types/types.go` (e.g.,
|
|
||||||
`x/partner/types/types.go:101 type Keeper struct{...}`, `NewKeeper()` returns
|
|
||||||
`&Keeper{partners: make(map[string]Partner)}`). There is NO `keeper/` subdir,
|
|
||||||
NO `msg_server.go`, NO `types.Msg*`, NO `sdk.Context`, and NO cosmos-sdk
|
|
||||||
import anywhere in `x/` (grep for `cosmos-sdk` / `sdk.Context` /
|
|
||||||
`cosmos/cosmos` returns zero matches — verified at v0.5 P0).
|
|
||||||
|
|
||||||
v0.5 promotes each module per the Cosmos-SDK `MsgServer` convention:
|
|
||||||
|
|
||||||
| Layer | v0.3 skeleton | v0.5 runtime addition |
|
|
||||||
|---|---|---|
|
|
||||||
| Keeper | in-memory `map[string]T` in `types/types.go` | `keeper/keeper.go` (store-backed, wraps `sdk.KVStore`); the v0.3 stub is retired or wrapped as a test helper |
|
|
||||||
| Messages | none | `types/msg_*.go` with `Msg*` structs implementing `sdk.Msg` (`ValidateBasic`, `GetSigners`) |
|
|
||||||
| Handlers | none | `keeper/msg_server.go` with `MsgServer` + one `*Response, error` method per `Msg*` |
|
|
||||||
| Module wiring | none | `module.go` (`AppModule` with `RegisterServices` registering the `MsgServer`); simtest may use a lighter `ModuleManager` shim |
|
|
||||||
| End-to-end test | invariant tests only | `simtest/` (or `keeper/msg_server_simtest_test.go`) exercising each handler against an in-memory `sdk.Context` |
|
|
||||||
| Cross-module deps | by-ID-string only (G-003) | by-ID-string preserved at the type level; keeper-to-keeper calls via `expected_keepers.go` interface shims (ibc-go convention) |
|
|
||||||
|
|
||||||
The existing `types/` locked consts, enums, and structs are NOT amended —
|
|
||||||
the runtime layer adds behavior on top, not changes to the contract. The
|
|
||||||
locked-const firewall (8%/0% bond cap, 6 bearers, 4 Partner tiers, Mission
|
|
||||||
Lock non-amendable, etc.) stays green.
|
|
||||||
|
|
||||||
### v0.5 Per-Module Runtime Surface
|
|
||||||
|
|
||||||
| Module | REQ | Phase | Runtime surface (MsgServer handlers) | Key types added/extended |
|
|
||||||
|---|---|---|---|---|
|
|
||||||
| `x/exit` | REQ-033 | P1 | `MsgSubmitExitRoute`, `MsgExecuteDEXSwap`, `MsgRefundExit` driving the v0.3 `ExitStatus` lifecycle (Proposed→InProgress→Settled/Failed/Refunded) | `Msg*` types; cross-chain exit invokes `x/bridge` via `BridgeKeeper` expected-keeper shim |
|
|
||||||
| `x/bridge` | REQ-033 | P1 | `MsgAttestBridgeRoute` (Pending→Attested via Watcher quorum), `MsgActivateBridge`, `MsgCloseBridge`, `OnRecvPacket`, `OnAcknowledgementPacket`, `OnTimeoutPacket` (ibc-go `IBCModule` contract) | `Msg*` types; ICS-20 v1 payload parser; Solana via wormhole-adapter verification branch (D-059) |
|
|
||||||
| `x/bearers` | REQ-034 | P2 | `MsgSendOYSATFrame`, `MsgReceiveOYSATFrame`, `MsgIssueOYQR`, `MsgConsumeOYQR` (one-shot) + session lifecycle (Open/Active/Closed/Revoked) | `Session` struct; store-backed `BearerTransport` impl (keeper as transport in simtest); `consumed` flag is the OY-QR replay firewall |
|
|
||||||
| `x/partner` | REQ-035 | P3 | `MsgIssueAnchorCredential`, `MsgOnboardAnchor` (Pending→Onboarded), `MsgSuspendAnchorCredential`, `MsgRevokeAnchorCredential` (Watcher-quorum authz) | `Msg*` types; `expected_keepers.go` shims for `x/watcher` (revocation authz) and `x/hub` (custody-provider-id validity, P4-wired) |
|
|
||||||
| `x/hub` | REQ-036 | P4 | `MsgRegisterCustodyService` (operator must be Onboarded Anchor), `MsgCustodyReceiveAsset`, `MsgCustodyReleaseAsset` (compliance-before-debit), `MsgRecordLendingPrimitive` (coupon clamp [0,800]), `MsgRecordComplianceAttestation` | `CustodyKeyring` interface + `memKeyring` in-memory test impl (D-058); `Msg*` names avoid banned "deposit" (lexicon) |
|
|
||||||
| `x/services` | REQ-037 | P5 | `MsgRegisterService` (window-grant check), `MsgActivateService`, `MsgSuspendService`, `MsgRevokeService`; per-kind: `MsgIssueCareGrant`, `MsgActivateSIM`, `MsgProvisionVault`, `MsgBindMailbox` | Per-kind `Msg*` (typed dispatch, not generic); `window-id` grant checked on EVERY op (revoked Window invalidates) |
|
|
||||||
| `x/bond` | REQ-038 | P6 | `MsgIssueBond`, `MsgIssueGrowthBond` (`Clamp` + `ClampGrowth`), `MsgTickGrowthBond`, `MsgPlaceSecondaryOrder`, `MsgCancelSecondaryOrder`, `MsgMatchSecondaryOrder` (CLOB, price-time priority, per-match clamp) | CLOB matching engine; per-match coupon clamp to [0, 800] bps via v0.3 `Clamp` (D-057/D-028); match above 800 REJECTED (fails closed, A-562) |
|
|
||||||
| `x/council` | REQ-039 | P7 | `MsgSubmitProposal` (MissionLockAmendment kind rejected at `ValidateBasic`), `MsgVote` (Veto is Watcher-only, quorum-based), `MsgTallyProposal` | `Proposal` struct + `ProposalKind` enum (4, incl. rejected MissionLockAmendment) + `ProposalStatus` enum (5) + `VoteOption` enum (4) — AUDIT §193 P1-1 promotion; `SignalKind` stays 4 (P1-2 defensible); Mission Lock const firewall intact |
|
|
||||||
|
|
||||||
### v0.5 Custody Keyring Interface Boundary (D-058)
|
|
||||||
|
|
||||||
`x/hub/types/keyring.go` defines the `CustodyKeyring` Go interface — the
|
|
||||||
custody key-share abstraction (MPC-via-interface, not a concrete HSM/MPC
|
|
||||||
vendor):
|
|
||||||
|
|
||||||
```
|
|
||||||
type CustodyKeyring interface {
|
|
||||||
Sign(ctx context.Context, assetID string, payload []byte) (sig []byte, err error)
|
|
||||||
Derive(ctx context.Context, assetID string) (pub PubKey, err error)
|
|
||||||
Status(ctx context.Context, assetID string) (KeyringStatus, error)
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
- v0.5 ships an in-memory test-only `memKeyring` impl (`x/hub/keeper/
|
|
||||||
keyring_mem.go` or `x/hub/types/keyring_mem_test.go`) that signs with a
|
|
||||||
throwaway ed25519 key. Real MPC/HSM backing is deferred (operational,
|
|
||||||
Year 3+).
|
|
||||||
- The interface supports key rotation: `Status` reports the active key
|
|
||||||
version; the handler consults the keyring per operation (no caching
|
|
||||||
across blocks — a cached pubkey breaks rotation).
|
|
||||||
- The boundary keeps v0.5 dep-neutral w.r.t. custody vendors while landing
|
|
||||||
the handler surface. GRILL reviews the interface boundary.
|
|
||||||
|
|
||||||
### v0.5 CLOB Matching Engine Invariants (D-057)
|
|
||||||
|
|
||||||
`x/bond` secondary-market matching is a **central-limit order book (CLOB)**
|
|
||||||
(not an AMM — D-057 rejects AMM as a Year-4 concern). The invariants:
|
|
||||||
|
|
||||||
1. **Price-time priority** — at the same price, the earlier resting order
|
|
||||||
fills first (by sequence). This is REQ-007 FCFS at the same price.
|
|
||||||
2. **Per-tx matching** — the handler matches a new order against the resting
|
|
||||||
book in the same tx (dYdX-v4-shaped); no asynchronous / end-of-block
|
|
||||||
batch matching in v0.5 simtest.
|
|
||||||
3. **Per-match coupon clamp** — every match's resulting coupon is clamped to
|
|
||||||
`[CouponFloorBps=0, CouponCapBps=800]` (D-028, locked since v0.2) via the
|
|
||||||
v0.3 `Clamp` helper. A match whose implied coupon exceeds 800 bps is
|
|
||||||
**REJECTED** (fails closed — A-562, the mission-lock-true choice; D-057
|
|
||||||
says "clamp", the runtime interpretation is reject-above-cap. Planner
|
|
||||||
confirms before P6).
|
|
||||||
4. **Mission-lock const firewall** — the handler references the consts
|
|
||||||
directly (not a local copy); the REQ-030 cross-const test (hub lending
|
|
||||||
consts == bond consts) stays green.
|
|
||||||
5. **No front-running safety claim** — per-tx matching in a single-
|
|
||||||
validator simtest has no MEV; the handler is documented as NOT
|
|
||||||
front-running-safe for mainnet (a Year-3+ concern). Simtest does not
|
|
||||||
assert front-running safety (out of scope for simtest-grade runtime,
|
|
||||||
D-054).
|
|
||||||
|
|
||||||
### v0.5 IBC Packet Handler Scope (D-059)
|
|
||||||
|
|
||||||
`x/bridge` IBC packet handlers cover the **5 locked L2 chains** already in
|
|
||||||
the v0.2 `x/satellite` skeleton (Polygon, Base, Arbitrum, Optimism, Solana
|
|
||||||
per REQ-009). No new L2 chains in v0.5. The handler shape:
|
|
||||||
|
|
||||||
- **4 EVM chains (Polygon/Base/Arbitrum/Optimism):** standard IBC
|
|
||||||
recv/ack/timeout on the ICS-20 v1 payload (the v0.2 satellite packet
|
|
||||||
shape). Timestamp-only timeouts (IBC Eureka model, ibc-go v10) avoid the
|
|
||||||
EVM height-timeout ambiguity.
|
|
||||||
- **Solana:** via the wormhole-style bridge adapter (D-021 stub promoted
|
|
||||||
to runtime). Solana packets arrive as wormhole VAAs (Verified Action
|
|
||||||
Approvals); the `x/bridge` handler verifies the guardian signature set
|
|
||||||
(a 2-of-N quorum, N = the wormhole guardian set) before transitioning the
|
|
||||||
route. The guardian set is read from state (not hardcoded); simtest uses
|
|
||||||
a frozen stub guardian set. Live wormhole integration deferred (D-054).
|
|
||||||
- **Replay protection:** mirrors ibc-go — delete the in-flight record on
|
|
||||||
first ack; reject on second; `OnTimeoutPacket` refunds the source-chain
|
|
||||||
escrow exactly once. Simtest covers both replay and timeout-refund cases
|
|
||||||
(the CVE-class ibc-go pitfall).
|
|
||||||
|
|
||||||
### v0.5 Council Governance Enum Additions (D-060)
|
|
||||||
|
|
||||||
`x/council/types` gains the AUDIT §193 P1-1 enums deferred from v0.4
|
|
||||||
(D-050/D-001 rejected them as `feat:` for the NFR milestone; v0.5 promotes
|
|
||||||
them as the feature milestone's P7):
|
|
||||||
|
|
||||||
| New type | Values | Locked count | Notes |
|
|
||||||
|---|---|---|---|
|
|
||||||
| `Proposal` struct | (id, council-id, kind, proposer-reach, submit-time, voting-deadline, status, tally) | — | Mirrors OZ Governor / `x/gov` proposal shape |
|
|
||||||
| `ProposalKind` enum | `Stand`, `Guild`, `Mesh`, `MissionLockAmendment-Rejected` | `ProposalKindCount = 4` | The 4th value exists but the handler rejects it — documents the non-amendability in code |
|
|
||||||
| `ProposalStatus` enum | `Pending`, `Active`, `Succeeded`, `Failed`, `Executed` | `ProposalStatusCount = 5` | Mirrors OZ Governor / `x/gov` lifecycle |
|
|
||||||
| `VoteOption` enum | `Yes`, `No`, `Abstain`, `Veto` | `VoteOptionCount = 4` | `Veto` is Watcher-only; quorum-based (default `WatcherVetoQuorum = 6` per REQ-004 6-of-9); a single Veto does NOT block (anti-greed, vision §19) |
|
|
||||||
|
|
||||||
**Mission Lock const firewall intact (G-003):**
|
|
||||||
- `MissionLockAmendable = false` (v0.2 locked const) is UNCHANGED. The
|
|
||||||
`MissionLockAmendment-Rejected` `ProposalKind` is the in-code
|
|
||||||
documentation of the non-amendability; the `MsgSubmitProposal`
|
|
||||||
`ValidateBasic` REJECTS a proposal of that kind (the message never
|
|
||||||
reaches the handler — A-572). The const is the firewall; the
|
|
||||||
`ValidateBasic` is the gate. The v0.2 `TestMissionLockAmendableFalse`
|
|
||||||
regression test stays green.
|
|
||||||
- `SignalKind` stays at 4 sources (P1-2 defensible per AUDIT; the v0.4
|
|
||||||
`TestSignalKindShapeIntentional` regression-guard test stays green).
|
|
||||||
Expansion to 5 is a locked-const change deferred to v0.6+ governance
|
|
||||||
vote (not a Mission-Lock const — a distinct locked const; the distinction
|
|
||||||
is documented in v0.4 ARCHITECTURE.md).
|
|
||||||
- Proposal execution (auto-executing a passed proposal) is NOT in v0.5;
|
|
||||||
the handler records the tally result but does not auto-execute (a v0.6+
|
|
||||||
concern).
|
|
||||||
|
|
||||||
### v0.5 G-003 Production Firewall (still intact)
|
|
||||||
|
|
||||||
The G-003 by-ID-string rule (no production cross-`x/<module>/types` struct
|
|
||||||
imports) survives the runtime promotion. The runtime adds a NEW cross-
|
|
||||||
module surface — keeper-to-keeper calls — handled via the ibc-go
|
|
||||||
`expected_keepers.go` convention:
|
|
||||||
|
|
||||||
- Each module's `types/expected_keepers.go` defines Go INTERFACES for the
|
|
||||||
keepers it depends on (e.g., `x/exit/types/expected_keepers.go` defines a
|
|
||||||
`BridgeKeeper` interface with the methods `x/exit`'s handler calls; the
|
|
||||||
`x/bridge` keeper satisfies it structurally).
|
|
||||||
- The handler depends on the INTERFACE, not the concrete keeper struct.
|
|
||||||
This is NOT a struct import of `x/bridge/types`; it is an interface
|
|
||||||
defined in `x/exit/types`. G-003's intent (no cross-module struct
|
|
||||||
coupling, no import cycles) is preserved.
|
|
||||||
- Test-only cross-package imports (the G-003 test exemption, used by
|
|
||||||
REQ-030 in v0.4) remain exempt: a simtest may import both
|
|
||||||
`x/exit/keeper` and `x/bridge/keeper` to wire the expected-keeper shims
|
|
||||||
in a test setup.
|
|
||||||
|
|
||||||
### v0.5 G-006 Controlled Exception (cosmos-sdk dep, D-055)
|
|
||||||
|
|
||||||
`go.mod` gains `github.com/cosmos/cosmos-sdk` (+ transitive deps) as the
|
|
||||||
runtime substrate. This is a GRILL-approved controlled exception to G-006
|
|
||||||
(zero-dep go.mod), scoped to the runtime promotion phases:
|
|
||||||
|
|
||||||
- **Runtime phases (P1..P7):** `keeper/`, `msg_server.go`, `module.go`,
|
|
||||||
`simtest/` import cosmos-sdk. The dep is load-bearing.
|
|
||||||
- **P0 (pre-execution) + P8 (final):** stay dep-neutral where possible
|
|
||||||
(RESEARCH.md, PERSONAS.md, PLAN — no Go code).
|
|
||||||
- **`types/` packages:** the v0.3 `types/` packages were pure stdlib
|
|
||||||
(`encoding/json`); v0.5 ADDS `types.Msg*` structs implementing `sdk.Msg`,
|
|
||||||
so the `types/` package gains a cosmos-sdk import. The invariant tests
|
|
||||||
(locked-const, lexicon) stay stdlib-only and green. The `Msg*` types are
|
|
||||||
isolated in `types/msg_*.go` files for clarity.
|
|
||||||
- **Version pin (A-504, planner/GRILL confirms):** cosmos-sdk v0.50.x
|
|
||||||
(LTS, go 1.22-compatible) + ibc-go v8.x (for cosmos-sdk v0.50) for the
|
|
||||||
IBC packet handler interfaces. ibc-go v10 (IBC v2 / Eureka) is the
|
|
||||||
documented target pattern but a newer pin; v8.x is the stable choice.
|
|
||||||
The exception is GRILL-ratified per D-055.
|
|
||||||
|
|
||||||
### v0.5 Cross-Component Dependencies (within v0.5, by-ID-string + expected-keeper shims)
|
|
||||||
|
|
||||||
Per the v0.2-v0.4 G-003 invariant, v0.5 components reference each other and
|
|
||||||
the baseline by ID-string at the type level; the runtime adds interface-
|
|
||||||
typed keeper dependencies via `expected_keepers.go` shims. The dependency
|
|
||||||
edges that affect D-056 phase ordering:
|
|
||||||
|
|
||||||
```
|
|
||||||
x/exit ──(BridgeKeeper interface)──► x/bridge (P1 intra-phase; bridge keeper satisfies x/exit/types expected keeper)
|
|
||||||
x/bridge ──(WatcherKeeper interface)──► x/watcher (P1; Attested transition + Solana adapter authz)
|
|
||||||
x/bridge ──(BreadKeeper interface)───► x/bread (P1; mint/release wrapped Bread on recv/timeout)
|
|
||||||
x/bearers ──(BreadKeeper interface)───► x/bread (P2; OY-QR consume transfer effect)
|
|
||||||
x/partner ──(WatcherKeeper interface)──► x/watcher (P3; revocation authz)
|
|
||||||
x/partner ──(HubKeeper interface)─────► x/hub (P3→P4; custody-provider-id validity; shim exists P3, impl wired P4)
|
|
||||||
x/hub ──(PartnerKeeper interface)─► x/partner (P4; operator must be Onboarded Anchor)
|
|
||||||
x/hub ──(lexicon-safe consts)─────► x/bond (P4; LendingCouponCapBps/Floor local consts cross-documented D-028/REQ-030)
|
|
||||||
x/services ──(WindowKeeper interface)──► x/window (P5; window-grant validity on every op)
|
|
||||||
x/services ──(VaultKeeper interface)───► x/vault (P5; VaultService provisioning)
|
|
||||||
x/bond ──(StandKeeper interface)───► x/stand (P6; GrowthBond issuer-stand-id)
|
|
||||||
x/council ──(WatcherKeeper interface)──► x/watcher (P7; Veto authz + quorum)
|
|
||||||
```
|
|
||||||
|
|
||||||
**Phase-ordering implication (confirms D-056):** the outer→inner chain is
|
|
||||||
exit (P1) → bearers (P2) → anchors (P3) → hub (P4) → services (P5) → bond
|
|
||||||
(P6) → council (P7). The P3→P4 edge (partner needs hub custody-provider-id
|
|
||||||
validity) is broken by the `expected_keepers.go` shim: the hub keeper
|
|
||||||
INTERFACE exists in P3 (in `x/partner/types/expected_keepers.go`); the real
|
|
||||||
hub keeper impl is wired in P4. This is the ibc-go convention for breaking
|
|
||||||
cross-module dep cycles and lets P3 ship before P4 without a forward struct
|
|
||||||
dependency.
|
|
||||||
|
|
||||||
### v0.5 Interface Contracts (6 cross-component — extended, not replaced)
|
|
||||||
|
|
||||||
The six cross-component interfaces (Standing, Forge/Fold, Mirror, Window,
|
|
||||||
Fee Covenant, Voice/Council) are EXTENDED at runtime in v0.5 (they were
|
|
||||||
skeleton-only in v0.3):
|
|
||||||
|
|
||||||
- **Window Lifecycle Interface** — `x/services` handlers check the
|
|
||||||
Window status on every operation (not just registration); a revoked
|
|
||||||
Window invalidates the service (A-552).
|
|
||||||
- **Fee Covenant Interface** — `x/exit`/`x/bridge` exit-fee-bps fields
|
|
||||||
are clamped by the Fee Covenant ceiling/floor at runtime (the v0.3
|
|
||||||
field was typed but the Clamp was not invoked; v0.5 invokes it).
|
|
||||||
- **Voice/Council Interface** — `x/council` gains the `Proposal`/
|
|
||||||
`VoteOption` enums + Voice lifecycle handlers; the `TallyResult`
|
|
||||||
`NoWithVeto` field (v0.2 zero-locked) is now populated by Watcher
|
|
||||||
Vetos (quorum-based, not single-veto).
|
|
||||||
- **Watcher Attestation** — `x/bridge` `Attested` state is driven by a
|
|
||||||
Watcher quorum via the `WatcherKeeper` expected-keeper shim; `x/council`
|
|
||||||
Veto authz uses the same shim.
|
|
||||||
- **Standing API** — `x/hub` compliance service checks a partner's
|
|
||||||
Standing by reach-id at runtime (the v0.3 by-ID-string field becomes a
|
|
||||||
query).
|
|
||||||
- **Forge/Fold** — unchanged in v0.5 (no forge/fold runtime promotion this
|
|
||||||
milestone).
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## v0.7 Architecture (Fraternal Groups Foundation)
|
|
||||||
|
|
||||||
This section appends the v0.7 component map. v0.7 introduces a NEW module
|
|
||||||
`x/cover` (D-084, D-039 precedent) and extends 4 existing modules. No
|
|
||||||
breaking schema changes to locked-const firewall; G-003 production firewall
|
|
||||||
intact; G-006 go.mod unchanged (`x/cover` uses existing cosmos-sdk substrate).
|
|
||||||
|
|
||||||
### v0.7 Component Index (new + extended modules)
|
|
||||||
|
|
||||||
| # | Component | Vision § | v0.7 Module | New/Ext | Phase | v0.7 Runtime Depth |
|
|
||||||
|---|---|---|---|---|---|---|
|
|
||||||
| 8 | Cover Pool Factory (Pact #4 Cover graduated) | §16 | `x/cover` | New | P1-P5 | CoverPool + CoverCharter + CoverCall + CoverFeeTag structs + Factory keeper + Anti-Crowding-Out firewall + Anti-Capture Bill of Rights (13 rights) + Cover Claims Voucher role + Pool governance hybrid + category staging; simtest-grade runtime (D-020) |
|
|
||||||
| 8 | Mutual Aid Bond (Pact #5 Bonds extended) | §17 | `x/bond` | Extended | P4 | MAB struct (anonymous embed of Bond) + CouponDenom enum (CoverCall/MutualAidCredit/Bread-rejected) + 3× annual surplus ceiling + tagged streaming use-of-proceeds (D-080); simtest |
|
|
||||||
| 10 | Chapter Federation (Orgs extended) | §12 | `x/guild` | Extended | P3 | ParentGuildID + IsChapter + SecessionTermsHash + GoodStandingLiens fields on Guild + SecessionTerms struct + cooling consts (21d/14d) + Household simplified + Confederation Voice; simtest |
|
|
||||||
| 6 | Shadow vouch weight + Cover Claims Voucher slash | §9.1, §9.4 | `x/standing` | Extended | P4 | ShadowVouchWeightMultiplier=0.5 const + IsShadow field on Vouch + SlashReasonFraudulentCoverCall const; simtest |
|
|
||||||
| 10 | Stand→Pier boundary + Household/Confederation keeper logic | §11, §13 | `x/stand` | Extended | P3, P5 | StandPierEscalationAnnualPassVolumeCents const + Household one-tap exit + Confederation Voice aggregation (switch on existing StandType, no struct change); simtest |
|
|
||||||
| 8 | Pact Cover cross-reference (no change) | §16 | `x/pact` | Unchanged | — | PactCover enum value stays as cross-reference (D-084, mirrors PactHubAPI ↔ x/hub); ExecuteCover() stub stays |
|
|
||||||
|
|
||||||
> The Cover Pool Factory is Pact #4 (Cover) per REQ-020/D-027. v0.2 stubbed
|
|
||||||
> it as a PactType enum value inside `x/pact`; v0.7 promotes it to its own
|
|
||||||
> `x/cover` module for the Factory + Charter + Bill of Rights + Voucher
|
|
||||||
> runtime (D-084). The `x/pact` PactCover enum value stays as a
|
|
||||||
> cross-reference; `x/cover` owns the runtime surface. This mirrors the
|
|
||||||
> D-039 precedent (`x/hub` split from `x/pact`'s PactHubAPI in v0.3).
|
|
||||||
|
|
||||||
### v0.7 Cross-Component Dependencies (within v0.7)
|
|
||||||
|
|
||||||
Per the G-003 invariant (by-ID-string inter-module references; no struct
|
|
||||||
imports across `x/<module>/types`), v0.7 components reference each other and
|
|
||||||
the v0.2-v0.6 baseline by ID string only. The dependency edges that affect
|
|
||||||
v0.7 phase ordering:
|
|
||||||
|
|
||||||
```
|
|
||||||
x/cover ──(StandingKeeper shim)──► x/standing (P1: gate query; G-003 expected_keepers.go)
|
|
||||||
x/cover ──(WatcherKeeper shim)──► x/watcher (P1: attestation pipeline; P4: MAB release witness)
|
|
||||||
x/cover ──(BondKeeper shim)──► x/bond (P4: MAB issuance ceiling query)
|
|
||||||
x/bond ──(CoverKeeper shim)──► x/cover (P4: MAB MsgDebitMABProceeds queries CoverKeeper.GetPoolReserveAccount; D-089(2) reverse edge — no import cycle, interface only)
|
|
||||||
x/bond ──(Stand by id)──► x/stand (v0.2 baseline; MAB issuer-stand-id, unchanged)
|
|
||||||
x/guild ──(Stand by id)──► x/stand (v0.2 baseline; Guild StandAffiliationID, unchanged)
|
|
||||||
x/guild ──(Cover Pool by id)──► x/cover (P3: Chapter Federation liens reference Cover Pool covenants)
|
|
||||||
x/cover ──(StillKeeper stub)──► x/still (P1: auto-pause on below-floor; P4: auto-Still on MAB misuse; D-089(1) simtest-local stub, NOT a real x/still keeper — x/still is NOT extended this milestone)
|
|
||||||
x/cover ──(PactCover by id)──► x/pact (cross-reference only; no struct import)
|
|
||||||
```
|
|
||||||
|
|
||||||
**Phase-ordering implication (informs D-082):** `x/cover` P1 lands the
|
|
||||||
Factory + firewall + locked floors + gates + tagging first (firewall-first
|
|
||||||
pattern). P2 extends `x/cover` with Charter + governance + staging. P3
|
|
||||||
extends `x/guild` (Chapter Federation depends on Cover Pool existing for
|
|
||||||
lien/covenant references). P4 extends `x/bond` (MAB depends on Cover Pool
|
|
||||||
reserve existing for use-of-proceeds) + `x/standing` (Shadow vouch + Voucher
|
|
||||||
slash). P5 lands the Anti-Capture Bill (cross-cutting; constrains all prior
|
|
||||||
surfaces) + secession cooling + Pier boundary. Confidence 0.82.
|
|
||||||
|
|
||||||
### v0.7 Interface Contracts (6 cross-component — extended this milestone)
|
|
||||||
|
|
||||||
The six cross-component interfaces are EXTENDED in v0.7:
|
|
||||||
|
|
||||||
- **Standing API** — `x/cover` Factory queries Standing via expected-keeper
|
|
||||||
shim (StandingKeeper.GetStandingBucket) for the Cover Pool Standing gate
|
|
||||||
(REQ-049, D-077). By-ID-string at type level (G-003).
|
|
||||||
- **Watcher Attestation Interface** — `x/cover` Factory + MAB release invoke
|
|
||||||
Watcher attestation via WatcherKeeper shim. Cover-Charter signed by Pool
|
|
||||||
Host + witnessed by Watcher (REQ-052). MAB proceeds release requires
|
|
||||||
Watcher quorum (D-080).
|
|
||||||
- **Window Lifecycle Interface** — unchanged in v0.7 (Cover-Charter
|
|
||||||
amendments cooling uses the existing Window Duration semantics; secession
|
|
||||||
cooling is a separate const-based mechanism, not a Window).
|
|
||||||
- **Fee Covenant Interface** — unchanged in v0.7 (Cover-Fees are a separate
|
|
||||||
tagging surface, not a Fee-Covenant route; the Anti-Crowding-Out firewall
|
|
||||||
enforces the separation).
|
|
||||||
- **Voice/Council Interface** — `x/cover` Pool governance hybrid (REQ-062)
|
|
||||||
= Pool Host + 3 elected Masons + Watcher observer. No Anchor seat (§5
|
|
||||||
Anchor no-Voice). MAB holders have NO Voice (REQ-063). Confederation Voice
|
|
||||||
(REQ-058) aggregates one-per-Stand.
|
|
||||||
- **Forge/Fold** — unchanged in v0.7.
|
|
||||||
|
|
||||||
### v0.7 Locked-Const Firewall Additions (GRILL-ratified D-086..D-090)
|
|
||||||
|
|
||||||
Per oy-state §3 + GRILL D-087, v0.7 adds 12 new locked consts (all net-new, no amendments to existing consts):
|
|
||||||
|
|
||||||
| Const | Value | Module | REQ |
|
|
||||||
|-------|-------|--------|-----|
|
|
||||||
| CoverReserveFloorAnnualContribX | 1.5 | x/cover | REQ-047 (locked) |
|
|
||||||
| CoverReserveCeilingAnnualContribX | 2.5 | x/cover | REQ-048 (not locked) |
|
|
||||||
| CoverStandingGateTrusted | 4.0 | x/cover | REQ-049 (locked) |
|
|
||||||
| CoverStandingGatePreferred | 4.5 | x/cover | REQ-049 (locked) |
|
|
||||||
| MABIssuanceCeilingAnnualSurplusMultiple | 3 | x/bond | REQ-054 (locked) |
|
|
||||||
| CoolingSecessionCoverActiveDays | 21 | x/guild | REQ-064 (locked) |
|
|
||||||
| CoolingSecessionNonCoverDays | 14 | x/guild | REQ-064 (locked) |
|
|
||||||
| StandPierEscalationAnnualPassVolumeCents | 10000000 | x/stand | REQ-059 (not locked) |
|
|
||||||
| CoverClaimsVoucherBondMultipleAvgCall | 10 | x/cover | REQ-055 (not locked) |
|
|
||||||
| AntiCaptureBillOfRightsCount | 13 | x/cover | REQ-056 (locked) |
|
|
||||||
| ShadowVouchWeightMultiplier | 0.5 | x/standing | REQ-060 (locked) |
|
|
||||||
| PierCarriesVoice | false | x/guild | REQ-053 / FR-VOICE-6 (locked, D-087) |
|
|
||||||
+296
-28
@@ -1,34 +1,302 @@
|
|||||||
# v0.6 Audit (Nomad Web UI)
|
# Audit: OpenYield (oy) — v0.2 (The Mesh) Final Phase
|
||||||
|
|
||||||
## Reconstruction test
|
> **Auditor**: CIAgent security auditor (ci-auditor, read-only; critical-fix mode per run.md FINAL PHASE step 3)
|
||||||
- git log ↔ .ciagent/ files: each REQ-040..REQ-045 maps to a shipped UI screen / firewall.
|
> **Date**: 2026-08-17
|
||||||
- REQ-040 → P1 (web/handlers/reach.go + 3 Reach templates + POST /reach atomic create)
|
> **Scope**: v0.2 milestone state on `oy/milestone/v0.2-mesh` (HEAD = `oy/phase/05-final-review-ship`)
|
||||||
- REQ-041 → P2 (web/handlers/stash.go + stash.html + Bread-scale conversion)
|
> **Milestone**: v0.2 — The Mesh (feature; tag_base `v0.1.x`)
|
||||||
- REQ-042 → P3 (web/handlers/window.go + 3 Window templates + lifecycle)
|
> **Mode**: multi-project (slug `oy`)
|
||||||
- REQ-043 → P4 (web/handlers/standing.go + standing.html + Freeholder signals)
|
> **Autonomy**: full
|
||||||
- REQ-044 → P5 (web/handlers/bloom.go + bloom.html + BloomRecord)
|
|
||||||
- REQ-045 → P1 (lexicon_meta_web/ firewall extension)
|
|
||||||
- 6 phase branches phase/01-*..phase/06-* created, merged, 5 deleted (06 pending).
|
|
||||||
- 6 patch tags v0.5.0..v0.5.5 created (v0.5.6 pending = milestone release).
|
|
||||||
- D-072 ordering respected: firewall-first P1 (REQ-045) before content P2..P5.
|
|
||||||
|
|
||||||
## Feature purity gate — GREEN
|
---
|
||||||
- **No breaking schema changes**: no x/ module modified (web/ is new app-layer, not an x/ amendment).
|
|
||||||
- **Locked-const firewall intact**: all v0.1..v0.5 consts unchanged (web/ does not touch x/ consts; it reads them via x/*/types imports — D-070 app-layer consumption).
|
|
||||||
- **G-003 production firewall intact**: web/ imports only x/*/types (verified by web/store/import_test.go / G-025; no x/*/keeper, no x/*/module imports).
|
|
||||||
- **G-006 go.mod unchanged**: git diff v0.5.0..HEAD -- go.mod go.sum is EMPTY (G-028 baseline diff). HTMX is a vendored static asset, NOT a Go dep.
|
|
||||||
|
|
||||||
## Coverage
|
## 1. Per-Check Verdicts
|
||||||
- web/store: 98.1% (≥80% target met).
|
|
||||||
- web/handlers: 89.2% (≥80% target met).
|
|
||||||
- lexicon_meta_web: 100% (test-only firewall).
|
|
||||||
|
|
||||||
## Lexicon firewalls — all 3 GREEN
|
### 1.1 Reconstruction Test — **PASS** (fixed)
|
||||||
- lexicon_meta_test.go (v0.2, x/*.go) — green (no regression).
|
|
||||||
- lexicon_meta_docs_test.go (v0.3, README + docs/**) — green.
|
|
||||||
- lexicon_meta_web/ (v0.6, web/**/*.{html,js,go}) — green.
|
|
||||||
|
|
||||||
## Manual browser check (dynamic port)
|
**Git log matches `.ciagent/` files:**
|
||||||
- go run ./web on a dynamically-allocated port; all 5 screens reachable; happy path works end-to-end (Create a Reach → Stash dashboard → Open a Window → Standing progress → Bloom accrual). Smoke-tested on ports 47077 (P1) and 53907 (P5).
|
|
||||||
|
|
||||||
## Verdict: AUDIT PASS. Feature purity gate GREEN. Milestone ready to ship.
|
`git log main..oy/milestone/v0.2-mesh --oneline` returns 5 commits, one per phase, in order:
|
||||||
|
|
||||||
|
```
|
||||||
|
6304228 docs(P04): complete Bonds+Bearers+L2 phase → v0.1.4
|
||||||
|
c7f7391 docs(P03): complete Councils+Forex phase → v0.1.3
|
||||||
|
0fefd88 docs(P02): complete Pacts+Partners phase → v0.1.2
|
||||||
|
93a8a3b docs(P01): complete Orgs+Window foundation phase → v0.1.1
|
||||||
|
3e762f6 docs(P00): complete pre-execution phase → v0.1.0
|
||||||
|
```
|
||||||
|
|
||||||
|
Each commit is a phase-ship commit (one commit per phase, squash-style) carrying a `---ci---` block.
|
||||||
|
|
||||||
|
**Per-phase `---ci---` block verification:**
|
||||||
|
|
||||||
|
| Phase | `project` | `milestone` | `status` | `phase` | `requirements.covered` | Verdict |
|
||||||
|
|---|---|---|---|---|---|---|
|
||||||
|
| P0 (3e762f6) | `oy` ✓ | `v0.2` ✓ | `complete` ✓ | `0` ✓ | REQ-009,011,015,016,017,018,020,021 ✓ | PASS |
|
||||||
|
| P1 (93a8a3b) | `oy` ✓ | `v0.2` ✓ | `complete` ✓ | `1` ✓ | REQ-015,016,017,012 ✓ | PASS |
|
||||||
|
| P2 (0fefd88) | `oy` ✓ | `v0.2` ✓ | `complete` ✓ | `2` ✓ | REQ-020,018 ✓ | PASS |
|
||||||
|
| P3 (c7f7391) | `oy` ✓ | `v0.2` ✓ | `complete` ✓ | `3` ✓ | REQ-011 (partial REQ-009) ✓ | PASS |
|
||||||
|
| P4 (6304228) | `oy` ✓ | `v0.2` ✓ | `complete` ✓ | `4` ✓ | REQ-021,009 ✓ | PASS |
|
||||||
|
|
||||||
|
All 5 ship commits carry a `---ci---` block with `project: oy`, `milestone: v0.2`, `status: complete`, and the correct `phase` integer + `requirements.covered` list. Multi-project mode discipline observed.
|
||||||
|
|
||||||
|
**Tags exist and map to the correct phase-ship commits:**
|
||||||
|
|
||||||
|
```
|
||||||
|
v0.1.0 -> 3e762f6 (P00 ship) ✓
|
||||||
|
v0.1.1 -> 93a8a3b (P01 ship) ✓
|
||||||
|
v0.1.2 -> 0fefd88 (P02 ship) ✓
|
||||||
|
v0.1.3 -> c7f7391 (P03 ship) ✓
|
||||||
|
v0.1.4 -> 6304228 (P04 ship) ✓
|
||||||
|
v0.1.5 -> ABSENT (correct — final phase's job to create)
|
||||||
|
```
|
||||||
|
|
||||||
|
`git tag -l | grep v0.1` returns exactly `v0.1.0..v0.1.4`. The milestone release tag `v0.1.5` (= v0.2 milestone per D-008/D-020) is NOT yet present — correctly deferred to the final phase ship step.
|
||||||
|
|
||||||
|
**Milestone NOT yet released:** confirmed — no `v0.1.5` tag exists. The final phase (P5) is in progress (this audit is part of P5).
|
||||||
|
|
||||||
|
**Branch HEAD alignment:** `oy/milestone/v0.2-mesh` and `oy/phase/05-final-review-ship` both point at `63042285e8f27c0eb0dc5661d4d674b8244540fa` (the P04 ship commit) — the final-phase branch is correctly at the same HEAD as the milestone branch, ready for the P5 ship commit.
|
||||||
|
|
||||||
|
### 1.2 `.ciagent` File Discipline — **PASS**
|
||||||
|
|
||||||
|
**All 9 expected files present in `.ciagent/oy/`:**
|
||||||
|
|
||||||
|
```
|
||||||
|
ARCHITECTURE.md ✓
|
||||||
|
GRILL.md ✓
|
||||||
|
PERSONAS.md ✓
|
||||||
|
PROJECT.md ✓
|
||||||
|
REQUIREMENTS.md ✓
|
||||||
|
RESEARCH.md ✓
|
||||||
|
REVIEW.md ✓
|
||||||
|
ROADMAP.md ✓
|
||||||
|
PLANS.md ✓
|
||||||
|
```
|
||||||
|
|
||||||
|
(Also present: `P1_SHIP_VERIFICATION.md`..`P4_SHIP_VERIFICATION.md` — phase ship records, not part of the canonical 9 but consistent with the per-phase ship discipline.)
|
||||||
|
|
||||||
|
**CHECKPOINT.json — valid JSON, all required fields present:**
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"phase": 4,
|
||||||
|
"stage": "execute",
|
||||||
|
"milestone": "v0.2",
|
||||||
|
"milestone_type": "feature",
|
||||||
|
"tag_base": "v0.1.x",
|
||||||
|
"phase_role": "execution",
|
||||||
|
"project": "oy",
|
||||||
|
"attempts": 0,
|
||||||
|
"updated_at": "2026-08-17T21:50:00Z"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
All 8 required fields present: `phase`, `stage`, `milestone`, `milestone_type`, `tag_base`, `phase_role`, `project`, `updated_at` ✓. Valid JSON (`python3 -m json.tool` clean). Note: `phase: 4` reflects the last-completed execution phase; the active P5 phase will bump this on ship.
|
||||||
|
|
||||||
|
**config.json — valid JSON, all required settings correct:**
|
||||||
|
|
||||||
|
| Setting | Required | Actual | Verdict |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `milestone_type` | `feature` | `feature` ✓ | PASS |
|
||||||
|
| `tag_base` | `v0.1.x` | `v0.1.x` ✓ | PASS |
|
||||||
|
| `ship.per_phase` | `true` | `true` ✓ | PASS |
|
||||||
|
| `ship.allow_skip` | `false` | `false` ✓ | PASS |
|
||||||
|
| `active_project` | `oy` | `oy` ✓ | PASS |
|
||||||
|
| `projects[]` length | >0 (multi-project) | 1 (`oy`) ✓ | PASS |
|
||||||
|
|
||||||
|
Valid JSON. Multi-project mode active (projects[].length=1).
|
||||||
|
|
||||||
|
### 1.3 Branch Hygiene — **PASS**
|
||||||
|
|
||||||
|
| Check | Result | Verdict |
|
||||||
|
|---|---|---|
|
||||||
|
| `main` exists | `289c499a6d82e41498d335f6c732d0d133c85a4b` (pre-v0.2) ✓ | PASS |
|
||||||
|
| `main` is at v0.1 (pre-v0.2) | merge-base(main, milestone) == main ✓ | PASS |
|
||||||
|
| `oy/milestone/v0.2-mesh` exists | local + remote `origin/oy/milestone/v0.2-mesh` ✓ | PASS |
|
||||||
|
| `oy/milestone/v0.2-mesh` contains all P0-P4 work | 5 commits P0-P4 ✓ | PASS |
|
||||||
|
| `oy/phase/05-final-review-ship` exists (current) | checked out, HEAD == milestone HEAD ✓ | PASS |
|
||||||
|
| NO leftover execution phase branches | `git branch \| grep "oy/phase"` → only `oy/phase/05-final-review-ship` ✓ | PASS |
|
||||||
|
|
||||||
|
`git branch | grep "oy/phase"` returns exactly one line: `* oy/phase/05-final-review-ship`. The execution phase branches `oy/phase/01-orgs-window-foundation`, `oy/phase/02-pacts-partners`, `oy/phase/03-councils-forex`, `oy/phase/04-bonds-bearers-l2` are all correctly deleted after their respective phase ships. Only the final-phase branch remains (as expected — it is the active phase).
|
||||||
|
|
||||||
|
### 1.4 Commit Discipline — **PASS**
|
||||||
|
|
||||||
|
**Every commit on the milestone branch has a `---ci---` block with `project: oy`:**
|
||||||
|
|
||||||
|
All 5 commits (P0-P4) carry `---ci---` blocks. Verified `project: oy` present in each (see §1.1 table). Multi-project mode discipline observed.
|
||||||
|
|
||||||
|
**Phase ship commits have `status: complete` + `requirements: covered`:**
|
||||||
|
|
||||||
|
All 5 commits have `status: complete` ✓. All 5 have a `requirements:` block with a `covered:` list (see §1.1 table) ✓. P3 also honestly declares `partial: [REQ-009]` (Forex oracle is consumed by Piers — soft ordering note; REQ-009 is fully covered by P4's `x/satellite`). No phase falsely claims full coverage.
|
||||||
|
|
||||||
|
**Task commits have `plan:`/`task:`/`status: execute`:**
|
||||||
|
|
||||||
|
The milestone branch uses a **one-commit-per-phase** squash model (each `docs(PNN): complete ...` commit is the phase ship commit). There are no intermediate per-task commits on the milestone branch — per-task commits were made on the per-phase execution branches (`oy/phase/01-*`..`04-*`), then squashed into the single phase-ship commit on the milestone branch. This is a valid CIAgent ship pattern (vertical-slice integrity preserved at the phase granularity). The `---ci---` blocks correctly carry `phase: N`, `status: complete`, `phase_role: execution` (on P1-P4), and the covered REQ list. The final-phase branch (`oy/phase/05-final-review-ship`) is the active phase; its commit will carry `phase: 5`.
|
||||||
|
|
||||||
|
### 1.5 Build / Test / Cover Sanity — **PASS**
|
||||||
|
|
||||||
|
| Check | Command | Result | Verdict |
|
||||||
|
|---|---|---|---|
|
||||||
|
| Build | `go build ./...` | exit 0, GREEN | PASS |
|
||||||
|
| Tests | `go test ./...` | exit 0, all 25 packages GREEN (15 v0.1 + 10 v0.2) | PASS |
|
||||||
|
| v0.1 baseline regression | v0.1 packages in `go test ./...` | all (cached) GREEN — no regression | PASS |
|
||||||
|
| Lexicon meta-test | `go test -run TestLexiconMeta -v .` | 4 meta-tests PASS (NoBannedTermsInX, SelfTestTable, BannedTermsCount, NoFalsePositive) | PASS |
|
||||||
|
| G-003 import invariant | `go test -run TestG003... ./x/window/types/` | PASS (zero cross-module struct imports in production) | PASS |
|
||||||
|
| Locked-const invariants | `go test -run TestMissionLockAmendable\|TestClamp\|TestHandPassFeeBps\|TestStandTypeCount\|TestPactTypeCount\|TestPartnerTierCount\|TestCouncilKindCount\|TestL2ChainCount\|TestCouponCap -v ./x/...` | ALL PASS | PASS |
|
||||||
|
| Independent lexicon scan | `grep -rniE '\b(bank\|deposit\|interest\|yield\|currency\|dollar\|euro\|account\|savings\|depositor)\b' x/ --include='*.go'` | exit 1 (zero hits) | PASS |
|
||||||
|
| `go.mod` unchanged | `git diff main..oy/milestone/v0.2-mesh -- go.mod` | EMPTY (G-006 verified) | PASS |
|
||||||
|
|
||||||
|
**Coverage on all 10 new/extended packages (≥80% required, D-033):**
|
||||||
|
|
||||||
|
| Package | Phase | Coverage | Verdict |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `x/window/types` | P1 | 100.0% | PASS |
|
||||||
|
| `x/stand/types` | P1 | 100.0% | PASS |
|
||||||
|
| `x/guild/types` | P1 | 100.0% | PASS |
|
||||||
|
| `x/pact/types` | P2 | 95.9% | PASS |
|
||||||
|
| `x/partner/types` | P2 | 100.0% | PASS |
|
||||||
|
| `x/council/types` | P3 | 96.4% | PASS |
|
||||||
|
| `x/forex/types` | P3 | 100.0% | PASS |
|
||||||
|
| `x/bond/types` | P4 | 96.8% | PASS |
|
||||||
|
| `x/bearers/types` | P4 (ext) | 100.0% | PASS |
|
||||||
|
| `x/satellite/types` | P4 | 100.0% | PASS |
|
||||||
|
|
||||||
|
Floor = 95.9% (`x/pact/types`); 8 of 10 at 100%. All exceed the 80% target. D-033 satisfied with margin.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 2. Critical Issues Found (MUST fix before milestone ship)
|
||||||
|
|
||||||
|
**Initial critical issue count: 2** — both from the P5-01-03 deliverable (REQ-coverage audit + ROADMAP tag-line reconciliation), which is part of the P5 must-haves but had NOT been executed at audit time (HEAD was still the P04 ship commit; P5 doc work was pending).
|
||||||
|
|
||||||
|
### Critical-1: REQUIREMENTS.md status column NOT updated (P5-01-03 obligation)
|
||||||
|
|
||||||
|
- **Spec**: PLANS.md P5-01-03 — "update REQUIREMENTS.md status column (Pending → Skeleton)" for all v0.2 REQs.
|
||||||
|
- **Pre-fix state**: all 8 v0.2-scope REQs (REQ-009, REQ-011, REQ-015, REQ-016, REQ-017, REQ-018, REQ-020, REQ-021) still showed `Pending | Future`. Two v0.2 components beyond the REQ list (Bearers OY-LR/Beacon per D-029, Forex v1 per D-030) were not represented at all.
|
||||||
|
- **Impact**: the milestone's own requirement-coverage audit deliverable was unmet. A reader of REQUIREMENTS.md would conclude v0.2 shipped nothing, contradicting the 5 phase-ship commits and the 10 new/extended packages in the codebase.
|
||||||
|
- **Disposition**: FIXED in this final phase. Status column updated: all 8 v0.2 REQs → `Skeleton` with `v0.2/PN` phase tags; Bearers OY-LR/Beacon and Forex v1 added as explicit rows; v0.1 summary test count corrected to 53 (G-001); a v0.2 Milestone Summary block added documenting the 10 packages, locked-const invariants, coverage, tag chain, and the G-010 tag-line note.
|
||||||
|
|
||||||
|
### Critical-2: ROADMAP.md tag-line reconciliation (G-010) NOT done; Phase 2 not marked complete
|
||||||
|
|
||||||
|
- **Spec**: PLANS.md P5-01-03 + GRILL.md G-010 — "reconcile ROADMAP.md's v0.0.x → v0.1.x tag-line note so the milestone release (`v0.1.5`) is not confused with the v0.0.x pre-MVP line"; PLANS.md P5-02-01 — "update ROADMAP.md Phase 2 checkbox".
|
||||||
|
- **Pre-fix state**: ROADMAP.md Phase 2 section had no skeleton-status note, no module mapping, no tag-line reconciliation note, and no completion marker. The v0.0.x (pre-MVP) vs v0.1.x (Mesh) patch-line distinction existed only implicitly (line 15 mentions a deferred "v0.1.0 MVP" tag, which collides with v0.2's P0 tag `v0.1.0` — exactly the confusion G-010 was raised to prevent).
|
||||||
|
- **Impact**: a reader could confuse the v0.2 P0 tag `v0.1.0` with the ROADMAP's deferred "v0.1.0 MVP" tag (line 15), and could not see from ROADMAP.md that v0.2 had shipped any skeleton work.
|
||||||
|
- **Disposition**: FIXED in this final phase. Phase 2 header marked `— v0.2 SKELETON COMPLETE`; the deliverable table extended with `v0.2 Skeleton Module` and `Phase` columns mapping each Year-2 deliverable to its shipped `x/<module>`; a G-010 tag-line reconciliation note added explicitly distinguishing the `v0.0.x` pre-MVP line (lines 4-13) from the `v0.1.x` Mesh line, listing the full tag chain `v0.1.0..v0.1.5`, and stating that `v0.1.5` is the milestone release (not the deferred MVP tag).
|
||||||
|
|
||||||
|
**Post-fix verification**: `go test ./...` re-run after the doc edits — still GREEN (exit 0). The fixes are documentation-only in `.ciagent/oy/`; no source code under `x/` was touched (auditor is read-only w.r.t. source; the critical fixes are `.ciagent` doc updates, which is the P5-01-03 deliverable surface).
|
||||||
|
|
||||||
|
**Remaining critical issue count after fixes: 0.**
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 3. Non-Critical Observations (P1+ flags, not blocking)
|
||||||
|
|
||||||
|
These are design-shape divergences in a single module's non-must-have lifecycle types, carried over from REVIEW.md §3. They do NOT block the milestone ship. They are flagged for post-hoc review by the orchestrator / a future v0.3 PLAN phase.
|
||||||
|
|
||||||
|
### P1-1: Council module — Proposal/VoteOption lifecycle enums absent
|
||||||
|
- **File**: `x/council/types/types.go` (entire file)
|
||||||
|
- **Spec drift**: P3-01-01 deliverable recommended `Proposal`, `ProposalStatus` (5 states), `VoteOption` (3 options) enums mirroring OZ Governor / `x/gov`. Implemented: `Council`, `CouncilMember`, `Voice`, `SignalKind`, `TallyResult` — no Proposal/VoteOption lifecycle.
|
||||||
|
- **Must-have impact**: NONE. P3 must-haves (3 councils, Mission Lock, TallyResult x/gov shape, no veto) all met.
|
||||||
|
- **Recommendation**: add `Proposal`/`ProposalStatus`/`VoteOption` in v0.3 when wiring the council keeper to a live governance runtime.
|
||||||
|
- **Severity**: P1 (spec drift from deliverable text, not a must-have, not blocking).
|
||||||
|
|
||||||
|
### P1-2: Council VoiceSource → SignalKind (4 sources, not 5)
|
||||||
|
- **File**: `x/council/types/types.go` (`SignalKind` enum)
|
||||||
|
- **Spec drift**: P3-01-01 deliverable specified `VoiceSource` (Stash/Standing/Vouch/Freeholder/Guild — 5 sources). Implemented: `SignalKind` (Stash/Standing/Vouch/Capital — 4 sources; Freeholder + Guild dropped, Capital added).
|
||||||
|
- **Code rationale**: Freeholder is an eligibility property (upstream in `x/standing`), Guild is a council tier — neither is a voice signal. Capital is committed-capital (vision §9.1). Defensible design refinement, but diverges from deliverable text.
|
||||||
|
- **Must-have impact**: NONE. P3 must-haves did not enumerate VoiceSource coverage.
|
||||||
|
- **Recommendation**: confirm intended v0.2 shape, or restore 5-source `VoiceSource` for v0.3 wiring. The `SignalKindCount=4` locked-const test currently locks the 4-source shape; changing it is a deliberate locked-const update.
|
||||||
|
- **Severity**: P1 (design-choice divergence, tested and self-consistent, not blocking).
|
||||||
|
|
||||||
|
### P2 (nit): Bearers ValidateGenesis remains a no-op
|
||||||
|
- **File**: `x/bearers/types/types.go:108`
|
||||||
|
- **Note**: CORRECT per spec — P4-02-01 said "DefaultParams/GenesisState unchanged" (bearers is an EXTENSION, not a new module; the A-212 ValidateGenesis upgrade was scoped to NEW modules only). Recording for completeness, not a defect. No action.
|
||||||
|
|
||||||
|
### Observation: CHECKPOINT.json `phase: 4` (not 5)
|
||||||
|
- **Note**: CHECKPOINT.json reflects the last-completed execution phase (P4). The active P5 phase will bump `phase: 5` and `stage` on the P5 ship commit. This is the expected state mid-P5 (audit in progress, ship not yet committed). Not a defect.
|
||||||
|
|
||||||
|
### Observation: P3 commit lists REQ-009 as `partial`
|
||||||
|
- **Note**: P3's `---ci---` block declares `partial: [REQ-009]`. This is honest soft-ordering accounting (Forex oracle is consumed by Piers; P3 ships the Forex half, P4 ships the L2 satellite half). REQ-009 is fully covered by P4's `x/satellite`. The `partial` flag is informational, not a coverage gap. Not a defect.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 4. Overall Audit Verdict
|
||||||
|
|
||||||
|
### **PASS** (after critical fixes applied)
|
||||||
|
|
||||||
|
The v0.2 (The Mesh) milestone is **shippable**.
|
||||||
|
|
||||||
|
**Per-check summary:**
|
||||||
|
|
||||||
|
| # | Check | Verdict |
|
||||||
|
|---|---|---|
|
||||||
|
| 1.1 | Reconstruction test (git log ↔ .ciagent, tags, milestone-not-released) | PASS |
|
||||||
|
| 1.2 | .ciagent file discipline (9 files, CHECKPOINT.json, config.json) | PASS |
|
||||||
|
| 1.3 | Branch hygiene (main, milestone, final-phase, no leftover branches) | PASS |
|
||||||
|
| 1.4 | Commit discipline (`---ci---` blocks, project: oy, status, requirements) | PASS |
|
||||||
|
| 1.5 | Build / test / cover sanity (build, test, ≥80% coverage, lexicon, invariants) | PASS |
|
||||||
|
|
||||||
|
**Critical issues: 2 found → 2 fixed → 0 remaining.**
|
||||||
|
- Critical-1 (REQUIREMENTS.md status column): FIXED.
|
||||||
|
- Critical-2 (ROADMAP.md G-010 tag-line reconciliation + Phase 2 completion): FIXED.
|
||||||
|
|
||||||
|
**Non-critical observations: 3** (2× P1 council spec drift + 1× P2 nit) — flagged for post-hoc review, do not block ship.
|
||||||
|
|
||||||
|
**STRIDE security summary** (per ci-auditor role, read-only):
|
||||||
|
|
||||||
|
| Category | Finding | Severity | Disposition |
|
||||||
|
|---|---|---|---|
|
||||||
|
| Spoofing | No auth surface (skeleton-only, zero deps); Reach IDs are opaque strings, no identity assertion logic | Low | Accept |
|
||||||
|
| Tampering | Locked consts are compile-time `const` (Mission Lock, Bond cap/floor, Guild fee 0); `ValidateGenesis` rejects dup IDs + out-of-bounds bond coupons at genesis load | Low | Accept |
|
||||||
|
| Repudiation | Append-only audit log (Window) with non-decreasing timestamp + entry-id uniqueness enforced; no tx log in skeleton (deferred Phase 3) | Low | Accept |
|
||||||
|
| Info Disclosure | Zero secrets in code; lexicon firewall prevents leaking banned financial terms into the codebase (REQ-012); no PII handling in skeleton | Low | Accept |
|
||||||
|
| Denial of Service | Rate-limit primitive (Window) is a simple counter (A-206); no network surface (zero deps, no relayer, no live oracle); DoS surface is Phase 3+ | Low | Accept |
|
||||||
|
| Elevation of Privilege | Mission Lock (`const false`) prevents governance amending the covenant; Bond clamp prevents coupon above 8% cap; G-003 invariant prevents import-cycle privilege escalation via struct imports | Low | Accept |
|
||||||
|
|
||||||
|
No threat exceeds the low/accept threshold. No escalations. The skeleton+tests scope (D-020) intentionally has no runtime attack surface; all security-relevant invariants are compile-time consts + tested firewalls.
|
||||||
|
|
||||||
|
**Confidence in overall verdict: 0.90**
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 5. Ship Readiness Confirmation
|
||||||
|
|
||||||
|
The milestone is ready for the final ship step (P5-02-01):
|
||||||
|
1. `go build ./...` GREEN ✓
|
||||||
|
2. `go test ./...` GREEN (25 packages, no regression) ✓
|
||||||
|
3. Coverage ≥80% on all 10 new/extended packages (floor 95.9%) ✓
|
||||||
|
4. Lexicon firewall green (zero banned terms; meta-test + self-test table pass) ✓
|
||||||
|
5. All locked-const invariants green ✓
|
||||||
|
6. G-003 by-ID-string import invariant green ✓
|
||||||
|
7. go.mod unchanged (G-006) ✓
|
||||||
|
8. Tags v0.1.0..v0.1.4 exist and map to correct commits ✓
|
||||||
|
9. v0.1.5 NOT yet present (correct — final phase creates it) ✓
|
||||||
|
10. REQUIREMENTS.md + ROADMAP.md reconciled (Critical-1, Critical-2 fixed) ✓
|
||||||
|
|
||||||
|
**Remaining P5 ship actions** (for the orchestrator, not the auditor):
|
||||||
|
- Commit the P5 final-phase work (this AUDIT.md + the REQUIREMENTS.md/ROADMAP.md fixes + REVIEW.md).
|
||||||
|
- Create the `v0.1.5` tag (= v0.2 milestone release per D-008/D-020).
|
||||||
|
- (Optional) Update CHECKPOINT.json `phase: 5`, `stage: ship` on the P5 commit.
|
||||||
|
- (If release_blocking were true) push tags to remote. config.json `ship.release_blocking: false`, so local tag is sufficient; remote push is at orchestrator discretion.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Summary Block
|
||||||
|
|
||||||
|
```
|
||||||
|
Per-check verdicts:
|
||||||
|
1.1 Reconstruction test — PASS (5 phase commits; tags v0.1.0..v0.1.4; v0.1.5 absent)
|
||||||
|
1.2 .ciagent discipline — PASS (9 files; CHECKPOINT.json + config.json valid)
|
||||||
|
1.3 Branch hygiene — PASS (no leftover execution branches; final-phase at milestone HEAD)
|
||||||
|
1.4 Commit discipline — PASS (all 5 commits: project: oy, status: complete, requirements: covered)
|
||||||
|
1.5 Build/test/cover — PASS (build GREEN; test GREEN; coverage floor 95.9%; lexicon + invariants green)
|
||||||
|
|
||||||
|
Critical issues: 2 found → 2 fixed → 0 remaining
|
||||||
|
- Critical-1: REQUIREMENTS.md status column → FIXED (P5-01-03 obligation)
|
||||||
|
- Critical-2: ROADMAP.md G-010 tag-line → FIXED (P5-01-03 obligation)
|
||||||
|
|
||||||
|
Non-critical: 3 (2× P1 council spec drift, 1× P2 nit) — flagged, not blocking
|
||||||
|
Escalations: 0
|
||||||
|
Overall verdict: PASS (after critical fixes)
|
||||||
|
Confidence: 0.90
|
||||||
|
AUDIT.md written: /root/oy/.ciagent/oy/AUDIT.md ✓
|
||||||
|
```
|
||||||
File diff suppressed because it is too large
Load Diff
+111
-65
@@ -3,75 +3,121 @@ active_personas:
|
|||||||
- id: backend-engineer
|
- id: backend-engineer
|
||||||
active: true
|
active: true
|
||||||
phase_specific: false
|
phase_specific: false
|
||||||
reason: "Owns the v0.7 runtime across all execution phases — the bulk of the milestone. v0.7 introduces a NEW module `x/cover` (Cover Pool Factory + Anti-Crowding-Out firewall + Anti-Capture Bill of Rights, per D-084) following the D-039 precedent (`x/hub` split from `x/pact` in v0.3). backend-engineer builds the `x/cover` types/ + keeper/ + module.go + expected_keepers.go + msg_server.go + simtest, mirroring the x/hub layout. Also owns EXTENSIONS: `x/bond` (MAB as anonymous-embed extension, mirroring GrowthBond), `x/guild` (ParentGuildID + IsChapter + SecessionTermsHash + GoodStandingLiens), `x/standing` (ShadowVouchWeightMultiplier const + IsShadow field + SlashReasonFraudulentCoverCall const), `x/stand` (Household/Confederation keeper logic — switch on existing StandType, no struct change), `x/pact` (PactCover stays as cross-reference, no change)."
|
reason: Owns ALL Bearers skeleton Go modules in v0.3 (x/exit, x/bridge, x/bearers ext, x/partner ext, x/hub, x/services, x/bond ext). The v0.2 cosmos-engineer/security-engineer split is collapsed back into backend-engineer for v0.3 because the Cosmos-convention-alignment load is lower (no new IBC/governance/capability modules — x/bridge reuses the v0.2 satellite ICS-20 shape, x/hub is a fresh B2B scaffold). v0.3 is bespoke-type skeleton + tests work, which is backend-engineer's core territory.
|
||||||
frameworks: [Go 1.22, cosmos-sdk v0.50.x (D-055), ibc-go v8.x, Go testing, simtest, lexicon firewall, locked-const invariant tests]
|
frameworks: [Go 1.22 stdlib, Cosmos-style types (zero-dep)]
|
||||||
territory: ["x/cover/**", "x/bond/**", "x/guild/**", "x/standing/**", "x/stand/**", "x/pact/**", "lexicon/**", "lexicon_meta_test.go", "lexicon_meta_docs/**", "lexicon_meta_web/**"]
|
territory: ["x/exit/**", "x/bridge/**", "x/hub/**", "x/services/**", "x/bearers/**", "x/partner/**", "x/bond/**", "x/**/types/**", "x/**/keeper/**"]
|
||||||
constraints:
|
constraints: ["zero external deps (G-006 — go.mod read-only)", "D-020 skeleton+tests pattern (D-035 continues)", "≥80% coverage on new/extended packages", "per-package lexicon assertion (REQ-012) in every new/extended test file", "by-ID-string inter-module refs (G-003 — no struct imports across x/<module>/types)", "locked-const invariants (HubService count, ServiceKind count, BridgeStatus count, ExitStatus count, Anchor credential fields)", "no live chain / no real IBC / no real bearer transports / no live B2B runtime"]
|
||||||
- "G-003 production firewall intact — x/cover references x/standing (StandingKeeper shim), x/watcher (WatcherKeeper shim), x/bond (BondKeeper shim) via expected_keepers.go interfaces; by-ID-string rule at type level; x/pact.PactCover stays as cross-reference (D-084, mirrors x/pact.PactHubAPI ↔ x/hub)"
|
|
||||||
- "G-006 controlled exception (D-055) — go.mod unchanged in v0.7 (x/cover uses existing cosmos-sdk substrate); target G-028 diff baseline EMPTY"
|
|
||||||
- "locked-const invariants — v0.7 ADDS consts (CoverReserveFloorAnnualContribX=1.5, CoverStandingGateTrusted=4.0, CoverStandingGatePreferred=4.5, MABIssuanceCeilingAnnualSurplusMultiple=3, CoolingSecessionCoverActiveDays=21, CoolingSecessionNonCoverDays=14, CoverClaimsVoucherBondMultipleAvgCall=10, AntiCaptureBillOfRightsCount=13, ShadowVouchWeightMultiplier=0.5, StandPierEscalationAnnualPassVolumeCents=10000000) but does NOT change existing locked consts"
|
|
||||||
- "lexicon firewall stays green — Msg* names avoid banned terms (no 'deposit', no 'account', no 'insurance' — use 'Cover', 'Cover-Fee', 'Cover Call', 'Cover-Charter')"
|
|
||||||
- "simtest NOT mainnet (D-054 continues) — x/cover keeper handlers exercised against in-memory sdk.Context"
|
|
||||||
- "≥80% coverage on x/cover + extensions (D-033 carries forward)"
|
|
||||||
- "Anti-Crowding-Out firewall (D-079) — x/cover/firewall subpackage rejects Cover-Fee routing outside contributor-pool semantics"
|
|
||||||
- "MAB use-of-proceeds (D-080) — tagged streaming + Watcher-witnessed release; auto-Still on misuse"
|
|
||||||
|
|
||||||
- id: lead-developer
|
- id: lead-developer
|
||||||
active: true
|
active: true
|
||||||
phase_specific: false
|
phase_specific: false
|
||||||
reason: "Coordinates v0.7 phase decomposition (P1..P6), territory enforcement (warn mode), and the final-phase feature purity gate audit. Owns the D-085 escalation (13th right identification — confidence 0.55; surfaced through normal decision flow before P5). Owns the §7 acceptance 'pen-test ≥1 independent third party' — at full autonomy, runs self-administered adversarial review (ci-griller) and logs as assumption unless PO rules otherwise."
|
reason: Coordinates the v0.3 phase decomposition (P1 firewall+docs foundation → P2 nomads → P3 freeholders → P4 Bearers I → P5 Bearers II → P6 review/ship), territory enforcement (warn mode per config.json), and final review. Owns the cross-component dependency finding (x/exit→x/bridge in P4; x/partner-Anchor→x/hub across P4→P5) that constrains phase ordering.
|
||||||
frameworks: [cross-cutting, Gitea Actions, Markdown, YAML, git]
|
frameworks: [cross-cutting]
|
||||||
territory: [".ciagent/**", ".gitea/workflows/**", ".ciagent/oy/ARCHITECTURE.md", ".ciagent/oy/ROADMAP.md", ".ciagent/oy/REQUIREMENTS.md"]
|
territory: [".ciagent/**", "**"]
|
||||||
constraints:
|
constraints: ["D-044 phase ordering (firewall-first; P4 before P5 for Anchor→hub dep)", "milestone versioning (v0.3 / tag_base v0.2.x)", "lexicon gate on merge (REQ-012 extends to docs/)", "persona territory warn-mode enforcement", "zero Go deps invariant (G-006); docs build-deps are allowed (D-042)"]
|
||||||
- "D-082 phase ordering — P1 Cover Factory (foundation+firewall) → P2 Charter/governance/staging → P3 Federation/Household/Confederation → P4 MAB/Voucher/Shadow → P5 Bill of Rights/secession/Pier → P6 final; each phase independently shippable"
|
|
||||||
- "milestone versioning (v0.7 feature / tag_base v0.6.x); final-phase patch IS the milestone release (D-008)"
|
|
||||||
- "feature purity gate: zero breaking schema changes; zero locked-const amendments to EXISTING consts; G-003 intact; G-006/G-028 go.mod diff EMPTY"
|
|
||||||
- "D-085 escalation (13th right) — low-confidence (0.55); surface to PO via normal decision flow before P5"
|
|
||||||
- "§7 pen-test acceptance — self-administered adversarial review if no external third party; log as assumption"
|
|
||||||
|
|
||||||
- id: security-engineer
|
|
||||||
active: true
|
|
||||||
phase_specific: false
|
|
||||||
reason: "REACTIVATED for v0.7 (carried from v0.5). v0.7 has the HIGHEST security-critical density since v0.5: (1) Anti-Capture Bill of Rights v0.2 (REQ-056) — 13 non-amendable, non-waivable rights as const firewall + ValidateBasic gate (mirroring MissionLockAmendable=false + MissionLockAmendmentRejected); (2) Anti-Crowding-Out firewall (D-079) — x/cover/firewall + lexicon_meta_cover meta-test; (3) Cover Claims Voucher slashing (REQ-055) — bond 10× avg Call size, no self-adjudication (FR-CPCV-2), slash via x/standing.Slash cross-Pool; (4) MAB use-of-proceeds lock (D-080) — tagged streaming + Watcher-witnessed release + auto-Still; (5) secession cooling + lien bounding (REQ-064/REQ-081); (6) Cover Pool reserve floor 1.5× (REQ-047) below-floor auto-pause."
|
|
||||||
frameworks: [Go 1.22, cosmos-sdk v0.50.x, Go testing, simtest, locked-const invariant tests, lexicon firewall]
|
|
||||||
territory: ["x/cover/types/rights.go", "x/cover/firewall/**", "x/cover/keeper/**", "x/bond/keeper/**", "x/bond/types/types.go", "x/guild/types/types.go", "x/standing/types/types.go", "x/council/types/types.go", "lexicon/**"]
|
|
||||||
constraints:
|
|
||||||
- "Bill of Rights = 13 separate RightID consts + 13 Waivable* bool consts (all false) + RightIsWaivable(id) always returns false (dual firewall: const + ValidateBasic gate on Cover-Charter waiver list)"
|
|
||||||
- "Anti-Crowding-Out firewall = x/cover/firewall subpackage (runtime CheckCoverFeeRouting) + lexicon_meta_cover meta-test (test-time doc-drift rejection) — defense in depth (D-079)"
|
|
||||||
- "Cover Claims Voucher: CoverClaimsVoucher struct in x/cover/types (NOT x/standing); bond = CoverClaimsVoucherBondMultipleAvgCall=10 × avg Call size; slash via x/standing.Slash with SlashReasonFraudulentCoverCall const; cross-Pool via Standing bucket drop"
|
|
||||||
- "MAB coupons NEVER Bread — CouponDenom enum with CouponDenomBread rejected at ValidateBasic (MissionLockAmendmentRejected pattern)"
|
|
||||||
- "Secession cooling consts secured at founding, not reducible (REQ-064 locked); GoodStandingLiens SecuredAtFounding=true not freely increasable (REQ-053/REQ-081)"
|
|
||||||
|
|
||||||
- id: cosmos-engineer
|
|
||||||
active: true
|
|
||||||
phase_specific: false
|
|
||||||
reason: "Advisory-density for v0.7. The `x/cover` module is new but follows the established x/hub D-039 pattern (types/ + keeper/ + module.go + expected_keepers.go + msg_server.go + simtest). The MsgServer promotion pattern is established (v0.5). cosmos-engineer reviews the x/cover AppModule wiring, RegisterServices, MsgServer() accessor, and the expected_keepers.go interface shims (StandingKeeper, WatcherKeeper, BondKeeper) for G-003 compliance. Less novel than v0.5 (where cosmos-sdk was first introduced)."
|
|
||||||
frameworks: [cosmos-sdk v0.50.x, ibc-go v8.x, Go testing, simtest]
|
|
||||||
territory: ["x/cover/keeper/**", "x/cover/types/msg_*.go", "x/cover/types/expected_keepers.go", "x/cover/module.go"]
|
|
||||||
constraints:
|
|
||||||
- "x/cover module follows x/hub layout (D-039 precedent): module.go AppModule + RegisterServices + MsgServer() accessor"
|
|
||||||
- "expected_keepers.go interfaces for cross-module keeper access (G-003): StandingKeeper.GetStandingBucket, WatcherKeeper.Attest, BondKeeper.GetBond"
|
|
||||||
- "Msg* structs implement sdk.Msg; ValidateBasic on each (cover-firewall, category-tag, standing-gate, reserve-floor, MAB-ceiling, rights-waiver-rejection)"
|
|
||||||
- "simtest pattern: msg_server_simtest_test.go exercising handlers against in-memory sdk.Context (x/hub/keeper/msg_server_simtest_test.go precedent)"
|
|
||||||
|
|
||||||
deactivated_personas:
|
|
||||||
- id: frontend-engineer
|
- id: frontend-engineer
|
||||||
active: false
|
active: true
|
||||||
phase_specific: false
|
|
||||||
reason: "v0.7 is protocol-heavy, zero UI. The v0.6 web UI (web/) is complete; v0.7 does not touch web/. No frontend work in REQ-046..REQ-066."
|
|
||||||
- id: docs-writer
|
|
||||||
active: false
|
|
||||||
phase_specific: false
|
|
||||||
reason: "No docs-content work in v0.7. The only docs work is ARCHITECTURE.md v0.7 section + PERSONAS.md + RESEARCH.md, which is lead-developer territory."
|
|
||||||
- id: mesh-engineer
|
|
||||||
active: false
|
|
||||||
phase_specific: false
|
|
||||||
reason: "No bearer transport work in v0.7. The bearer runtime shipped in v0.5 and is untouched. Cover Pools are a protocol/financial surface, not a bearer/transport surface."
|
|
||||||
- id: data-engineer
|
|
||||||
active: false
|
|
||||||
phase_specific: false
|
|
||||||
reason: "No genesis-schema or custody-state work in v0.7. x/cover uses the SDK in-memory store pattern from v0.5; no new data-shape work."
|
|
||||||
- id: ci-security-auditor
|
|
||||||
active: false
|
|
||||||
phase_specific: true
|
phase_specific: true
|
||||||
reason: "Default off; activates in P6 (final review/audit/ship) for the feature purity gate + the §7 acceptance pen-test (self-administered adversarial review)."
|
reason: v0.3 introduces the docs site (REQ-027) — the first non-skeleton, non-Go deliverable since v0.1's Mesh Experience. frontend-engineer owns the docs territory (docs/**, mkdocs.yml, README.md) and the docs firewall test (lexicon_meta_docs_test.go). Phase-specific: ACTIVE only for P1-P3 (docs phases); removed after P3 once the docs site is complete and the Bearers skeleton phases (P4/P5) are pure Go.
|
||||||
|
frameworks: [MkDocs Material, Markdown]
|
||||||
|
territory: ["docs/**", "mkdocs.yml", "README.md", "lexicon_meta_docs_test.go"]
|
||||||
|
constraints: ["lexicon-clean by construction (REQ-012 extended to docs via D-043 — 10 banned terms must not appear in docs/*.md or README.md; 'yield' banned as standalone word, 'OpenYield' safe via word-boundary regex)", "audience-organized nav (nomads/freeholders/shared/reference per D-042)", "~20-25 pages total per D-045", "no publishing CI in v0.3 (D-046 — mkdocs.yml buildable locally only)", "mkdocs.yml is build-only Python dep; go.mod stays zero-dep (G-006)"]
|
||||||
|
removed_after: P3
|
||||||
|
|
||||||
|
- id: docs-writer
|
||||||
|
active: true
|
||||||
|
phase_specific: true
|
||||||
|
reason: Custom persona for the docs content authoring load (REQ-027, D-045 ~20-25 pages across 4 audiences). Folded as a SEPARATE persona rather than into frontend-engineer because the skills differ: frontend-engineer owns the docs TOOLCHAIN (mkdocs.yml config, theme, nav structure, firewall test wiring) while docs-writer owns the CONTENT (the actual Markdown pages: nomads Reach/Stash/bearers pages, freeholders Standing/Bonds pages, shared Principles/Bread-Scale pages, reference architecture-index). Splitting keeps the toolchain-vs-content boundary explicit so a toolchain change does not entangle content review. Phase-specific: ACTIVE only for P1-P3; removed after P3.
|
||||||
|
frameworks: [Markdown, MkDocs Material (content authoring only)]
|
||||||
|
territory: ["docs/nomads/**/*.md", "docs/freeholders/**/*.md", "docs/shared/**/*.md", "docs/reference/**/*.md"]
|
||||||
|
constraints: ["lexicon-clean by construction (same REQ-012 extension — 'real production'/'real return' not 'real yield'; 'Holder'/'Reach' not 'account'; 'Stash'/'Vault'/'Root-Pool' not 'bank'/'deposit'/'savings')", "audience-organized (each page belongs to exactly one of nomads/freeholders/shared/reference)", "page-count budget per D-045", "no banned-term literals in page source (the docs firewall scans .md files directly, unlike .go which uses fragment assembly)"]
|
||||||
|
removed_after: P3
|
||||||
|
|
||||||
|
deactivated:
|
||||||
|
- id: data-engineer
|
||||||
|
reason: INACTIVE for v0.3. The project has zero external deps and no database; the v0.2 data-engineer owned genesis.go schema helpers, which are a thin layer in v0.3's new modules (x/exit, x/bridge, x/hub, x/services each get a small GenesisState + ValidateGenesis following the v0.2 A-212 pattern). That work is owned by backend-engineer in v0.3 (the genesis schema is part of the skeleton type authoring, not a separate schema-design discipline). Reactivate if a future milestone adds a real store/migration.
|
||||||
|
- id: cosmos-engineer
|
||||||
|
reason: The v0.2 custom persona is NOT reactivated for v0.3. v0.3's new modules do not map onto new Cosmos SDK modules the way v0.2's did (x/gov, x/group, x/authz, x/capability, x/ibc-transfer). x/bridge reuses the v0.2 satellite ICS-20 shape (already aligned); x/hub/x/services/x/exit are bespoke B2B/service scaffolds with no direct Cosmos analog. The Cosmos-convention-alignment load drops below the threshold that justified a separate persona. backend-engineer absorbs the work.
|
||||||
|
- id: security-engineer
|
||||||
|
reason: The v0.2 custom persona is NOT reactivated for v0.3. v0.3's invariant density is lower than v0.2's (no Mission Lock, no new fee/bond clamp — the 8%/0% consts are reused unchanged from v0.2; the new locked-consts are enum counts: HubService=3, ServiceKind=4, BridgeStatus, ExitStatus). The locked-const + invariant tests are absorbed by backend-engineer's per-package test authoring. The docs firewall (lexicon_meta_docs_test.go) is frontend-engineer's territory. Reactivate in v0.4 if a new Mission-Lock-class invariant lands.
|
||||||
|
- id: ci-security-auditor
|
||||||
|
reason: Default deactivated; activate in P6 (review/ship) for the v0.3 milestone audit.
|
||||||
|
- id: mesh-engineer
|
||||||
|
reason: Still not needed in v0.3 (OY-SAT/OY-QR are type stubs only; no hardware/RF runtime). Activate in v0.4+ for real bearer runtime.
|
||||||
|
|
||||||
|
custom_personas:
|
||||||
|
- id: docs-writer
|
||||||
|
rationale: v0.3's docs deliverable (~20-25 pages across 4 audiences per D-045) is a substantial content-authoring load distinct from the docs toolchain work. A dedicated docs-writer keeps the content-vs-toolchain boundary explicit: frontend-engineer owns mkdocs.yml/nav/theme/firewall-wiring; docs-writer owns the page content. This split means a toolchain PR (e.g., adding a markdown extension) does not entangle a content review (e.g., a nomads Reach-page rewrite), and vice versa. Distinct from frontend-engineer because content authoring (prose, audience voice, lexicon-safe phrasing) is a different skill from toolchain config (YAML, theme, nav, Go test wiring). Removed after P3 when the docs site is complete.
|
||||||
|
---
|
||||||
|
|
||||||
|
# Personas: OpenYield (oy) — v0.3 (Bearers & Documentation)
|
||||||
|
|
||||||
|
> This file supersedes the v0.2 PERSONAS.md for the v0.3 milestone. The v0.2
|
||||||
|
> custom personas (cosmos-engineer, security-engineer) are NOT reactivated for
|
||||||
|
> v0.3 — see Deactivated below for rationale. The default four personas are
|
||||||
|
> backend-engineer, data-engineer, frontend-engineer, lead-developer; v0.3
|
||||||
|
> activates backend-engineer + lead-developer + frontend-engineer (phase-
|
||||||
|
> specific) and adds one custom persona (docs-writer, phase-specific).
|
||||||
|
|
||||||
|
## Active Roster
|
||||||
|
|
||||||
|
### backend-engineer
|
||||||
|
- **Domain**: All Bearers skeleton Go modules in v0.3 — `x/exit`, `x/bridge`, `x/hub`, `x/services` (new); `x/bearers`, `x/partner`, `x/bond` (extended). Owns the D-020 skeleton+tests pattern (D-035 continues): Go types + keeper stubs + invariant tests, no live chain. Absorbs the v0.2 cosmos-engineer/security-engineer split because v0.3's Cosmos-convention and invariant density are lower.
|
||||||
|
- **Frameworks**: Go 1.22 stdlib, Cosmos-style types (zero-dep).
|
||||||
|
- **Territory**: `x/exit/**`, `x/bridge/**`, `x/hub/**`, `x/services/**`, `x/bearers/**`, `x/partner/**`, `x/bond/**`, `x/**/types/**`, `x/**/keeper/**`. (`go.mod` is read-only per G-006.)
|
||||||
|
- **Constraints**: zero external deps (G-006), D-020 skeleton+tests (D-035), ≥80% coverage on new/extended packages, per-package lexicon assertion (REQ-012), by-ID-string inter-module refs (G-003), locked-const invariants (HubService/ServiceKind/BridgeStatus/ExitStatus counts + Anchor credential fields), no live chain/IBC/bearer/B2B runtime.
|
||||||
|
|
||||||
|
### lead-developer
|
||||||
|
- **Domain**: v0.3 phase decomposition (P1 firewall+docs foundation → P2 nomads → P3 freeholders → P4 Bearers I → P5 Bearers II → P6 review/ship), territory enforcement (warn mode), final review. Owns the cross-component dependency finding that constrains phase ordering: `x/exit`→`x/bridge` (same phase P4); `x/partner`-Anchor→`x/hub` (P4 before P5).
|
||||||
|
- **Frameworks**: cross-cutting.
|
||||||
|
- **Territory**: `.ciagent/**`, `**`.
|
||||||
|
- **Constraints**: D-044 phase ordering (firewall-first; P4→P5 for Anchor→hub dep), milestone versioning (v0.3 / tag_base v0.2.x), lexicon gate on merge (REQ-012 extends to docs/), persona territory warn-mode, zero Go deps (G-006; docs build-deps allowed per D-042).
|
||||||
|
|
||||||
|
### frontend-engineer (phase-specific: P1-P3 only)
|
||||||
|
- **Domain**: v0.3 docs TOOLCHAIN — `mkdocs.yml` (site_name, nav, theme: material, markdown_extensions), the audience-based nav structure (nomads/freeholders/shared/reference per D-042), and the docs firewall test wiring (`lexicon_meta_docs_test.go` mirroring `lexicon_meta_test.go` with `lexicon.FindBannedTerm` + word-boundary regex + self-test table + self-exclusion, scanning `README.md` + `docs/**/*.md`). Owns the firewall landing in P1 BEFORE content (D-044 firewall-first). Removed after P3.
|
||||||
|
- **Frameworks**: MkDocs Material, Markdown, Go testing (for the firewall test).
|
||||||
|
- **Territory**: `docs/**` (toolchain), `mkdocs.yml`, `README.md`, `lexicon_meta_docs_test.go`.
|
||||||
|
- **Constraints**: lexicon-clean by construction (REQ-012 extended via D-043; 10 banned terms absent from docs; "yield" banned standalone, "OpenYield" safe), audience-organized nav, ~20-25 pages total (D-045), no publishing CI in v0.3 (D-046), mkdocs.yml build-only Python dep (go.mod stays zero-dep per G-006).
|
||||||
|
- **Removed after**: P3.
|
||||||
|
|
||||||
|
### docs-writer (custom, phase-specific: P1-P3 only)
|
||||||
|
- **Domain**: v0.3 docs CONTENT — the actual Markdown pages across the four audiences (nomads: Reach/Stash/bearers/Maps-Pay/Pacts/standing-basics; freeholders: 4-signals/Bayesian-Standing/Stands-Guilds/Councils-Voice/Bonds/Partner-spectrum; shared: Six-Principles/Bread-Scale/Storage-pools/Watchers-Mirror/Lexicon-glossary/Vision-overview; reference: architecture-index/component-map). Split from frontend-engineer so content review and toolchain review do not entangle. Removed after P3.
|
||||||
|
- **Frameworks**: Markdown, MkDocs Material (content authoring only).
|
||||||
|
- **Territory**: `docs/nomads/**/*.md`, `docs/freeholders/**/*.md`, `docs/shared/**/*.md`, `docs/reference/**/*.md`.
|
||||||
|
- **Constraints**: lexicon-clean by construction (same REQ-012 extension; "real production"/"real return" not "real yield"; "Holder"/"Reach" not "account"; "Stash"/"Vault"/"Root-Pool" not "bank"/"deposit"/"savings"), audience-organized (each page in exactly one audience dir), page-count budget per D-045, no banned-term literals in page source (docs firewall scans .md directly, unlike .go fragment assembly).
|
||||||
|
- **Removed after**: P3.
|
||||||
|
|
||||||
|
## Deactivated
|
||||||
|
|
||||||
|
- **data-engineer** — INACTIVE for v0.3. Zero deps + no database; the v0.2 genesis.go schema work is a thin layer absorbed by backend-engineer in v0.3's new modules. Reactivate if a future milestone adds a real store/migration.
|
||||||
|
- **cosmos-engineer** (v0.2 custom) — NOT reactivated. v0.3's new modules do not map onto new Cosmos SDK modules (x/bridge reuses v0.2 satellite shape; x/hub/x/services/x/exit are bespoke). Cosmos-convention load drops below the threshold for a separate persona; backend-engineer absorbs.
|
||||||
|
- **security-engineer** (v0.2 custom) — NOT reactivated. v0.3's invariant density is lower (no new Mission-Lock/fee-clamp; 8%/0% consts reused unchanged; new locked-consts are enum counts). Locked-const + invariant tests absorbed by backend-engineer's per-package test authoring; docs firewall is frontend-engineer's. Reactivate in v0.4 if a new Mission-Lock-class invariant lands.
|
||||||
|
- **ci-security-auditor** — Default deactivated; activate in P6 (review/ship) for the milestone audit.
|
||||||
|
- **mesh-engineer** — Still not needed (OY-SAT/OY-QR are type stubs only). Activate in v0.4+ for real bearer runtime.
|
||||||
|
|
||||||
|
## Custom Personas
|
||||||
|
|
||||||
|
- **docs-writer** — v0.3's docs deliverable (~20-25 pages, D-045) is a substantial content-authoring load distinct from the docs toolchain. A dedicated docs-writer keeps the content-vs-toolchain boundary explicit: frontend-engineer owns mkdocs.yml/nav/theme/firewall-wiring; docs-writer owns page content. This split means a toolchain PR does not entangle a content review and vice versa. Distinct from frontend-engineer because prose/audience-voice/lexicon-safe-phrasing is a different skill from YAML/theme/nav/Go-test wiring. Removed after P3 when the docs site is complete.
|
||||||
|
|
||||||
|
## Framework Alignment
|
||||||
|
- **Go 1.22** — backend-engineer targets Go 1.22 (`go.mod`); zero external deps (G-006).
|
||||||
|
- **MkDocs Material** — frontend-engineer + docs-writer target MkDocs Material (D-042); build-only Python dep, NOT a Go dependency. No publishing CI in v0.3 (D-046).
|
||||||
|
|
||||||
|
## Territory Alignment
|
||||||
|
- backend-engineer owns all `x/*` Bearers-skeleton modules (new: exit/bridge/hub/services; extended: bearers/partner/bond) + shared `types/`+`keeper/` authoring.
|
||||||
|
- frontend-engineer owns the docs toolchain (`docs/**` config, `mkdocs.yml`, `README.md`, `lexicon_meta_docs_test.go`).
|
||||||
|
- docs-writer owns docs content (`docs/<audience>/**/*.md`).
|
||||||
|
- lead-developer owns `.ciagent/**` + `**` for cross-cutting coordination.
|
||||||
|
- `go.mod` is read-only in v0.3 (G-006) — no persona may modify it; docs build-deps are allowed (D-042) but live outside `go.mod`.
|
||||||
|
|
||||||
|
## Constraint Alignment
|
||||||
|
- **Lexicon (REQ-012)** — every active persona carries it; backend-engineer asserts per test file (x/*); frontend-engineer asserts via the docs firewall (docs/* + README.md). The firewall extension is a sibling test, NOT a modification of the v0.2 meta-test (D-043).
|
||||||
|
- **Skeleton + tests (D-020/D-035)** — backend-engineer enforces.
|
||||||
|
- **≥80% coverage** — backend-engineer owns the gate for x/* packages.
|
||||||
|
- **Phase ordering (D-044)** — lead-developer enforces; firewall-first (P1) before content (P2/P3); P4 (exit/bridge/bearers/partner) before P5 (hub/services/bond) for the Anchor→hub dependency.
|
||||||
|
- **Locked-const invariants** — backend-engineer owns; HubService=3, ServiceKind=4, BridgeStatus count, ExitStatus count, Anchor credential fields, 8%/0% bond consts (reused).
|
||||||
|
|
||||||
|
## Phase-Specific Personas
|
||||||
|
- **frontend-engineer** — phase-specific to v0.3 P1-P3 (docs phases). Removed after P3; the Bearers skeleton phases (P4/P5) are pure Go (backend-engineer). Reassess at v0.4 if new docs work is queued.
|
||||||
|
- **docs-writer** — phase-specific to v0.3 P1-P3 (docs content). Removed after P3 with frontend-engineer.
|
||||||
+1
-1610
File diff suppressed because it is too large
Load Diff
+2
-315
@@ -1,4 +1,3 @@
|
|||||||
<!-- Auto-generated from .ciagent/oy/oy-spec — PO edits oy-spec, not this file; see oy-state for current shipped state. -->
|
|
||||||
# Project: OpenYield (oy)
|
# Project: OpenYield (oy)
|
||||||
|
|
||||||
## Objective
|
## Objective
|
||||||
@@ -62,241 +61,7 @@ OpenYield (OY) is a durable, anti-greed, jurisdiction-light financial layer —
|
|||||||
- D-009: Rebased history to fix v1.0 → v0.1 in ---ci--- blocks
|
- D-009: Rebased history to fix v1.0 → v0.1 in ---ci--- blocks
|
||||||
|
|
||||||
## Milestone
|
## Milestone
|
||||||
v0.7 — Fraternal Groups Foundation (in progress; feature type; tags run on the v0.6.x patch line)
|
v0.3 — Bearers & Documentation (active milestone; feature type; tags run on the v0.2.x patch line)
|
||||||
|
|
||||||
### v0.7 Scope (Fraternal Groups Foundation — Cover Pools + Chapter Federation + Mutual Aid Bonds + Anti-Capture Bill v0.2)
|
|
||||||
|
|
||||||
v0.7 adapts the 1890–1930 fraternal benefit-society model for borderless
|
|
||||||
digital service. It delivers Cover Pools (insurance-like commitment pools
|
|
||||||
with mission-locked reserve floors + Standing gates), Chapter Federation
|
|
||||||
(Parent/Chapter Guild model with secession terms + good-standing liens
|
|
||||||
declared at founding), Mutual Aid Bonds (Cover-Call-couponed bonds with
|
|
||||||
issuance ceiling 3× annual surplus, use-of-proceeds locked to reserve
|
|
||||||
build-out), and the Anti-Capture Bill of Rights v0.2 (13 rights codified,
|
|
||||||
non-amendable, non-waivable by any Charter). This is the milestone that
|
|
||||||
unblocks the v0.1 Q7 "Cover Pool seniority mechanics" deferred item —
|
|
||||||
REQ-046..REQ-050 supply the seniority/gate math and promote `x/pact` Cover
|
|
||||||
from skeleton to a dedicated `x/cover` module runtime (D-039 precedent:
|
|
||||||
`x/hub` split out of `x/pact`'s `PactHubAPI` in v0.3).
|
|
||||||
|
|
||||||
Simtest-grade runtime (D-020 pattern continues — no live chain launch, no
|
|
||||||
mainnet). Cover Pool "live on testnet" (§7 acceptance) = `x/cover` keeper
|
|
||||||
message handlers + simtest-grade end-to-end flows, not mainnet deployment.
|
|
||||||
No `app.go`/`cmd/oyd` exists in the repo; v0.7 does not create one.
|
|
||||||
|
|
||||||
New module: `x/cover` (Cover Pool Factory + Anti-Crowding-Out firewall +
|
|
||||||
Anti-Capture Bill of Rights). The existing `x/pact` `PactCover` enum value
|
|
||||||
remains as a cross-reference (G-003 by-ID-string pattern).
|
|
||||||
|
|
||||||
- **REQ-046** Cover Pool Factory runtime — Factory rejects category launches below in-force reserve floor; supports Cover-Charter deployment; Watcher attestation pipeline operational; category staging per REQ-065.
|
|
||||||
- **REQ-047** Cover Pool reserve target floor 1.5× annual contributions — LOCKED; mission-lock semantic enforced; below-floor auto-pause of Cover-Fee routing.
|
|
||||||
- **REQ-048** Cover Pool reserve target ceiling 2.5× (governance-tunable within 1.5×–2.5×) — Watcher escalation after 12 months; Pool Council MAY vote within bounded range.
|
|
||||||
- **REQ-049** Cover Pool Standing gate minimums — LOCKED; Travel ≥ Trusted 4.0; Health-MCS ≥ Preferred 4.5; Pool MAY tighten but NEVER loosen below protocol minimum. Binds at Factory runtime (D-077).
|
|
||||||
- **REQ-050** Cover-Fee tagging at protocol layer — LOCKED; Cover-Fee Grains carry `category_tag`; settlement rejects category-mismatched Calls (FR-COVER-11); Pool-level fungibility preserved for net-reserve accounting.
|
|
||||||
- **REQ-051** Guild Charter + Common Bond requirement — LOCKED; at formation: Common Bond declared + hash-pinned; Public Profile published (bond summary, disclaimers, Mason count or "private", Pier wrapper if any).
|
|
||||||
- **REQ-052** Cover-Charter (SoB, dispute path, gate, holding period) — LOCKED; distinct from governance charter; signed by Pool Host + witnessed by Watcher at deployment; amendments require Pool supermajority + 7-day cooling + Watcher + Counsel; protocol does NOT enforce SoB content (FR-CHTR-5).
|
|
||||||
- **REQ-053** Chapter Federation (Parent/Chapter, secession terms, liens at founding) — Parent Guild + Chapters; Chapters inherit + may tighten but not loosen; secession terms coded at founding; good-standing liens at founding (not freely increasable); Chapter retains mesh-level Voice (Pier does NOT carry Voice per FR-VOICE-6).
|
|
||||||
- **REQ-054** Mutual Aid Bond (issuance ceiling 1×–3×, coupons in Cover Calls) — LOCKED; issuance ceiling mission-locked at 3× annual surplus; coupons payable in Cover Calls or mutual-aid credits (NEVER Bread); coupon rate bounded by `CouponCapBps=800`; use-of-proceeds locked to reserve build-out; default recapture per FR-MAB-7; Watcher attestation at deployment + quarterly audit. Enforcement: tagged streaming + Watcher-witnessed release (D-080, defense in depth).
|
|
||||||
- **REQ-055** Cover Claims Voucher role + bond + slashing — Specialization of Voucher role; bond default 10× avg Call size per Pool; reviews each Call independently (no self-adjudication, FR-CPCV-2); slashing via §9.4 mechanism with cross-Pool applicability (NFR-SEC-8); bounded earnings.
|
|
||||||
- **REQ-056** Anti-Capture Bill of Rights v0.2 — LOCKED; 13 rights codified in code; cannot be amended or waived by any Charter; covers one-tap exit, no tax on personal Stash, audit-able Voice, cooling, Watcher inspection, Freeholder voucher, Counsel escalation, Anchored-Bread conversion, Wayfarer's Record, secession (founding terms), non-Cover-access, category-mismatch refusal.
|
|
||||||
- **REQ-057** Household simplified — no formal Council, one-tap exit — Household Stand may operate without formal Council; one-tap exit is the dispute path.
|
|
||||||
- **REQ-058** Confederation Voice — one-Stand-one-Vote, internal bundle — LOCKED; Confederation aggregates member Stand Voice one-per-Stand; member Stands may bundle delegated Voice internally via §19 delegation.
|
|
||||||
- **REQ-059** Stand→Pier-customer boundary — escalation rule ($100k per D-074) — When annual Pass volume > $100k, Stand is invited to Hub API; soft upgrade, not a ban.
|
|
||||||
- **REQ-060** Shadow vouch partial credit — 50% weight in Freeholder signal — LOCKED; Shadow vouch weight = 0.5× in Community Endorsement signal (vs 1.0× for non-Shadow vouch).
|
|
||||||
- **REQ-061** Disclaimer cadence — per charter signing — LOCKED; jurisdictional disclaimer surfaced at every charter signing; not session-bounded.
|
|
||||||
- **REQ-062** Pool governance hybrid (Host + 3 elected + Watcher observer) — LOCKED; Cover Pool Council = Pool Host + 3 Masons elected by Pool-eligible Masons + Watcher observer seat; Cover Calls require majority with Watcher observer present. No Anchor seat (Anchor no-Voice §5).
|
|
||||||
- **REQ-063** MAB holder — surplus seniority only, no Voice at dissolution — LOCKED; Mutual Aid Bond holders rank after Cover-Fee contributors but before Bread holders in Pool-surplus distributions (FR-MAB-4); NO Voice in Pool dissolution decisions (claimants, not Masons).
|
|
||||||
- **REQ-064** Secession cooling — 21d Cover-active / 14d non-Cover — LOCKED; Chapter secession cooling: 21 Mesh-days if Cover-active, 14 Mesh-days if non-Cover; secured at founding, not reducible; lien audit required; Cover Call / Bond covenant clearance required before secession completes.
|
|
||||||
- **REQ-065** Cover Pool category staging — Phase 2/3/4 — LOCKED; Phase 2: Travel + Health-MCS + Income-Pause; Phase 3: Equipment/Loss + Life-Burial + Road-Side; Phase 4: Cyber-Skimming + Guild-Internal-Mutual-Aid; Factory respects staging and rejects out-of-phase launches.
|
|
||||||
- **REQ-066** Pier selection — Guild Council chooses, reversible, Pier Selection Index — Guild Council chooses Pier at formation; reversible by Cover Pool supermajority + Counsel witness; mesh maintains Pier Selection Index; Pier-Routed Legal Wrapper OPTIONAL (§5 default-no-wrapper).
|
|
||||||
|
|
||||||
### Milestone Type
|
|
||||||
Feature (REQ-046..REQ-066 are feat-class primitives + test adjuncts for the firewall). Phase 0 → `v0.6.0`; execution phases `v0.6.1..v0.6.5`; final phase patch `v0.6.6` IS the v0.7 milestone release. No separate minor tag. The final-phase audit enforces the feature purity gate (no breaking schema changes; G-003 production firewall intact; G-006 go.mod unchanged — `x/cover` keeper uses existing cosmos-sdk runtime substrate).
|
|
||||||
|
|
||||||
### Out of Scope (v0.7)
|
|
||||||
- Real blockchain interaction / mainnet / IBC / real bearer transports (D-020 continues; runtime = simtest-grade keeper handlers)
|
|
||||||
- A real `oyd` daemon / `app.go` / `cmd/oyd` (no chain runtime exists; deferred to v0.8+)
|
|
||||||
- Sovereign Anchor SPEC (`oy-sovereign-anchors` forthcoming; experimental, not load-bearing per §5/D-076)
|
|
||||||
- USZ classification runtime (v0.8 — depends on Anchor pre-commitment framework, REQ-095)
|
|
||||||
- Cluster A–E + Infrastructure Economics (REQ-067..REQ-097, all v0.8 per D-081)
|
|
||||||
- Pier-Routed Legal Wrapper (OPTIONAL per §5; default-no-wrapper; not implemented as code)
|
|
||||||
- Authentication / sessions / real key management (mock; deferred to v0.8+)
|
|
||||||
- Persistence (mock store; deferred to v0.8+)
|
|
||||||
- The 5 P1+ mainnet-readiness items deferred from v0.5 (governance spam deposit, CLOB batch auction, real IBC simtest, CLOB perf, emitMatchEventHook) — those are v0.8+ mainnet-readiness
|
|
||||||
- SignalKind 4→5 expansion (deferred to v0.8+ governance vote)
|
|
||||||
|
|
||||||
### Prior Milestones
|
|
||||||
- v0.1 — OpenYield Foundation Init (COMPLETE; pre-MVP foundation skeleton; released as v0.0.9)
|
|
||||||
- v0.2 — The Mesh (COMPLETE; skeleton + tests; released as v0.1.5)
|
|
||||||
- v0.3 — Bearers & Documentation (COMPLETE; feature; released as v0.2.6)
|
|
||||||
- v0.4 — Refinement (COMPLETE; NFR; released as v0.3.4)
|
|
||||||
- v0.5 — Bearers Runtime (COMPLETE; feature; released as v0.4.8)
|
|
||||||
- v0.6 — Nomad Web UI (COMPLETE; feature; released as v0.5.6)
|
|
||||||
|
|
||||||
## Prior Milestone
|
|
||||||
v0.6 — Nomad Web UI (complete; feature type; tags ran on the v0.5.x patch line)
|
|
||||||
|
|
||||||
### v0.6 Scope (Nomad Web UI MVP — generated test data, no real chain)
|
|
||||||
|
|
||||||
v0.6 is the project's first UI milestone. It delivers a working prototype Web
|
|
||||||
UI where a person can sign up to be a Nomad (create a Reach + open a Stash)
|
|
||||||
and exercise basic functionality around the (Reach, Stash) components, plus
|
|
||||||
Window authorization, Standing progress, and Bloom accrual views. All data is
|
|
||||||
generated as test fixtures — there is no real blockchain interaction, no live
|
|
||||||
chain launch, no real bearer transports (D-020 continues to govern network
|
|
||||||
deployment). The UI is a greenfield Go `html/template` + HTMX layer served by
|
|
||||||
a Go mock HTTP server that instantiates the real `x/*/types` structs (Reach,
|
|
||||||
Stash, Window, FreeholderSignals, BloomRecord) populated from in-memory
|
|
||||||
fixtures. No keeper, no Cosmos runtime, no `app.go` (none exists in the repo).
|
|
||||||
|
|
||||||
This milestone is the prerequisite for real-world MVP testing: it makes the
|
|
||||||
Nomad path visible and exercisable in a browser. Wiring the UI to a real `oyd`
|
|
||||||
daemon (once one exists) is deferred to v0.7+ (no `app.go`, `cmd/`, or `main.go`
|
|
||||||
exists in the repo today).
|
|
||||||
|
|
||||||
- **REQ-040** Nomad Reach signup Web UI — Go HTTP mock server (`web/`) + "Create a Reach" form + Reach list/detail; grounds the UI in `x/identity/types.Reach`. "Sign up" maps to "Create a Reach" (the word "account" is banned per REQ-012).
|
|
||||||
- **REQ-041** Stash dashboard Web UI — balance in Grain + Bread-scale conversion (using `x/bread/types.BreadScaleAll()`) + 90-day maturity progress bar (`x/stash/types.StashActivity.IsMature`).
|
|
||||||
- **REQ-042** Window authorization Web UI — form to open a Window (scope + duration + rate-limit), lifecycle view (Open→Active→Revoked/Expired via `x/window/types.Window.Activate/Revoke/Expire`), audit log.
|
|
||||||
- **REQ-043** Standing + Freeholder signals progress Web UI — computed from mock `Rating`/`Vouch`/`Slash` records using the locked constants + `GetStandingBucket`/`ComputeDiversityBonus`/`GetVoucherWeight`; 4-signal progress (`FreeholderSignals.IsFreeholderEligible`).
|
|
||||||
- **REQ-044** Bloom accrual Web UI — per-Stash `BloomRecord` view (`AccruedGrain`, `RateBasisPoints`), computed from mock data; shows the 4.5% target rate.
|
|
||||||
- **REQ-045** Extend REQ-012 lexicon firewall to scan `web/templates/**` + `web/static/**` (new `lexicon_meta_web_test.go`). Firewall-first: lands in P1 before content.
|
|
||||||
|
|
||||||
### Milestone Type
|
|
||||||
Feature (all execution phases are `feat` except REQ-045 which is `test`). Phase 0 → `v0.5.0`; execution phases `v0.5.1..v0.5.5`; final phase patch `v0.5.6` IS the v0.6 milestone release. No separate minor tag. The final-phase audit enforces the feature purity gate (no breaking schema changes; G-003 production firewall intact; G-006 go.mod unchanged unless a runtime dep is GRILL-approved — HTMX is a vendored static asset, not a Go dep).
|
|
||||||
|
|
||||||
### Out of Scope (v0.6)
|
|
||||||
- Real blockchain interaction / mainnet / IBC / real bearer transports (D-020 continues)
|
|
||||||
- A real `oyd` daemon / `app.go` / `cmd/oyd` (no chain runtime exists; deferred to v0.7+)
|
|
||||||
- Real Anchors onboarding / Hub API B2B / real custody (simtest/mock only)
|
|
||||||
- Authentication / sessions / real key management (mock; a Reach is created by form submission, stored in-memory)
|
|
||||||
- Persistence (mock store is in-memory; resets on restart)
|
|
||||||
- i18n / multi-language UI
|
|
||||||
- Real Standing oracle / real Bloom accrual engine (computed from fixtures using locked constants)
|
|
||||||
- The 5 P1+ mainnet-readiness items deferred from v0.5 (governance spam deposit, CLOB front-running, real IBC simtest, CLOB perf, emitMatchEventHook testability) — those are v0.7+ mainnet-readiness, not UI work
|
|
||||||
|
|
||||||
### Prior Milestones
|
|
||||||
- v0.1 — OpenYield Foundation Init (COMPLETE; pre-MVP foundation skeleton; released as v0.0.9)
|
|
||||||
- v0.2 — The Mesh (COMPLETE; skeleton + tests; released as v0.1.5)
|
|
||||||
- v0.3 — Bearers & Documentation (COMPLETE; feature; released as v0.2.6)
|
|
||||||
- v0.4 — Refinement (COMPLETE; NFR; released as v0.3.4)
|
|
||||||
- v0.5 — Bearers Runtime (COMPLETE; feature; released as v0.4.8)
|
|
||||||
|
|
||||||
### v0.6 Scope (Nomad Web UI MVP — generated test data, no real chain)
|
|
||||||
|
|
||||||
v0.6 is the project's first UI milestone. It delivers a working prototype Web
|
|
||||||
UI where a person can sign up to be a Nomad (create a Reach + open a Stash)
|
|
||||||
and exercise basic functionality around the (Reach, Stash) components, plus
|
|
||||||
Window authorization, Standing progress, and Bloom accrual views. All data is
|
|
||||||
generated as test fixtures — there is no real blockchain interaction, no live
|
|
||||||
chain launch, no real bearer transports (D-020 continues to govern network
|
|
||||||
deployment). The UI is a greenfield Go `html/template` + HTMX layer served by a
|
|
||||||
Go mock HTTP server that instantiates the real `x/*/types` structs (Reach,
|
|
||||||
Stash, Window, FreeholderSignals, BloomRecord) populated from in-memory
|
|
||||||
fixtures. No keeper, no Cosmos runtime, no `app.go` (none exists in the repo).
|
|
||||||
|
|
||||||
This milestone is the prerequisite for real-world MVP testing: it makes the
|
|
||||||
Nomad path visible and exercisable in a browser. Wiring the UI to a real `oyd`
|
|
||||||
daemon (once one exists) is deferred to v0.7+ (no `app.go`, `cmd/`, or `main.go`
|
|
||||||
exists in the repo today).
|
|
||||||
|
|
||||||
- **REQ-040** Nomad Reach signup Web UI — Go HTTP mock server (`web/`) + "Create a Reach" form + Reach list/detail; grounds the UI in `x/identity/types.Reach`. "Sign up" maps to "Create a Reach" (the word "account" is banned per REQ-012).
|
|
||||||
- **REQ-041** Stash dashboard Web UI — balance in Grain + Bread-scale conversion (using `x/bread/types.BreadScaleAll()`) + 90-day maturity progress bar (`x/stash/types.StashActivity.IsMature`).
|
|
||||||
- **REQ-042** Window authorization Web UI — form to open a Window (scope + duration + rate-limit), lifecycle view (Open→Active→Revoked/Expired via `x/window/types.Window.Activate/Revoke/Expire`), audit log.
|
|
||||||
- **REQ-043** Standing + Freeholder signals progress Web UI — computed from mock `Rating`/`Vouch`/`Slash` records using the locked constants + `GetStandingBucket`/`ComputeDiversityBonus`/`GetVoucherWeight`; 4-signal progress (`FreeholderSignals.IsFreeholderEligible`).
|
|
||||||
- **REQ-044** Bloom accrual Web UI — per-Stash `BloomRecord` view (`AccruedGrain`, `RateBasisPoints`), computed from mock data; shows the 4.5% target rate.
|
|
||||||
- **REQ-045** Extend REQ-012 lexicon firewall to scan `web/templates/**` + `web/static/**` (new `lexicon_meta_web_test.go`). Firewall-first: lands in P1 before content.
|
|
||||||
|
|
||||||
### Milestone Type
|
|
||||||
Feature (all execution phases are `feat` except REQ-045 which is `test`). Phase 0 → `v0.5.0`; execution phases `v0.5.1..v0.5.5`; final phase patch `v0.5.6` IS the v0.6 milestone release. No separate minor tag. The final-phase audit enforces the feature purity gate (no breaking schema changes; G-003 production firewall intact; G-006 go.mod unchanged unless a runtime dep is GRILL-approved — HTMX is a vendored static asset, not a Go dep).
|
|
||||||
|
|
||||||
### Out of Scope (v0.6)
|
|
||||||
- Real blockchain interaction / mainnet / IBC / real bearer transports (D-020 continues)
|
|
||||||
- A real `oyd` daemon / `app.go` / `cmd/oyd` (no chain runtime exists; deferred to v0.7+)
|
|
||||||
- Real Anchors onboarding / Hub API B2B / real custody (simtest/mock only)
|
|
||||||
- Authentication / sessions / real key management (mock; a Reach is created by form submission, stored in-memory)
|
|
||||||
- Persistence (mock store is in-memory; resets on restart)
|
|
||||||
- i18n / multi-language UI
|
|
||||||
- Real Standing oracle / real Bloom accrual engine (computed from fixtures using locked constants)
|
|
||||||
- The 5 P1+ mainnet-readiness items deferred from v0.5 (governance spam deposit, CLOB front-running, real IBC simtest, CLOB perf, emitMatchEventHook testability) — those are v0.7+ mainnet-readiness, not UI work
|
|
||||||
|
|
||||||
### Prior Milestones
|
|
||||||
- v0.1 — OpenYield Foundation Init (COMPLETE; pre-MVP foundation skeleton; released as v0.0.9)
|
|
||||||
- v0.2 — The Mesh (COMPLETE; skeleton + tests; released as v0.1.5)
|
|
||||||
- v0.3 — Bearers & Documentation (COMPLETE; feature; released as v0.2.6)
|
|
||||||
- v0.4 — Refinement (COMPLETE; NFR; released as v0.3.4)
|
|
||||||
- v0.5 — Bearers Runtime (COMPLETE; feature; released as v0.4.8)
|
|
||||||
|
|
||||||
## Prior Milestone
|
|
||||||
v0.5 — Bearers Runtime (complete; feature type; tags ran on the v0.4.x patch line)
|
|
||||||
|
|
||||||
### v0.5 Scope (Live-runtime promotions of the v0.3 Bearers skeletons)
|
|
||||||
|
|
||||||
v0.5 promotes the v0.3 Bearers skeletons from type+keeper-stub layers to live
|
|
||||||
runtime behavior. This is the first milestone to ship executable behavior
|
|
||||||
beyond invariant tests — keepers gain message handlers, transactions, and
|
|
||||||
end-to-end flows. Sourced from the v0.3/v0.4 deferred items (D-050,
|
|
||||||
PROJECT.md v0.4 out-of-scope, ROADMAP Phase 3 "The Bearers" runtime subset).
|
|
||||||
|
|
||||||
The skeleton-first pattern (D-020) continues to govern NEW components, but
|
|
||||||
v0.3-era modules (`x/exit`, `x/bridge`, `x/bearers`, `x/partner`, `x/hub`,
|
|
||||||
`x/services`, `x/bond`) gain runtime implementations this milestone. No live
|
|
||||||
chain launch (D-020 continues to apply to network deployment); runtime here
|
|
||||||
means keeper message handlers + simtest-grade end-to-end flows, not mainnet.
|
|
||||||
|
|
||||||
- **REQ-033** Exit layer runtime — `x/exit` DEX swap routing + bridge message handlers; `x/bridge` L2↔L1 IBC packet handlers. Promotes REQ-010 from skeleton → runtime. Live DEX/IBC channels still deferred.
|
|
||||||
- **REQ-034** Bearers transport runtime — OY-SAT + OY-QR bearer transport message handlers in `x/bearers` (extends REQ-019). Hardware integration deferred; runtime = message-handling + session lifecycle in simtest.
|
|
||||||
- **REQ-035** Anchors onboarding runtime — `x/partner` Anchor tier credential issuance + revocation handlers (extends REQ-018). Real institutional onboarding deferred; runtime = credential lifecycle in simtest.
|
|
||||||
- **REQ-036** Hub API B2B runtime — `x/hub` custody, lending primitive, compliance message handlers. Real B2B suite deferred; runtime = keeper handlers + simtest.
|
|
||||||
- **REQ-037** Services runtime — `x/services` Care / SIM / Vault / Mail service lifecycle handlers. Live service integrations deferred; runtime = lifecycle handlers + simtest.
|
|
||||||
- **REQ-038** Bond market depth runtime — `x/bond` Growth Bonds + secondary-market matching handlers (extends REQ-021). Live market depth deferred; runtime = matching engine + simtest.
|
|
||||||
- **REQ-039** Council governance runtime — `x/council` Proposal/VoteOption enum types (AUDIT §193 P1-1, deferred from v0.4) + Voice lifecycle handlers. Mission Lock const firewall intact (G-003); runtime = governance message handlers + simtest.
|
|
||||||
|
|
||||||
### Milestone Type
|
|
||||||
Feature (all execution phases are `feat`). Phase 0 → `v0.4.0`; execution phases `v0.4.1..v0.4.N`; final phase patch `v0.4.(N+1)` IS the v0.5 milestone release. No separate minor tag. The final-phase audit enforces the feature purity gate (no breaking schema changes; locked-const firewall intact).
|
|
||||||
|
|
||||||
### Out of Scope (v0.5)
|
|
||||||
- Live chain launch / mainnet / real IBC channels / real bearer transports (D-020 pattern continues; runtime = simtest-grade message handlers)
|
|
||||||
- Real institutional Anchors onboarding (credential lifecycle in simtest only)
|
|
||||||
- Yield Token, Travel + 11 service categories (ROADMAP Phase 4 — Maturity)
|
|
||||||
- i18n / MkDocs internationalization
|
|
||||||
- Cover Pool seniority mechanics (still deferred per PROJECT.md Q7)
|
|
||||||
- Breaking schema changes / locked-const amendments (Mission Lock non-amendable)
|
|
||||||
- SignalKind 4→5 enum expansion (AUDIT §193 P1-2; defensible per current rationale, deferred to v0.6+ governance vote)
|
|
||||||
|
|
||||||
### Prior Milestones
|
|
||||||
- v0.1 — OpenYield Foundation Init (COMPLETE; pre-MVP foundation skeleton; released as v0.0.9)
|
|
||||||
- v0.2 — The Mesh (COMPLETE; skeleton + tests; released as v0.1.5)
|
|
||||||
- v0.3 — Bearers & Documentation (COMPLETE; feature; released as v0.2.6)
|
|
||||||
- v0.4 — Refinement (COMPLETE; NFR; released as v0.3.4)
|
|
||||||
|
|
||||||
## Prior Milestone
|
|
||||||
v0.4 — Refinement (complete; NFR type; tags ran on the v0.3.x patch line)
|
|
||||||
|
|
||||||
### v0.4 Scope (Refinement-only NFR — v0.3 post-hoc forward-references)
|
|
||||||
|
|
||||||
v0.4 is a refinement-only NFR milestone: zero `feat:` phases. It lands the
|
|
||||||
durability fixes v0.3 flagged but did not block on, sourced from REVIEW.md,
|
|
||||||
AUDIT.md §193, and GRILL.md G-014. Live-runtime promotions of the v0.3 Bearers
|
|
||||||
skeletons are out of scope (deferred to v0.5+).
|
|
||||||
|
|
||||||
- **REQ-029** Lexicon firewall shared helper (`lexicon.SyntheticBannedStrings()`) — dedupe the synthetic self-test table between `lexicon_meta_test.go` and `lexicon_meta_docs_test.go`. Both meta-tests derive count + strings from the single `lexicon` package source, so a future banned-term addition updates both firewalls from one place. (GRILL G-014)
|
|
||||||
- **REQ-030** Cross-package const-equality test — `x/hub.LendingCouponCapBps == x/bond.CouponCapBps` (and Floor). Test-only import (G-003 exempt). Catches silent mission-lock drift between hub LOCAL consts and bond D-028 consts. (REVIEW.md P2 / A-304)
|
|
||||||
- **REQ-031** x/* lifecycle type shape-divergence review + alignment fixes — audit non-must-have lifecycle types across modules flagged by AUDIT §193; align where divergent without behavioral change. (AUDIT.md §193)
|
|
||||||
- **REQ-032** Docs build CI — Gitea Actions workflow running `go test ./...` (lexicon firewall) + `mkdocs build` on every push; upload `site/` as a CI artifact. Full Gitea Pages publishing deferred if no hosting target configured. (D-046)
|
|
||||||
|
|
||||||
### Milestone Type
|
|
||||||
NFR (all phases are refactor/test/quality/chore). Phase 0 → `v0.3.0`; execution phases `v0.3.1..v0.3.3`; final phase patch `v0.3.4` IS the milestone release. No separate minor tag. The final-phase audit enforces the NFR purity gate (zero `feat:` commits).
|
|
||||||
|
|
||||||
### Out of Scope (v0.4)
|
|
||||||
- Live-runtime promotions: Exit/DEX, OY-SAT/OY-QR hardware, Hub API B2B, bond matching, L2 IBC rollout, Anchors onboarding (all `feat:`, deferred to v0.5+)
|
|
||||||
- i18n / MkDocs internationalization (`feat:`, rejected by D-001 filter)
|
|
||||||
- Yield Token, Travel + 11 service categories (ROADMAP Phase 4)
|
|
||||||
- Cover Pool seniority mechanics (still deferred per PROJECT.md Q7)
|
|
||||||
|
|
||||||
### Prior Milestones
|
|
||||||
- v0.1 — OpenYield Foundation Init (COMPLETE; pre-MVP foundation skeleton; released as v0.0.9)
|
|
||||||
- v0.2 — The Mesh (COMPLETE; skeleton + tests; released as v0.1.5)
|
|
||||||
- v0.3 — Bearers & Documentation (COMPLETE; feature; released as v0.2.6)
|
|
||||||
|
|
||||||
### v0.3 Scope (Bearers skeleton + Docs site — ROADMAP Phase 3 partial, plus a docs deliverable)
|
### v0.3 Scope (Bearers skeleton + Docs site — ROADMAP Phase 3 partial, plus a docs deliverable)
|
||||||
|
|
||||||
@@ -380,82 +145,4 @@ Auto-decided defaults logged per clarify workflow Step 4 (full autonomy → acce
|
|||||||
|
|
||||||
### Ideation outcome (Phase 0 — IDEATE stage, autonomy=full)
|
### Ideation outcome (Phase 0 — IDEATE stage, autonomy=full)
|
||||||
|
|
||||||
IDEATE stage ratified 8 ideas (IDEATE-01..IDEATE-08) at full autonomy, mapped to REQ-010/REQ-022..REQ-028. Docs deliverable (IDEATE-01/02) is the user's `--ideate` request; Bearers ideas (IDEATE-03..08) are the ROADMAP Phase 3 subset. Three ideation tiers ran (mechanical, backend-enriched, cross-project); mechanical tier found no `lessons:`/`compound:` tags in v0.1/v0.2 history (convention unused) and v0.2 closed clean (9/9 REQs, 303 tests, ≥95.9% coverage). Defaults accepted per full autonomy; traceability recorded in `.ciagent/oy/REQUIREMENTS.md` (IDEATE Traceability section).
|
IDEATE stage ratified 8 ideas (IDEATE-01..IDEATE-08) at full autonomy, mapped to REQ-010/REQ-022..REQ-028. Docs deliverable (IDEATE-01/02) is the user's `--ideate` request; Bearers ideas (IDEATE-03..08) are the ROADMAP Phase 3 subset. Three ideation tiers ran (mechanical, backend-enriched, cross-project); mechanical tier found no `lessons:`/`compound:` tags in v0.1/v0.2 history (convention unused) and v0.2 closed clean (9/9 REQs, 303 tests, ≥95.9% coverage). Defaults accepted per full autonomy; traceability recorded in `.ciagent/oy/REQUIREMENTS.md` (IDEATE Traceability section).
|
||||||
|
|
||||||
### v0.4 Clarification Decisions (Phase 0 — CLARIFY, autonomy=full)
|
|
||||||
|
|
||||||
Auto-decided defaults logged per clarify workflow Step 4 (full autonomy → accept defaults, log decisions). v0.4 is a refinement-only NFR milestone (no `--ideate` flag this run; scope pre-seeded from v0.3 forward-references). The D-001 refinement-only filter governs scope eligibility.
|
|
||||||
|
|
||||||
| ID | Decision | Rationale | Confidence | Alternatives |
|
|
||||||
|----|----------|-----------|------------|--------------|
|
|
||||||
| D-047 | **v0.4 milestone type = NFR** (all phases refactor/test/quality/chore). Zero `feat:` phases by construction. Tags run on the `v0.3.x` patch line: P0 → `v0.3.0`, P1..P3 → `v0.3.1..v0.3.3`, final phase P4 → `v0.3.4` (milestone release). No separate minor tag. | The candidate work set (REQ-029..REQ-032) is entirely refactor/test/quality/chore. Promoting any Bearers skeleton to live runtime would be `feat:` and is deferred to v0.5+. | 0.90 | [feature milestone promoting v0.3 skeletons to live runtime] |
|
|
||||||
| D-048 | **REQ-029 lexicon shared helper**: add `lexicon.SyntheticBannedStrings() []string` to the `lexicon` package; both `lexicon_meta_test.go` and `lexicon_meta_docs_test.go` consume it instead of duplicating their own synthetic self-test tables. Both already assert `len(terms) == 10` from `lexicon.BannedTerms()` (G-014 minimum met); the helper closes the drift risk fully. | GRILL G-014 binding fix. Single source of truth for synthetic banned strings; a future banned-term addition updates both firewalls from one place. Refactor+test (NFR-eligible). | 0.88 | [cross-reference comment only (G-014 minimum)] |
|
|
||||||
| D-049 | **REQ-030 cross-package const-equality test**: new test file `x/hub/types/cross_const_test.go` (package `types`) that imports `x/bond/types` (test-only, G-003 exempt) and asserts `hub.LendingCouponCapBps == bond.CouponCapBps` and `hub.LendingCouponFloorBps == bond.CouponFloorBps`. Test-only import does not violate G-003 (production-import firewall). | REVIEW.md P2 / A-304. Catches silent mission-lock drift between hub LOCAL consts and bond D-028 consts. Test (NFR-eligible). | 0.85 | [document manual-sync requirement in ARCHITECTURE.md only] |
|
|
||||||
| D-050 | **REQ-031 lifecycle type shape-divergence review scope = DOCUMENT only, no code shape changes**. AUDIT §193 P1-1 (council Proposal/VoteOption absent) and P1-2 (SignalKind 4 vs 5 sources) are `feat:`-class additions (new enum types / locked-const shape changes) and are REJECTED by the D-001 refinement-only filter. v0.4 REQ-031 ships an ARCHITECTURE.md section documenting the divergence decisions (P1-2 defensible per AUDIT code rationale; P1-1 deferred to v0.5+ governance runtime) + a test asserting the current `SignalKindCount==4` locked-const shape is intentional (regression guard, not a shape change). | Adding Proposal/VoteOption enums is `feat:`; changing SignalKind 4→5 is a locked-const change. Both are out-of-scope for an NFR milestone. Documentation + a regression-guard test are NFR-eligible. | 0.82 | [add Proposal/VoteOption enums (feat:, deferred to v0.5+)] |
|
|
||||||
| D-051 | **REQ-032 docs build CI = Gitea Actions workflow** at `.gitea/workflows/docs-build.yml` running `go test ./...` (lexicon firewall) + `mkdocs build` on every push; upload `site/` as a CI artifact. Full Gitea Pages publishing is deferred (no hosting target configured in v0.4). The workflow file itself is a `chore` (config, not feature). | D-046 forward-reference. `.github/workflows/` does not exist; Gitea Actions uses `.gitea/workflows/`. Build+artifact CI is `chore` (NFR-eligible); full Pages publish needs a hosting target (deferred). | 0.80 | [include full Gitea Pages publish (needs hosting target + secrets)] |
|
|
||||||
| D-052 | **Phase ordering** (provisional, planner finalizes): P1 lexicon hardening (REQ-029 + REQ-030 — same `lexicon`/test territory, vertical slice) → P2 lifecycle divergence documentation + regression guard (REQ-031) → P3 docs build CI (REQ-032) → P4 final review + audit + milestone ship. Each phase independently shippable; P1 lands the firewall durability fixes first (highest-severity regression risk). | P1 bundles the two lexicon/const firewall fixes (same territory); P2 is documentation+test; P3 is CI config. Vertical slices. | 0.80 | [different wave ordering] |
|
|
||||||
| D-053 | **No IDEATE stage in v0.4** (no `--ideate` flag this run). The NFR scope was pre-seeded from v0.3 forward-references and ratified at CLARIFY. If `--ideate` is passed on a later v0.4 run, the D-001 refinement-only filter applies. | run.md §IDEATE is conditional on `--ideate`. This invocation has no `--ideate`. | 1.00 | [run IDEATE anyway] |
|
|
||||||
|
|
||||||
## Clarification Decisions (Phase 0 v0.5 — CLARIFY, autonomy=full)
|
|
||||||
|
|
||||||
Auto-decided defaults logged per clarify workflow Step 4 (full autonomy → accept defaults, log decisions). No `--ideate` flag this run; v0.5 scope is pre-seeded from PROJECT.md v0.4 out-of-scope + AUDIT §193 P1-1 + D-050 and ratified at CLARIFY.
|
|
||||||
|
|
||||||
| ID | Decision | Rationale | Confidence | Alternatives |
|
|
||||||
|----|----------|-----------|------------|--------------|
|
|
||||||
| D-054 | **"Runtime" = simtest-grade keeper message handlers + end-to-end flows, NOT mainnet.** v0.5 ships executable keeper behavior (MsgServer handlers, keeper Set/Get/Remove, simtest `simtest`-package flows) for the v0.3 Bearers modules. No live chain launch, no real IBC channels, no real bearer transports, no real institutional onboarding (D-020 pattern continues to govern network deployment). | v0.3 skeletons are types + keeper stubs + invariant tests. The next increment is message handlers + simtest, which is the Cosmos-SDK standard pre-mainnet step. Mainnet deployment is a Year-3+ operational concern (Watchers + Root Basket backing required). | 0.88 | [full mainnet launch in v0.5; types-only with no handlers (stalls progress)] |
|
|
||||||
| D-055 | **Cosmos SDK dependency is GRILL-approved for v0.5.** `go.mod` gains `github.com/cosmos/cosmos-sdk` (and transitive deps) as the runtime substrate for keeper MsgServer handlers, `types.Msg`, `sdk.Context`, store, and simtest. This is a controlled exception to G-006 (zero-dep go.mod), escalated to GRILL for binding ratification. The exception is scoped to runtime promotion phases (P1..P7); P0 and the final phase remain dep-neutral where possible. | v0.3 skeletons used stub `keeper.go` files that already import cosmos-sdk (see LSP errors on `x/watcher/keeper/keeper.go` — pre-existing imports). Promoting to runtime makes the dependency load-bearing rather than stub-only. G-006's intent (zero-dep for skeleton durability) is preserved by isolating the dep to runtime phases and keeping types/invariants dep-free. | 0.80 | [stay zero-dep, hand-roll keeper store + message types (duplicates SDK, high risk); defer all runtime to v0.6+ (stalls)] |
|
|
||||||
| D-056 | **Phase ordering** (provisional, planner finalizes): P1 Exit+Bridge runtime (REQ-033, Layer 3 — outermost edge, fewest internal deps) → P2 Bearers transport runtime (REQ-034, depends on exit for off-mesh routing) → P3 Anchors runtime (REQ-035, depends on partner + bearers) → P4 Hub API runtime (REQ-036, depends on anchors for custody backing) → P5 Services runtime (REQ-037, depends on hub) → P6 Bond market runtime (REQ-038, depends on hub lending primitive) → P7 Council governance runtime (REQ-039, cross-cutting, lands last) → P8 final review + audit + milestone ship. Each phase independently shippable; P1 lands the outermost edge first (lowest internal coupling). | The dependency chain is outer→inner: exit needs nothing internal; bearers routes through exit; anchors ride bearers; hub custody backs anchors; services sit on hub; bond matching uses hub lending; governance is cross-cutting. Vertical slices, each phase shippable. | 0.82 | [governance-first; bond-first; single mega-phase] |
|
|
||||||
| D-057 | **Bond matching engine = central-limit order book (CLOB) with the 8% cap / 0% floor consts (D-028) as hard clamp on each match.** No AMM (constant-product or otherwise) in v0.5; AMM is a Year-4 Maturity concern. The CLOB matches Growth Bond bids/offers at the locked coupon cap; secondary-market trades clear at market price but the bond's *coupon* stays within the mission-locked band. REQ-038 ships the matching handler + simtest; live market depth deferred. | CLOB is the standard secondary-market primitive; AMM is for spot/swaps (Exit layer's DEX, deferred). The mission-lock clamp (D-028) is a per-match invariant, not a market-wide cap. CLOB lets the cap be enforced per-match. | 0.80 | [AMM (wrong fit for coupon-bearing bonds); batch auction (deferred to Maturity)] |
|
|
||||||
| D-058 | **Hub custody model = key-share abstraction (MPC-via-interface, not a concrete HSM/MPC vendor).** `x/hub` custody handlers expose a `CustodyKeyring` interface with `Sign`/`Derive` methods; v0.5 ships an in-memory test-only implementation. Real MPC/HSM backing is deferred (operational, Year 3+). This keeps v0.5 dep-neutral w.r.t. custody vendors while landing the handler surface. | Custody key management is operational, not protocol-level. An interface + test impl lets runtime handlers be exercised in simtest without committing to a vendor. GRILL reviews the interface boundary. | 0.78 | [commit to a specific MPC vendor (premature); hand-roll shamir (out of scope)] |
|
|
||||||
| D-059 | **IBC packet scope = the 5 L2 chains already in the v0.2 skeleton** (Polygon, Base, Arbitrum, Optimism, Solana per REQ-009/`x/satellite`). v0.5 `x/bridge` handlers implement IBC packet recv/ack for these 5 chains' `BridgeStatus` transitions. No new L2 chains in v0.5. Solana IBC uses the wormhole-style bridge adapter (already stubbed in `x/bridge` per D-021). | The 5 L2 chains are the locked-const set (REQ-009). Adding new chains is a Year-4 concern. Solana IBC was a v0.1 deferred item (D-021) now promoted. | 0.82 | [add 3+ new L2 chains (Year 4); defer Solana IBC again (stalls)] |
|
|
||||||
| D-060 | **Council governance shape (AUDIT §193 P1-1)**: add `Proposal` and `VoteOption` enum types to `x/council/types` (currently absent per AUDIT). `ProposalKind` enum = {Stand, Guild, Mesh, MissionLockAmendment-Rejected} (Mission Lock non-amendable → the enum value exists but the handler rejects it; documents the non-amendability in code). `VoteOption` enum = {Yes, No, Abstain, Veto} (Veto = Watcher-only, quorum rule). SignalKind stays at 4 sources (P1-2 defensible per AUDIT; expansion deferred to v0.6+ governance vote). Mission Lock const firewall (G-003) intact. | AUDIT P1-1 flagged the absence as a divergence. Adding the enums is `feat:` (deferred from v0.4 by D-001). P1-2 (SignalKind 4→5) is a locked-const change rejected by the audit rationale, so it stays at 4. | 0.82 | [add SignalKind 5th source (locked-const change, rejected); defer Proposal/VoteOption again (stalls)] |
|
|
||||||
| D-061 | **No IDEATE stage in v0.5** (no `--ideate` flag this run). The feature scope was pre-seeded from PROJECT.md v0.4 out-of-scope + AUDIT §193 P1-1 + D-050 and ratified at CLARIFY. The D-001 refinement-only filter does NOT apply (v0.5 is a feature milestone, not NFR). | run.md §IDEATE is conditional on `--ideate`. This invocation has no `--ideate`. | 1.00 | [run IDEATE anyway] |
|
|
||||||
|
|
||||||
## Clarification Decisions (Phase 0 v0.6 — CLARIFY, autonomy=full)
|
|
||||||
|
|
||||||
Auto-decided defaults logged per clarify workflow Step 4 (full autonomy → accept defaults, log decisions). `--ideate` flag IS present this run; v0.6 is the project's first UI milestone. The D-001 refinement-only filter does NOT apply (v0.6 is a feature milestone). User-validated stack choices recorded via interactive questions: Go `html/template` + HTMX (frontend stack), Go mock API server (mock data layer), all 5 screens (Reach signup, Stash dashboard, Window authorization, Standing + Freeholder signals, Bloom accrual), new top-level `web/` dir (UI code location).
|
|
||||||
|
|
||||||
| ID | Decision | Rationale | Confidence | Alternatives |
|
|
||||||
|----|----------|-----------|------------|--------------|
|
|
||||||
| D-066 | **Frontend stack = Go `html/template` + HTMX.** HTMX is a single vendored JS file served as a static asset — no node toolchain, no `package.json`, no build step. Go `html/template` is stdlib. **G-006 (zero-dep) is preserved** — this is the decisive factor vs. a React/Svelte SPA. Sufficient for Reach/Stash/Window/Standing/Bloom screens (progressive enhancement over server-rendered HTML). Weakest for rich dashboards, but adequate for an MVP prototype. | User-validated. Project has a strong zero-dep ethos (G-006); v0.5 took a controlled G-006 exception for cosmos-sdk only after GRILL ratification. A node toolchain + `package.json` would be a far larger exception for a UI MVP that can be served by stdlib + one vendored JS file. | 0.88 | [React/Vite SPA (adds node toolchain, breaks Go-only convention); SvelteKit (same tradeoff); pure static HTML/CSS/vanilla JS (most fragile)] |
|
|
||||||
| D-067 | **Mock data layer = Go HTTP server in `web/` instantiating real `x/*/types` structs.** New top-level `web/` dir holds `main.go`, HTTP handlers, an in-memory mock store seeded from fixtures, and `static/` + `templates/`. The mock store imports `x/identity/types`, `x/stash/types`, `x/window/types`, `x/standing/types`, `x/bread/types`, `x/bloom/types` and populates them with test values. **No keeper, no Cosmos runtime, no `app.go`** (none exists in the repo). This grounds the UI in the actual locked data shapes (Reach, Stash, Window, FreeholderSignals, BloomRecord) — the UI does not exercise a chain but does exercise the real Go type definitions. | User-validated. The four modules the Nomad UI primarily surfaces (identity, stash, window, standing) are types-only skeletons with no keeper/MsgServer. A Go mock server reuses the type definitions as the source of truth, so the UI is grounded in the locked constants (GrainsPerBread=10000, MaturityThresholdDays=90, standing formula) rather than mirroring them in TS/JSON. | 0.85 | [frontend-only TS/JSON fixtures (UI would not exercise any Go code path); Go mock API + in-memory keepers (more code, premature)] |
|
|
||||||
| D-068 | **UI code location = new top-level `web/` dir.** Clean separation from `x/` protocol modules; does not touch the `go.mod` module path; does not pretend to be a Cosmos module. `web/` contains `main.go` (or `cmd/oyd-ui/main.go`), handlers, mock store, fixtures, `static/`, `templates/`. | User-validated. The Mesh Experience component is ROADMAP Phase 2, not a v0.6 deliverable; coupling the UI to Cosmos module conventions (a new `x/meshexperience`) is premature. A top-level `web/` dir matches the project's existing convention of non-`x/` top-level dirs (`docs/`, `lexicon/`, `lexicon_meta_docs/`). | 0.90 | [new `x/meshexperience` Cosmos module (couples UI to Cosmos conventions prematurely); `cmd/oyd-ui` + `web/` split (more files, clearer build)] |
|
|
||||||
| D-069 | **Lexicon firewall extension to `web/`.** REQ-012 currently scans `x/` + `docs/`. A new sibling meta-test `lexicon_meta_web_test.go` (package `lexicon_meta_web`) scans `web/templates/**/*.html` + `web/static/**/*.js` for the 10 banned terms, using the same `lexicon.FindBannedTerm` + word-boundary regex. Self-exclusion + fragment pattern preserved. **"Sign up" maps to "Create a Reach"** — the word "account" is banned (REQ-012). Firewall-first: lands in P1 before content (P2..P5) so UI strings are lexicon-clean by construction. | REQ-012 is `All` phases and UI strings are user-facing; the firewall must cover the UI to be durable. Extending the existing meta-test pattern (not modifying it) preserves v0.2/v0.3 coverage. Firewall-first (D-044 pattern) ensures UI content is lexicon-clean by construction, not by retrofit. | 0.88 | [skip (REQ-012 is All phases); single combined meta-test scanning x/ + docs/ + web/ (loses isolation)] |
|
|
||||||
| D-070 | **G-003 firewall scope: `web/` importing `x/*/types` is app-layer consumption, not a cross-`x/` production import.** G-003 (production import firewall) prohibits production struct imports across `x/<module>/types` packages. `web/` is not an `x/` module — it is the application layer that consumes protocol types, exactly as a future `cmd/oyd` would. The G-003 firewall stays intact: no `x/` module gains a production import of another `x/` module's types via `web/`. GRILL reviews this boundary. | G-003's intent is to prevent cross-module coupling inside the protocol layer. The application layer consuming types is the intended consumption direction. `web/` importing `x/identity/types` is no different from `cmd/oyd` importing it (when one exists). | 0.85 | [treat `web/` as an `x/` module (wrong — it is not protocol); forbid `web/` from importing `x/*/types` (would force TS/JSON fixtures, losing the grounding in locked constants)] |
|
|
||||||
| D-071 | **"Sign up" = create a Reach + open a Stash atomically.** The Nomad entry path per `docs/nomads/reach.md` is "a Nomad starts with a Reach and a Stash". The signup form creates both atomically: a `Reach` with `IsNomad=true` + a `Stash` with `HolderID` matching the Reach's `HolderID` and `BalanceGrain` seeded to a test value (e.g., 500,000 Grain = 50 Bread). No KYC, no custodian (REQ-001 self-service principle). The UI labels this "Create a Reach" (lexicon-clean; "account" is banned). | The docs define the Nomad starting state as Reach + Stash. Creating only a Reach would leave the Nomad unable to view a Stash dashboard (P2) — the atomic creation matches the docs and makes the happy path contiguous. | 0.82 | [create Reach only, defer Stash creation to a separate flow (fractures the happy path); create Reach + Stash + Window all at signup (over-scope for an MVP)] |
|
|
||||||
| D-072 | **Phase ordering** (provisional, planner finalizes): P1 Web foundation + Reach signup + lexicon firewall extension (REQ-040 + REQ-045 — same `web/` territory, vertical slice, firewall-first) → P2 Stash dashboard (REQ-041, depends on Reach existing) → P3 Window authorization (REQ-042, depends on Stash existing) → P4 Standing + Freeholder signals (REQ-043, depends on Reach existing) → P5 Bloom accrual (REQ-044, depends on Stash existing) → P6 final review + audit + milestone ship. Each phase independently shippable; P1 lands the foundation + firewall first (lexicon-clean by construction). | P1 bundles the web foundation + Reach signup + the firewall extension (same `web/` territory, vertical slice). P2..P5 each add one screen, ordered by the Nomad happy path (Reach → Stash → Window → Standing → Bloom). Vertical slices, each phase shippable. | 0.82 | [different wave ordering; bundle Stash + Window in one phase] |
|
|
||||||
| D-073 | **Bread-scale source of truth = `x/bread/types` code constants, NOT `docs/shared/bread-scale.md`.** The code constants (`GrainsPerBread=10000`, `BreadScaleAll()` table) are the locked, tested values; the docs table is aspirational/outdated (states 1,000× ratios that do not match the code). The UI uses the code constants for all Bread-scale conversions. A doc-fix for `docs/shared/bread-scale.md` is flagged as a P1+ follow-up (not a v0.6 deliverable — docs were a v0.3 deliverable; this is a doc-drift fix, not a UI feature). | The code constants are tested (`x/bread/types/types_test.go` asserts them); the docs are not. Using the code as the source of truth keeps the UI consistent with the protocol layer. | 0.90 | [use the docs table (wrong — not tested, disagrees with code); fix the docs in v0.6 (out of scope — doc-drift fix, not a UI feature)] |
|
|
||||||
|
|
||||||
## Clarification Decisions (Phase 0 v0.7 — CLARIFY, autonomy=full)
|
|
||||||
|
|
||||||
Auto-decided defaults logged per clarify workflow Step 4 (full autonomy → accept defaults, log decisions). No `--ideate` flag this run; v0.7 scope is pre-seeded from oy-spec v3 §7 (Fraternal Groups Foundation, REQ-046..REQ-066) and ratified at CLARIFY. All 8 §8 open questions resolved by accepting PO recommendations as binding (D-074..D-081). The D-001 refinement-only filter does NOT apply (v0.7 is a feature milestone). Three scope-shaping questions were validated interactively with the user before CLARIFY:
|
|
||||||
|
|
||||||
1. **v0.7 scope (§7 vs §8 Q4)** — user ruled: §7 only (REQ-046..REQ-066, 21 REQs). Cluster A+B+C are v0.8 (D-081).
|
|
||||||
2. **Accept all other PO recommendations** — user ruled: yes, accept all 7 (D-074..D-080) as binding.
|
|
||||||
3. **Generate oy-state v2 at P0 start** — user ruled: yes (done at SPECIFY).
|
|
||||||
|
|
||||||
| ID | Decision | Rationale | Confidence | Alternatives |
|
|
||||||
|----|----------|-----------|------------|--------------|
|
|
||||||
| D-074 | **TBD-X = $100k annual Pass volume** for Stand→Pier-customer boundary escalation (REQ-059). When a Stand's annual Pass volume exceeds $100k (10,000,000 Grain-cents at GrainsPerBread=10000), the Stand is invited to the Hub API as a soft upgrade (not a ban). The threshold is a new `x/stand` const `StandPierEscalationAnnualPassVolumeCents=10000000` (not locked — Pool/Council may tune within bounds). | §8 Q1 PO rec accepted at full autonomy. $100k is the natural inflection where a Stand's activity volume resembles a small Pier-customer more than a personal Holder; soft upgrade preserves self-service (Principle 6). | 0.85 | [$50k (too aggressive — flags mature Households); $250k (too lax — delays Hub API onboarding)] |
|
|
||||||
| D-075 | **TBD-Z density formula for USZ classification (REQ-095, v0.8)** = `<10 Holders per km² AND strategic value ≥ mission score, OR sovereign request, OR mission-aligned override via Mesh Council supermajority`. The formula is locked now (oy-state §3) but the USZ runtime is v0.8 (depends on Anchor pre-commitment framework). | §8 Q2 PO rec accepted. The 3-criteria OR structure matches the spec's "≥3 criteria" requirement (density + strategic value + mission-aligned override) while allowing sovereign request as a separate path. | 0.80 | [pure density threshold (ignores strategic value); Mesh Council sole arbiter (no objective floor)] |
|
|
||||||
| D-076 | **Sovereign Anchors = separate SPEC `oy-sovereign-anchors`**, not folded into `oy-pier`. v0.7 status: experimental, not load-bearing. The `oy-spec` §5 constraint forbids USZ infrastructure financing via Sovereign Anchor partnerships from being load-bearing until the separate SPEC ships. | §8 Q3 PO rec accepted. Sovereign Anchors are infrastructure-scale (reserve entities, banking partners, multi-jurisdiction custody) — a different design surface than the Pier-Routed Legal Wrapper (which is OPTIONAL per §5). Folding them into `oy-pier` would conflate legal-wrapper-scale with infrastructure-scale. | 0.85 | [fold into oy-pier (conflates scales); fold into oy-spec (too large for the net-new-only diff)] |
|
|
||||||
| D-077 | **Standing gate enforcement timing = Cover Pool Factory runtime (v0.7/P1)**, not first live Cover Pool deployment. The `CoverStandingGateTrusted=4.0` and `CoverStandingGatePreferred=4.5` consts bind at the `x/cover` Factory layer — every Pool the Factory launches inherits the protocol minimum; Pool Council MAY tighten but the Factory rejects any launch below the floor. | §8 Q5 PO rec accepted. Gates are protocol-layer invariants (REQ-049 locked=yes); deferring them to first-live-Pool would allow a window where a Pool could launch below the floor. Factory-runtime binding closes the window. | 0.88 | [first-live-Pool binding (allows a below-floor window); per-Pool configurable with no floor (violates REQ-049 locked)] |
|
|
||||||
| D-078 | **Watcher/Voucher operating-expense compensation cap = 5% of Root-Pool Bloom annually** (REQ-096, v0.8). The absolute $TBD-W cap is deferred to v0.8 P0 (needs Root-Pool Bloom size estimate). v0.7 does not implement Watcher/Voucher compensation (Cluster E + Infra Economics are v0.8 per D-081). | §8 Q6 PO rec accepted. 5% Bloom is bounded by the protocol's own yield (not a transfer-payment analog); the absolute cap prevents Bloom-rate collapse if Bloom grows large. Deferring $TBD-W avoids hardcoding a USD figure that depends on mainnet Bloom size. | 0.82 | [10% (too high — risks Bloom-rate dilution); 1% (too low — may not cover Watcher ops); no absolute cap (unbounded if Bloom grows)] |
|
|
||||||
| D-079 | **Anti-Crowding-Out Covenant enforcement = separate `x/cover/firewall` package (runtime) + `lexicon_meta_cover`-style meta-test (test-time)**, defense in depth. The runtime subpackage rejects any code path that would route Cover-Fees outside contributor-pool semantics (e.g., to Root-Pool operating expenses, transfer payments, or non-Cover destinations). The meta-test rejects doc/string drift that would describe such routing. This parallels the lexicon_meta pattern (D-044/D-069 firewall-first). | §8 Q7 PO rec accepted. The covenant is a §1/§2.3 SPEC-001 invariant — "Cover-Fees never crowd out the contributor pool". A separate firewall (not embedded in Factory validation) makes the invariant visible, testable, and resistant to Factory-layer refactors. Defense in depth: runtime rejects the code path, meta-test rejects the doc drift. | 0.84 | [embed in Factory validation (invisible, refactorable); meta-test only (no runtime gate — docs clean but code could route around)] |
|
|
||||||
| D-080 | **MAB use-of-proceeds lock enforcement = tagged streaming + Watcher-witnessed release**, defense in depth. MAB proceeds are tagged with `use_of_proceeds=reserve_build_out` at issuance; the `x/bond` keeper streams tagged Grain to the `x/cover` reserve only, with auto-Still on any misuse detection (attempt to route to a non-reserve destination). Watcher attestation witnesses each release at quarterly audit (REQ-054). | §8 Q8 PO rec accepted. Tagged streaming makes the lock enforceable at the keeper layer (not just auditable post-hoc); Watcher-witnessed release adds the human-attestation layer. Defense in depth: keeper auto-Stills on misuse, Watcher catches what the keeper misses. | 0.85 | [Watcher-quorum-only release (no runtime gate — relies on Watcher catching misuse after the fact); unrestricted + audit-only (no enforcement, just detection)] |
|
|
||||||
| D-081 | **v0.7 scope = §7 authoritative — REQ-046..REQ-066 only (21 REQs).** Cluster A+B+C (REQ-067..REQ-081) are v0.8, NOT v0.7, despite §8 Q4 PO rec suggesting Cluster A+B+C ship in v0.7. The §7 v0.7 acceptance text lists only REQ-046..REQ-066; the §7 v0.8 acceptance text lists REQ-067..REQ-097 with the const firewall extensions. §7 is the milestone contract; §8 Q4 was a recommendation the PO can override — and did, by accepting the "§7 only" interactive ruling before CLARIFY. | §7 acceptance text is the authoritative milestone contract (it lists the REQs and the acceptance criteria). §8 Q4 was a sequencing recommendation, not a binding scope ruling. Shipping 36 REQs in v0.7 would create a mega-milestone with coupled territories (fraternal primitives + their risk mitigations are different vertical slices). v0.7 = foundation; v0.8 = hardening. | 0.90 | [§8 Q4 — Cluster A+B+C in v0.7 (36 REQs, coupled territories); §7 + partial Cluster A only (REQ-067..072, 27 REQs — still couples fraternal + trust-minimization)] |
|
|
||||||
| D-082 | **v0.7 phase ordering** (provisional, planner finalizes): P1 Cover Pool firewall + foundation (REQ-046/047/049/050 — firewall-first, same `x/cover` territory) → P2 Cover-Charter + Council + staging (REQ-048/052/062/065 — extends `x/cover` + `x/council`) → P3 Guild Charter + Chapter Federation (REQ-051/053/057/058/061 — extends `x/guild`, `x/stand`) → P4 MAB + Cover Claims Voucher (REQ-054/055/060/063 — extends `x/bond`, `x/standing`, `x/cover`) → P5 Anti-Capture Bill + secession + Pier (REQ-056/059/064/066 — cross-cutting, lands last as it constrains all prior surfaces) → P6 final review + audit + milestone ship. Each phase independently shippable; P1 lands the firewall + locked floors first (firewall-first pattern per D-044/D-069/D-079). | The 21 REQs cluster into 5 vertical slices by module territory + dependency. P1 is the spine (Factory + firewall + locked floors + gates + tagging); everything else hangs off it. P5 lands last because the Anti-Capture Bill constrains all prior surfaces (non-amendable rights that P1-P4 code must not violate). | 0.82 | [governance-first (REQ-062 first — but it depends on Factory); MAB-first (REQ-054 — but it depends on Cover Pool reserve existing); single mega-phase (couples territories)] |
|
|
||||||
| D-083 | **No IDEATE stage in v0.7** (no `--ideate` flag this run). The feature scope was pre-seeded from oy-spec v3 §7 (REQ-046..REQ-066) and ratified at CLARIFY with all 8 §8 questions resolved. The D-001 refinement-only filter does NOT apply (v0.7 is a feature milestone). | run.md §IDEATE is conditional on `--ideate`. This invocation has no `--ideate`. | 1.00 | [run IDEATE anyway] |
|
|
||||||
| D-084 | **New module `x/cover`** (Cover Pool Factory + Anti-Crowding-Out firewall + Anti-Capture Bill of Rights). The existing `x/pact` `PactCover` enum value remains as a cross-reference (G-003 by-ID-string pattern). This mirrors the D-039 precedent (`x/hub` split out of `x/pact`'s `PactHubAPI` in v0.3) — when a PactType grows into a first-class protocol surface with its own keeper + firewall, it graduates to a dedicated module. The `x/pact` `PactCover` enum value stays as a typed cross-reference so `x/pact` tests still pass; `x/cover` owns the runtime. | REQ-046 (Factory runtime), REQ-047 (reserve floor in `x/pact/cover` per spec text — interpreted as `x/cover` since that's where the Factory lives), REQ-050 (Cover-Fee tagging at protocol layer), REQ-052 (Cover-Charter), REQ-055 (Cover Claims Voucher), REQ-056 (Anti-Capture Bill) all need a home. A dedicated `x/cover` module is the D-039 pattern; keeping them in `x/pact` would overload `x/pact` (which is a 6-Pact enum skeleton, not a Cover Pool runtime). The spec text "codified in `x/pact/cover`" is read as "the Cover surface, which graduated from `x/pact`" — `x/cover` is the graduated module. GRILL ratifies. | 0.82 | [keep everything in `x/pact` (overloads the 6-Pact enum module); create 3 micro-modules (`x/coverpool`, `x/covercharter`, `x/anticapture` — fragments the Cover surface)] |
|
|
||||||
|
|
||||||
## GRILL Decisions (Phase 0 v0.7 — GRILL, autonomy=full)
|
|
||||||
|
|
||||||
The ci-griller red-teamed the v0.7 plan across 9 axes + 7 specific probes. Overall verdict: **CONDITIONAL PASS** (confidence 0.72) with 5 binding decisions (D-086..D-090) and 3 escalations to PO. The plan does NOT proceed to P1 until D-086..D-090 are applied (they are applied to PLANS.md + ARCHITECTURE.md + this file). This grill IS the self-administered adversarial review (pen-test) per oy-state §7 remaining-open item 4.
|
|
||||||
|
|
||||||
| ID | Decision | Rationale | Confidence | Affects |
|
|
||||||
|----|----------|-----------|------------|--------|
|
|
||||||
| D-086 | **P1 Factory scope clarification** — P1's `MsgLaunchCoverPool` is *functional for Phase-2 categories ONLY* (Travel/HealthMCS/IncomePause). `FactoryAllowedPhases` Params field set to `[Phase2]` only in P1; Phase3/Phase4 categories REJECTED in P1. P2 extends to `[Phase2, Phase3, Phase4]`. P1 simtest includes negative case: out-of-phase category launch rejected. | The plan's "placeholder" language was ambiguous. Pinning P1 to Phase-2-only makes the vertical slice honest: P1 ships a working Factory for the Phase-2 subset, not a half-Factory. | 0.82 | PLANS P1 |
|
|
||||||
| D-087 | **`PierCarriesVoice` const reconciliation** — P3 introduces `PierCarriesVoice bool const false` in `x/guild/types` (FR-VOICE-6: Pier does NOT carry Voice). Added as the **12th locked const** to the v0.7 const additions table (was 11; now 12). Mission-locked invariant — const is the correct firewall shape (not a field). | The plan and the const table disagreed by 1. A const that exists in code but not in the firewall table is invisible to the regression firewall. | 0.80 | PLANS const table, oy-state §3, ARCHITECTURE const table |
|
|
||||||
| D-088 | **`lexicon_meta_cover` banned-term list + firewall shape** — (1) The `lexicon_meta_cover/` meta-test uses a NEW `lexicon.CoverBannedTerms()` helper banning `insurance`, `premium`, `claim`, `policy` scoped to the Cover surface (NOT project-wide — avoids false positives in non-Cover modules where "claim" is a common English word). (2) The `x/cover/firewall/` runtime subpackage shape is pinned to an **allow-list of permitted routing destinations** (the Pool's `ReserveAccount`), checked via string-equality at the start of every `MsgRouteCoverFee` handler. (3) **Optional cleanup:** replace `x/pact` "insurance-like" docstrings (`x/pact/types/types.go:36,158`) with "Cover-like" as a P1 doc-fix. | (1) Without a defined banned-term list, the `lexicon_meta_cover` meta-test was a paper tiger — it scanned but didn't ban the terms the plan said are banned. (2) The firewall's "rejects any code path" language was aspirational; an allow-list is the simtest-grade concrete form. (3) The `x/pact` "insurance-like" string is latent lexicon debt. | 0.78 | PLANS P1, `lexicon/lexicon.go`, `x/pact/types/types.go` |
|
|
||||||
| D-089 | **`StillKeeper` stub + `x/bond → x/cover` CoverKeeper reverse edge** — (1) `StillKeeper.Still(poolID, reason)` is satisfied by a **simtest-local stub** (test-only, G-003 exempt), NOT a real `x/still` keeper. `x/still` is NOT extended this milestone (verified: `x/still/keeper/` is empty). (2) ARCHITECTURE.md v0.7 dependency map adds the reverse edge: `x/bond ──(CoverKeeper shim)──► x/cover` (the MAB `MsgDebitMABProceeds` handler queries `CoverKeeper.GetPoolReserveAccount(poolID)`). NEW expected-keeper interface in `x/bond/types/expected_keepers.go`. No import cycle (interface only). | (1) The auto-Still hook references a method that doesn't exist; without a documented stub, P4 cannot wire the simtest. (2) The reverse dependency edge is real (MAB handler must query the Pool's reserve account) but undocumented — a hidden architecture coupling. | 0.76 | PLANS P1/P4, ARCHITECTURE dependency map, `x/bond/types/expected_keepers.go` |
|
|
||||||
| D-090 | **Bill of Rights temporal gap + Voucher cold-start + Standing-gate dual check + D-085 window** — (1) **Bill of Rights temporal-gap fix (most serious):** the `RightID` type + 13 `Waivable*` consts (all `false`) + `RightIsWaivable(id) bool` (always `false`) + `MsgSignCoverCharter.ValidateBasic` gate rejecting any `WaivedRights` element land in **P2** (before the first Charter can be signed), NOT P5. P5 adds the *ceremony* surface (Counsel review handler, full simtest). (2) **Voucher bond cold-start fix:** `bond = max(CoverClaimsVoucherBondMultipleAvgCall × avgCallSize, MinimumVoucherBond)` where `MinimumVoucherBond` is a Params field with a non-zero default. (3) **Standing-gate dual check:** the `CoverStandingGateTrusted`/`CoverStandingGatePreferred` floor is enforced at BOTH the `MsgLaunchCoverPool` handler AND the `MsgAmendPoolStandingGate` (Params-amendment) `ValidateBasic`. (4) **D-085 escalation window tightened to before P2** (because D-090(1) moves the RightID + 13 consts to P2). Fallback at P2: log `RightNonParticipationNoDenial` as the 13th right at confidence 0.55 and proceed. | (1) The P2→P5 temporal gap was a real security hole — rights waivable between P2 and P5. (2) Zero-bond cold-start was a Voucher bypass. (3) A Params-only check left the amendment path open. (4) The escalation window must match the new P2 deadline. | 0.72 | PLANS P2, P4, P5, RESEARCH D-085 |
|
|
||||||
+33
-192
@@ -1,4 +1,3 @@
|
|||||||
<!-- Auto-generated from .ciagent/oy/oy-spec — PO edits oy-spec, not this file; see oy-state for current shipped state. -->
|
|
||||||
# Requirements: OpenYield (oy)
|
# Requirements: OpenYield (oy)
|
||||||
|
|
||||||
| ID | Requirement | Vision § | Priority | Status | Phase |
|
| ID | Requirement | Vision § | Priority | Status | Phase |
|
||||||
@@ -31,209 +30,51 @@
|
|||||||
|
|
||||||
| ID | Requirement | Vision § | Priority | Status | Phase |
|
| ID | Requirement | Vision § | Priority | Status | Phase |
|
||||||
|----|-------------|----------|----------|--------|-------|
|
|----|-------------|----------|----------|--------|-------|
|
||||||
| REQ-010 | Exit layer (Layer 3) — DEX swaps, bridges, off-mesh services | §7 | Medium | Skeleton | v0.3/P4 |
|
| REQ-010 | Exit layer (Layer 3) — DEX swaps, bridges, off-mesh services | §7 | Medium | Pending | v0.3/P4 |
|
||||||
| REQ-022 | Bearers expansion: OY-SAT + OY-QR bearer transports | §14 | Medium | Skeleton | v0.3/P4 |
|
| REQ-022 | Bearers expansion: OY-SAT + OY-QR bearer transports | §14 | Medium | Pending | v0.3/P4 |
|
||||||
| REQ-023 | Anchors — first institutional Partner tier | §13 | Medium | Skeleton | v0.3/P4 |
|
| REQ-023 | Anchors — first institutional Partner tier | §13 | Medium | Pending | v0.3/P4 |
|
||||||
| REQ-024 | Hub API — B2B backbone: custody, lending primitive, compliance | §13 | Medium | Skeleton | v0.3/P5 |
|
| REQ-024 | Hub API — B2B backbone: custody, lending primitive, compliance | §13 | Medium | Pending | v0.3/P5 |
|
||||||
| REQ-025 | Services — Care / SIM / Vault / Mail | §13 | Medium | Skeleton | v0.3/P5 |
|
| REQ-025 | Services — Care / SIM / Vault / Mail | §13 | Medium | Pending | v0.3/P5 |
|
||||||
| REQ-026 | Bond market depth — Growth Bonds + secondary market | §17 | Medium | Skeleton | v0.3/P5 |
|
| REQ-026 | Bond market depth — Growth Bonds + secondary market | §17 | Medium | Pending | v0.3/P5 |
|
||||||
| REQ-027 | README.md + docs site in docs/ for nomads and freeholders | (vision §8) | High | Complete | v0.3/P1-P3 |
|
| REQ-027 | README.md + docs site in docs/ for nomads and freeholders | (vision §8) | High | Pending | v0.3/P1-P3 |
|
||||||
| REQ-028 | Extend REQ-012 lexicon firewall to scan docs/ + README.md | §3 | High | Complete | v0.3/P1 |
|
| REQ-028 | Extend REQ-012 lexicon firewall to scan docs/ + README.md | §3 | High | Pending | v0.3/P1 |
|
||||||
|
|
||||||
> REQ-022 through REQ-028 are NEW in v0.3 (ratified during Phase 0 IDEATE as
|
> REQ-022 through REQ-028 are NEW in v0.3 (ratified during Phase 0 IDEATE as
|
||||||
> IDEATE-01..IDEATE-07, then assigned final REQ-IDs). REQ-010 is promoted from
|
> IDEATE-01..IDEATE-07, then assigned final REQ-IDs). REQ-010 is promoted from
|
||||||
> v0.1 Skeleton to a fuller v0.3 skeleton.
|
> v0.1 Skeleton to a fuller v0.3 skeleton.
|
||||||
|
|
||||||
## v0.4 Milestone Requirements (Refinement — NFR)
|
## IDEATE Traceability (Phase 0 — IDEATE stage, autonomy=full)
|
||||||
|
|
||||||
v0.4 is a refinement-only NFR milestone: zero `feat:` phases. Scope sourced
|
|
||||||
from v0.3 forward-references (REVIEW.md, AUDIT.md §193, GRILL.md G-014).
|
|
||||||
Live-runtime promotions are out of scope (deferred to v0.5+). The D-001
|
|
||||||
refinement-only filter applies to any IDEATE stage.
|
|
||||||
|
|
||||||
| ID | Requirement | Source | Class | Priority | Status | Phase |
|
|
||||||
|----|-------------|--------|-------|----------|--------|-------|
|
|
||||||
| REQ-029 | Lexicon firewall: shared `lexicon.SyntheticBannedStrings()` helper — dedupe the synthetic self-test table between `lexicon_meta_test.go` and `lexicon_meta_docs_test.go`; both meta-tests derive count + strings from the single source so a future banned-term addition updates both firewalls from one place | GRILL G-014 | refactor/test | High | Complete | v0.4/P1 |
|
|
||||||
| REQ-030 | Cross-package const-equality test: `x/hub.LendingCouponCapBps == x/bond.CouponCapBps` (and Floor) — test-only import (G-003 exempt), catches silent mission-lock drift between hub LOCAL consts and bond D-028 consts | REVIEW.md P2 / A-304 | test | High | Complete | v0.4/P1 |
|
|
||||||
| REQ-031 | x/* lifecycle type shape-divergence review + alignment fixes — audit non-must-have lifecycle types across modules flagged by AUDIT §193; align shapes where divergent (no behavioral change) | AUDIT.md §193 | refactor/quality | Medium | Complete | v0.4/P2 |
|
|
||||||
| REQ-032 | Docs build CI — Gitea Actions workflow that runs `go test ./...` (lexicon firewall) + `mkdocs build` on every push; upload the built `site/` as a CI artifact. Full Gitea Pages publishing deferred if no hosting target is configured (chore, not feat) | D-046 | chore/ci | Medium | Complete | v0.4/P3 |
|
|
||||||
|
|
||||||
> REQ-029..REQ-032 are NEW in v0.4. All are NFR classes (refactor/test/quality/
|
|
||||||
> chore) — zero `feat:` phases by construction. The final-phase audit enforces
|
|
||||||
> the NFR purity gate (zero `feat:` commits in the milestone).
|
|
||||||
|
|
||||||
## Milestone v0.4 Summary (Refinement — NFR) — COMPLETE
|
|
||||||
|
|
||||||
- 4 v0.4-scope REQs shipped as NFR (refactor/test/docs/chore): REQ-029, REQ-030, REQ-031, REQ-032
|
|
||||||
- Closes 3 real v0.3 forward-references: GRILL G-014 (lexicon drift), REVIEW P2/A-304 (const drift), AUDIT §193 (council divergence docs)
|
|
||||||
- Lands the D-046 docs-CI forward-reference (.gitea/workflows/docs-build.yml, build+artifact, no Pages publish per D-051)
|
|
||||||
- NFR purity gate GREEN: zero `feat:` commit subjects in the milestone (20 commits, all docs/refactor/test/chore/verify/decision/checkpoint/Merge)
|
|
||||||
- `go.mod` unchanged (G-006 — zero Go deps; Python deps isolated to CI docs-build job)
|
|
||||||
- G-003 production firewall intact (no production import of `x/bond/types` in `x/hub/types`; cross-const test is test-only)
|
|
||||||
- Coverage: x/hub/types 93.3% (v0.3 floor preserved), x/council/types 96.4% (improved); both above 80% target
|
|
||||||
- Tags: v0.3.0 (P0) -> v0.3.1 (P1) -> v0.3.2 (P2) -> v0.3.3 (P3) -> v0.3.4 (P4 = v0.4 milestone release)
|
|
||||||
- Tag-line note: v0.4 (NFR) ships on the v0.3.x patch line (config tag_base). The v0.3.4 milestone release IS the deliverable (D-008 — final phase patch IS the milestone release; no separate minor tag).
|
|
||||||
|
|
||||||
## v0.5 Milestone Requirements (Bearers Runtime — Feature)
|
|
||||||
|
|
||||||
v0.5 promotes the v0.3 Bearers skeletons from type+keeper-stub layers to
|
|
||||||
live runtime behavior (keeper message handlers + simtest-grade end-to-end
|
|
||||||
flows). No live chain launch (D-020 continues to govern network deployment);
|
|
||||||
runtime = keeper handlers + simtest, not mainnet. Sourced from the v0.3/v0.4
|
|
||||||
deferred items (D-050, PROJECT.md v0.4 out-of-scope, ROADMAP Phase 3 runtime).
|
|
||||||
|
|
||||||
| ID | Requirement | Source | Class | Priority | Status | Phase |
|
|
||||||
|----|-------------|--------|-------|----------|--------|-------|
|
|
||||||
| REQ-033 | Exit layer runtime — `x/exit` DEX swap routing + `x/bridge` L2↔L1 IBC packet handlers; promotes REQ-010 from skeleton → runtime (simtest-grade message handlers; live DEX/IBC channels deferred) | PROJECT.md v0.4 OOS / D-050 | feat | High | Complete | v0.5/P1 |
|
|
||||||
| REQ-034 | Bearers transport runtime — OY-SAT + OY-QR bearer transport message handlers in `x/bearers` (extends REQ-019/REQ-022); session lifecycle in simtest (hardware integration deferred) | PROJECT.md v0.4 OOS | feat | Medium | Complete | v0.5/P2 |
|
|
||||||
| REQ-035 | Anchors onboarding runtime — `x/partner` Anchor tier credential issuance + revocation handlers (extends REQ-018/REQ-023); credential lifecycle in simtest (real institutional onboarding deferred) | PROJECT.md v0.4 OOS | feat | Medium | Complete | v0.5/P3 |
|
|
||||||
| REQ-036 | Hub API B2B runtime — `x/hub` custody, lending primitive, compliance message handlers; keeper handlers + simtest (real B2B suite deferred) | PROJECT.md v0.4 OOS | feat | High | Complete | v0.5/P4 |
|
|
||||||
| REQ-037 | Services runtime — `x/services` Care / SIM / Vault / Mail service lifecycle handlers; runtime handlers + simtest (live service integrations deferred) | PROJECT.md v0.4 OOS | feat | Medium | Complete | v0.5/P5 |
|
|
||||||
| REQ-038 | Bond market depth runtime — `x/bond` Growth Bonds + secondary-market matching handlers (extends REQ-021/REQ-026); matching engine + simtest (live market depth deferred) | PROJECT.md v0.4 OOS | feat | High | Complete | v0.5/P6 |
|
|
||||||
| REQ-039 | Council governance runtime — `x/council` Proposal/VoteOption enum types (AUDIT §193 P1-1, deferred from v0.4) + Voice lifecycle handlers; governance message handlers + simtest (Mission Lock const firewall intact per G-003; SignalKind 4→5 expansion deferred to v0.6+) | AUDIT §193 P1-1 / D-050 | feat | Medium | Complete | v0.5/P7 |
|
|
||||||
|
|
||||||
> REQ-033..REQ-039 are NEW in v0.5. All are `feat`-class (runtime promotion
|
|
||||||
> from skeleton). No breaking schema changes; locked-const firewall intact
|
|
||||||
> (Mission Lock non-amendable). The final-phase audit enforces the feature
|
|
||||||
> purity gate (no breaking schema changes; G-003 production firewall intact;
|
|
||||||
> G-006 go.mod unchanged unless a runtime dep is GRILL-approved).
|
|
||||||
|
|
||||||
## Milestone v0.5 Summary (Bearers Runtime — Feature) — COMPLETE
|
|
||||||
|
|
||||||
- 7 v0.5-scope REQs shipped as feature (runtime promotion from skeleton): REQ-033, REQ-034, REQ-035, REQ-036, REQ-037, REQ-038, REQ-039
|
|
||||||
- 8 modules promoted to runtime (keeper MsgServer handlers + simtest-grade end-to-end flows): x/exit, x/bridge, x/bearers, x/partner, x/hub, x/services, x/bond, x/council
|
|
||||||
- cosmos-sdk v0.50.8 + ibc-go v8.2.1 added (D-055/D-062, G-006 controlled exception — scoped to runtime phases; types/ packages stay dep-free)
|
|
||||||
- G-003 production firewall intact (expected_keepers.go interfaces; no production struct imports across x/<module>/types)
|
|
||||||
- Locked-const firewall intact: all v0.1..v0.4 consts unchanged (ExitStatusCount=5, BridgeStatusCount=4, BearerTypeCount=6, OYSATLink.SurveillanceResistant=true, PartnerTierCount=4, HubServiceCount=3, LendingCouponCapBps=800, LendingCouponFloorBps=0, ServiceKindCount=4, CouponCapBps=800, CouponFloorBps=0, CouncilKindCount=3, SignalKindCount=4, MissionLockAmendable=false); v0.5 additions additive (AnchorCredentialStatusCount=4, WatcherVetoQuorum default 6 param-tunable)
|
|
||||||
- 5 GRILL decisions ratified: D-055 (cosmos-sdk dep), D-062 (version pin), D-063 (bond CLOB REJECT above 800bps), D-064 (MissionLockAmendment reject-at-ValidateBasic), D-065 (Watcher Veto quorum default 6)
|
|
||||||
- 8 binding fixes landed: G-017 (NoWithVeto test reconciled), G-018 (go 1.22 build gate), G-019 (ImpliedCoupon helper + boundary test), G-020 (WatcherVetoQuorum bounds [2,9]), G-021 (IBC replay ERROR), G-022 (baseline stubs documented), G-023 (keeper/msg_server.go ownership split), G-024 (types/ tests stdlib-only)
|
|
||||||
- Coverage ≥80% on all 8 keeper packages: x/exit/keeper 85.0%, x/bridge/keeper 82.1%, x/bearers/keeper 91.2%, x/partner/keeper 87.6%, x/hub/keeper 90.0%, x/services/keeper 91.5%, x/bond/keeper 92.5%, x/council/keeper 90.3%
|
|
||||||
- 34 packages green (no regression on v0.1..v0.4 baseline)
|
|
||||||
- Tags: v0.4.0 (P0) -> v0.4.1 (P1) -> v0.4.2 (P2) -> v0.4.3 (P3) -> v0.4.4 (P4) -> v0.4.5 (P5) -> v0.4.6 (P6) -> v0.4.7 (P7) -> v0.4.8 (P8 = v0.5 milestone release)
|
|
||||||
- Tag-line note: v0.5 (feature) ships on the v0.4.x patch line (config tag_base). The v0.4.8 milestone release IS the deliverable (D-008 — final phase patch IS the milestone release; no separate minor tag).
|
|
||||||
- 5 P1+ issues flagged for v0.6+ mainnet-readiness (governance spam deposit, CLOB front-running/batch auction, real IBC light-client simtest, CLOB prefix-key perf, emitMatchEventHook testability)
|
|
||||||
|
|
||||||
## v0.6 Milestone Requirements (Nomad Web UI — Feature)
|
|
||||||
|
|
||||||
v0.6 is the project's first UI milestone. It delivers a working prototype Web
|
|
||||||
UI where a person can sign up to be a Nomad (create a Reach + open a Stash)
|
|
||||||
and exercise basic functionality around the (Reach, Stash) components, plus
|
|
||||||
Window authorization, Standing progress, and Bloom accrual views. All data is
|
|
||||||
generated as test fixtures — no real blockchain interaction (D-020 continues).
|
|
||||||
The UI is a greenfield Go `html/template` + HTMX layer served by a Go mock HTTP
|
|
||||||
server (`web/`) that instantiates the real `x/*/types` structs from in-memory
|
|
||||||
fixtures. No keeper, no Cosmos runtime, no `app.go`.
|
|
||||||
|
|
||||||
| ID | Requirement | Source | Class | Priority | Status | Phase |
|
|
||||||
|----|-------------|--------|-------|----------|--------|-------|
|
|
||||||
| REQ-040 | Nomad Reach signup Web UI — Go HTTP mock server (`web/main.go`, Go 1.22 `net/http.ServeMux`, mock store) + "Create a Reach" form (POST) + Reach list/detail views; grounds the UI in `x/identity/types.Reach`. "Sign up" maps to "Create a Reach" (the word "account" is banned per REQ-012). Signup atomically creates a Reach (`IsNomad=true`) + a Stash (per D-071, Nomad starts with both). | user `--ideate` request + D-066/D-067/D-068/D-071 | feat | High | Complete | v0.6/P1 |
|
|
||||||
| REQ-041 | Stash dashboard Web UI — balance in Grain + Bread-scale conversion (using `x/bread/types.BreadScaleAll()` + `GrainsPerBread=10000`, per D-073 code constants are the source of truth) + 90-day maturity progress bar (`x/stash/types.StashActivity.IsMature`, `MaturityThresholdDays=90`). | user `--ideate` request + D-073 | feat | High | Complete | v0.6/P2 |
|
|
||||||
| REQ-042 | Window authorization Web UI — form to open a Window (scope + duration + rate-limit) delegating to a service, lifecycle view (Open→Active→Revoked/Expired via `x/window/types.Window.Activate/Revoke/Expire`), audit log (`AuditEntry`). | user `--ideate` request | feat | Medium | Complete | v0.6/P3 |
|
|
||||||
| REQ-043 | Standing + Freeholder signals progress Web UI — computed from mock `Rating`/`Vouch`/`Slash` records using the locked constants + `GetStandingBucket`/`ComputeDiversityBonus`/`GetVoucherWeight`; 4-signal progress (`FreeholderSignals.IsFreeholderEligible` — StashMaturity, MultiDomainStanding, CommittedCapital, CommunityEndorsement). | user `--ideate` request | feat | Medium | Complete | v0.6/P4 |
|
|
||||||
| REQ-044 | Bloom accrual Web UI — per-Stash `BloomRecord` view (`AccruedGrain`, `RateBasisPoints`, `LastAccrualBlock`), computed from mock data; shows the 4.5% target rate (`TargetBloomRateBasisPoints=450`). | user `--ideate` request | feat | Low | Complete | v0.6/P5 |
|
|
||||||
| REQ-045 | Extend REQ-012 lexicon firewall to scan `web/templates/**` + `web/static/**` + `web/**/*.go` (new `lexicon_meta_web_test.go`, package `lexicon_meta_web`, subdir `lexicon_meta_web/`). Mirrors the `lexicon_meta_docs` pattern with G-013 walk-coverage + G-009 self-test + G-014 shared `SyntheticBannedStrings()`. Firewall-first: lands in P1 before content (P2..P5). | D-069 + RESEARCH D-075 | test/quality | High | Complete | v0.6/P1 |
|
|
||||||
|
|
||||||
> REQ-040..REQ-045 are NEW in v0.6. REQ-040..REQ-044 are `feat`-class (UI
|
|
||||||
> screens); REQ-045 is `test` (lexicon firewall extension). No breaking schema
|
|
||||||
> changes; G-003 production firewall intact (`web/` is app-layer, not an `x/`
|
|
||||||
> module); G-006 go.mod unchanged (HTMX is a vendored static asset, not a Go
|
|
||||||
> dep). The final-phase audit enforces the feature purity gate.
|
|
||||||
|
|
||||||
## v0.7 Milestone Requirements (Fraternal Groups Foundation — Feature)
|
|
||||||
|
|
||||||
v0.7 adapts the 1890–1930 fraternal benefit-society model for borderless
|
|
||||||
digital service. It delivers Cover Pools (mission-locked reserve floors +
|
|
||||||
Standing gates), Chapter Federation (Parent/Chapter Guild model with
|
|
||||||
secession terms + good-standing liens at founding), Mutual Aid Bonds
|
|
||||||
(Cover-Call-couponed, 3× annual surplus ceiling, use-of-proceeds locked to
|
|
||||||
reserve build-out), and the Anti-Capture Bill of Rights v0.2 (13 rights
|
|
||||||
codified, non-amendable, non-waivable). This milestone unblocks the v0.1 Q7
|
|
||||||
"Cover Pool seniority mechanics" deferred item — REQ-046..REQ-050 supply the
|
|
||||||
seniority/gate math and promote `x/pact` Cover from skeleton to a dedicated
|
|
||||||
`x/cover` module runtime (D-084, D-039 precedent).
|
|
||||||
|
|
||||||
Simtest-grade runtime (D-020 pattern continues — no live chain launch, no
|
|
||||||
mainnet). Cover Pool "live on testnet" (§7 acceptance) = `x/cover` keeper
|
|
||||||
message handlers + simtest-grade end-to-end flows. No `app.go`/`cmd/oyd`
|
|
||||||
exists; v0.7 does not create one. New module: `x/cover` (Factory + Anti-
|
|
||||||
Crowding-Out firewall + Anti-Capture Bill of Rights). The existing `x/pact`
|
|
||||||
`PactCover` enum value remains as a cross-reference (G-003 by-ID-string).
|
|
||||||
|
|
||||||
| ID | Requirement | Vision § | Priority | Status | Phase |
|
|
||||||
|----|-------------|----------|----------|--------|-------|
|
|
||||||
| REQ-046 | Cover Pool Factory runtime — Factory rejects category launches below in-force reserve floor; supports Cover-Charter deployment; Watcher attestation pipeline operational; category staging per REQ-065 | §16 | High | Not started | v0.7/P1 |
|
|
||||||
| REQ-047 | Cover Pool reserve target floor 1.5× annual contributions — LOCKED; mission-lock semantic enforced; below-floor auto-pause of Cover-Fee routing | §16 | High | Not started | v0.7/P1 |
|
|
||||||
| REQ-048 | Cover Pool reserve target ceiling 2.5× (governance-tunable within 1.5×–2.5×) — Watcher escalation after 12 months; Pool Council MAY vote within bounded range | §16 | High | Not started | v0.7/P2 |
|
|
||||||
| REQ-049 | Cover Pool Standing gate minimums — LOCKED; Travel ≥ Trusted 4.0; Health-MCS ≥ Preferred 4.5; Pool MAY tighten but NEVER loosen below protocol minimum. Binds at Factory runtime (D-077) | §16, §9.3 | High | Not started | v0.7/P1 |
|
|
||||||
| REQ-050 | Cover-Fee tagging at protocol layer — LOCKED; Cover-Fee Grains carry `category_tag`; settlement rejects category-mismatched Calls (FR-COVER-11); Pool-level fungibility preserved for net-reserve accounting | §16 | High | Not started | v0.7/P1 |
|
|
||||||
| REQ-051 | Guild Charter + Common Bond requirement — LOCKED; at formation: Common Bond declared + hash-pinned; Public Profile published (bond summary, disclaimers, Mason count or "private", Pier wrapper if any) | §12 | Medium | Not started | v0.7/P3 |
|
|
||||||
| REQ-052 | Cover-Charter (SoB, dispute path, gate, holding period) — LOCKED; distinct from governance charter; signed by Pool Host + witnessed by Watcher at deployment; amendments require Pool supermajority + 7-day cooling + Watcher + Counsel; protocol does NOT enforce SoB content (FR-CHTR-5) | §16 | High | Not started | v0.7/P2 |
|
|
||||||
| REQ-053 | Chapter Federation (Parent/Chapter, secession terms, liens at founding) — Parent Guild + Chapters; Chapters inherit + may tighten but not loosen; secession terms coded at founding; good-standing liens at founding (not freely increasable); Chapter retains mesh-level Voice (Pier does NOT carry Voice per FR-VOICE-6) | §12 | High | Not started | v0.7/P3 |
|
|
||||||
| REQ-054 | Mutual Aid Bond (issuance ceiling 1×–3×, coupons in Cover Calls) — LOCKED; issuance ceiling mission-locked at 3× annual surplus; coupons payable in Cover Calls or mutual-aid credits (NEVER Bread); coupon rate bounded by `CouponCapBps=800`; use-of-proceeds locked to reserve build-out; default recapture per FR-MAB-7; Watcher attestation at deployment + quarterly audit. Enforcement: tagged streaming + Watcher-witnessed release (D-080) | §17 | High | Not started | v0.7/P4 |
|
|
||||||
| REQ-055 | Cover Claims Voucher role + bond + slashing — Specialization of Voucher role; bond default 10× avg Call size per Pool; reviews each Call independently (no self-adjudication, FR-CPCV-2); slashing via §9.4 mechanism with cross-Pool applicability (NFR-SEC-8); bounded earnings | §9.4, §15 | High | Not started | v0.7/P4 |
|
|
||||||
| REQ-056 | Anti-Capture Bill of Rights v0.2 — LOCKED; 13 rights codified in code; cannot be amended or waived by any Charter; covers one-tap exit, no tax on personal Stash, audit-able Voice, cooling, Watcher inspection, Freeholder voucher, Counsel escalation, Anchored-Bread conversion, Wayfarer's Record, secession (founding terms), non-Cover-access, category-mismatch refusal | §8.2 [3] | High | Not started | v0.7/P5 |
|
|
||||||
| REQ-057 | Household simplified — no formal Council, one-tap exit — Household Stand may operate without formal Council; one-tap exit is the dispute path | §11 | Low | Not started | v0.7/P3 |
|
|
||||||
| REQ-058 | Confederation Voice — one-Stand-one-Vote, internal bundle — LOCKED; Confederation aggregates member Stand Voice one-per-Stand; member Stands may bundle delegated Voice internally via §19 delegation | §11 | Medium | Not started | v0.7/P3 |
|
|
||||||
| REQ-059 | Stand→Pier-customer boundary — escalation rule ($100k per D-074) — When annual Pass volume > $100k (10M Grain-cents), Stand is invited to Hub API; soft upgrade, not a ban | §11, §13 | Medium | Not started | v0.7/P5 |
|
|
||||||
| REQ-060 | Shadow vouch partial credit — 50% weight in Freeholder signal — LOCKED; Shadow vouch weight = 0.5× in Community Endorsement signal (vs 1.0× for non-Shadow vouch) | §9.1 | Medium | Not started | v0.7/P4 |
|
|
||||||
| REQ-061 | Disclaimer cadence — per charter signing — LOCKED; jurisdictional disclaimer surfaced at every charter signing; not session-bounded | §11 | Low | Not started | v0.7/P3 |
|
|
||||||
| REQ-062 | Pool governance hybrid (Host + 3 elected + Watcher observer) — LOCKED; Cover Pool Council = Pool Host + 3 Masons elected by Pool-eligible Masons + Watcher observer seat; Cover Calls require majority with Watcher observer present. No Anchor seat (Anchor no-Voice §5) | §16 | High | Not started | v0.7/P2 |
|
|
||||||
| REQ-063 | MAB holder — surplus seniority only, no Voice at dissolution — LOCKED; MAB holders rank after Cover-Fee contributors but before Bread holders in Pool-surplus distributions (FR-MAB-4); NO Voice in Pool dissolution decisions (claimants, not Masons) | §17 | Medium | Not started | v0.7/P4 |
|
|
||||||
| REQ-064 | Secession cooling — 21d Cover-active / 14d non-Cover — LOCKED; Chapter secession cooling: 21 Mesh-days if Cover-active, 14 Mesh-days if non-Cover; secured at founding, not reducible; lien audit required; Cover Call / Bond covenant clearance required before secession completes | §4.6 [3] | Medium | Not started | v0.7/P5 |
|
|
||||||
| REQ-065 | Cover Pool category staging — Phase 2/3/4 — LOCKED; Phase 2: Travel + Health-MCS + Income-Pause; Phase 3: Equipment/Loss + Life-Burial + Road-Side; Phase 4: Cyber-Skimming + Guild-Internal-Mutual-Aid; Factory respects staging and rejects out-of-phase launches | §16 | High | Not started | v0.7/P2 |
|
|
||||||
| REQ-066 | Pier selection — Guild Council chooses, reversible, Pier Selection Index — Guild Council chooses Pier at formation; reversible by Cover Pool supermajority + Counsel witness; mesh maintains Pier Selection Index; Pier-Routed Legal Wrapper OPTIONAL (§5 default-no-wrapper) | §13 | Medium | Not started | v0.7/P5 |
|
|
||||||
|
|
||||||
> REQ-046..REQ-066 are NEW in v0.7. All are `feat`-class primitives (Cover
|
|
||||||
> Pool Factory, Cover-Charter, Chapter Federation, MAB, Cover Claims Voucher,
|
|
||||||
> Anti-Capture Bill) + a `test` adjunct for the Anti-Crowding-Out firewall
|
|
||||||
> (D-079, ships in P1 firewall-first). No breaking schema changes to the
|
|
||||||
> locked-const firewall; G-003 production firewall intact (`x/cover` is a new
|
|
||||||
> module that references `x/pact`/`x/standing`/`x/bond` by ID-string only);
|
|
||||||
> G-006 go.mod unchanged (`x/cover` keeper uses existing cosmos-sdk runtime
|
|
||||||
> substrate). The final-phase audit enforces the feature purity gate.
|
|
||||||
|
|
||||||
### v0.8+ Milestone Requirements (Risk Mitigations + Infrastructure Economics — Deferred)
|
|
||||||
|
|
||||||
> All 31 REQs (REQ-067..REQ-097) are deferred to v0.8 per D-081 (§7
|
|
||||||
> authoritative). Listed here for traceability; not started this milestone.
|
|
||||||
|
|
||||||
| ID | Requirement | Vision § | Priority | Status | Target milestone |
|
|
||||||
|----|-------------|----------|----------|--------|------------------|
|
|
||||||
| REQ-067..REQ-072 | Cluster A — Trust-minimization attacks (audit cadence, bridge pause, Eye quorum, Watcher fork-recovery, Anchor concentration cap, RWA venue) | §7, §16, §20, §6 | High | Deferred | v0.8 |
|
|
||||||
| REQ-073..REQ-076 | Cluster B — Economic structural (sovereign reserve, Root Basket liquidity, MAB default recapture, Forex multi-venue) | §6, §13, §17 | High/Medium | Deferred | v0.8 |
|
|
||||||
| REQ-077..REQ-081 | Cluster C — Capture & centralization (governance capture, Processor FCFS, Partner/Pier capture, Pool governance capture, secession abuse) | §19, §15, §13, §16, §4.6 | High/Medium | Deferred | v0.8 |
|
|
||||||
| REQ-082..REQ-086 | Cluster D — Identity & reputation (Sybil, Window abuse, vouching cascade, norm chilling, registry identity) | §9.2, §10, §9.1, §9.4, §4.9, §11 | High/Medium | Deferred | v0.8 |
|
|
||||||
| REQ-087..REQ-091 | Cluster E — Adoption & organic (cycle defaults, charter ambiguity, cross-chain drift, fee-covenant override, adverse selection) | §16, §11, §7, §20, §18, §19 | Medium/High | Deferred | v0.8 |
|
|
||||||
| REQ-092..REQ-097 | Infrastructure Economics (relay fee schedule, coverage standing bonus, IYB with subordination, USZ classification, Watcher/Voucher compensation, Anchor no-Voice) | §15, §9.1, §17, §13, §7, §19 | High/Medium | Deferred | v0.8 |
|
|
||||||
|
|
||||||
The IDEATE stage ran the three ideation tiers (mechanical, backend-enriched,
|
The IDEATE stage ran the three ideation tiers (mechanical, backend-enriched,
|
||||||
cross-project) on the v0.6 milestone scope and ratified 6 ideas (IDEATE-09..
|
cross-project) on the v0.3 milestone scope and ratified 8 ideas (IDEATE-01..
|
||||||
IDEATE-14) at full autonomy. Each IDEATE-NN maps to a REQ-ID in the v0.6
|
IDEATE-08) at full autonomy. Each IDEATE-NN maps to a REQ-ID in the v0.3
|
||||||
requirements table above. The user pre-validated the 5 screens + stack via
|
requirements table above. Mechanical tier: no `lessons:`/`compound:` tags in
|
||||||
interactive questions during CLARIFY (Go html/template + HTMX, Go mock API
|
v0.1/v0.2 history (convention unused); one historical escalation (milestone
|
||||||
server, new `web/` dir, all 5 screens); IDEATE ratifies that validation.
|
release pending — no remote) resolved in v0.2; v0.2 closed clean (9/9 REQs,
|
||||||
|
303 tests, ≥95.9% coverage). Backend-enriched + cross-project tiers confirmed
|
||||||
Mechanical tier: v0.5 closed clean (7/7 REQs, 8 keeper packages ≥80% coverage,
|
the docs deliverable + Bearers skeleton bundle (D-034) and the firewall-first
|
||||||
G-003/locked-const firewalls intact, 5 P1+ flagged for v0.7+ mainnet-readiness);
|
ordering (D-044). Defaults accepted per full autonomy.
|
||||||
no `lessons:`/`compound:` tags in v0.1..v0.5 history (convention unused).
|
|
||||||
Backend-enriched tier: confirmed the mock-server-over-real-Go-types approach
|
|
||||||
grounds the UI in the locked constants (D-067/D-073). Cross-project tier: no
|
|
||||||
applicable cross-project patterns (this is the project's first UI; no prior UI
|
|
||||||
conventions to inherit). Defaults accepted per full autonomy.
|
|
||||||
|
|
||||||
| IDEATE ID | REQ-ID | Category | Source | Confidence | Phase |
|
| IDEATE ID | REQ-ID | Category | Source | Confidence | Phase |
|
||||||
|-----------|--------|----------|--------|------------|-------|
|
|-----------|--------|----------|--------|------------|-------|
|
||||||
| IDEATE-09 | REQ-040 | feature/ui | user `--ideate` request + D-066/D-067/D-068/D-071 | 0.92 | v0.6/P1 |
|
| IDEATE-01 | REQ-027 | improvement/docs | user `--ideate` request + D-042/D-045 | 0.90 | v0.3/P1-P3 |
|
||||||
| IDEATE-10 | REQ-041 | feature/ui | user `--ideate` request + D-073 | 0.90 | v0.6/P2 |
|
| IDEATE-02 | REQ-028 | quality/security | D-043 + RESEARCH firewall-extension design | 0.88 | v0.3/P1 |
|
||||||
| IDEATE-11 | REQ-042 | feature/ui | user `--ideate` request | 0.85 | v0.6/P3 |
|
| IDEATE-03 | REQ-010 | coverage/architecture | ROADMAP Phase 3 + D-036 | 0.80 | v0.3/P4 |
|
||||||
| IDEATE-12 | REQ-043 | feature/ui | user `--ideate` request | 0.85 | v0.6/P4 |
|
| IDEATE-04 | REQ-022 | coverage | ROADMAP Phase 3 + D-037 | 0.82 | v0.3/P4 |
|
||||||
| IDEATE-13 | REQ-044 | feature/ui | user `--ideate` request | 0.80 | v0.6/P5 |
|
| IDEATE-05 | REQ-023 | coverage | ROADMAP Phase 3 + D-038 | 0.78 | v0.3/P4 |
|
||||||
| IDEATE-14 | REQ-045 | quality/security | D-069 + RESEARCH D-075 | 0.88 | v0.6/P1 |
|
| IDEATE-06 | REQ-024 | architecture | ROADMAP Phase 3 + D-039 | 0.80 | v0.3/P5 |
|
||||||
|
| IDEATE-07 | REQ-025 | coverage | ROADMAP Phase 3 + D-040 | 0.78 | v0.3/P5 |
|
||||||
|
| IDEATE-08 | REQ-026 | coverage | ROADMAP Phase 3 + D-041 | 0.80 | v0.3/P5 |
|
||||||
|
|
||||||
Notes:
|
Notes:
|
||||||
- IDEATE-09/14 ship in P1 (web foundation + firewall-first, same `web/` territory — vertical slice).
|
- IDEATE-01/02 (docs deliverable + firewall) are the user's `--ideate` request
|
||||||
- IDEATE-10..13 ship in P2..P5 (one screen per phase, ordered by the Nomad happy path: Reach → Stash → Window → Standing → Bloom).
|
ratified via D-042/D-043/D-045.
|
||||||
- The D-001 refinement-only filter does NOT apply (v0.6 is a feature milestone, not NFR).
|
- IDEATE-03..08 (Bearers skeleton) are the ROADMAP Phase 3 subset bundled into
|
||||||
|
v0.3 per D-034.
|
||||||
|
- IDEATE-02 lands in P1 (firewall-first) BEFORE IDEATE-01 content (P2/P3) per
|
||||||
|
D-044 — docs are lexicon-clean by construction.
|
||||||
|
- IDEATE-03..05 ship in P4 (Bearers skeleton I); IDEATE-06..08 ship in P5
|
||||||
|
(Bearers skeleton II) — vertical slices, each phase independently shippable.
|
||||||
|
|
||||||
## Milestone v0.1 Summary
|
## Milestone v0.1 Summary
|
||||||
- 10 REQs complete (skeleton + tests)
|
- 10 REQs complete (skeleton + tests)
|
||||||
|
|||||||
+1
-1576
File diff suppressed because it is too large
Load Diff
+253
-14
@@ -1,19 +1,258 @@
|
|||||||
# v0.6 Review (Nomad Web UI)
|
# Review: OpenYield (oy) — v0.2 (The Mesh) Final Phase (P1-P4)
|
||||||
|
|
||||||
## Multi-persona code review across P1..P5
|
> **Reviewer**: CIAgent code reviewer (correctness, security, maintainability, adversarial lenses)
|
||||||
|
> **Date**: 2026-08-17
|
||||||
|
> **Scope**: `git diff main..oy/milestone/v0.2-mesh` — all v0.2 execution work (P1-P4: x/window, x/stand, x/guild, x/pact, x/partner, x/council, x/forex, x/bond, x/satellite, x/bearers extension, lexicon package, lexicon_meta_test.go)
|
||||||
|
> **Milestone**: v0.2 — The Mesh
|
||||||
|
> **Mode**: multi-project (slug `oy`)
|
||||||
|
> **Autonomy**: full — P0 fixes auto-applied; P1+ flagged for post-hoc review (do not block ship)
|
||||||
|
|
||||||
### 8 adversarial probes
|
---
|
||||||
|
|
||||||
1. **`go run ./web` starts with no external deps (G-006)** — PASS. `git diff v0.5.0..HEAD -- go.mod go.sum` is empty. HTMX is a vendored static asset (`web/static/htmx.min.js`), NOT a `go get`. Zero new require lines across the v0.6 milestone.
|
## Verification Commands Run
|
||||||
2. **All 5 screens reachable from the home page** — PASS. Nav in `web/templates/base.html` links to /reach, /stash, /window, /standing, /bloom. Each route returns 200 (handler tests + smoke test on dynamic port 47077/53907).
|
|
||||||
3. **`lexicon_meta_web/` firewall scans `web/templates/**` + `web/static/**` + `web/**/*.go`** — PASS. `go test ./lexicon_meta_web/...` green; G-013 walk-coverage test injects a synthetic banned-term fixture and finds it.
|
|
||||||
4. **Bread-scale conversion matches `x/bread/types` code constants (D-073)** — PASS. `TestStashBreadScaleConversionCorrectness` asserts GrainsPerBread=10000, Crumb=100 Grain (code values); would FAIL if the outdated docs 1000x values were used.
|
|
||||||
5. **Standing score uses locked formula constants** — PASS. `TestStandingScoreComputedFromLockedConstants` asserts PriorMean=4.0, PriorWeight=10, ComputeDiversityBonus, GetVoucherWeight, GetStandingBucket (all from x/standing/types, NOT hardcoded).
|
|
||||||
6. **Freeholder-eligible badge reflects `IsFreeholderEligible()`** — PASS. `TestFreeholderEligibleBadgeReflectsMethod` asserts the rendered badge matches the real method output for both eligible (holder-alia) and non-eligible (holder-bryn) Reaches.
|
|
||||||
7. **Window lifecycle transitions call `Window.Activate/Revoke/Expire`** — PASS. `TestWindowActivateTransitionsOpenToActive` + `TestWindowRevokeTransitionsToRevoked` assert the real x/window/types methods are invoked (status transitions verified). `TestWindowRevokeOnExpiredIsNoOp` asserts the v0.2 terminal-state contract (revoke-on-expired is a no-op).
|
|
||||||
8. **No banned terms in any rendered page** — PASS. Per-handler rendered-HTML lexicon checks (G-026) in all 5 phases scan BOTH 200 happy-path AND error response bodies (400/404). `lexicon_meta_web/` file-scan firewall green on all web/**/*.{html,js,go} files.
|
|
||||||
|
|
||||||
### Verdict: SHIP. No P0 issues. No P1+ issues flagged.
|
| Command | Result |
|
||||||
|
|---|---|
|
||||||
|
| `go build ./...` | **GREEN** (exit 0) |
|
||||||
|
| `go test ./...` | **GREEN** (exit 0, all 25 packages: 15 v0.1 baseline + 10 v0.2 new/extended) |
|
||||||
|
| `go test -cover ./x/{window,stand,guild,pact,partner,council,forex,bond,bearers,satellite}/types/...` | **ALL ≥80%** (range 95.9%–100.0%; 8 of 10 at 100%) |
|
||||||
|
| `go test -run TestLexiconMeta ./...` | **GREEN** (4 meta-tests pass at root pkg) |
|
||||||
|
| `go test -run TestG003NoCrossModuleStructImportsInProduction ./x/window/types/` | **GREEN** (G-003 invariant enforced) |
|
||||||
|
| `git diff main..oy/milestone/v0.2-mesh -- go.mod` | **EMPTY** (go.mod read-only — G-006 verified) |
|
||||||
|
| `grep -rniE '\b(bank\|deposit\|interest\|yield\|currency\|dollar\|euro\|account\|savings\|depositor)\b' x/ --include='*.go'` | **ZERO HITS** (lexicon firewall green) |
|
||||||
|
| v0.1 baseline regression | **NO REGRESSION** (all v0.1 packages cached/green) |
|
||||||
|
|
||||||
### G-028 audit (go.mod diff against v0.5.0 baseline)
|
### Coverage detail
|
||||||
`git diff v0.5.0..HEAD -- go.mod go.sum` — EMPTY. v0.6 adds zero Go dependencies (HTMX is a vendored static asset). G-006 preserved across the milestone.
|
|
||||||
|
| Package | Coverage |
|
||||||
|
|---|---|
|
||||||
|
| x/window/types | 100.0% |
|
||||||
|
| x/stand/types | 100.0% |
|
||||||
|
| x/guild/types | 100.0% |
|
||||||
|
| x/pact/types | 95.9% |
|
||||||
|
| x/partner/types | 100.0% |
|
||||||
|
| x/council/types | 96.4% |
|
||||||
|
| x/forex/types | 100.0% |
|
||||||
|
| x/bond/types | 96.8% |
|
||||||
|
| x/bearers/types | 100.0% |
|
||||||
|
| x/satellite/types | 100.0% |
|
||||||
|
|
||||||
|
All packages exceed the 80% target (D-033) — the floor is 95.9%.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 1. Per-Axis Verdicts
|
||||||
|
|
||||||
|
### Axis 1 — Correctness — **PASS** (confidence 0.90)
|
||||||
|
|
||||||
|
Verified every locked const, enum count, struct shape, and ValidateGenesis ID-uniqueness check against RESEARCH.md §1 + PLANS.md task specs:
|
||||||
|
|
||||||
|
| Component | Locked const / enum | Spec | Code | Verdict |
|
||||||
|
|---|---|---|---|---|
|
||||||
|
| Window | `WindowStatusCount` | 4 (Open/Active/Revoked/Expired) | `=4` ✓ | PASS |
|
||||||
|
| Stand | `StandTypeCount` | 9 (Household/Crew/Entity/Co-op/Circle/Trust/Foundation/Confederation/Shadow) | `=9` ✓ all 9 names match vision §11 | PASS |
|
||||||
|
| Guild | `HandPassFeeBps` | 0 | `=0` ✓ + FeeGrain==0 enforced in ValidateGenesis | PASS |
|
||||||
|
| Pact | `PactTypeCount` | 6 (Pause/Ground/Stance/Cover/StandRegistry/HubAPI) | `=6` ✓ | PASS |
|
||||||
|
| Pact | `MissionLockAmendable` | false | `=false` ✓ + per-type `AmendableCoreTermsPause/Ground/Stance=false` ✓ | PASS |
|
||||||
|
| Partner | `PartnerTierCount` | 4 (Op/MasterOp/Pier/Anchor) | `=4` ✓ | PASS |
|
||||||
|
| Council | `CouncilKindCount` | 3 (Mesh/Guild/Stand) | `=3` ✓ | PASS |
|
||||||
|
| Council | `MissionLockAmendable` | false | `=false` ✓ (highest-severity firewall) | PASS |
|
||||||
|
| Forex | `SpreadCapBps` | ≥0 (placeholder 0, A-214) | `=0` ✓ + test asserts ≥0 | PASS |
|
||||||
|
| Bond | `CouponCapBps` | 800 (8%) | `=800` ✓ | PASS |
|
||||||
|
| Bond | `CouponFloorBps` | 0 (0%) | `=0` ✓ | PASS |
|
||||||
|
| Satellite | `L2ChainCount` | 5 (Polygon active + 4 stubs) | `=5` ✓ Polygon only ChainActive | PASS |
|
||||||
|
| Satellite | `ChannelStatusCount` | 4 (Init/TryOpen/Open/Closed) | `=4` ✓ ICS-20 v1 shape | PASS |
|
||||||
|
|
||||||
|
**ValidateGenesis ID-uniqueness checks (A-212 upgrade from v0.1 no-op)** — all present and tested:
|
||||||
|
- window: dup window-ids ✓ + audit-log entry-id uniqueness + non-decreasing timestamps ✓
|
||||||
|
- stand: dup stand-ids ✓ + dup (stand-id, reach-id) membership pairs ✓
|
||||||
|
- guild: dup guild-ids ✓ + dup pass-ids ✓ + FeeGrain==0 covenant ✓
|
||||||
|
- pact: dup pact-ids ✓ + known-type check ✓ + Mission-Lock echo ✓
|
||||||
|
- partner: dup partner-ids ✓
|
||||||
|
- council: dup council-ids ✓ + dup voice-ids ✓ + referential integrity (voice→council) ✓ + Stand/Guild Council ref-required ✓
|
||||||
|
- forex: dup pair-ids ✓ + dup provider-ids ✓ + known-oracle-kind ✓
|
||||||
|
- bond: dup bond-ids ✓ + coupon clamp at genesis load ✓ + known-status ✓
|
||||||
|
- satellite: dup channel-ids ✓ + dup denoms ✓
|
||||||
|
- bearers: no-op (correct — spec said "DefaultParams/GenesisState unchanged"; extension is types-only)
|
||||||
|
|
||||||
|
**Correctness caveat (P1, not blocking):** the council module's *governance lifecycle shape* is simpler than the P3-01-01 deliverable recommended (see P1+ flags below). All must-haves are met; the drift is in the non-must-have Proposal/VoteOption lifecycle enums.
|
||||||
|
|
||||||
|
### Axis 2 — Security — **PASS** (confidence 0.92)
|
||||||
|
|
||||||
|
- **Lexicon firewall (G-002, REQ-012)**: zero banned terms in any `x/**/*.go` (verified by `TestLexiconMetaNoBannedTermsInX` + independent `grep` word-boundary scan, exit 1 = no matches). The firewall is NEW in v0.2 and green from P1. The `lexicon/lexicon.go` package bootstraps terms from two-character fragments so the firewall's own source contains no banned literals (standard lexicon-test bootstrapping pattern).
|
||||||
|
- **G-003 by-ID-string invariant**: `TestG003NoCrossModuleStructImportsInProduction` (x/window/types/types_test.go:437) scans every non-test `.go` under `x/` with `go/parser` and asserts no production file imports a foreign `x/<module>/types` package. Test passes. Independent grep confirms: the only cross-module `oy/openyield/x/...` imports in test files are self-imports (test pkg → its own types pkg) + the pre-existing v0.1 `x/bearers` test → `x/processing/types` (a test import, not production).
|
||||||
|
- **Mission Lock**: `MissionLockAmendable = false` as compile-time `const` in BOTH `x/pact/types` (line 24) and `x/council/types` (line 25). Per-type `AmendableCoreTermsPause/Ground/Stance = false` consts in pact. Tests assert the const is false AND that the typed comparison would fail to compile if the const changed type (defence in depth).
|
||||||
|
- **Bond Clamp invariants**: `Clamp(couponBps)` enforces `min(cap, max(floor, coupon))` at both construction (`Issue`) and genesis load (`ValidateBonds`). Tested for above-cap→cap, in-range→unchanged, below-floor boundary. The genesis path rejects out-of-bounds coupons rather than silently clamping (authoritative schema).
|
||||||
|
- **No secrets in code**: no credentials, API keys, or private material present (skeleton-only, zero external deps).
|
||||||
|
|
||||||
|
### Axis 3 — Maintainability — **PASS** (confidence 0.90)
|
||||||
|
|
||||||
|
- **v0.1 pattern consistency**: all 10 packages follow the v0.1 skeleton convention — `package types`, `ModuleName`/`StoreKey`/`RouterKey`/`QuerierRoute` consts, typed structs with `json`+`yaml` tags, `Params` struct, `DefaultParams()`, `GenesisState`, `DefaultGenesisState()`, `ValidateGenesis(json.RawMessage) error`. No drift from the v0.1 layout.
|
||||||
|
- **Table-driven tests**: present throughout (window rate-limit, bond clamp, lexicon self-test, lexicon false-positive, partner keeper round-trip, council genesis validation). Matches v0.1's 53-test baseline pattern (now 299 tests across 23 files — v0.1 baseline preserved + v0.2 additions).
|
||||||
|
- **Coverage ≥80%**: all 10 new/extended packages exceed 80% (floor 95.9%, 8 of 10 at 100%). D-033 satisfied.
|
||||||
|
- **No external deps added**: `git diff main..oy/milestone/v0.2-mesh -- go.mod` is EMPTY. G-006/A-201 zero-dep invariant intact. All v0.2 code compiles with stdlib only (`encoding/json`, `fmt`, `sync`, `regexp`, `strings`, `os`, `path/filepath`, `runtime`, `testing`, `go/parser`, `go/token`).
|
||||||
|
- **G-008 genesis schema vs test split**: `genesis.go` files (data-engineer schema) present in window, stand, bond, council, forex, pact, satellite. `*_test.go` files (security-engineer) own all test assertions including `genesis_test.go` (present in window, stand, bond). Helper composition is clean: `ValidateGenesis` in `types.go` delegates to `Validate*` helpers in `genesis.go`.
|
||||||
|
|
||||||
|
### Axis 4 — Adversarial — **CONDITIONAL** (confidence 0.78)
|
||||||
|
|
||||||
|
- **No double-counted REQs**: every v0.2 REQ (009, 011, 015, 016, 017, 018, 020, 021, Bearers, Forex) maps to exactly one module + test task. REQ-012 (lexicon) is cross-cutting (per-module + project-wide meta-test).
|
||||||
|
- **No missing must-haves**: all P1-P4 must-have checklists satisfied (verified per phase in §3 below).
|
||||||
|
- **Spec drift detected (P1, non-blocking)**: the council module's P3-01-01 deliverable recommended a full OZ Governor / `x/gov` proposal lifecycle (`Proposal` struct, `ProposalStatus` enum with 5 states, `VoteOption` enum with 3 options) plus a 5-source `VoiceSource` enum (Stash/Standing/Vouch/Freeholder/Guild). The implemented code has a simpler `Voice` + `TallyResult` shape, renamed `VoiceSource`→`SignalKind` with 4 sources (Stash/Standing/Vouch/Capital — dropped Freeholder and Guild, added Capital), and no Proposal/ProposalStatus/VoteOption enums. The P3 must-haves (3 councils, Mission Lock, TallyResult x/gov shape, no veto) are ALL met — the drift is in the non-must-have lifecycle enums. Flagged P1 for v0.3 (see §2).
|
||||||
|
- **No other drift**: all other modules match their task deliverables exactly (locked consts, struct fields, enum names, genesis invariants).
|
||||||
|
|
||||||
|
### Axis 5 — Grill Binding Decisions — **9 APPLIED + 1 N/A** (see §4)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 2. P0 Issues + Auto-Applied Fixes
|
||||||
|
|
||||||
|
**P0 count: 0.** No P0 issues found. No auto-applied fixes.
|
||||||
|
|
||||||
|
Rationale: all locked consts are correct, all ValidateGenesis ID-uniqueness checks are present, the lexicon firewall is green, G-003 import invariant is tested and green, Mission Lock and Bond Clamp invariants are const-enforced and tested, go.mod is unchanged, coverage exceeds 80% everywhere. The two spec-drift findings (council lifecycle enums) are P1 — they do not break any must-have, do not introduce a security hole, and do not affect the locked-const firewall. They are flagged for post-hoc review, not auto-fixed (auto-fixing would mean designing the Proposal/VoteOption lifecycle, which is a design decision the orchestrator should make in v0.3, not a P0 patch).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 3. P1+ Issues for Post-Hoc Review (flag, don't fix)
|
||||||
|
|
||||||
|
### P1-1: Council module — Proposal/VoteOption lifecycle enums absent
|
||||||
|
- **File:line**: `x/council/types/types.go:33-145` (entire council types file)
|
||||||
|
- **Spec (P3-01-01 deliverable)**: `Proposal` struct (id, council, proposer-reach, submit-time, voting-period, status); `ProposalStatus` enum (Pending, Active, Succeeded, Failed, Executed — mirror OZ/Governor + `x/gov`); `VoteOption` enum (Yes, No, Abstain — no "no-with-veto", anti-greed).
|
||||||
|
- **Implemented**: `Council`, `CouncilMember`, `Voice`, `SignalKind`, `TallyResult`. No `Proposal`, no `ProposalStatus`, no `VoteOption`. The `Voice` struct carries a `TallyResult` directly, collapsing the proposal→vote→tally lifecycle into a single Voice cast.
|
||||||
|
- **Must-have impact**: NONE. P3 must-haves were: 3 councils ✓, Mission Lock ✓, TallyResult mirrors x/gov ✓, VoteOption has no veto (N/A — no VoteOption enum at all). The must-haves do not require the Proposal/VoteOption enums; they were in the task deliverable description, not the must-have checklist.
|
||||||
|
- **Recommendation for v0.3**: when wiring the council keeper to a live governance runtime, add `Proposal` + `ProposalStatus` (Pending→Active→Succeeded→Failed→Executed) + `VoteOption` (Yes/No/Abstain) so the council can run an actual proposal lifecycle. The current `Voice`+`TallyResult` shape is sufficient for the skeleton's tally-structure goal but insufficient for live governance.
|
||||||
|
- **Severity**: P1 (spec drift from deliverable, not a must-have, not blocking).
|
||||||
|
|
||||||
|
### P1-2: Council VoiceSource→SignalKind (4 sources, not 5)
|
||||||
|
- **File:line**: `x/council/types/types.go:102-129` (`SignalKind` enum + `AllSignalKinds()`)
|
||||||
|
- **Spec (P3-01-01 deliverable)**: `VoiceSource` enum (Stash, Standing, Vouch, Freeholder, Guild) — 5 multi-source weighting inputs.
|
||||||
|
- **Implemented**: `SignalKind` enum (Stash, Standing, Vouch, Capital) — 4 sources. "Freeholder" and "Guild" dropped; "Capital" added.
|
||||||
|
- **Code rationale (types.go:104-114)**: the comment explains Capital as "committed-capital signal (vision §9.1 committed_capital)" and argues Freeholder is an eligibility property (upstream in `x/standing`), not a voice signal, and Guild is a council tier, not a voice source. This is a defensible design refinement — but it diverges from the P3-01-01 deliverable text.
|
||||||
|
- **Must-have impact**: NONE. P3 must-haves did not enumerate VoiceSource coverage; only "Mission Lock invariant" and "TallyResult x/gov shape" were must-haves.
|
||||||
|
- **Recommendation for post-hoc review**: confirm with the lead-developer/cosmos-engineer that the 4-source `SignalKind` (Stash/Standing/Vouch/Capital) is the intended v0.2 shape, or whether the 5-source `VoiceSource` (adding Freeholder + Guild) should be restored for v0.3 wiring. The `SignalKindCount=4` locked-const test (types_test.go:102) currently locks the 4-source shape; changing it in v0.3 is a deliberate locked-const update.
|
||||||
|
- **Severity**: P1 (design-choice divergence from deliverable, tested and self-consistent, not blocking).
|
||||||
|
|
||||||
|
### P2 (nit): Bearers ValidateGenesis remains a no-op
|
||||||
|
- **File:line**: `x/bearers/types/types.go:108` (`func ValidateGenesis(bz json.RawMessage) error { return nil }`)
|
||||||
|
- **Note**: this is CORRECT per spec — P4-02-01 said "DefaultParams/GenesisState unchanged" (bearers is an EXTENSION, not a new module; v0.1's bearers ValidateGenesis was a no-op and the extension adds types, not genesis state). The A-212 upgrade was scoped to NEW modules. Recording as a P2 nit for completeness, not a defect. No action needed.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 4. Grill Binding Decisions Verification (G-001..G-010)
|
||||||
|
|
||||||
|
| ID | Decision | Status | Evidence |
|
||||||
|
|---|---|---|---|
|
||||||
|
| **G-001** | Correct v0.1 baseline test count: 53 tests / 11 files (not 48) | **APPLIED** | PROJECT.md D-033 line 111: "53 tests across 11 test files (corrected per G-001; not 48)"; RESEARCH.md line 20: "53 tests across 11 test files (not 48)"; RESEARCH.md line 575: "53 tests, 11 files, zero deps". No "48" reference remains as a v0.1 baseline claim. |
|
||||||
|
| **G-002** | Lexicon assertion tests are NEW in v0.2 (v0.1 has zero); firewall is new work, not inherited | **APPLIED** | RESEARCH.md lines 16-20: "v0.1 is lexicon-clean in practice but has **zero** lexicon test files... The lexicon assertion tests are NEW in v0.2"; PROJECT.md D-032 line 110: "lexicon assertion tests are NEW in v0.2 — v0.1 is lexicon-clean in practice but has NO lexicon test firewall". Code: `lexicon/lexicon.go` + `lexicon_meta_test.go` are new in v0.2; zero lexicon test files exist on `main`. |
|
||||||
|
| **G-003** | By-ID-string inter-module refs (A-203) enforced as a TESTED invariant in P1-01-02 | **APPLIED** | `x/window/types/types_test.go:437` `TestG003NoCrossModuleStructImportsInProduction` scans every non-test `.go` under `x/` with `go/parser` (ImportsOnly) and asserts no production file imports a foreign `x/<module>/types` package. Test passes (verified: `go test -run TestG003... -v` → PASS). Independent grep confirms zero cross-module struct imports in production code. |
|
||||||
|
| **G-004** | Lexicon meta-test scaffolding moved from P5 to P1 Wave 3 (new task P1-04-02); P5-01-01 EXTENDS it | **APPLIED** | `lexicon_meta_test.go` exists at repo root with `TestLexiconMetaNoBannedTermsInX`, `TestLexiconMetaSelfTestTable`, `TestLexiconMetaBannedTermsCount`, `TestLexiconMetaNoFalsePositiveOnOpenYield`. Package doc (line 1-15) states "the durable firewall created in v0.2 P1 Wave 3; P5-01-01 EXTENDS it rather than recreating it." All 4 meta-tests pass. |
|
||||||
|
| **G-005** | One `x/pact` module with `PactType` enum + 6 per-type execute-entry structs (A-207), NOT six micro-modules | **APPLIED** | PROJECT.md D-027 line 105: "**one `x/pact` module** with a `PactType` enum... NOT six micro-modules". Code: single `x/pact/types/types.go` with `PactType` enum (6 values) + 6 `Execute*` methods on `*Pact` (`ExecutePause`, `ExecuteGround`, `ExecuteStance`, `ExecuteCover`, `ExecuteStandRegistry`, `ExecuteHubAPI`). No `x/pactpause`, `x/pactground`, etc. dirs exist. |
|
||||||
|
| **G-006** | `go.mod` is read-only in v0.2 (zero deps, A-201); any change is an escalation | **APPLIED** | `git diff main..oy/milestone/v0.2-mesh -- go.mod` is **EMPTY**. PERSONAS.md lines 9, 33, 65, 83, 114 all state "go.mod is read-only in v0.2 (G-006)". No persona may modify it. |
|
||||||
|
| **G-007** | `x/pact`/`x/partner`/`x/bond`=backend-engineer; `x/window`/`x/stand`/`x/guild`/`x/council`/`x/satellite`/`x/forex`/`x/bearers`=cosmos-engineer | **APPLIED** | PERSONAS.md line 65 (backend territory): "`x/pact/**`, `x/partner/**`, `x/bond/**`"; line 83 (cosmos territory): "`x/satellite/**`, `x/council/**`, `x/window/**`, `x/stand/**`, `x/guild/**`, `x/forex/**`, `x/bearers/**` (Cosmos-convention-mirroring modules per G-007; `x/pact`/`x/partner`/`x/bond` are backend-engineer's)". Lines 109-111 reiterate the split. No overlap remains. |
|
||||||
|
| **G-008** | Genesis schema (`genesis.go`)=data-engineer; genesis test assertions (`*_test.go` incl `genesis_test.go`)=security-engineer | **APPLIED** | PERSONAS.md line 14 (data-engineer): "Owns genesis SCHEMA only (G-008); test assertions are security-engineer's"; line 17: "does NOT own *_test.go files (G-008)"; line 41 (security-engineer): "owns ALL *_test.go files including genesis_test.go (G-008)"; line 71 (data-engineer territory): "`x/**/types/genesis.go`, `x/**/genesis.go` (excludes `*_test.go` per G-008)"; line 89 (security-engineer territory): "all test files per G-008". Code: `genesis.go` files present in 7 modules; `genesis_test.go` present in window/stand/bond; all `*_test.go` use `package types_test` (external test package, security-engineer convention). |
|
||||||
|
| **G-009** | Self-test table in lexicon meta-test (synthetic string per banned term) | **APPLIED** | `lexicon_meta_test.go:83` `TestLexiconMetaSelfTestTable` — builds a synthetic string per banned term (10 terms: bank, deposit, interest, yield, currency, dollar, euro, account, savings, depositor) and asserts each triggers detection. Test passes. Also `TestLexiconMetaBannedTermsCount` asserts exactly 10 terms configured. |
|
||||||
|
| **G-010** | P5-01-03 reconciles ROADMAP.md tag-line narrative (v0.0.x vs v0.1.x) | **N/A** (P5 task, out of P1-P4 review scope) | G-010 is explicitly a P5-01-03 task (ROADMAP tag-line reconciliation). P1-P4 execution phases do not touch ROADMAP.md. The PLANS.md P5-01-03 task description (line 249) still carries the G-010 obligation. Correctly deferred to P5. |
|
||||||
|
|
||||||
|
**Grill decisions applied: 9 APPLIED + 1 N/A (G-010 is P5, out of scope) = 9 of 9 applicable.**
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 5. Per-Phase Must-Have Audit
|
||||||
|
|
||||||
|
### P1 (Orgs + Window Foundation) — ALL MET ✓
|
||||||
|
- [x] `x/window`, `x/stand`, `x/guild` each have `types/types.go` + `types/types_test.go` (v0.1 pattern, package `types`, zero external deps).
|
||||||
|
- [x] `go build ./...` and `go test ./...` green across the whole repo.
|
||||||
|
- [x] ≥80% coverage on `x/window/types` (100%), `x/stand/types` (100%), `x/guild/types` (100%).
|
||||||
|
- [x] Window lifecycle tests: Open→Active→Revoked→Expired (`TestWindowLifecycleOpenActiveRevokedExpired`); revoke-after-expire no-op (`TestRevokeAfterExpireIsNoOp`); double-revoke idempotent (`TestDoubleRevokeIdempotent`).
|
||||||
|
- [x] Stand locked-const: exactly 9 types with vision §11 names (`TestStandTypeCountLockedConst`, `TestAllStandTypesNames`).
|
||||||
|
- [x] Guild `HandPassFeeBps == 0` invariant test (`TestHandPassFeeBpsLockedConst`).
|
||||||
|
- [x] Lexicon assertion in all 3 new test files.
|
||||||
|
- [x] `ValidateGenesis` performs ID-uniqueness checks (A-212).
|
||||||
|
- [x] G-003 import-invariant test (`TestG003NoCrossModuleStructImportsInProduction`).
|
||||||
|
- [x] Lexicon meta-test scaffolding in P1 Wave 3 (G-004) with self-test table (G-009).
|
||||||
|
- (Tag `v0.1.1` is a ship-time action, not a code must-have — tracked in P1-04-01.)
|
||||||
|
|
||||||
|
### P2 (Pacts + Partners) — ALL MET ✓
|
||||||
|
- [x] `x/pact`, `x/partner` each have `types/types.go` + `types/types_test.go`.
|
||||||
|
- [x] `go build ./...` and `go test ./...` green.
|
||||||
|
- [x] ≥80% coverage on `x/pact/types` (95.9%), `x/partner/types` (100%).
|
||||||
|
- [x] Pact locked-const: exactly 6 types (vision §16 names) (`TestPactTypeCountLockedConst`).
|
||||||
|
- [x] Partner locked-const: exactly 4 tiers (Op, MasterOp, Pier, Anchor) (`TestPartnerTierCountLockedConst`).
|
||||||
|
- [x] Mission-Lock invariant: Pause/Ground/Stance `AmendableCoreTerms == false` (`TestMissionLockAmendableConstFalse` + per-type flags).
|
||||||
|
- [x] Lexicon assertion in both new test files.
|
||||||
|
- [x] `ValidateGenesis` ID-uniqueness checks (pact: dup pact-id; partner: dup partner-id).
|
||||||
|
|
||||||
|
### P3 (Councils + Forex) — ALL MET ✓ (with P1 spec-drift flags on council lifecycle)
|
||||||
|
- [x] `x/council`, `x/forex` each have `types/types.go` + `types/types_test.go`.
|
||||||
|
- [x] `go build ./...` and `go test ./...` green.
|
||||||
|
- [x] ≥80% coverage on `x/council/types` (96.4%), `x/forex/types` (100%).
|
||||||
|
- [x] Council locked-const: exactly 3 kinds (Mesh, Guild, Stand) (`TestCouncilKindCountLockedConst`).
|
||||||
|
- [x] **Mission Lock invariant**: `MissionLockAmendable == false` + cannot-be-set-true test (`TestMissionLockAmendableConstFalse`, `TestMissionLockAmendableCannotBeSetTrue`).
|
||||||
|
- [x] `TallyResult` shape mirrors `x/gov` (yes/no/abstain/nowithveto/total/quorum_met) (`TestTallyResultStructShape`).
|
||||||
|
- [x] `VoteOption` has no "no-with-veto" — N/A (no VoteOption enum; `TallyResult.NoWithVeto` is always 0, `TestTallyResultNoWithVetoAlwaysZero`).
|
||||||
|
- [x] Forex pair labels lexicon-clean (base-asset/quote-asset, "Bread"/"Asset" sample) (`TestForexPairStructFields`); `RateOracle` interface compiles (`TestRateOracleInterfaceCompiles`).
|
||||||
|
- [x] Lexicon assertion in both new test files.
|
||||||
|
- [x] `ValidateGenesis` ID-uniqueness (council: dup council-id + dup voice-id) + referential integrity (voice→council) (`TestValidateGenesisRejectsVoiceWithUnknownCouncil`).
|
||||||
|
- [P1 flag] Council `Proposal`/`ProposalStatus`/`VoteOption` enums absent (see §3 P1-1).
|
||||||
|
- [P1 flag] Council `VoiceSource`→`SignalKind` (4 not 5) (see §3 P1-2).
|
||||||
|
|
||||||
|
### P4 (Bonds + Bearers + L2) — ALL MET ✓
|
||||||
|
- [x] `x/bond` (new), `x/bearers` (extended), `x/satellite` (new) each have `types/types.go` + `types/types_test.go`.
|
||||||
|
- [x] `go build ./...` and `go test ./...` green — including all v0.1 baseline tests (no regression across 25 packages).
|
||||||
|
- [x] ≥80% coverage on `x/bond/types` (96.8%), `x/bearers/types` (100%), `x/satellite/types` (100%).
|
||||||
|
- [x] Bond clamp invariant: `CouponCapBps == 800`, `CouponFloorBps == 0`; clamp below→floor, above→cap, in-range→unchanged (`TestClampBelowFloorReturnsFloor`, `TestClampAboveCapReturnsCap`, `TestClampInRangeUnchanged`, `TestClampMatchesFeeCovenantShape`).
|
||||||
|
- [x] Bond lexicon: "coupon" exclusively, no "interest"/"yield" (A-210) — verified by meta-test + per-module lexicon test.
|
||||||
|
- [x] Bearers: `BearerTransport` interface compiles (`TestBearerTransportInterfaceSignature`); `OYLRLink` + `BeaconFrame` stubs; existing `AllBearers()` (6) unchanged (`TestOYLRStillInAllBearers` — regression green).
|
||||||
|
- [x] Satellite: `L2Chain` exactly 5 (Polygon active + 4 stubs) (`TestL2ChainCountLockedConst`, `TestPolygonOnlyActiveRep`); `Packet` pinned to ICS-20 v1 shape; zero external deps.
|
||||||
|
- [x] Lexicon assertion in all 3 test files (bond, bearers, satellite).
|
||||||
|
- [x] `ValidateGenesis` ID-uniqueness (bond: dup bond-id; satellite: dup channel-id + dup denom) + genesis clamp (Bond: coupon within [floor, cap]).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 6. Overall Verdict
|
||||||
|
|
||||||
|
### **APPROVE WITH P1+ FLAGS**
|
||||||
|
|
||||||
|
The v0.2 (The Mesh) milestone P1-P4 execution work is **shippable**.
|
||||||
|
|
||||||
|
**Rationale:**
|
||||||
|
- All P1-P4 must-have checklists are met (verified per phase in §5).
|
||||||
|
- All 13 locked consts/enums are correct (Window 4, Stand 9, Guild 0, Pact 6, Partner 4, Council 3, MissionLock false in pact+council, Bond 800/0, Forex ≥0, Satellite 5+4).
|
||||||
|
- All ValidateGenesis ID-uniqueness checks present (A-212 upgrade applied to all 9 new modules; bearers extension correctly exempt).
|
||||||
|
- `go build ./...` and `go test ./...` green across all 25 packages (15 v0.1 + 10 v0.2) — no regression.
|
||||||
|
- Coverage ≥80% on all 10 new/extended packages (floor 95.9%, 8 of 10 at 100%).
|
||||||
|
- Lexicon firewall green (zero banned terms in any `x/**/*.go`); G-002 firewall is new and operational.
|
||||||
|
- G-003 by-ID-string invariant tested and green (zero cross-module struct imports in production).
|
||||||
|
- go.mod unchanged (G-006 verified — `git diff` empty).
|
||||||
|
- 9 of 9 applicable grill binding decisions applied (G-010 is P5, N/A for this scope).
|
||||||
|
- Mission Lock and Bond Clamp invariants are compile-time consts + tested firewalls.
|
||||||
|
|
||||||
|
**P1+ flags (2) for post-hoc review — do NOT block the milestone ship:**
|
||||||
|
1. Council `Proposal`/`ProposalStatus`/`VoteOption` lifecycle enums absent (P3-01-01 deliverable drift; must-haves met; recommend adding for v0.3 live governance wiring).
|
||||||
|
2. Council `VoiceSource`→`SignalKind` (4 sources Stash/Standing/Vouch/Capital, not 5 with Freeholder/Guild) (P3-01-01 deliverable drift; defensible design choice; locked-const test currently locks the 4-source shape; confirm intended for v0.3).
|
||||||
|
|
||||||
|
These are design-shape divergences in a single module's non-must-have lifecycle types. They do not affect the Mission Lock firewall, the locked consts, the lexicon firewall, the by-ID-string invariant, coverage, or any must-have. The orchestrator should review them post-ship and decide whether v0.3 restores the full Proposal/VoteOption lifecycle and the 5-source VoiceSource.
|
||||||
|
|
||||||
|
**P0 fixes auto-applied: 0**
|
||||||
|
**P1+ flags: 2** (both in x/council/types)
|
||||||
|
**P2 nits: 1** (bearers ValidateGenesis no-op — correct per spec, no action)
|
||||||
|
**Grill decisions applied: 9 APPLIED + 1 N/A (G-010 is P5) = 9 of 9 applicable**
|
||||||
|
|
||||||
|
**Confidence in overall verdict: 0.88**
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Summary Block
|
||||||
|
|
||||||
|
```
|
||||||
|
Per-axis verdicts:
|
||||||
|
1. Correctness — PASS (0.90) [all locked consts correct; council lifecycle drift is P1]
|
||||||
|
2. Security — PASS (0.92) [lexicon green; G-003 tested; Mission Lock + Bond Clamp const-enforced]
|
||||||
|
3. Maintainability — PASS (0.90) [v0.1 pattern; coverage ≥95.9%; go.mod unchanged; G-008 split clean]
|
||||||
|
4. Adversarial — CONDITIONAL (0.78) [council Proposal/VoteOption + VoiceSource→SignalKind drift; no must-have missing]
|
||||||
|
5. Grill Decisions — 9 APPLIED + 1 N/A (G-010 P5)
|
||||||
|
|
||||||
|
P0 fixes auto-applied: 0
|
||||||
|
P1+ flags: 2 (x/council/types — Proposal/VoteOption lifecycle absent; VoiceSource→SignalKind 4-not-5)
|
||||||
|
P2 nits: 1 (bearers ValidateGenesis no-op — correct per spec)
|
||||||
|
Overall: APPROVE WITH P1+ FLAGS (confidence 0.88) — milestone ship not blocked
|
||||||
|
```
|
||||||
+1
-165
@@ -23,18 +23,9 @@
|
|||||||
- [x] P5: Final Review + Ship → v0.1.5 (milestone release)
|
- [x] P5: Final Review + Ship → v0.1.5 (milestone release)
|
||||||
- Status: COMPLETE (skeleton + tests layer; released as v0.1.5)
|
- Status: COMPLETE (skeleton + tests layer; released as v0.1.5)
|
||||||
|
|
||||||
## Milestone v0.3 — Bearers & Documentation (COMPLETE; feature type; tags v0.2.x)
|
## Milestone v0.3 — Bearers & Documentation (ACTIVE; feature type; tags v0.2.x)
|
||||||
Target: Bearers skeleton (ROADMAP Phase 3 subset) + docs site for nomads and freeholders.
|
Target: Bearers skeleton (ROADMAP Phase 3 subset) + docs site for nomads and freeholders.
|
||||||
|
|
||||||
- [x] P0: Pre-Execution (spec/clarify/research/ideate/plan/grill) → v0.2.0
|
|
||||||
- [x] P1: Docs foundation + REQ-012 firewall extension → v0.2.1
|
|
||||||
- [x] P2: Nomads docs → v0.2.2
|
|
||||||
- [x] P3: Freeholders docs + reference → v0.2.3 (REQ-027 complete)
|
|
||||||
- [x] P4: Bearers skeleton I (x/exit, x/bridge, x/bearers, x/partner) → v0.2.4
|
|
||||||
- [x] P5: Bearers skeleton II (x/hub, x/services, x/bond) → v0.2.5
|
|
||||||
- [x] P6: Final Review + Audit + Ship → v0.2.6 (milestone release)
|
|
||||||
- Status: COMPLETE — Bearers skeleton (7 x/* packages) + docs site (26 pages) shipped
|
|
||||||
|
|
||||||
> v0.3 bundles two work-streams under one feature milestone: (A) Bearers
|
> v0.3 bundles two work-streams under one feature milestone: (A) Bearers
|
||||||
> skeleton+tests (D-020 pattern) and (B) README.md + MkDocs Material docs site
|
> skeleton+tests (D-020 pattern) and (B) README.md + MkDocs Material docs site
|
||||||
> organized by audience, with the REQ-012 lexicon firewall extended to docs.
|
> organized by audience, with the REQ-012 lexicon firewall extended to docs.
|
||||||
@@ -69,161 +60,6 @@ Target: Bearers skeleton (ROADMAP Phase 3 subset) + docs site for nomads and fre
|
|||||||
> (= the v0.3 milestone release, per D-008 — final phase patch IS the
|
> (= the v0.3 milestone release, per D-008 — final phase patch IS the
|
||||||
> milestone release; no separate minor tag).
|
> milestone release; no separate minor tag).
|
||||||
|
|
||||||
## Milestone v0.4 — Refinement (COMPLETE; NFR type; tags v0.3.x)
|
|
||||||
|
|
||||||
Target: Close the v0.3 post-hoc forward-references (lexicon firewall drift,
|
|
||||||
hub↔bond const drift, council lifecycle type divergence) + land the deferred
|
|
||||||
docs build CI. Refinement-only NFR milestone: zero `feat:` phases.
|
|
||||||
|
|
||||||
- [x] P0: Pre-Execution (spec/clarify/research/plan/grill/mvp-ux) → v0.3.0
|
|
||||||
- [x] P1: Lexicon + const hardening (REQ-029, REQ-030) → v0.3.1
|
|
||||||
- [x] P2: Lifecycle divergence docs + regression guard (REQ-031) → v0.3.2
|
|
||||||
- [x] P3: Docs build CI (REQ-032) → v0.3.3
|
|
||||||
- [x] P4: Final Review + Audit + Ship → v0.3.4 (milestone release)
|
|
||||||
- Status: COMPLETE — 4 NFR REQs shipped; NFR purity gate GREEN (zero feat: commits); go.mod unchanged
|
|
||||||
|
|
||||||
> v0.4 closes three real v0.3 forward-references (GRILL G-014 lexicon helper,
|
|
||||||
> REVIEW P2/A-304 cross-const test, AUDIT §193 council divergence docs) and
|
|
||||||
> lands the D-046 docs-CI forward-reference. Live-runtime promotions of the
|
|
||||||
> v0.3 Bearers skeletons are deferred to v0.5+ (feat:-class, rejected by the
|
|
||||||
> D-001 refinement-only filter).
|
|
||||||
|
|
||||||
| Phase | Type | Scope | Patch |
|
|
||||||
|---|---|---|---|
|
|
||||||
| P0 | docs | Pre-Execution (spec/clarify/research/plan/grill/mvp-ux) | v0.3.0 |
|
|
||||||
| P1 | refactor+test | Lexicon shared helper (REQ-029) + cross-const test (REQ-030) | v0.3.1 |
|
|
||||||
| P2 | docs+test | Council lifecycle divergence docs (REQ-031) + regression guard | v0.3.2 |
|
|
||||||
| P3 | chore+ci | Docs build CI workflow (REQ-032) | v0.3.3 |
|
|
||||||
| P4 | final | REVIEW + AUDIT + milestone SHIP | v0.3.4 (milestone release) |
|
|
||||||
|
|
||||||
### v0.4 Component mapping
|
|
||||||
|
|
||||||
| Component | Deliverable | v0.4 Change | Phase |
|
|
||||||
|---|---|---|---|
|
|
||||||
| Lexicon firewall | Shared `SyntheticBannedStrings()` helper | `lexicon/lexicon.go` + both meta-tests refactored | v0.4/P1 |
|
|
||||||
| Mission-locked const firewall | Cross-package const-equality test | `x/hub/types/cross_const_test.go` (NEW) | v0.4/P1 |
|
|
||||||
| Council Voice/Council interface | Lifecycle divergence documentation + regression guard | ARCHITECTURE.md section + `x/council/types/types_test.go` intent test | v0.4/P2 |
|
|
||||||
| Docs CI | Gitea Actions workflow (build + artifact) | `.gitea/workflows/docs-build.yml` (NEW) | v0.4/P3 |
|
|
||||||
|
|
||||||
> **Tag-line note (G-010 continuation)**: v0.4 (NFR) ships on the `v0.3.x`
|
|
||||||
> patch line (config.json `tag_base: v0.3.x`): P0 -> `v0.3.0`, P1..P3 ->
|
|
||||||
> `v0.3.1..v0.3.3`, P4 -> `v0.3.4` (= the v0.4 milestone release, per D-008 —
|
|
||||||
> final phase patch IS the milestone release; no separate minor tag).
|
|
||||||
|
|
||||||
## Milestone v0.5 — Bearers Runtime (COMPLETE; feature type; tags v0.4.x)
|
|
||||||
|
|
||||||
Target: Promote the v0.3 Bearers skeletons from type+keeper-stub layers to
|
|
||||||
live runtime behavior (keeper MsgServer handlers + simtest-grade end-to-end
|
|
||||||
flows). NOT mainnet (D-020 pattern continues to govern network deployment);
|
|
||||||
runtime = simtest-grade message handlers, not mainnet deployment.
|
|
||||||
|
|
||||||
- [x] P0: Pre-Execution (spec/clarify/research/plan/grill/mvp-ux) → v0.4.0
|
|
||||||
- [x] P1: Exit + Bridge runtime (REQ-033) → v0.4.1
|
|
||||||
- [x] P2: Bearers transport runtime (REQ-034) → v0.4.2
|
|
||||||
- [x] P3: Anchors onboarding runtime (REQ-035) → v0.4.3
|
|
||||||
- [x] P4: Hub API B2B runtime (REQ-036) → v0.4.4
|
|
||||||
- [x] P5: Services runtime (REQ-037) → v0.4.5
|
|
||||||
- [x] P6: Bond market runtime (REQ-038) → v0.4.6
|
|
||||||
- [x] P7: Council governance runtime (REQ-039) → v0.4.7
|
|
||||||
- [x] P8: Final Review + Audit + Ship → v0.4.8 (milestone release)
|
|
||||||
- Status: COMPLETE — 7 runtime REQs shipped; all 8 keeper packages ≥80% coverage (82.1%..92.5%); G-003 firewall intact; locked-const firewall intact; cosmos-sdk v0.50.8 + ibc-go v8.2.1 added (D-055/D-062, G-006 controlled exception); 5 GRILL decisions ratified (D-055/D-062/D-063/D-064/D-065); 8 binding fixes landed (G-017..G-024); 5 P1+ flagged for v0.6+ mainnet-readiness.
|
|
||||||
|
|
||||||
| Phase | Type | Scope | Patch |
|
|
||||||
|---|---|---|---|
|
|
||||||
| P0 | docs | Pre-Execution (spec/clarify/research/plan/grill/mvp-ux) | v0.4.0 |
|
|
||||||
| P1 | feat | Exit + Bridge runtime: x/exit DEX swap routing + x/bridge IBC packet handlers (5 L2 chains) | v0.4.1 |
|
|
||||||
| P2 | feat | Bearers transport runtime: OY-SAT + OY-QR message handlers + session lifecycle | v0.4.2 |
|
|
||||||
| P3 | feat | Anchors onboarding runtime: x/partner Anchor credential lifecycle | v0.4.3 |
|
|
||||||
| P4 | feat | Hub API B2B runtime: custody/lending/compliance + CustodyKeyring interface (D-058) | v0.4.4 |
|
|
||||||
| P5 | feat | Services runtime: Care/SIM/Vault/Mail service lifecycle handlers | v0.4.5 |
|
|
||||||
| P6 | feat | Bond market runtime: Growth Bonds + secondary-market CLOB matching (REJECT above 800bps D-063) | v0.4.6 |
|
|
||||||
| P7 | feat | Council governance runtime: Proposal/VoteOption enums (AUDIT §193 P1-1) + MissionLockAmendment reject (D-064) | v0.4.7 |
|
|
||||||
| P8 | final | REVIEW + AUDIT + milestone SHIP | v0.4.8 (milestone release) |
|
|
||||||
|
|
||||||
### v0.5 Component mapping
|
|
||||||
|
|
||||||
| Component | Deliverable | v0.5 Runtime Module | Phase |
|
|
||||||
|---|---|---|---|
|
|
||||||
| Exit layer (Layer 3) | DEX swap routing + cross-chain exit handlers | x/exit/keeper + x/exit/module.go | v0.5/P1 |
|
|
||||||
| Bridge (L2↔L1) | IBC packet handlers (5 L2 chains, Solana wormhole-adapter) | x/bridge/keeper + x/bridge/module.go + ibc_module.go | v0.5/P1 |
|
|
||||||
| Bearers expansion | OY-SAT + OY-QR message handlers + session lifecycle | x/bearers/keeper + x/bearers/module.go | v0.5/P2 |
|
|
||||||
| Anchors | Anchor credential issuance/revocation runtime | x/partner/keeper + x/partner/module.go | v0.5/P3 |
|
|
||||||
| Hub API | Custody/lending/compliance runtime + CustodyKeyring interface | x/hub/keeper + x/hub/module.go + keyring_mem.go | v0.5/P4 |
|
|
||||||
| Services | Care/SIM/Vault/Mail service lifecycle runtime | x/services/keeper + x/services/module.go | v0.5/P5 |
|
|
||||||
| Bond market | Growth Bonds + secondary-market CLOB matching engine | x/bond/keeper + x/bond/module.go + clob.go | v0.5/P6 |
|
|
||||||
| Council governance | Proposal/VoteOption enums + governance message handlers | x/council/keeper + x/council/module.go | v0.5/P7 |
|
|
||||||
|
|
||||||
> **Tag-line note (G-010 continuation)**: v0.5 (feature) ships on the `v0.4.x`
|
|
||||||
> patch line (config.json `tag_base: v0.4.x`): P0 -> `v0.4.0`, P1..P7 ->
|
|
||||||
> `v0.4.1..v0.4.7`, P8 -> `v0.4.8` (= the v0.5 milestone release, per D-008 —
|
|
||||||
> final phase patch IS the milestone release; no separate minor tag).
|
|
||||||
|
|
||||||
### v0.5 deferred to v0.6+ (P1+ from REVIEW.md)
|
|
||||||
- P1 security: no proposal deposit/bond (governance spam gap — mainnet-readiness)
|
|
||||||
- P1 adversarial: CLOB per-tx front-running exposure (batch auction is a v0.6+ design)
|
|
||||||
- P1 maintainability: simtest doesn't exercise real IBC light-client verification
|
|
||||||
- P2 performance: CLOB `restingBookForBond` O(n) load (prefix-key for mainnet)
|
|
||||||
- P2 maintainability: `emitMatchEventHook` package-level mutable var (minor testability)
|
|
||||||
- SignalKind 4→5 expansion (AUDIT §193 P1-2; deferred to v0.6+ governance vote)
|
|
||||||
- Live chain launch / mainnet / real IBC channels / real bearer transports (D-020 continues)
|
|
||||||
- Real institutional Anchors onboarding (credential lifecycle in simtest only)
|
|
||||||
- Yield Token, Travel + 11 service categories (ROADMAP Phase 4 — Maturity)
|
|
||||||
|
|
||||||
## Milestone v0.6 — Nomad Web UI (COMPLETE; feature type; tags v0.5.x)
|
|
||||||
|
|
||||||
Target: The project's first UI milestone. A working prototype Web UI where a
|
|
||||||
person can sign up to be a Nomad (create a Reach + open a Stash) and exercise
|
|
||||||
basic functionality around the (Reach, Stash) components, plus Window
|
|
||||||
authorization, Standing progress, and Bloom accrual views. All data is
|
|
||||||
generated as test fixtures — no real blockchain interaction (D-020 continues).
|
|
||||||
Greenfield Go `html/template` + HTMX layer served by a Go mock HTTP server
|
|
||||||
(`web/`) that instantiates the real `x/*/types` structs from in-memory
|
|
||||||
fixtures. No keeper, no Cosmos runtime, no `app.go` (none exists in the repo).
|
|
||||||
|
|
||||||
- [x] P0: Pre-Execution (spec/clarify/research/ideate/plan/grill/mvp-ux) → v0.5.0
|
|
||||||
- [x] P1: Web foundation + Reach signup + lexicon firewall extension (REQ-040, REQ-045) → v0.5.1
|
|
||||||
- [x] P2: Stash dashboard (REQ-041) → v0.5.2
|
|
||||||
- [x] P3: Window authorization (REQ-042) → v0.5.3
|
|
||||||
- [x] P4: Standing + Freeholder signals (REQ-043) → v0.5.4
|
|
||||||
- [x] P5: Bloom accrual view (REQ-044) → v0.5.5
|
|
||||||
- [x] P6: Final Review + Audit + Ship → v0.5.6 (milestone release)
|
|
||||||
|
|
||||||
| Phase | Type | Scope | Patch |
|
|
||||||
|---|---|---|---|
|
|
||||||
| P0 | docs | Pre-Execution (spec/clarify/research/ideate/plan/grill/mvp-ux) | v0.5.0 |
|
|
||||||
| P1 | feat+test | Web foundation + Reach signup (REQ-040) + lexicon firewall extension to web/ (REQ-045) | v0.5.1 |
|
|
||||||
| P2 | feat | Stash dashboard: balance + Bread-scale conversion + 90-day maturity progress (REQ-041) | v0.5.2 |
|
|
||||||
| P3 | feat | Window authorization: open/lifecycle/audit-log view (REQ-042) | v0.5.3 |
|
|
||||||
| P4 | feat | Standing + Freeholder signals progress: computed from mock Ratings/Vouches/Slashes (REQ-043) | v0.5.4 |
|
|
||||||
| P5 | feat | Bloom accrual view: per-Stash BloomRecord (REQ-044) | v0.5.5 |
|
|
||||||
| P6 | final | REVIEW + AUDIT + milestone SHIP | v0.5.6 (milestone release) |
|
|
||||||
|
|
||||||
### v0.6 Component mapping
|
|
||||||
|
|
||||||
| Component | Deliverable | v0.6 Module | Phase |
|
|
||||||
|---|---|---|---|
|
|
||||||
| Web UI foundation | Go HTTP mock server + base templates + HTMX vendored | web/main.go, web/handlers/, web/store/, web/templates/, web/static/ | v0.6/P1 |
|
|
||||||
| Reach signup | "Create a Reach" form + Reach list/detail | web/handlers/reach.go, web/templates/reach.html | v0.6/P1 |
|
|
||||||
| Stash dashboard | Balance + Bread-scale + 90-day maturity | web/handlers/stash.go, web/templates/stash.html | v0.6/P2 |
|
|
||||||
| Window authorization | Open/lifecycle/audit-log view | web/handlers/window.go, web/templates/window.html | v0.6/P3 |
|
|
||||||
| Standing + Freeholder signals | Progress view from mock Ratings/Vouches/Slashes | web/handlers/standing.go, web/templates/standing.html | v0.6/P4 |
|
|
||||||
| Bloom accrual | Per-Stash BloomRecord view | web/handlers/bloom.go, web/templates/bloom.html | v0.6/P5 |
|
|
||||||
| Lexicon firewall | Extend REQ-012 to web/ | lexicon_meta_web/lexicon_meta_web_test.go | v0.6/P1 |
|
|
||||||
|
|
||||||
> **Tag-line note (G-010 continuation)**: v0.6 (feature) ships on the `v0.5.x`
|
|
||||||
> patch line (config.json `tag_base: v0.5.x`): P0 -> `v0.5.0`, P1..P5 ->
|
|
||||||
> `v0.5.1..v0.5.5`, P6 -> `v0.5.6` (= the v0.6 milestone release, per D-008 —
|
|
||||||
> final phase patch IS the milestone release; no separate minor tag).
|
|
||||||
|
|
||||||
### v0.6 deferred to v0.7+
|
|
||||||
- Real blockchain interaction / mainnet / IBC / real bearer transports (D-020 continues)
|
|
||||||
- A real `oyd` daemon / `app.go` / `cmd/oyd` (no chain runtime exists; wiring the UI to a real daemon is v0.7+)
|
|
||||||
- Authentication / sessions / real key management (mock; a Reach is created by form submission, stored in-memory)
|
|
||||||
- Persistence (mock store is in-memory; resets on restart)
|
|
||||||
- i18n / multi-language UI
|
|
||||||
- The 5 P1+ mainnet-readiness items deferred from v0.5 (governance spam deposit, CLOB front-running, real IBC simtest, CLOB perf, emitMatchEventHook testability) — those are v0.7+ mainnet-readiness, not UI work
|
|
||||||
- Bread-scale doc-fix (`docs/shared/bread-scale.md` is outdated vs code constants — P1+ follow-up, not v0.6 scope)
|
|
||||||
|
|
||||||
## Phase 3 — The Bearers (Year 3) — v0.3 PARTIAL SKELETON
|
## Phase 3 — The Bearers (Year 3) — v0.3 PARTIAL SKELETON
|
||||||
**Target**: $10B annual volume → fee auto-declines to 0.07%
|
**Target**: $10B annual volume → fee auto-declines to 0.07%
|
||||||
|
|
||||||
|
|||||||
@@ -1,179 +0,0 @@
|
|||||||
# OpenYield Spec — spec-v3 (net new only)
|
|
||||||
Owner: <product owner>
|
|
||||||
Status: draft
|
|
||||||
Ingested as: oy-spec
|
|
||||||
|
|
||||||
> This spec contains ONLY net new requirements, constraints, and decisions for v0.7+ scope. Locked-vision baseline (REQ-001..REQ-021), shipped REQs (REQ-022..REQ-045 per `oy-state` §2), Principles [locked], Lexicon [locked], and pre-filled project invariants are NOT restated; they remain in force per vision v3.0 and prior spec revisions. This is the diff against spec-v2.
|
|
||||||
|
|
||||||
## 1. Objective
|
|
||||||
|
|
||||||
The v0.7 milestone delivers **Fraternal Groups Foundation** — Cover Pools, Chapter Federation, Mutual Aid Bonds, and the Anti-Capture Bill of Rights v0.2 — adapting the 1890–1930 fraternal benefit-society model for borderless digital service [3]. The v0.8+ roadmap layers in **Risk Mitigations + Infrastructure Economics** — Cluster A–E risk register closures, infrastructure underwriting primitives (Relay Fee Schedule, Coverage Standing Bonus, IYB with subordination, USZ classification), Watcher/Voucher compensation, and the Anchor no-Voice clause. Two PO rulings bind this revision: **no subsidies** (Root-Pool operating-expense subsidies and transfer-payment analogs are forbidden), and **Anchor no-Voice** (Anchors — including Sovereign Anchors — receive preferred contract terms only, never governance Voice).
|
|
||||||
|
|
||||||
## 2. Vision source
|
|
||||||
Vision v3.0 [1]; SPEC-001 `oy-fraternal-groups` v0.2 [3]. All locked commitments remain in force; **no vision amendments proposed**.
|
|
||||||
|
|
||||||
## 3. Principles [locked]
|
|
||||||
Locked per vision v3.0 §2. Not restated.
|
|
||||||
|
|
||||||
## 4. Requirements (net new)
|
|
||||||
|
|
||||||
> REQ-001..REQ-021 are locked-vision baseline (in force, not restated). REQ-022..REQ-045 are shipped per `oy-state` §2 (not restated). New REQs continue from REQ-046.
|
|
||||||
|
|
||||||
### v0.7 — Fraternal Groups Foundation (REQ-046..REQ-066)
|
|
||||||
|
|
||||||
#### Fraternal Group Primitives (REQ-046..REQ-056)
|
|
||||||
|
|
||||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
|
||||||
|----|-------|----------|---------|---------|---------------------|
|
|
||||||
| REQ-046 | Cover Pool Factory runtime | §16 | High | no | Factory rejects category launches below in-force reserve floor; supports Cover-Charter deployment; Watcher attestation pipeline operational; category staging per REQ-065 |
|
|
||||||
| REQ-047 | Cover Pool reserve target floor 1.5× annual contributions | §16 | High | yes | 1.5× minimum reserve codified in `x/pact/cover`; mission-lock semantic enforced; below-floor auto-pause of Cover-Fee routing |
|
|
||||||
| REQ-048 | Cover Pool reserve target ceiling 2.5× (governance-tunable within bounds) | §16 | High | no | Watcher escalation to 2.5× after 12 months operating history; Pool Council MAY vote within bounded range 1.5×–2.5× |
|
|
||||||
| REQ-049 | Cover Pool Standing gate minimums | §16, §9.3 | High | yes | Travel ≥ Trusted 4.0; Health-MCS ≥ Preferred 4.5; Pool Council MAY tighten but NEVER loosen below protocol minimum |
|
|
||||||
| REQ-050 | Cover-Fee tagging at protocol layer | §16 | High | yes | Cover-Fee Grains carry `category_tag`; settlement engine rejects category-mismatched Calls (FR-COVER-11); Pool-level fungibility preserved for net-reserve accounting |
|
|
||||||
| REQ-051 | Guild Charter + Common Bond requirement | §12 | Medium | yes | At formation: Common Bond declared + hash-pinned; Public Profile published (bond summary, disclaimers, Mason count or "private", Pier wrapper if any) |
|
|
||||||
| REQ-052 | Cover-Charter (Statement of Beliefs, dispute path, gate, holding period) | §16 | High | yes | Cover-Charter distinct from governance charter; signed by Cover Pool Host + witnessed by Watcher at deployment; amendments require Pool supermajority + 7-day cooling + Watcher + Counsel; protocol does NOT enforce SoB content (FR-CHTR-5) |
|
|
||||||
| REQ-053 | Chapter Federation (Parent/Chapter, secession terms, liens at founding) | §12 | High | no | Parent Guild + Chapters model; Chapters inherit + may tighten but not loosen; secession terms coded at founding; good-standing liens at founding (not freely increasable); Chapter retains mesh-level Voice (Pier does NOT carry Voice per FR-VOICE-6) |
|
|
||||||
| REQ-054 | Mutual Aid Bond (issuance ceiling 1×–3×, coupons in Cover Calls) | §17 | High | yes | Issuance ceiling mission-locked at 3× annual surplus; coupons payable in Cover Calls or mutual-aid credits (NEVER Bread); coupon rate bounded by `CouponCapBps=800`; use-of-proceeds locked to reserve build-out; default recapture per FR-MAB-7; Watcher attestation at deployment + quarterly audit |
|
|
||||||
| REQ-055 | Cover Claims Voucher role + bond + slashing | §9.4, §15 | High | no | Specialization of Voucher role; bond default 10× avg Call size per Pool; reviews each Call independently (no self-adjudication, FR-CPCV-2); slashing via §9.4 mechanism with cross-Pool applicability (NFR-SEC-8); bounded earnings |
|
|
||||||
| REQ-056 | Anti-Capture Bill of Rights v0.2 | §8.2 [3] | High | yes | 13 rights codified in code; cannot be amended or waived by any Charter; covers one-tap exit, no tax on personal Stash, audit-able Voice, cooling, Watcher inspection, Freeholder voucher, Counsel escalation, Anchored-Bread conversion, Wayfarer's Record, secession (founding terms), non-Cover-access, category-mismatch refusal |
|
|
||||||
|
|
||||||
#### Architect Recommendations Q1–Q10 (REQ-057..REQ-066)
|
|
||||||
|
|
||||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
|
||||||
|----|-------|----------|---------|---------|---------------------|
|
|
||||||
| REQ-057 | Household simplified — no formal Council, one-tap exit | §11 | Low | no | Household Stand may operate without formal Council; one-tap exit is the dispute path |
|
|
||||||
| REQ-058 | Confederation Voice — one-Stand-one-Vote, internal bundle | §11 | Medium | yes | Confederation aggregates member Stand Voice one-per-Stand; member Stands may bundle delegated Voice internally via §19 delegation |
|
|
||||||
| REQ-059 | Stand→Pier-customer boundary — escalation rule (TBD-X volume threshold) | §11, §13 | Medium | no | When annual volume > TBD-X, Stand is invited to Hub API; soft upgrade, not a ban. **TBD-X = PO ruling needed (§8)** |
|
|
||||||
| REQ-060 | Shadow vouch partial credit — 50% weight in Freeholder signal | §9.1 | Medium | yes | Shadow vouch weight = 0.5× in Community Endorsement signal (vs 1.0× for non-Shadow vouch) |
|
|
||||||
| REQ-061 | Disclaimer cadence — per charter signing | §11 | Low | yes | Jurisdictional disclaimer surfaced at every charter signing; not session-bounded |
|
|
||||||
| REQ-062 | Pool governance hybrid (Host + 3 elected + Watcher observer) | §16 | High | yes | Cover Pool Council = Pool Host + 3 Masons elected by Pool-eligible Masons + Watcher observer seat; Cover Calls require majority with Watcher observer present |
|
|
||||||
| REQ-063 | MAB holder — surplus seniority only, no Voice at dissolution | §17 | Medium | yes | Mutual Aid Bond holders rank after Cover-Fee contributors but before Bread holders in Pool-surplus distributions (FR-MAB-4); NO Voice in Pool dissolution decisions (claimants, not Masons) |
|
|
||||||
| REQ-064 | Secession cooling — 21d Cover-active / 14d non-Cover | §4.6 [3] | Medium | yes | Chapter secession cooling: 21 Mesh-days if Cover-active, 14 Mesh-days if non-Cover; secured at founding, not reducible; lien audit required; Cover Call / Bond covenant clearance required before secession completes |
|
|
||||||
| REQ-065 | Cover Pool category staging — Phase 2/3/4 | §16 | High | yes | Phase 2: Travel + Health-MCS + Income-Pause; Phase 3: Equipment/Loss + Life-Burial + Road-Side; Phase 4: Cyber-Skimming + Guild-Internal-Mutual-Aid; Factory respects staging and rejects out-of-phase launches |
|
|
||||||
| REQ-066 | Pier selection — Guild Council chooses, reversible, Pier Selection Index | §13 | Medium | no | Guild Council chooses Pier at formation; reversible by Cover Pool supermajority + Counsel witness; mesh maintains Pier Selection Index (jurisdictional reliability, fiduciary record, integration quality); SPEC-001 §8.3 Pier-Routed Legal Wrapper remains OPTIONAL with default-no-wrapper stance |
|
|
||||||
|
|
||||||
### v0.8+ — Risk Mitigations + Infrastructure Economics (REQ-067..REQ-097)
|
|
||||||
|
|
||||||
> All REQs in this section are LOCKED unless otherwise specified. Each maps to a Cluster A–E mitigation in the risk register.
|
|
||||||
|
|
||||||
#### Cluster A — Trust-minimization attacks (REQ-067..REQ-072)
|
|
||||||
|
|
||||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
|
||||||
|----|-------|----------|---------|---------|---------------------|
|
|
||||||
| REQ-067 | Smart contract audit cadence + bounty + Still/Stir | §20 | High | yes | ≥2 independent audits before each Phase transition (high/critical remediated pre-launch); severity-graded bounty (Cat >$1M, Crit >$100k); module-level Still/Stir with Watcher-witnessed halt; canary 5→25→100% on parameter changes; >72h time-lock on parameter changes unless emergency Mesh Council + Watcher witness |
|
|
||||||
| REQ-068 | Bridge pause semantics + multi-path + daily Watcher attestation | §7 | High | yes | `BridgeStatusCount=4` (Active→Paused→Frozen→Sunset); rate-limit per bridge per cycle; ≥2 independent paths for any mission-critical satellite; Watcher daily attestation of bridge balances (mismatch → auto-Still); Root-Pool-funded insurance pool |
|
|
||||||
| REQ-069 | Eye quorum ≥7 + diversity + TWAP | §16 | High | yes | ≥7 Eyes per asset class; median (not mean); geographic/organizational diversity (no single Eye jurisdiction >25% weight); TWAP minimum 1-hour window; outlier rejection at 2σ, alerts at 1σ; Eye reputation with slashing bond (Watcher model); mesh-level Still per asset class on variance breach |
|
|
||||||
| REQ-070 | Watcher 6-of-9 + 100k bond + daily cadence + fork-recovery | §7 | High | yes | All vision §7 + fork-recovery path: governance can fork from a captured Watcher set within Mission Lock bounds; rotation on instability metric (missed attestations, peer-deviation); slashing at 100,000 Bread bond per bad attestation |
|
|
||||||
| REQ-071 | Anchor concentration cap 20% + redemption gate + auto-Still | §6 | High | yes | Any single Anchored-Bread ≤20% of Root Basket (governance-tunable within bounds); 24–72h redemption gate when anchor deviates >2% from peg; quarterly stress tests Watcher-witnessed; auto-Still for the affected stream |
|
|
||||||
| REQ-072 | RWA venue multi-custodian + multi-jurisdiction minimum + Watcher attestation | §6 | High | yes | ≥3 independent custodians with segregated accounts; jurisdictional spread preferred (≥2 jurisdictions where commercially feasible) but NOT load-bearing; Watcher attestation per venue (reserves, NAV, audit reports); Watcher + Counsel sign-off substitution path within 30 days; insurance where commercially available |
|
|
||||||
|
|
||||||
#### Cluster B — Economic structural (REQ-073..REQ-076)
|
|
||||||
|
|
||||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
|
||||||
|----|-------|----------|---------|---------|---------------------|
|
|
||||||
| REQ-073 | Sovereign reserve — ≥2 independent entities | §6, §13 | High | yes | ≥2 independent reserve entities (different legal forms; jurisdiction selection driven by legal robustness + banking reliability + regulatory clarity — NOT by jurisdiction count); segregated accounts; quarterly third-party audits; ≥2 banking partners per currency; cash-equivalents only at entity level |
|
|
||||||
| REQ-074 | Root Basket liquidity tier 7-day 10%-redemption target | §6 | Medium | yes | Short-duration T-bills ~35% working (liquidity tier); 7-day, 10%-redemption stress test target <1% slippage; staged redemption gates above $X with 24h hold; facility lines at banking partners where feasible |
|
|
||||||
| REQ-075 | Mutual Aid Bond default recapture + seniority | §17 | High | yes | MAB coupons in Cover Calls (NEVER Bread, FR-MAB-3); seniority per FR-MAB-4 (Cover-Fee contributors > MAB > Bread holders); Watcher quarterly review + red-flag escalation on miss; default recapture per FR-MAB-7; mission-lock on bond covenant upper 8% lower 0% (REQ-021) |
|
|
||||||
| REQ-076 | Forex Engine multi-venue + Watcher daily attestation | §13 | Medium | yes | ≥3 counterparties per major currency corridor; annual counterparty due diligence; real-time exposure caps per counterparty; Watcher daily attestation on Forex reserve balances; governance substitution within composition bounds |
|
|
||||||
|
|
||||||
#### Cluster C — Capture & centralization (REQ-077..REQ-081)
|
|
||||||
|
|
||||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
|
||||||
|----|-------|----------|---------|---------|---------------------|
|
|
||||||
| REQ-077 | Governance capture — multi-source Voice + Mission Lock + supermajority + cooling | §19 | High | yes | Multi-source Voice per §19 (Bread 1/1000, Freeholder full Voice, one-Mason-one-Vote opt-in, Guild delegation); Mission Lock list enforced (six non-amendable items); supermajority ≥67% + 7-day cooling on any governance action affecting funds; Watcher right of inspection on governance logs; `MissionLockAmendmentRejected` ProposalKind reverts amendment vote at protocol layer (D-064) |
|
|
||||||
| REQ-078 | Processor FCFS + dynamic share (parity with Processors, extended to relay operators per REQ-092) | §15 | High | yes | FCFS (not fee-auctioned); geographic proximity wins; light client ~30MB / 1-3% battery/day; dynamic processor share auto-declining 50→30→20→10% as volume grows |
|
|
||||||
| REQ-079 | Partner/Pier capture — self-service default + Window revoke + pay-to-play | §13 | High | yes | Self-service default (Principle 6) — no Partner required for any product; Window one-tap revoke; pay-to-play model (Piers pay OY, not reverse); mesh-level Pier Selection Index; Cover-Charter amendments require Watcher witness + Counsel signature; Chapter retains mesh-level Voice regardless of Pier fiduciary role |
|
|
||||||
| REQ-080 | Pool governance capture — hybrid + Cover Claims Voucher + Chapter secession | §16 | High | yes | Hybrid Pool governance (REQ-062); Cover Calls require majority with Watcher observer; Cover Claims Voucher independent adjudication (REQ-055); Chapter secession right (founding terms, REQ-064); MAB holders have NO Voice (REQ-063) |
|
|
||||||
| REQ-081 | Secession abuse — lien-bounding + cooling + lien audit | §4.6 [3] | Medium | yes | Good-standing liens codified at founding, not freely increasable (FR-CHAP-7); cooling periods 21d Cover-active / 14d non-Cover (REQ-064); secession requires Chapter Head signature + Good-Standing Lien audit; Cover Call / Bond covenant clearance required before secession completes; Parent Guild Treasury receives pro-rata Cover-Fee settlement for in-flight Cover Calls |
|
|
||||||
|
|
||||||
#### Cluster D — Identity & reputation (REQ-082..REQ-086)
|
|
||||||
|
|
||||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
|
||||||
|----|-------|----------|---------|---------|---------------------|
|
|
||||||
| REQ-082 | Sybil on Standing — Bayesian prior + distinct counterparties + time decay | §9.2 | High | yes | Bayesian prior weight 10 (§9.2); minimum distinct counterparties 3/10/30; time-decayed Bayesian average penalizes burst-rating; Diversity Bonus × Voucher Weight resists amplification; Watcher attestation on Freeholder transition; 90-day Stash Maturity signal |
|
|
||||||
| REQ-083 | Window abuse — 5-property semantics + rate-limit enforcement | §10 | High | yes | Window enforces 5 properties (Scope, Duration, Rate-limit, Audit log, Revoke); one-tap revoke works mid-service; audit log exportable to Holder's Stash at any time; rate-limit enforcement is protocol-layer with Watcher-witnessed violations; Partner abuse triggers Window closure + Partner status review |
|
|
||||||
| REQ-084 | Vouching cascade — vouch slashes voucher + Watcher detection | §9.1, §9.4 | Medium | yes | Vouch requires skin-in-the-game — vouchee's Crack slashes voucher's Standing; Freeholder min-counterparties = 10 makes cascade hard to bootstrap; Watcher detection on rapid vouch sequences; Voucher Weight tapers with chain depth |
|
|
||||||
| REQ-085 | Norm chilling — Cover opt-in + dispute path + public profile | §4.9 [3] | Medium | yes | Cover opt-in (FR-NORM-4); non-participation MUST NOT deny other mesh products; norms enforced only through dispute path (FR-NORM-2), never unilateral Council; norm violations counted toward §9.4 slashing history (visible reputation consequence); Pool Public Profile must publish Statement if any (FR-CHTR-4 + FR-GLD-11); protocol never enforces SoB content |
|
|
||||||
| REQ-086 | Registry as identity — Shadow pseudonymity + schema minimalism | §11 | Medium | yes | Shadow Stand pseudonymous at protocol layer (FR-SHADOW-2 + §11); public/private visibility Holder-chosen (not Registry-mandated); Window reads explicit + rate-limited + logged + revocable (NFR-PRI-3); Watcher witness on private Stand registry access; Registry base schema excludes identity-grade fields (no names, no biometrics, no Pier credentials) |
|
|
||||||
|
|
||||||
#### Cluster E — Adoption & organic (REQ-087..REQ-091)
|
|
||||||
|
|
||||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
|
||||||
|----|-------|----------|---------|---------|---------------------|
|
|
||||||
| REQ-087 | Cycle defaults — Cover integration + hash-committed order | §16, §11 | Medium | yes | Cover Pool integration with default ranking (SPEC-001 §12.1); Cycle Host order hash-committed (FR-CIRCLE-1); Counsel-mediated dispute path (FR-CIRCLE-4); Circle pauses via Still on default; restarts after resolution |
|
|
||||||
| REQ-088 | Charter ambiguity — linter + Counsel review | §11 | Low | yes | Charter-template linter at Registry submission (covers common fields); Counsel review at chartering for any non-standard Charter; Counsel right to amend within 30-day ambiguity window without unanimous Mason approval |
|
|
||||||
| REQ-089 | Cross-chain drift — Watcher per-chain attestation + canonical routing | §7, §20 | Medium | yes | Watchers re-attest per chain (per REQ-068 daily cadence + `BridgeStatusCount=4`); cross-chain Mirror registry with rolling snapshots per cycle for Stand Registry reads; Stand Registry reads route to canonical source via Window; drift triggers Paused bridge-status |
|
|
||||||
| REQ-090 | Fee-Covenant override — Mission Lock + smart-contract enforcement + Council vote revert | §18, §19 | High | yes | Fee ceiling 0.1%, floor 0.01%, 1-Grain minimum non-amendable (Mission Lock); smart-contract enforcement with Watcher attestation; `MissionLockAmendmentRejected` ProposalKind reverts any Council vote to amend (D-064); structural ceiling on governance capture |
|
|
||||||
| REQ-091 | Adverse selection — Standing gate + holding period + Pool tightening | §16 | High | yes | Standing-gate minimums mission-locked (REQ-049: Trusted 4.0 Travel / Preferred 4.5 Health-MCS); 30-day default holding period (FR-COVER-9); Pool tightening permitted but not loosening below protocol minimum; Cover Claims Voucher independent review of high-risk claims; aggregate statistics public (NFR-PRI-4) to drive Pool-level gate tuning |
|
|
||||||
|
|
||||||
#### Infrastructure Economics (REQ-092..REQ-097)
|
|
||||||
|
|
||||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
|
||||||
|----|-------|----------|---------|---------|---------------------|
|
|
||||||
| REQ-092 | Relay Fee Schedule (parity with Processors, auto-declining) | §15 | High | yes | Per-packet relay fee for OY-LR / OY-BLE / OY-WiFi-Direct relay operators; paid in Bread from protocol-fee pool; auto-declining on same schedule as Processor share (50→30→20→10%); self-balancing supply (dense zones saturate, sparse zones attract premium) |
|
|
||||||
| REQ-093 | Coverage Standing Bonus (supplement Committed Capital, not replace) | §9.1 | Medium | yes | Sustained infrastructure provision (90-day rolling relay uptime, Watcher attestation) counts as a Standing signal; supplements (does NOT replace) Committed Capital (which remains 1+ active Pact OR 60+ day Guild per §9.1); same anti-gaming rules apply |
|
|
||||||
| REQ-094 | Infrastructure Yield Bond (with structural subordination) | §17 | Medium | yes | IYB coupon from Root-Pool infrastructure budget; bounded by `CouponCapBps=800`; use-of-proceeds locked to infrastructure build-out; standard IYB for high-density (commercial trade routes, dense corridors); subordinated IYB for transitional USZs (Anchor takes first loss, local fee revenue takes upside); Watcher attestation at deployment + every quarterly audit |
|
|
||||||
| REQ-095 | Universal Service Zone classification (no subsidies) | §13 | Medium | yes | USZ designation via Mesh Council vote within bounds; ≥3 criteria (density, strategic value, mission-aligned override); opt-in (zones choose to be USZs); **NO SUBSIDIES** — infrastructure capital sourced EXCLUSIVELY from (a) Anchor pre-commitment, (b) Sovereign Anchor partnerships, (c) subordinated IYB; market decides whether USZ infrastructure is built; **TBD-Z density formula = PO ruling needed (§8)** |
|
|
||||||
| REQ-096 | Watcher/Voucher operating-expense compensation (capped) | §7, §19 | Medium | yes | Watcher + Voucher compensation paid from Root-Pool operating budget; capped annually by Mesh Council vote within bounds; NOT from Bond Market fees (avoids fee-maximization race); audited quarterly by Watchers; Counsel = civic contribution, no operating-expense compensation |
|
|
||||||
| REQ-097 | Anchor no-Voice clause (Anchor = preferred terms, zero Voice) | §13, §19 | High | yes | Anchors (commercial per §13) — and Sovereign Anchors — receive preferred contract terms only; ZERO Voice in any Council; no Voice transfer to underlying governments or institutions; Pier Selection Index surfaces Anchor reputation; no "no masters" violation, no matter the Anchor's institutional weight |
|
|
||||||
|
|
||||||
## 5. Constraints (net new)
|
|
||||||
|
|
||||||
> Pre-filled project invariants (14 components, lexicon firewall, Mission Lock non-amendable, etc.) remain in force per spec-v2 and prior revisions; not restated.
|
|
||||||
|
|
||||||
Net new for spec-v3:
|
|
||||||
|
|
||||||
- **No subsidies.** Root-Pool operating-expense subsidies, transfer-payment analogs, and welfare-state derivatives are **FORBIDDEN**. Capital for infrastructure is sourced exclusively from Anchor pre-commitment underwriting, Sovereign Anchor partnerships, and subordinated Infrastructure Yield Bond structures. *(oy-spec-v3, PO ruling 2026-08-18)*
|
|
||||||
- **Anchor no-Voice.** Anchors (per §13) — including Sovereign Anchors — receive preferred contract terms only. **ZERO Voice in any Council.** No Voice transfer to underlying governments or institutions. *(oy-spec-v3, PO ruling 2026-08-18)*
|
|
||||||
- **Sovereign Anchors require separate SPEC.** The Sovereign Anchor framework is too infrastructure-scale to fold into oy-spec. Forthcoming SPEC: `oy-sovereign-anchors`. Until that SPEC ships, USZ infrastructure financing via Sovereign Anchor partnerships is **experimental, not load-bearing**. *(oy-spec-v3, PO ruling 2026-08-18)*
|
|
||||||
- **Pier-Routed Legal Wrapper is OPTIONAL.** Default stance: no wrapper required. SPEC-001 §8.3 menu is value-add for Chapters/Guilds that want a legal seat, not a requirement. *(oy-spec-v3, per session refactor)*
|
|
||||||
|
|
||||||
## 6. Lexicon [locked]
|
|
||||||
Locked per vision v3.0 §3. Not restated.
|
|
||||||
|
|
||||||
## 7. Milestone intent
|
|
||||||
|
|
||||||
- **Current shipped:** v0.6 (Nomad Web UI) — v0.5.6 — COMPLETE [2]
|
|
||||||
- **Next: v0.7 — Fraternal Groups Foundation.** Ships REQ-046..REQ-056 (Cover Pool Factory + Cover-Charter + Chapter Federation + Mutual Aid Bond + Cover Claims Voucher + Anti-Capture Bill v0.2) + REQ-057..REQ-066 (architect recommendations Q1–Q10).
|
|
||||||
- *Acceptance:* ≥1 Cover Pool live on testnet with reserve enforcement + Standing gate + category tagging; ≥1 Parent Guild with Chapter in secession-eligible formation with good-standing liens declared at founding; ≥1 Mutual Aid Bond issuance with Cover-Call coupon settlement + use-of-proceeds lock to reserve build-out; Anti-Capture Bill v0.2 reviewed by bonded Counsel; pen-test ≥1 independent third party; high/critical findings remediated.
|
|
||||||
- **v0.8 — Risk Mitigations + Infrastructure Economics.** Ships REQ-067..REQ-097 (Cluster A–E mitigations + Relay Fee Schedule + Coverage Standing Bonus + IYB + USZ classification + Watcher/Voucher compensation + Anchor no-Voice).
|
|
||||||
- *Acceptance:* all listed REQs in §4 v0.8+ implemented with regression tests; `oy-state` §3 const firewall extended with `EyeQuorumMin=7`, `AnchorConcentrationCapBps=2000`, `MABCouponMaxAnnualSurplusMultiple=3`, `BondIssuerSurplusCeilings={1×, 2×, 3×}`, `CoolingSecessionCoverActive=21 days`, `CoolingSecessionNonCover=14 days`, `CoverReserveFloorAnnualContribX=1.5`.
|
|
||||||
- **Out-of-scope additions for v0.7:**
|
|
||||||
- Sovereign Anchor SPEC (forthcoming; experimental only this milestone per §5)
|
|
||||||
- USZ classification runtime (deferred to v0.8 — depends on Anchor pre-commitment framework)
|
|
||||||
- Pre-existing deferred items per `oy-state` §4 remain deferred (not restated here)
|
|
||||||
|
|
||||||
## 8. Open questions (net new)
|
|
||||||
|
|
||||||
> Pre-existing PO decisions tracked in `oy-state` §7 remain open unless addressed here.
|
|
||||||
|
|
||||||
1. **TBD-X volume threshold** for Stand→Pier-customer boundary escalation (REQ-059). PO recommendation: **$100k annual Pass volume**.
|
|
||||||
2. **TBD-Z density formula** for USZ classification (REQ-095). PO recommendation: **<10 Holders per km² AND strategic value ≥ mission score, OR sovereign request, OR mission-aligned override via Mesh Council supermajority**.
|
|
||||||
3. **Sovereign Anchor SPEC scope decision.** Separate SPEC (`oy-sovereign-anchors`) or fold into `oy-pier`? PO recommendation: **separate SPEC** — Sovereign Anchors are infrastructure-scale, not legal-wrapper-scale; v0.7 status is *experimental, not load-bearing* per §5.
|
|
||||||
4. **Risk mitigation sequencing.** Which of REQ-067..REQ-091 ship in v0.7 vs deferred to v0.8? PO recommendation: **Cluster A + B + C ship in v0.7 (immediate existential + economic + capture risks); Cluster D + E + REQ-092..REQ-097 ship in v0.8 (immune-system + adoption + infrastructure economics).**
|
|
||||||
5. **Standing gate enforcement timing.** When does REQ-049 (Cover Pool Standing gate minimums) bind? At Cover Pool Factory runtime (v0.7) or at first live Cover Pool deployment (v0.7 acceptance)? PO recommendation: **Factory runtime — gates are protocol-layer.**
|
|
||||||
6. **Watcher/Voucher operating-expense cap.** Mesh Council vote within bounds; PO recommendation: **annual cap = 5% of Root-Pool Bloom, capped at $TBD-W absolute**.
|
|
||||||
7. **Anti-Crowding-Out Covenant enforcement code.** The covenant is in §1 / §2.3 of SPEC-001 [3]; does the ciagent codify it as a separate `x/cover` package firewall (parallel to lexicon_meta tests), or embed it in Cover Pool Factory validation? PO recommendation: **separate firewall** — parallel to lexicon meta-tests; rejects any code path that would route Cover-Fees outside contributor-pool semantics.
|
|
||||||
8. **MAB use-of-proceeds lock enforcement.** Per REQ-054, MAB proceeds are locked to reserve build-out. Does the ciagent codify this as tagged streaming with auto-Still on misuse detection, or as a Watcher-quorum-only release? PO recommendation: **tagged streaming + Watcher-witnessed release** (defense in depth).
|
|
||||||
|
|
||||||
The ciagent logs assumptions if these are unanswered at autonomy=full (decision_confidence_threshold 0.6, clarify_budget 10).
|
|
||||||
|
|
||||||
## 9. Changelog
|
|
||||||
|
|
||||||
| Spec-v | Date | Commit (docs(spec):) | What changed | REQs affected |
|
|
||||||
|--------|------|----------------------|--------------|---------------|
|
|
||||||
| v1 | (template date) | docs(spec): initial spec | Pre-filled REQ-001..REQ-021 locked-vision baseline; §1, §2, §5, §6 placeholders | REQ-001..REQ-021 |
|
|
||||||
| v2 | 2026-08-18 | docs(spec): v0.7 fraternal groups + risk mitigations + infrastructure economics, no subsidies, anchor no-voice | Comprehensive revision — added REQ-046..REQ-097 (52 new REQs); folded SPEC-001 v0.2 §4 functional requirements and §12.2 architect recommendations as protocol REQs; eliminated Root-Pool subsidy layer; added Anchor no-Voice clause and Sovereign Anchors as separate SPEC; Pier-Routed Legal Wrapper downgraded to OPTIONAL; three new constraints added to §5; §1 expanded with fraternal scope; §7 split into v0.7 + v0.8 plan; 8 open questions logged | REQ-046..REQ-097 (new); §1, §5, §7, §8 |
|
|
||||||
| **v3** | **2026-08-18** | **docs(spec): net new only — trim restated sections** | **Trim: removed restated REQ-001..REQ-021 baseline table (locked, in force), locked Principles restatement, locked Lexicon restatement, pre-filled project invariants from §5; §2 reduced to vision document reference only; §6 reduced to locked-pointer; §7 reduced to v0.7 + v0.8 milestone plan + new out-of-scope additions. Keep: REQ-046..REQ-097 unchanged; new §5 constraints unchanged; 8 new §8 questions unchanged.** | **No new REQs; net-new-only diff against spec-v2** |
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Rules (PO ↔ ciagent contract)
|
|
||||||
Locked per spec-v2 / template. Not restated.
|
|
||||||
|
|
||||||
## Commit convention
|
|
||||||
Locked per spec-v2 / template. Not restated.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
End of `oy-spec` v3 — net-new-only diff against spec-v2. Awaiting ciagent acknowledgment + P0 generation of new `oy-state` per regeneration rule in §7.
|
|
||||||
@@ -1,176 +0,0 @@
|
|||||||
<!--
|
|
||||||
OpenYield Spec Template
|
|
||||||
=======================
|
|
||||||
Copy this file to `.ciagent/oy/oy-spec` (no .md extension) when starting a
|
|
||||||
fresh milestone cycle. Then fill every `<!-- TODO -->` placeholder and commit
|
|
||||||
with a `docs(spec):` Conventional Commit (see the commit convention block at
|
|
||||||
the bottom of this file).
|
|
||||||
|
|
||||||
What is pre-filled (do NOT edit unless the locked baseline itself changes):
|
|
||||||
- §3 Principles [locked] (Six Principles)
|
|
||||||
- §5 Constraints (project invariants)
|
|
||||||
- §6 Lexicon [locked] (banned terms + replacements)
|
|
||||||
- §4 REQ-001..REQ-021 (locked-vision baseline rows — acceptance criteria
|
|
||||||
still need filling on first use)
|
|
||||||
- Rules + Commit convention blocks
|
|
||||||
|
|
||||||
What the PO must fill per milestone:
|
|
||||||
- §1 Objective
|
|
||||||
- §2 Vision source (locked sections list)
|
|
||||||
- §4 acceptance criteria for every REQ the milestone implements
|
|
||||||
- §4 new REQ-NNN rows for milestone-specific additions (continuing the ID
|
|
||||||
sequence from the last shipped REQ — check `oy-state` §2 for the current
|
|
||||||
max REQ-ID)
|
|
||||||
- §7 Milestone intent (current shipped, next target, out-of-scope)
|
|
||||||
- §8 Open questions for the ciagent
|
|
||||||
- §9 Changelog (one row per spec revision)
|
|
||||||
-->
|
|
||||||
|
|
||||||
# OpenYield Spec — spec-vN
|
|
||||||
Owner: <product owner>
|
|
||||||
Status: draft
|
|
||||||
Ingested as: oy-spec
|
|
||||||
|
|
||||||
> This is the **only** document the product owner (PO) sends to the ciagent for
|
|
||||||
> implementation. The ciagent consumes it to regenerate PROJECT.md,
|
|
||||||
> REQUIREMENTS.md, and ARCHITECTURE.md. Nothing else is read from upstream.
|
|
||||||
>
|
|
||||||
> In return the ciagent maintains **one** sibling file — `oy-state` — that tells
|
|
||||||
> the PO what exists, what's locked, what's deferred, and what drift exists
|
|
||||||
> between this spec and the shipped code. Read `oy-state` before editing
|
|
||||||
> `oy-spec`; it prevents re-proposing shipped or explicitly-deferred REQs.
|
|
||||||
>
|
|
||||||
> `oy-spec` and `oy-state` are the only two docs that cross the PO<->ciagent
|
|
||||||
> boundary. All other `.ciagent/oy/*.md` files are ciagent-internal working
|
|
||||||
> memory — do not edit them.
|
|
||||||
|
|
||||||
## 1. Objective
|
|
||||||
<!-- TODO: <=3 sentences — what the mesh is and who it serves -->
|
|
||||||
|
|
||||||
## 2. Vision source
|
|
||||||
- Document: Vision v3.0 (22 sections)
|
|
||||||
- Locked commitments (non-amendable sections):
|
|
||||||
<!-- TODO: list section numbers that are non-amendable -->
|
|
||||||
|
|
||||||
## 3. Principles [locked]
|
|
||||||
1. Real value
|
|
||||||
2. Sustainability
|
|
||||||
3. Mission-lock
|
|
||||||
4. Openness
|
|
||||||
5. Ownership
|
|
||||||
6. Self-service
|
|
||||||
<!-- Do not edit — the ciagent enforces these as REQ-001. -->
|
|
||||||
|
|
||||||
## 4. Requirements
|
|
||||||
<!-- Each row: ID | Title | Vision § | Priority | Locked? | Acceptance criteria
|
|
||||||
REQ-001..REQ-021 are the locked-vision baseline — fill their acceptance
|
|
||||||
criteria on first use, do not change their Locked? column without an
|
|
||||||
explicit §9 changelog override.
|
|
||||||
Add new milestone-specific REQs below REQ-021, continuing the ID sequence
|
|
||||||
from the last shipped REQ (check `oy-state` §2 for the current max). -->
|
|
||||||
| ID | Title | Vision § | Priority | Locked? | Acceptance criteria |
|
|
||||||
|----|-------|----------|---------|---------|---------------------|
|
|
||||||
| REQ-001 | Enforce Six Principles | §2 | High | yes | <!-- TODO: criteria --> |
|
|
||||||
| REQ-002 | Fee ceiling 0.1% / floor 0.01% / 1-Grain min | §18 | High | yes | <!-- TODO: criteria --> |
|
|
||||||
| REQ-003 | Bloom from real production only (Root Basket) | §6 | High | yes | <!-- TODO: criteria --> |
|
|
||||||
| REQ-004 | 9 Watchers, 6-of-9 quorum | §7 | High | yes | <!-- TODO: criteria --> |
|
|
||||||
| REQ-005 | Four Freeholder signals | §9.1 | High | yes | <!-- TODO: criteria --> |
|
|
||||||
| REQ-006 | Standing anti-gaming formula | §9.2 | High | yes | <!-- TODO: criteria --> |
|
|
||||||
| REQ-007 | FCFS processing | §15 | High | yes | <!-- TODO: criteria --> |
|
|
||||||
| REQ-008 | OY Chain (Layer 1) | §7 | High | yes | <!-- TODO: criteria --> |
|
|
||||||
| REQ-009 | Satellite chains (Layer 2) | §7 | Medium | no | <!-- TODO: criteria --> |
|
|
||||||
| REQ-010 | Exit layer (Layer 3) | §7 | Medium | no | <!-- TODO: criteria --> |
|
|
||||||
| REQ-011 | Three Councils with Mission Lock | §19 | High | yes | <!-- TODO: criteria --> |
|
|
||||||
| REQ-012 | Lexicon compliance | §3 | High | yes | <!-- TODO: criteria --> |
|
|
||||||
| REQ-013 | Bread unit with scale | §4 | High | yes | <!-- TODO: criteria --> |
|
|
||||||
| REQ-014 | Three pools of storage | §5 | High | yes | <!-- TODO: criteria --> |
|
|
||||||
| REQ-015 | Window primitive | §10 | High | no | <!-- TODO: criteria --> |
|
|
||||||
| REQ-016 | Nine Stand types | §11 | Medium | yes | <!-- TODO: criteria --> |
|
|
||||||
| REQ-017 | Guilds with free Hand-Passes | §12 | Medium | yes | <!-- TODO: criteria --> |
|
|
||||||
| REQ-018 | Four-tier Partner Spectrum | §13 | Medium | no | <!-- TODO: criteria --> |
|
|
||||||
| REQ-019 | Six bearers via Unified Bearer Layer | §14 | Medium | yes | <!-- TODO: criteria --> |
|
|
||||||
| REQ-020 | Six Pacts | §16 | Medium | no | <!-- TODO: criteria --> |
|
|
||||||
| REQ-021 | Mesh Bond Market with 8% cap | §17 | Medium | yes | <!-- TODO: criteria --> |
|
|
||||||
| <!-- TODO: REQ-022 --> | <!-- TODO: title --> | <!-- TODO: vision § --> | <!-- TODO: priority --> | <!-- TODO: locked? --> | <!-- TODO: criteria --> |
|
|
||||||
| <!-- TODO: REQ-023 --> | <!-- TODO: title --> | <!-- TODO: vision § --> | <!-- TODO: priority --> | <!-- TODO: locked? --> | <!-- TODO: criteria --> |
|
|
||||||
|
|
||||||
## 5. Constraints
|
|
||||||
- 14 modular components, 6 cross-component interfaces
|
|
||||||
- Mission Lock non-amendable
|
|
||||||
- Lexicon firewall: banned terms = bank, deposit, interest, yield, currency, dollar/euro, account, savings, depositor
|
|
||||||
- Skeleton-first until mainnet gate (D-020 pattern)
|
|
||||||
- Zero Go deps except GRILL-approved runtime exceptions
|
|
||||||
- Coverage >=80% on shipped packages
|
|
||||||
- Multi-project mode active; project slug = `oy`
|
|
||||||
|
|
||||||
## 6. Lexicon [locked]
|
|
||||||
- Banned: bank, deposit, interest, yield, currency, dollar, euro, account, savings, depositor
|
|
||||||
- Required replacements: account -> Reach, deposit -> receive-asset, interest -> coupon, yield -> bloom, currency -> asset
|
|
||||||
|
|
||||||
## 7. Milestone intent
|
|
||||||
- Current shipped: <!-- TODO: last shipped milestone tag, e.g. v0.6 (v0.5.6) — COMPLETE -->
|
|
||||||
- Next: <!-- TODO: next milestone target — one paragraph + the REQ-IDs it draws from -->
|
|
||||||
- Out-of-scope this milestone:
|
|
||||||
<!-- TODO: list — cross-reference `oy-state` §4 (deferred) to avoid re-proposing -->
|
|
||||||
|
|
||||||
## 8. Open questions for the ciagent
|
|
||||||
<!-- TODO: bulleted; the ciagent logs assumptions if unanswered at autonomy=full -->
|
|
||||||
|
|
||||||
## 9. Changelog
|
|
||||||
<!-- Every spec revision MUST be a `docs(spec):` commit (see commit convention
|
|
||||||
block below). One row per revision. -->
|
|
||||||
| Spec-v | Date | Commit (docs(spec):) | What changed | REQs affected |
|
|
||||||
|--------|------|----------------------|--------------|---------------|
|
|
||||||
| v1 | <!-- TODO: date --> | <!-- TODO: docs(spec): initial spec --> | <!-- TODO: summary --> | <!-- TODO: REQ-IDs --> |
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Rules (PO <-> ciagent contract)
|
|
||||||
|
|
||||||
- **One document each way.** No slides, sidecar notes, or direct edits to
|
|
||||||
generated docs. If you want to change product intent, edit `oy-spec`; if you
|
|
||||||
want to know what the ciagent did, read `oy-state`.
|
|
||||||
- **Every REQ the ciagent implements must appear in §4 with acceptance
|
|
||||||
criteria.** Vague criteria -> vague implementation.
|
|
||||||
- **Mark a REQ `[locked]`** only if a future spec revision must not change it
|
|
||||||
without an explicit override line in §9. Locked REQs map to const firewalls
|
|
||||||
the ciagent defends with regression tests (listed in `oy-state` §3).
|
|
||||||
- **The ciagent regenerates `oy-state` at every milestone ship AND at P0 of the
|
|
||||||
next milestone if `oy-spec` changed since the last `oy-state`.** `oy-state`
|
|
||||||
is authoritative for "what exists"; PROJECT.md is internal working memory.
|
|
||||||
- **Before proposing a new REQ in §4, grep `oy-state` §2 (coverage) and §4
|
|
||||||
(deferred).** Re-proposing an existing or explicitly-deferred REQ is a no-op
|
|
||||||
and will be flagged as drift in the next `oy-state` §5.
|
|
||||||
- **When §4 or §6 change,** the ciagent regenerates PROJECT/REQUIREMENTS and
|
|
||||||
flags drift. When §3/§5 only change, no regeneration is needed.
|
|
||||||
|
|
||||||
## Commit convention (mandatory for `oy-spec`)
|
|
||||||
|
|
||||||
- Every commit that modifies `oy-spec` MUST use a Conventional Commit message:
|
|
||||||
|
|
||||||
```
|
|
||||||
docs(spec): <imperative summary <=72 chars>
|
|
||||||
|
|
||||||
<optional body: what changed in §4/§6 and why; >=1 line per REQ affected>
|
|
||||||
```
|
|
||||||
|
|
||||||
- Examples:
|
|
||||||
```
|
|
||||||
docs(spec): add REQ-046 governance spam deposit (§4)
|
|
||||||
|
|
||||||
Opens REQ-046 per oy-state §4 deferred item "governance spam deposit".
|
|
||||||
Acceptance: proposal deposit >= 1 Loaf, slashable on spam.
|
|
||||||
```
|
|
||||||
```
|
|
||||||
docs(spec): lock REQ-002 fee ceiling — overrideable only via §9
|
|
||||||
|
|
||||||
REQ-002 fee covenant locked per vision §18; any future change requires an
|
|
||||||
explicit §9 changelog override line.
|
|
||||||
```
|
|
||||||
|
|
||||||
- The ciagent will **REJECT** any `oy-spec` commit whose subject does not match
|
|
||||||
`docs(spec): ...`. This makes spec changes grep-able and ties each
|
|
||||||
implementation milestone back to the spec revision that authorized it (via
|
|
||||||
the §9 Changelog row referenced in the commit body).
|
|
||||||
- **No squash merges, `fixup!`, or empty commits** for `oy-spec`. Every edit
|
|
||||||
is a real `docs(spec):` commit on the default branch.
|
|
||||||
@@ -1,245 +0,0 @@
|
|||||||
# OpenYield State — state-v2
|
|
||||||
Generated: 2026-08-19
|
|
||||||
Milestone: v0.7 (Fraternal Groups Foundation) — IN PROGRESS (P0 SPECIFY)
|
|
||||||
Tag: v0.6.x patch line (P0 → v0.6.0)
|
|
||||||
Ingested as: oy-state
|
|
||||||
|
|
||||||
> This is the **only** document the ciagent sends to the product owner (PO)
|
|
||||||
> to communicate current project state. The PO reads it before editing
|
|
||||||
> `oy-spec`. `oy-spec` and `oy-state` are the only two docs that cross the
|
|
||||||
> PO<->ciagent boundary; all other `.ciagent/oy/*.md` files are ciagent-internal
|
|
||||||
> working memory.
|
|
||||||
>
|
|
||||||
> Regeneration rule: the ciagent regenerates this file at every milestone ship
|
|
||||||
> AND at P0 of the next milestone if `oy-spec` changed since the last `oy-state`.
|
|
||||||
> `oy-state` is authoritative for "what exists"; PROJECT.md is internal working
|
|
||||||
> memory.
|
|
||||||
|
|
||||||
## 1. Current position
|
|
||||||
- Last shipped: v0.6 (Nomad Web UI) — COMPLETE — tag v0.5.6 (release_id 776)
|
|
||||||
- Next queued: v0.7 — Fraternal Groups Foundation (REQ-046..REQ-066, 21 REQs)
|
|
||||||
- Release forge: Gitea (git.cloudinit.dev/oy/openyield), release_id 776
|
|
||||||
- Autonomy: full (decision_confidence_threshold 0.6, clarify_budget 10)
|
|
||||||
- Open `oy-spec` §8 questions answered by ciagent: 8 (D-074..D-081 — all PO recommendations accepted as binding; see §7)
|
|
||||||
- v0.7 tag line: v0.6.x (previous minor's patch line per branch-strategy). P0 → v0.6.0; P1..P5 → v0.6.1..v0.6.5; P6 final → v0.6.6 (= v0.7 milestone release). No separate minor tag (D-008).
|
|
||||||
- v0.7 milestone type: feature (REQ-046..REQ-066 are feat-class primitives + a small number of test/docs adjuncts)
|
|
||||||
- v0.7 scope ruling (D-081): §7 is authoritative — v0.7 ships REQ-046..REQ-066 only; Cluster A–E + Infrastructure Economics (REQ-067..REQ-097) all defer to v0.8.
|
|
||||||
|
|
||||||
### Milestone history (compact)
|
|
||||||
| Milestone | Type | Tag | Status |
|
|
||||||
|-----------|------|-----|--------|
|
|
||||||
| v0.1 Foundation Init | feat | v0.0.9 | COMPLETE |
|
|
||||||
| v0.2 The Mesh | feat | v0.1.5 | COMPLETE |
|
|
||||||
| v0.3 Bearers & Docs | feat | v0.2.6 | COMPLETE |
|
|
||||||
| v0.4 Refinement | NFR | v0.3.4 | COMPLETE |
|
|
||||||
| v0.5 Bearers Runtime | feat | v0.4.8 | COMPLETE |
|
|
||||||
| v0.6 Nomad Web UI | feat | v0.5.6 | COMPLETE |
|
|
||||||
| v0.7 Fraternal Groups Foundation | feat | v0.6.x (in progress) | IN PROGRESS — P0 SPECIFY |
|
|
||||||
|
|
||||||
## 2. Requirement coverage
|
|
||||||
<!-- Mirror of oy-spec §4. Status: Not started | Skeleton | Runtime | Complete | Deferred | Rejected -->
|
|
||||||
|
|
||||||
### Shipped baseline (REQ-001..REQ-045) — per state-v1, unchanged this regeneration
|
|
||||||
| REQ | Title | Status | Shipped in | Module(s) | Locked? |
|
|
||||||
|-----|-------|--------|-----------|----------|---------|
|
|
||||||
| REQ-001 | Enforce Six Principles | Skeleton | v0.1 | x/* | yes |
|
|
||||||
| REQ-002 | Fee ceiling 0.1% / floor 0.01% / 1-Grain min | Complete | v0.1 | x/feecovenant | yes |
|
|
||||||
| REQ-003 | Bloom from real production only (Root Basket) | Complete | v0.2 | x/bread, x/bloom | yes |
|
|
||||||
| REQ-004 | 9 Watchers, 6-of-9 quorum | Complete | v0.1 | x/watcher | yes |
|
|
||||||
| REQ-005 | Four Freeholder signals | Complete | v0.2 | x/standing | yes |
|
|
||||||
| REQ-006 | Standing anti-gaming formula | Complete | v0.2 | x/standing | yes |
|
|
||||||
| REQ-007 | FCFS processing | Complete | v0.1 | x/bearers | yes |
|
|
||||||
| REQ-008 | OY Chain (Layer 1) | Skeleton | v0.1 | x/* (no app.go yet) | yes |
|
|
||||||
| REQ-009 | Satellite chains (Layer 2) | Skeleton | v0.2 | x/satellite | no |
|
|
||||||
| REQ-010 | Exit layer (Layer 3) | Runtime | v0.5 | x/exit, x/bridge | no |
|
|
||||||
| REQ-011 | Three Councils with Mission Lock | Runtime | v0.5 | x/council | yes |
|
|
||||||
| REQ-012 | Lexicon compliance | Complete | v0.1 (x/), v0.3 (docs/), v0.6 (web/) | lexicon_meta_test, lexicon_meta_docs, lexicon_meta_web | yes |
|
|
||||||
| REQ-013 | Bread unit with scale | Complete | v0.1 | x/bread | yes |
|
|
||||||
| REQ-014 | Three pools of storage | Complete | v0.1 | x/stash, x/vault, x/rootpool | yes |
|
|
||||||
| REQ-015 | Window primitive | Runtime | v0.2 (skeleton), v0.6 (UI) | x/window | no |
|
|
||||||
| REQ-016 | Nine Stand types | Skeleton | v0.2 | x/stand | yes |
|
|
||||||
| REQ-017 | Guilds with free Hand-Passes | Skeleton | v0.2 | x/guild | yes |
|
|
||||||
| REQ-018 | Four-tier Partner Spectrum | Runtime | v0.5 | x/partner | no |
|
|
||||||
| REQ-019 | Six bearers via Unified Bearer Layer | Runtime | v0.5 | x/bearers | yes |
|
|
||||||
| REQ-020 | Six Pacts | Skeleton | v0.2 | x/pact | no |
|
|
||||||
| REQ-021 | Mesh Bond Market with 8% cap | Runtime | v0.5 | x/bond | yes |
|
|
||||||
| REQ-022..REQ-045 | (shipped v0.3..v0.6 — see state-v1 §2 for full table) | Complete | v0.3..v0.6 | various | mixed |
|
|
||||||
|
|
||||||
### v0.7 — Fraternal Groups Foundation (REQ-046..REQ-066) — Not started
|
|
||||||
| REQ | Title | Vision § | Priority | Locked? | Status | Target phase |
|
|
||||||
|-----|-------|----------|---------|---------|--------|--------------|
|
|
||||||
| REQ-046 | Cover Pool Factory runtime | §16 | High | no | Not started | v0.7/P1 |
|
|
||||||
| REQ-047 | Cover Pool reserve target floor 1.5× annual contributions | §16 | High | yes | Not started | v0.7/P1 |
|
|
||||||
| REQ-048 | Cover Pool reserve target ceiling 2.5× (governance-tunable) | §16 | High | no | Not started | v0.7/P2 |
|
|
||||||
| REQ-049 | Cover Pool Standing gate minimums | §16, §9.3 | High | yes | Not started | v0.7/P1 |
|
|
||||||
| REQ-050 | Cover-Fee tagging at protocol layer | §16 | High | yes | Not started | v0.7/P1 |
|
|
||||||
| REQ-051 | Guild Charter + Common Bond requirement | §12 | Medium | yes | Not started | v0.7/P3 |
|
|
||||||
| REQ-052 | Cover-Charter (SoB, dispute path, gate, holding period) | §16 | High | yes | Not started | v0.7/P2 |
|
|
||||||
| REQ-053 | Chapter Federation (Parent/Chapter, secession terms, liens) | §12 | High | no | Not started | v0.7/P3 |
|
|
||||||
| REQ-054 | Mutual Aid Bond (issuance ceiling 1×–3×, coupons in Cover Calls) | §17 | High | yes | Not started | v0.7/P4 |
|
|
||||||
| REQ-055 | Cover Claims Voucher role + bond + slashing | §9.4, §15 | High | no | Not started | v0.7/P4 |
|
|
||||||
| REQ-056 | Anti-Capture Bill of Rights v0.2 | §8.2 [3] | High | yes | Not started | v0.7/P5 |
|
|
||||||
| REQ-057 | Household simplified — no formal Council, one-tap exit | §11 | Low | no | Not started | v0.7/P3 |
|
|
||||||
| REQ-058 | Confederation Voice — one-Stand-one-Vote, internal bundle | §11 | Medium | yes | Not started | v0.7/P3 |
|
|
||||||
| REQ-059 | Stand→Pier-customer boundary — escalation rule ($100k per D-074) | §11, §13 | Medium | no | Not started | v0.7/P5 |
|
|
||||||
| REQ-060 | Shadow vouch partial credit — 50% weight in Freeholder signal | §9.1 | Medium | yes | Not started | v0.7/P4 |
|
|
||||||
| REQ-061 | Disclaimer cadence — per charter signing | §11 | Low | yes | Not started | v0.7/P3 |
|
|
||||||
| REQ-062 | Pool governance hybrid (Host + 3 elected + Watcher observer) | §16 | High | yes | Not started | v0.7/P2 |
|
|
||||||
| REQ-063 | MAB holder — surplus seniority only, no Voice at dissolution | §17 | Medium | yes | Not started | v0.7/P4 |
|
|
||||||
| REQ-064 | Secession cooling — 21d Cover-active / 14d non-Cover | §4.6 [3] | Medium | yes | Not started | v0.7/P5 |
|
|
||||||
| REQ-065 | Cover Pool category staging — Phase 2/3/4 | §16 | High | yes | Not started | v0.7/P2 |
|
|
||||||
| REQ-066 | Pier selection — Guild Council chooses, reversible, Pier Selection Index | §13 | Medium | no | Not started | v0.7/P5 |
|
|
||||||
|
|
||||||
### v0.8+ — Risk Mitigations + Infrastructure Economics (REQ-067..REQ-097) — Deferred to v0.8
|
|
||||||
> All 31 REQs deferred to v0.8 per D-081 (§7 authoritative). Listed here for visibility; not started this milestone.
|
|
||||||
| REQ | Title | Status | Target milestone |
|
|
||||||
|-----|-------|--------|-----------------|
|
|
||||||
| REQ-067..REQ-072 | Cluster A — Trust-minimization attacks | Deferred | v0.8 |
|
|
||||||
| REQ-073..REQ-076 | Cluster B — Economic structural | Deferred | v0.8 |
|
|
||||||
| REQ-077..REQ-081 | Cluster C — Capture & centralization | Deferred | v0.8 |
|
|
||||||
| REQ-082..REQ-086 | Cluster D — Identity & reputation | Deferred | v0.8 |
|
|
||||||
| REQ-087..REQ-091 | Cluster E — Adoption & organic | Deferred | v0.8 |
|
|
||||||
| REQ-092..REQ-097 | Infrastructure Economics | Deferred | v0.8 |
|
|
||||||
|
|
||||||
## 3. Locked constants (const firewall)
|
|
||||||
<!-- Amending any row requires an explicit override line in oy-spec §9. -->
|
|
||||||
| Const | Value | Module | Why locked |
|
|
||||||
|-------|-------|--------|-----------|
|
|
||||||
| MissionLockAmendable | false | x/council | vision §19 — non-amendable |
|
|
||||||
| CouponCapBps | 800 (8%) | x/bond | vision §17, D-028 |
|
|
||||||
| CouponFloorBps | 0 (0%) | x/bond | vision §17, D-028 |
|
|
||||||
| LendingCouponCapBps | 800 | x/hub | D-028 mirror (REQ-030 cross-const test) |
|
|
||||||
| LendingCouponFloorBps | 0 | x/hub | D-028 mirror (REQ-030 cross-const test) |
|
|
||||||
| HandPassFeeBps | 0 | x/guild | vision §12, D-025 |
|
|
||||||
| FeeCeilingBps | 10 (0.1%) | x/feecovenant | vision §18, REQ-002 |
|
|
||||||
| FeeFloorBps | 1 (0.01%) | x/feecovenant | vision §18, REQ-002 |
|
|
||||||
| SignalKindCount | 4 | x/standing | AUDIT §193 P1-2 (defensible; expansion deferred to v0.7+ governance) |
|
|
||||||
| BearerTypeCount | 6 | x/bearers | vision §14, REQ-019 |
|
|
||||||
| BridgeStatusCount | 4 | x/bridge | D-036 |
|
|
||||||
| ExitStatusCount | 5 | x/exit | D-036 |
|
|
||||||
| PartnerTierCount | 4 | x/partner | vision §13, REQ-018 |
|
|
||||||
| StandTypeCount | 9 | x/stand | vision §11, REQ-016 |
|
|
||||||
| PactTypeCount | 6 | x/pact | vision §16, REQ-020 |
|
|
||||||
| CouncilKindCount | 3 | x/council | vision §19, REQ-011 |
|
|
||||||
| WatcherQuorum | 6-of-9 | x/watcher | vision §7, REQ-004 |
|
|
||||||
| WatcherVetoQuorum | 6 (param-tunable [2,9]) | x/council | D-065 |
|
|
||||||
| MaturityThresholdDays | 90 | x/stash | vision §9.1, REQ-005 |
|
|
||||||
| GrainsPerBread | 10000 | x/bread | vision §4, REQ-013 |
|
|
||||||
| TargetBloomRateBasisPoints | 450 (4.5%) | x/bloom | vision §6 |
|
|
||||||
| AnchorCredentialStatusCount | 4 | x/partner | v0.5 addition (additive) |
|
|
||||||
| OYSATLink.SurveillanceResistant | true | x/bearers | vision §14, locked |
|
|
||||||
| ServiceKindCount | 4 | x/services | D-040 |
|
|
||||||
| HubServiceCount | 3 | x/hub | D-039 |
|
|
||||||
|
|
||||||
### v0.7 planned const additions (GRILL-ratified D-086..D-090)
|
|
||||||
| Const | Value | Module | REQ | Why locked |
|
|
||||||
|-------|-------|--------|-----|-----------|
|
|
||||||
| CoverReserveFloorAnnualContribX | 1.5 | x/cover (NEW) | REQ-047 (locked) | vision §16 — 1.5× annual contributions floor, mission-locked |
|
|
||||||
| CoverReserveCeilingAnnualContribX | 2.5 | x/cover (NEW) | REQ-048 (not locked — governance-tunable within 1.5×–2.5×) | vision §16 — upper bound of bounded range |
|
|
||||||
| CoverStandingGateTrusted | 4.0 (Trusted bucket) | x/cover (NEW) | REQ-049 (locked) | vision §16, §9.3 — Travel gate minimum (Pool MAY tighten, NEVER loosen). D-090(3): enforced at BOTH launch handler AND Params-amendment ValidateBasic. |
|
|
||||||
| CoverStandingGatePreferred | 4.5 (Preferred bucket) | x/cover (NEW) | REQ-049 (locked) | vision §16, §9.3 — Health-MCS gate minimum. D-090(3): dual check. |
|
|
||||||
| MABIssuanceCeilingAnnualSurplusMultiple | 3 | x/bond (extended) | REQ-054 (locked) | vision §17 — 3× annual surplus mission-locked ceiling |
|
|
||||||
| MABCouponCapBps | 800 (reuse CouponCapBps) | x/bond | REQ-054 (locked) | coupon bounded by existing CouponCapBps (D-028) — no new const, cross-const test extends |
|
|
||||||
| CoolingSecessionCoverActiveDays | 21 | x/guild (extended) | REQ-064 (locked) | vision §4.6 — secession cooling, secured at founding, not reducible |
|
|
||||||
| CoolingSecessionNonCoverDays | 14 | x/guild (extended) | REQ-064 (locked) | vision §4.6 — secession cooling, secured at founding, not reducible |
|
|
||||||
| StandPierEscalationAnnualPassVolumeCents | 10000000 ($100k in Grain-cents) | x/stand (extended) | REQ-059 (not locked) | D-074 ruling — TBD-X = $100k annual Pass volume; simtest placeholder (no USD/Grain oracle) |
|
|
||||||
| CoverClaimsVoucherBondMultipleAvgCall | 10 | x/cover (NEW) | REQ-055 (not locked) | §9.4, §15 — bond default 10× avg Call size per Pool. D-090(2): bond = max(10× avg, MinimumVoucherBond) — cold-start fallback. |
|
|
||||||
| AntiCaptureBillOfRightsCount | 13 | x/cover (NEW) | REQ-056 (locked) | §8.2 — 13 rights codified, non-amendable, non-waivable. D-090(1): RightID type + 13 Waivable* consts + ValidateBasic gate land in P2 (NOT P5). |
|
|
||||||
| ShadowVouchWeightMultiplier | 0.5 | x/standing (extended) | REQ-060 (locked) | vision §9.1 — Shadow vouch 50% weight in Community Endorsement signal |
|
|
||||||
| PierCarriesVoice | false | x/guild (extended) | REQ-053 / FR-VOICE-6 (locked, D-087) | vision §12 — Pier does NOT carry Voice; mission-locked invariant (12th const per GRILL D-087) |
|
|
||||||
|
|
||||||
> Note: the v0.8 const firewall extensions named in oy-spec §7 v0.8 acceptance
|
|
||||||
> (`EyeQuorumMin=7`, `AnchorConcentrationCapBps=2000`,
|
|
||||||
> `MABCouponMaxAnnualSurplusMultiple=3`, `BondIssuerSurplusCeilings={1×,2×,3×}`,
|
|
||||||
> `CoolingSecessionCoverActive=21 days`, `CoolingSecessionNonCover=14 days`,
|
|
||||||
> `CoverReserveFloorAnnualContribX=1.5`) overlap with v0.7's REQ-047/049/054/
|
|
||||||
> 064 const additions. The v0.7 additions above land the v0.7-locked subset
|
|
||||||
> (REQ-047/049/054/064 locked=yes); the v0.8 acceptance list is the v0.8
|
|
||||||
> consolidated const firewall update that will add the remaining Cluster A–E
|
|
||||||
> consts (`EyeQuorumMin`, `AnchorConcentrationCapBps`, etc.). The cooling
|
|
||||||
> consts and CoverReserveFloor land in v0.7 because their REQs are v0.7;
|
|
||||||
> v0.8's acceptance row re-lists them as a consolidated checkpoint, not a
|
|
||||||
> re-introduction.
|
|
||||||
|
|
||||||
## 4. Deferred / out-of-scope (do NOT re-propose without §9 override)
|
|
||||||
| Item | Deferred from | Reason | Revisit at |
|
|
||||||
|------|--------------|--------|------------|
|
|
||||||
| Cover Pool seniority mechanics | v0.1 Q7 | unstated math | **UNBLOCKED v0.7** — REQ-046..REQ-050 now supply the seniority/gate math; promoting to runtime this milestone |
|
|
||||||
| SignalKind 4->5 enum expansion | v0.4 AUDIT §193 P1-2 | locked-const change; defensible at 4 | v0.8+ governance vote (not v0.7 scope) |
|
|
||||||
| Governance spam deposit/bond | v0.5 REVIEW P1 | mainnet-readiness | v0.8+ (Cluster C, REQ-077 adjacent) |
|
|
||||||
| CLOB per-tx front-running (batch auction) | v0.5 REVIEW P1 | mainnet-readiness | v0.8+ |
|
|
||||||
| Real IBC light-client simtest | v0.5 REVIEW P1 | mainnet-readiness | v0.8+ (Cluster A, REQ-068 adjacent) |
|
|
||||||
| CLOB `restingBookForBond` O(n) -> prefix-key | v0.5 REVIEW P2 | mainnet perf | v0.8+ |
|
|
||||||
| `emitMatchEventHook` testability | v0.5 REVIEW P2 | minor | v0.8+ |
|
|
||||||
| Live chain launch / mainnet / real IBC channels | v0.1 (D-020) | skeleton-first until mainnet gate | v0.8+ (Year 3 target) |
|
|
||||||
| Real `oyd` daemon / `app.go` / `cmd/oyd` | v0.6 OOS | no chain runtime exists | v0.8+ (v0.7 Cover Pool "live on testnet" = simtest-grade keeper runtime, not mainnet) |
|
|
||||||
| Real institutional Anchors onboarding | v0.5 OOS | credential lifecycle in simtest only | v0.8+ |
|
|
||||||
| Real bearer transports (hardware/RF) | v0.5 OOS | message handlers + simtest only | v0.8+ (Year 3) |
|
|
||||||
| Authentication / sessions / real key mgmt | v0.6 OOS | mock; Reach created by form submission | v0.8+ |
|
|
||||||
| Persistence (in-memory mock store) | v0.6 OOS | resets on restart | v0.8+ |
|
|
||||||
| i18n / multi-language UI | v0.3/v0.6 OOS | single-language | v0.8+ |
|
|
||||||
| Yield Token, Travel + 11 service categories | ROADMAP Phase 4 | Maturity (Years 4-5) | Year 4+ |
|
|
||||||
| Maya's Day integration spec | v0.1 Q1 | Mesh Experience component | Phase 2 |
|
|
||||||
| Standing anti-gaming sub-tables | v0.1 Q2 | formula locked; sub-tables deferred | v0.8+ |
|
|
||||||
| Pier credential routing (e-Residency, biometrics) | v0.1 Q5 | deferred | v0.8+ |
|
|
||||||
| Experimental bond forms | v0.1 Q6 | Phase 4+ only | Year 4+ |
|
|
||||||
| Processor share tier boundary exact volumes | v0.1 Q8 | deferred | v0.8+ |
|
|
||||||
| Docs bread-scale.md fix (outdated vs code consts) | v0.6 P1+ | doc-drift fix, not UI feature | next docs touch |
|
|
||||||
| **Sovereign Anchor SPEC** (`oy-sovereign-anchors`) | v0.7 §5 | infrastructure-scale, separate SPEC; experimental, not load-bearing | post-v0.7 (PO D-076) |
|
|
||||||
| **USZ classification runtime** | v0.7 §7 | depends on Anchor pre-commitment framework (v0.8 REQ-095) | v0.8 |
|
|
||||||
| **Cluster A–E + Infrastructure Economics (REQ-067..REQ-097)** | v0.7 §7 / D-081 | §7 authoritative — v0.7 ships REQ-046..066 only | v0.8 |
|
|
||||||
| **Pier-Routed Legal Wrapper** | v0.7 §5 | OPTIONAL per PO; default-no-wrapper; not implemented as code | never (optional value-add) |
|
|
||||||
| **Watcher/Voucher operating-expense compensation absolute cap ($TBD-W)** | v0.7 §8 Q6 | v0.8 REQ-096; annual 5% Bloom cap ruled (D-078), absolute cap deferred | v0.8 |
|
|
||||||
|
|
||||||
## 5. Drift flags (ciagent -> PO)
|
|
||||||
<!-- Differences between oy-spec (latest) and what the ciagent has shipped. -->
|
|
||||||
- Lexicon drift: **none**
|
|
||||||
- Locked-const drift: **none** (v0.7 const additions are net-new, not amendments)
|
|
||||||
- REQ-shape drift: **none** (oy-spec v3 net-new-only diff ingested; REQ-046..REQ-097 added to coverage §2; baseline REQ-001..REQ-045 unchanged)
|
|
||||||
- Architecture drift: **planned** — v0.7 introduces a NEW module `x/cover` (Cover Pool Factory + Anti-Crowding-Out firewall + Anti-Capture Bill of Rights). The existing `x/pact` `PactCover` enum value remains as a cross-reference (G-003 by-ID-string). This mirrors the D-039 precedent (`x/hub` split out of `x/pact`'s `PactHubAPI` in v0.3). Will be ratified at GRILL (P0).
|
|
||||||
- Spec-version drift: **none** — oy-spec v3 ingested at commit d10bf5e; this state-v2 reflects it.
|
|
||||||
|
|
||||||
## 6. Constraints honored (firewall status)
|
|
||||||
- **G-003** production import firewall: GREEN (by-ID-string rule at type level; expected_keepers.go shims for keeper cross-calls). v0.7 `x/cover` will follow the same pattern — no production struct imports across `x/<module>/types`.
|
|
||||||
- **G-006** go.mod zero-dep: CONTROLLED EXCEPTION — cosmos-sdk v0.50.8 + ibc-go v8.2.1 added in v0.5 (D-055 GRILL-approved, scoped to runtime phases; types/ packages stay dep-free). v0.7 `x/cover` keeper will use the same SDK runtime substrate; no new Go deps expected.
|
|
||||||
- **G-028** go.mod diff baseline (v0.6 vs v0.5.0): EMPTY. v0.7 target: EMPTY (no new Go deps; `x/cover` keeper uses existing SDK).
|
|
||||||
- **REQ-012** lexicon firewall: GREEN — 3 meta-tests (x/, docs/, web/) all passing. v0.7 will extend to a 4th meta-test if Cover surfaces add user-facing strings (pending RESEARCH); otherwise the existing 3 suffice.
|
|
||||||
- **Mission Lock** non-amendable: GREEN — `MissionLockAmendable=false` unchanged; `MissionLockAmendmentRejected` ProposalKind rejected at ValidateBasic (D-064). v0.7 Anti-Capture Bill (REQ-056) extends this: 13 rights non-amendable + non-waivable by any Charter.
|
|
||||||
- **Coverage** >=80% on shipped packages: GREEN (v0.5 keepers 82.1%-92.5%; v0.6 web/store 98.1%, web/handlers 89.2%, lexicon_meta_web 100%). v0.7 target: `x/cover` + extensions >=80%.
|
|
||||||
- **Feature purity gate** (v0.7): GREEN target — no breaking schema changes to locked-const firewall; G-003 intact; go.mod unchanged.
|
|
||||||
- **No subsidies** (v0.7 §5 NEW): GREEN by construction — v0.7 does not introduce any Root-Pool operating-expense subsidy or transfer-payment analog. The Anti-Crowding-Out firewall (D-079, REQ-047/050) rejects any code path routing Cover-Fees outside contributor-pool semantics. Infrastructure financing is out of v0.7 scope (v0.8 REQ-092..095).
|
|
||||||
- **Anchor no-Voice** (v0.7 §5 NEW): GREEN by construction — v0.7 does not grant Voice to any Anchor. The Cover Pool Council (REQ-062) = Pool Host + 3 elected Masons + Watcher observer; no Anchor seat. MAB holders (REQ-063) have NO Voice. Sovereign Anchors are out of v0.7 scope (experimental per §5).
|
|
||||||
|
|
||||||
## 7. Open PO decisions before next milestone
|
|
||||||
<!-- The PO should rule on these in oy-spec §8 or §7 before v0.7 P0. -->
|
|
||||||
|
|
||||||
### Resolved this regeneration (D-074..D-081 — PO recommendations accepted as binding at full autonomy)
|
|
||||||
| ID | §8 Q | Decision | Rationale | Confidence | Affects |
|
|
||||||
|----|------|----------|-----------|------------|--------|
|
|
||||||
| D-074 | Q1 (TBD-X) | **$100k annual Pass volume** for Stand→Pier-customer escalation | PO rec accepted; soft upgrade not ban | 0.85 | REQ-059 (v0.7/P5) |
|
|
||||||
| D-075 | Q2 (TBD-Z) | **<10 Holders/km² AND strategic value ≥ mission score, OR sovereign request, OR Mesh Council supermajority** | PO rec accepted; formula locked for v0.8 USZ | 0.80 | REQ-095 (v0.8) |
|
|
||||||
| D-076 | Q3 (Sovereign Anchor SPEC) | **Separate SPEC `oy-sovereign-anchors`**; experimental, not load-bearing v0.7 | PO rec accepted; infrastructure-scale ≠ legal-wrapper-scale | 0.85 | §5 constraint (v0.7) |
|
|
||||||
| D-077 | Q5 (Standing gate timing) | **Factory runtime** — gates are protocol-layer | PO rec accepted; gates bind at x/cover Factory, not first live Pool | 0.88 | REQ-049 (v0.7/P1) |
|
|
||||||
| D-078 | Q6 (Watcher/Voucher cap) | **Annual cap = 5% of Root-Pool Bloom**; absolute $TBD-W deferred to v0.8 | PO rec accepted; 5% Bloom ruled now, absolute cap later | 0.82 | REQ-096 (v0.8) |
|
|
||||||
| D-079 | Q7 (Anti-Crowding-Out firewall) | **Separate `x/cover/firewall` package + `lexicon_meta_cover`-style meta-test** (defense in depth) | PO rec "separate firewall" accepted; runtime subpackage rejects code paths + meta-test rejects doc drift | 0.84 | REQ-047/050 (v0.7/P1) |
|
|
||||||
| D-080 | Q8 (MAB use-of-proceeds) | **Tagged streaming + Watcher-witnessed release** (defense in depth) | PO rec accepted; tagged streaming auto-Stills on misuse, Watcher witnesses release | 0.85 | REQ-054 (v0.7/P4) |
|
|
||||||
| D-081 | Q4 (Risk mitigation sequencing) | **§7 authoritative** — v0.7 ships REQ-046..066 only; Cluster A+B+C are v0.8 | PO rec overridden by §7 acceptance text; §7 is the milestone contract | 0.90 | v0.7 scope (all REQ-046..066) |
|
|
||||||
|
|
||||||
### Remaining open (post-v0.7 — for v0.8 P0)
|
|
||||||
1. **$TBD-W absolute Watcher/Voucher cap** — deferred to v0.8 REQ-096 (D-078 partial ruling).
|
|
||||||
2. **Sovereign Anchor SPEC scope** — `oy-sovereign-anchors` to be authored by PO before v0.8 P0 (D-076).
|
|
||||||
3. **v0.8 Cluster A–E sequencing within v0.8** — which of REQ-067..REQ-097 ship in v0.8 P1..PN? PO should pick a subset or rule "all 31 in v0.8".
|
|
||||||
4. **Pen-test third party** — v0.7 §7 acceptance requires "pen-test ≥1 independent third party"; at full autonomy with no external third party available, the ciagent will run a self-administered adversarial review (ci-griller persona) and log this as an assumption unless the PO rules otherwise before P6.
|
|
||||||
5. **`oyd` daemon** — still no `app.go`/`cmd/oyd`; v0.7 Cover Pool "live on testnet" = simtest-grade keeper runtime. PO should decide whether v0.8 starts the daemon or continues simtest-only.
|
|
||||||
6. **SignalKind 4->5 expansion** — still deferred to v0.8+ governance vote (not v0.7 scope).
|
|
||||||
|
|
||||||
## 8. Build/test status
|
|
||||||
- `go build ./...`: GREEN (baseline confirmed 2026-08-19 on main @ d10bf5e)
|
|
||||||
- `go test ./...`: GREEN (all packages; v0.5 keepers + v0.6 web + lexicon meta-tests all passing)
|
|
||||||
- Coverage: all shipped keeper packages >=80%; web packages >=89%
|
|
||||||
- Lexicon meta-tests: 3/3 GREEN (x/, docs/, web/)
|
|
||||||
- Last green commit: d10bf5e (docs(spec): v3 net-new-only)
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
_`oy-state` is regenerated by the ciagent. Do not edit by hand._
|
|
||||||
@@ -1,55 +0,0 @@
|
|||||||
# OpenYield docs build CI (REQ-032, D-046 forward-reference, D-051, G-016).
|
|
||||||
#
|
|
||||||
# Runs the lexicon firewall (go test ./...) AND builds the MkDocs Material docs
|
|
||||||
# site on every push. The docs-build job DEPENDS on go-test (G-016 binding:
|
|
||||||
# firewall-gates-docs-build — a lexicon violation blocks the docs build so no
|
|
||||||
# false-green docs artifact is produced from a repo with a firewall failure).
|
|
||||||
#
|
|
||||||
# Scope (chore, not feat: per D-001 refinement-only filter):
|
|
||||||
# - go-test job: setup Go 1.22, run `go test ./...` (lexicon firewall + all
|
|
||||||
# x/* tests + the v0.4 cross-const test). Zero external Go deps (G-006).
|
|
||||||
# - docs-build job: setup Python, pip install mkdocs + mkdocs-material
|
|
||||||
# (build-only Python deps, ISOLATED to this job — go.mod is NOT modified),
|
|
||||||
# run `mkdocs build` (produces site/), upload site/ as a CI artifact.
|
|
||||||
#
|
|
||||||
# Out of scope (deferred per D-051): full Gitea Pages publishing. v0.4 ships
|
|
||||||
# build + artifact only; a hosting target is not configured.
|
|
||||||
#
|
|
||||||
# Triggers: on push (all branches) so the firewall + docs build are checked
|
|
||||||
# on every change, not just on main.
|
|
||||||
|
|
||||||
name: docs-build
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
go-test:
|
|
||||||
name: go test ./... (lexicon firewall + all x/* tests)
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v4
|
|
||||||
- uses: actions/setup-go@v5
|
|
||||||
with:
|
|
||||||
go-version: '1.22'
|
|
||||||
- name: go test ./...
|
|
||||||
run: go test ./...
|
|
||||||
|
|
||||||
docs-build:
|
|
||||||
name: mkdocs build (docs site artifact)
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
needs: go-test # G-016: firewall-gates-docs-build (no false-green docs build)
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v4
|
|
||||||
- uses: actions/setup-python@v5
|
|
||||||
with:
|
|
||||||
python-version: '3.11'
|
|
||||||
- name: install mkdocs + mkdocs-material
|
|
||||||
run: pip install mkdocs mkdocs-material
|
|
||||||
- name: mkdocs build
|
|
||||||
run: mkdocs build
|
|
||||||
- name: upload site/ artifact
|
|
||||||
uses: actions/upload-artifact@v4
|
|
||||||
with:
|
|
||||||
name: docs-site
|
|
||||||
path: site/
|
|
||||||
retention-days: 14
|
|
||||||
@@ -2,5 +2,3 @@
|
|||||||
.env.secrets
|
.env.secrets
|
||||||
.env.*
|
.env.*
|
||||||
.ciagent/.env.secrets
|
.ciagent/.env.secrets
|
||||||
# MkDocs build output (REQ-032 CI produces site/ as an artifact; never commit it)
|
|
||||||
site/
|
|
||||||
|
|||||||
@@ -25,14 +25,10 @@ Loaf → Batch → Cake → Bakery → Granary → Mill → Harvest → Earth.**
|
|||||||
|
|
||||||
## Status
|
## Status
|
||||||
|
|
||||||
**v0.6 (Nomad Web UI) — in progress.** v0.5 shipped the Bearers Runtime
|
**v0.3 (Bearers & Documentation) — in progress.** The codebase is a skeleton +
|
||||||
(simtest-grade keeper handlers for 8 x/ modules). v0.6 adds the project's
|
tests layer (Go types + keeper stubs + invariant tests, zero external Go deps)
|
||||||
first UI: a Go `html/template` + HTMX prototype Web UI in `web/` where a
|
matching the v0.1/v0.2 pre-MVP pattern. See `.ciagent/oy/ROADMAP.md` for the
|
||||||
visitor can sign up to be a Nomad (create a Reach + open a Stash) and
|
phase plan and `.ciagent/oy/PROJECT.md` for governance.
|
||||||
exercise basic functionality around Reach, Stash, Window, Standing, and
|
|
||||||
Bloom. All data is generated test fixtures — no real chain. See
|
|
||||||
`.ciagent/oy/ROADMAP.md` for the phase plan and `.ciagent/oy/PROJECT.md`
|
|
||||||
for governance.
|
|
||||||
|
|
||||||
## Build & test
|
## Build & test
|
||||||
|
|
||||||
@@ -44,29 +40,6 @@ go build ./...
|
|||||||
go test ./...
|
go test ./...
|
||||||
```
|
```
|
||||||
|
|
||||||
## Web UI
|
|
||||||
|
|
||||||
The Nomad Web UI (v0.6) is a Go `html/template` server with HTMX progressive
|
|
||||||
enhancement, served by a mock HTTP server in `web/` that instantiates the
|
|
||||||
real `x/*/types` structs from in-memory fixtures. No node, no build step,
|
|
||||||
no real chain. To run it:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
go run ./web
|
|
||||||
# opens on http://localhost:8080 (PORT env var overridable)
|
|
||||||
```
|
|
||||||
|
|
||||||
Five screens, all reachable from the home nav:
|
|
||||||
|
|
||||||
- `/reach` — create a Reach (sign up to be a Nomad) + Reach list/detail
|
|
||||||
- `/stash/{holderID}` — Stash dashboard (Grain balance + Bread scale + 90-day maturity)
|
|
||||||
- `/window` — Window authorization (open/lifecycle/audit log)
|
|
||||||
- `/standing/{reachID}` — Standing + Freeholder signals progress
|
|
||||||
- `/bloom/{stashID}` — Bloom accrual view
|
|
||||||
|
|
||||||
HTMX is a single vendored JS file (`web/static/htmx.min.js`), NOT a Go
|
|
||||||
dependency — `go.mod` stays unchanged (G-006).
|
|
||||||
|
|
||||||
## Docs
|
## Docs
|
||||||
|
|
||||||
The docs site is [MkDocs Material](https://squidfunk.github.io/mkdocs-material/)
|
The docs site is [MkDocs Material](https://squidfunk.github.io/mkdocs-material/)
|
||||||
@@ -85,19 +58,17 @@ deferred to v0.4 (D-046); v0.3 ships the source.
|
|||||||
## Lexicon firewall
|
## Lexicon firewall
|
||||||
|
|
||||||
OpenYield bans 10 financial terms as standalone words (REQ-012) across all Go
|
OpenYield bans 10 financial terms as standalone words (REQ-012) across all Go
|
||||||
source (`x/**/*.go`), all docs (`README.md` + `docs/**/*.md`), and all web UI
|
source (`x/**/*.go`) and all docs (`README.md` + `docs/**/*.md`). The banned
|
||||||
files (`web/**/*.{html,js,go}`). The banned terms are the words you would
|
terms are the words you would expect a legacy financial institution to use;
|
||||||
expect a legacy financial institution to use; this README and the docs describe
|
this README and the docs describe them only by their **safe replacements**, so
|
||||||
them only by their **safe replacements**, so the firewall itself never trips.
|
the firewall itself never trips. The firewall is enforced in code by two
|
||||||
The firewall is enforced in code by three sibling Go tests:
|
sibling Go tests:
|
||||||
|
|
||||||
- `lexicon_meta_test.go` (v0.2) — scans `x/**/*.go`.
|
- `lexicon_meta_test.go` (v0.2) — scans `x/**/*.go`.
|
||||||
- `lexicon_meta_docs/lexicon_meta_docs_test.go` (v0.3) — scans `README.md` +
|
- `lexicon_meta_docs/lexicon_meta_docs_test.go` (v0.3) — scans `README.md` +
|
||||||
`docs/**/*.md`.
|
`docs/**/*.md`.
|
||||||
- `lexicon_meta_web/lexicon_meta_web_test.go` (v0.6) — scans
|
|
||||||
`web/templates/**` + `web/static/**` + `web/**/*.go`.
|
|
||||||
|
|
||||||
All three use `lexicon.FindBannedTerm` (word-boundary, case-insensitive), so
|
Both use `lexicon.FindBannedTerm` (word-boundary, case-insensitive), so
|
||||||
"OpenYield" is safe (word-boundary does not match the banned term inside an
|
"OpenYield" is safe (word-boundary does not match the banned term inside an
|
||||||
identifier) but the standalone banned term is not — docs say **"real
|
identifier) but the standalone banned term is not — docs say **"real
|
||||||
production"** / **"real return"**, and a Holder's identity is **Holder** /
|
production"** / **"real return"**, and a Holder's identity is **Holder** /
|
||||||
|
|||||||
@@ -1,154 +1,3 @@
|
|||||||
module github.com/oy/openyield
|
module github.com/oy/openyield
|
||||||
|
|
||||||
go 1.22
|
go 1.22
|
||||||
|
|
||||||
require (
|
|
||||||
cosmossdk.io/store v1.1.0
|
|
||||||
github.com/cosmos/cosmos-sdk v0.50.8
|
|
||||||
github.com/cosmos/ibc-go/modules/capability v1.0.0
|
|
||||||
github.com/cosmos/ibc-go/v8 v8.2.1
|
|
||||||
)
|
|
||||||
|
|
||||||
require (
|
|
||||||
cosmossdk.io/api v0.7.5 // indirect
|
|
||||||
cosmossdk.io/collections v0.4.0 // indirect
|
|
||||||
cosmossdk.io/core v0.11.0 // indirect
|
|
||||||
cosmossdk.io/depinject v1.0.0-alpha.4 // indirect
|
|
||||||
cosmossdk.io/errors v1.0.1 // indirect
|
|
||||||
cosmossdk.io/log v1.3.1 // indirect
|
|
||||||
cosmossdk.io/math v1.3.0 // indirect
|
|
||||||
cosmossdk.io/x/tx v0.13.3 // indirect
|
|
||||||
cosmossdk.io/x/upgrade v0.1.0 // indirect
|
|
||||||
filippo.io/edwards25519 v1.0.0 // indirect
|
|
||||||
github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
|
|
||||||
github.com/99designs/keyring v1.2.1 // indirect
|
|
||||||
github.com/DataDog/datadog-go v3.2.0+incompatible // indirect
|
|
||||||
github.com/DataDog/zstd v1.5.5 // indirect
|
|
||||||
github.com/beorn7/perks v1.0.1 // indirect
|
|
||||||
github.com/bgentry/speakeasy v0.1.1-0.20220910012023-760eaf8b6816 // indirect
|
|
||||||
github.com/btcsuite/btcd/btcec/v2 v2.3.2 // indirect
|
|
||||||
github.com/cenkalti/backoff/v4 v4.1.3 // indirect
|
|
||||||
github.com/cespare/xxhash v1.1.0 // indirect
|
|
||||||
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
||||||
github.com/cockroachdb/errors v1.11.1 // indirect
|
|
||||||
github.com/cockroachdb/logtags v0.0.0-20230118201751-21c54148d20b // indirect
|
|
||||||
github.com/cockroachdb/pebble v1.1.0 // indirect
|
|
||||||
github.com/cockroachdb/redact v1.1.5 // indirect
|
|
||||||
github.com/cockroachdb/tokenbucket v0.0.0-20230807174530-cc333fc44b06 // indirect
|
|
||||||
github.com/cometbft/cometbft v0.38.9 // indirect
|
|
||||||
github.com/cometbft/cometbft-db v0.9.1 // indirect
|
|
||||||
github.com/cosmos/btcutil v1.0.5 // indirect
|
|
||||||
github.com/cosmos/cosmos-db v1.0.2 // indirect
|
|
||||||
github.com/cosmos/cosmos-proto v1.0.0-beta.5 // indirect
|
|
||||||
github.com/cosmos/go-bip39 v1.0.0 // indirect
|
|
||||||
github.com/cosmos/gogogateway v1.2.0 // indirect
|
|
||||||
github.com/cosmos/gogoproto v1.5.0 // indirect
|
|
||||||
github.com/cosmos/iavl v1.1.2 // indirect
|
|
||||||
github.com/cosmos/ics23/go v0.10.0 // indirect
|
|
||||||
github.com/cosmos/ledger-cosmos-go v0.13.3 // indirect
|
|
||||||
github.com/danieljoos/wincred v1.1.2 // indirect
|
|
||||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
||||||
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
|
|
||||||
github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f // indirect
|
|
||||||
github.com/dgraph-io/badger/v2 v2.2007.4 // indirect
|
|
||||||
github.com/dgraph-io/ristretto v0.1.1 // indirect
|
|
||||||
github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
|
|
||||||
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
||||||
github.com/dvsekhvalnov/jose2go v1.6.0 // indirect
|
|
||||||
github.com/emicklei/dot v1.6.1 // indirect
|
|
||||||
github.com/fatih/color v1.15.0 // indirect
|
|
||||||
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
||||||
github.com/fsnotify/fsnotify v1.7.0 // indirect
|
|
||||||
github.com/getsentry/sentry-go v0.27.0 // indirect
|
|
||||||
github.com/go-kit/kit v0.12.0 // indirect
|
|
||||||
github.com/go-kit/log v0.2.1 // indirect
|
|
||||||
github.com/go-logfmt/logfmt v0.6.0 // indirect
|
|
||||||
github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
|
|
||||||
github.com/gogo/googleapis v1.4.1 // indirect
|
|
||||||
github.com/gogo/protobuf v1.3.2 // indirect
|
|
||||||
github.com/golang/glog v1.2.0 // indirect
|
|
||||||
github.com/golang/protobuf v1.5.4 // indirect
|
|
||||||
github.com/golang/snappy v0.0.4 // indirect
|
|
||||||
github.com/google/btree v1.1.2 // indirect
|
|
||||||
github.com/google/go-cmp v0.6.0 // indirect
|
|
||||||
github.com/gorilla/handlers v1.5.2 // indirect
|
|
||||||
github.com/gorilla/mux v1.8.1 // indirect
|
|
||||||
github.com/gorilla/websocket v1.5.0 // indirect
|
|
||||||
github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
|
|
||||||
github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
|
|
||||||
github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
|
|
||||||
github.com/hashicorp/go-hclog v1.5.0 // indirect
|
|
||||||
github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
|
|
||||||
github.com/hashicorp/go-metrics v0.5.3 // indirect
|
|
||||||
github.com/hashicorp/go-plugin v1.5.2 // indirect
|
|
||||||
github.com/hashicorp/golang-lru v1.0.2 // indirect
|
|
||||||
github.com/hashicorp/hcl v1.0.0 // indirect
|
|
||||||
github.com/hashicorp/yamux v0.1.1 // indirect
|
|
||||||
github.com/hdevalence/ed25519consensus v0.1.0 // indirect
|
|
||||||
github.com/huandu/skiplist v1.2.0 // indirect
|
|
||||||
github.com/iancoleman/strcase v0.3.0 // indirect
|
|
||||||
github.com/improbable-eng/grpc-web v0.15.0 // indirect
|
|
||||||
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
||||||
github.com/jmhodges/levigo v1.0.0 // indirect
|
|
||||||
github.com/klauspost/compress v1.17.7 // indirect
|
|
||||||
github.com/kr/pretty v0.3.1 // indirect
|
|
||||||
github.com/kr/text v0.2.0 // indirect
|
|
||||||
github.com/libp2p/go-buffer-pool v0.1.0 // indirect
|
|
||||||
github.com/linxGnu/grocksdb v1.8.14 // indirect
|
|
||||||
github.com/magiconair/properties v1.8.7 // indirect
|
|
||||||
github.com/mattn/go-colorable v0.1.13 // indirect
|
|
||||||
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
||||||
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
|
|
||||||
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
|
||||||
github.com/mtibben/percent v0.2.1 // indirect
|
|
||||||
github.com/oasisprotocol/curve25519-voi v0.0.0-20230904125328-1f23a7beb09a // indirect
|
|
||||||
github.com/oklog/run v1.1.0 // indirect
|
|
||||||
github.com/pelletier/go-toml/v2 v2.1.0 // indirect
|
|
||||||
github.com/petermattis/goid v0.0.0-20231207134359-e60b3f734c67 // indirect
|
|
||||||
github.com/pkg/errors v0.9.1 // indirect
|
|
||||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
||||||
github.com/prometheus/client_golang v1.19.0 // indirect
|
|
||||||
github.com/prometheus/client_model v0.6.1 // indirect
|
|
||||||
github.com/prometheus/common v0.52.2 // indirect
|
|
||||||
github.com/prometheus/procfs v0.13.0 // indirect
|
|
||||||
github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
|
|
||||||
github.com/rogpeppe/go-internal v1.12.0 // indirect
|
|
||||||
github.com/rs/cors v1.8.3 // indirect
|
|
||||||
github.com/rs/zerolog v1.32.0 // indirect
|
|
||||||
github.com/sagikazarmark/locafero v0.4.0 // indirect
|
|
||||||
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
|
|
||||||
github.com/sasha-s/go-deadlock v0.3.1 // indirect
|
|
||||||
github.com/sourcegraph/conc v0.3.0 // indirect
|
|
||||||
github.com/spf13/afero v1.11.0 // indirect
|
|
||||||
github.com/spf13/cast v1.6.0 // indirect
|
|
||||||
github.com/spf13/cobra v1.8.0 // indirect
|
|
||||||
github.com/spf13/pflag v1.0.5 // indirect
|
|
||||||
github.com/spf13/viper v1.18.2 // indirect
|
|
||||||
github.com/stretchr/testify v1.9.0 // indirect
|
|
||||||
github.com/subosito/gotenv v1.6.0 // indirect
|
|
||||||
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
|
|
||||||
github.com/tendermint/go-amino v0.16.0 // indirect
|
|
||||||
github.com/tidwall/btree v1.7.0 // indirect
|
|
||||||
github.com/zondax/hid v0.9.2 // indirect
|
|
||||||
github.com/zondax/ledger-go v0.14.3 // indirect
|
|
||||||
go.etcd.io/bbolt v1.3.8 // indirect
|
|
||||||
go.uber.org/multierr v1.10.0 // indirect
|
|
||||||
golang.org/x/crypto v0.22.0 // indirect
|
|
||||||
golang.org/x/exp v0.0.0-20240404231335-c0f41cb1a7a0 // indirect
|
|
||||||
golang.org/x/net v0.24.0 // indirect
|
|
||||||
golang.org/x/sync v0.7.0 // indirect
|
|
||||||
golang.org/x/sys v0.19.0 // indirect
|
|
||||||
golang.org/x/term v0.19.0 // indirect
|
|
||||||
golang.org/x/text v0.14.0 // indirect
|
|
||||||
google.golang.org/genproto v0.0.0-20240227224415-6ceb2ff114de // indirect
|
|
||||||
google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de // indirect
|
|
||||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda // indirect
|
|
||||||
google.golang.org/grpc v1.63.2 // indirect
|
|
||||||
google.golang.org/protobuf v1.33.0 // indirect
|
|
||||||
gopkg.in/ini.v1 v1.67.0 // indirect
|
|
||||||
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
||||||
gotest.tools/v3 v3.5.1 // indirect
|
|
||||||
nhooyr.io/websocket v1.8.6 // indirect
|
|
||||||
pgregory.net/rapid v1.1.0 // indirect
|
|
||||||
sigs.k8s.io/yaml v1.4.0 // indirect
|
|
||||||
)
|
|
||||||
|
|||||||
@@ -85,41 +85,3 @@ func FindBannedTerm(s string) (string, bool) {
|
|||||||
func ContainsBannedTerm(s string) (string, bool) {
|
func ContainsBannedTerm(s string) (string, bool) {
|
||||||
return FindBannedTerm(s)
|
return FindBannedTerm(s)
|
||||||
}
|
}
|
||||||
|
|
||||||
// SyntheticBannedStrings returns one synthetic string per banned term, each
|
|
||||||
// embedding exactly one banned term in a plausible sentence context. This
|
|
||||||
// is the single source of truth (REQ-029, GRILL G-014) for the synthetic
|
|
||||||
// self-test table consumed by BOTH project-wide meta-tests:
|
|
||||||
//
|
|
||||||
// lexicon_meta_test.go :: TestLexiconMetaSelfTestTable (package lexicon_meta, scans x/**/*.go)
|
|
||||||
// lexicon_meta_docs_test.go :: TestLexiconMetaDocsSelfTestTable (package lexicon_meta_docs, scans README.md + docs/**/*.md)
|
|
||||||
//
|
|
||||||
// Before REQ-029, both meta-tests DUPLICATED their own 10-string synthetic
|
|
||||||
// table (byte-identical), creating a drift risk: a future banned-term
|
|
||||||
// addition updating one table but not the other would silently drop coverage
|
|
||||||
// in the unmaintained firewall. SyntheticBannedStrings() eliminates the
|
|
||||||
// duplication — both meta-tests now consume this helper, so a future addition
|
|
||||||
// updates both firewalls from one place. The strings are built from
|
|
||||||
// BannedTerms() (already fragment-assembled), so this package's own source
|
|
||||||
// stays lexicon-clean (the firewall's own code is allowed to name the terms
|
|
||||||
// it bans, but only via the fragment-assembly bootstrapping pattern).
|
|
||||||
//
|
|
||||||
// The returned slice is indexed positionally against BannedTerms(): the i-th
|
|
||||||
// synthetic string embeds the i-th banned term. Both meta-tests assert
|
|
||||||
// len(SyntheticBannedStrings()) == len(BannedTerms()) and that each string
|
|
||||||
// triggers FindBannedTerm with the matching term.
|
|
||||||
func SyntheticBannedStrings() []string {
|
|
||||||
terms := BannedTerms()
|
|
||||||
return []string{
|
|
||||||
"open a " + terms[0] + " here", // bank
|
|
||||||
"make a " + terms[1] + " now", // deposit
|
|
||||||
"compounding " + terms[2] + " rate", // interest
|
|
||||||
"the " + terms[3] + " is 5pct", // yield
|
|
||||||
"foreign " + terms[4] + " pair", // currency
|
|
||||||
"price in " + terms[5], // dollar
|
|
||||||
"price in " + terms[6], // euro
|
|
||||||
"freeze the " + terms[7], // account
|
|
||||||
"move to " + terms[8] + " now", // savings
|
|
||||||
"the " + terms[9] + " lost money", // depositor
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|||||||
@@ -128,14 +128,22 @@ func TestLexiconMetaDocsNoBannedTermsInDocs(t *testing.T) {
|
|||||||
// breaks, this test fails before the firewall silently passes a real
|
// breaks, this test fails before the firewall silently passes a real
|
||||||
// violation in a docs page.
|
// violation in a docs page.
|
||||||
//
|
//
|
||||||
// REQ-029 (GRILL G-014): the synthetic strings are sourced from
|
// G-014 self-test drift: this table is the docs mirror of the
|
||||||
// lexicon.SyntheticBannedStrings(), the single source of truth shared with
|
// TestLexiconMetaSelfTestTable in lexicon_meta_test.go (package lexicon_meta).
|
||||||
// lexicon_meta_test.go :: TestLexiconMetaSelfTestTable. Before REQ-029, this
|
// Both reuse lexicon.BannedTerms() as the single source for the 10 terms, so
|
||||||
// file DUPLICATED its own 10-string table (byte-identical to the x/ meta-
|
// a future addition updates both firewalls from one place. The synthetic
|
||||||
// test), creating a drift risk; the shared helper closes it. This file no
|
// strings are assembled from lexicon.BannedTerms() fragments so this file
|
||||||
// longer builds its own synthetic table — both meta-tests consume the same
|
// does not contain any banned term as a literal substring (it would otherwise
|
||||||
// helper, so a future banned-term addition updates both firewalls from one
|
// trip its own scan; the meta-test file is also excluded from its own scan,
|
||||||
// place.
|
// but the self-test keeps the source clean for readability/searchability).
|
||||||
|
//
|
||||||
|
// CROSS-REFERENCE: keep this table aligned with
|
||||||
|
//
|
||||||
|
// lexicon_meta_test.go :: TestLexiconMetaSelfTestTable
|
||||||
|
//
|
||||||
|
// Any change to the synthetic-string construction must be mirrored in both
|
||||||
|
// files (or, preferably, add a shared helper in the lexicon package — see
|
||||||
|
// G-014 minimum-viable: cross-reference comment + shared BannedTerms()).
|
||||||
func TestLexiconMetaDocsSelfTestTable(t *testing.T) {
|
func TestLexiconMetaDocsSelfTestTable(t *testing.T) {
|
||||||
terms := lexicon.BannedTerms()
|
terms := lexicon.BannedTerms()
|
||||||
// The spec lists 10 banned terms (plan docs say "9", counting dollar/euro
|
// The spec lists 10 banned terms (plan docs say "9", counting dollar/euro
|
||||||
@@ -144,10 +152,22 @@ func TestLexiconMetaDocsSelfTestTable(t *testing.T) {
|
|||||||
if len(terms) != 10 {
|
if len(terms) != 10 {
|
||||||
t.Fatalf("BannedTerms() len = %d, want 10", len(terms))
|
t.Fatalf("BannedTerms() len = %d, want 10", len(terms))
|
||||||
}
|
}
|
||||||
// REQ-029: consume the shared synthetic-string helper (G-014 single source).
|
// Each synthetic string embeds exactly one banned term in a plausible
|
||||||
synthetic := lexicon.SyntheticBannedStrings()
|
// sentence context. Each must be detected.
|
||||||
|
synthetic := []string{
|
||||||
|
"open a " + terms[0] + " here", // bank
|
||||||
|
"make a " + terms[1] + " now", // deposit
|
||||||
|
"compounding " + terms[2] + " rate", // interest
|
||||||
|
"the " + terms[3] + " is 5pct", // yield
|
||||||
|
"foreign " + terms[4] + " pair", // currency
|
||||||
|
"price in " + terms[5], // dollar
|
||||||
|
"price in " + terms[6], // euro
|
||||||
|
"freeze the " + terms[7], // account
|
||||||
|
"move to " + terms[8] + " now", // savings
|
||||||
|
"the " + terms[9] + " lost money", // depositor
|
||||||
|
}
|
||||||
if len(synthetic) != len(terms) {
|
if len(synthetic) != len(terms) {
|
||||||
t.Fatalf("SyntheticBannedStrings() len = %d, want %d (must match BannedTerms())", len(synthetic), len(terms))
|
t.Fatalf("synthetic table len = %d, want %d", len(synthetic), len(terms))
|
||||||
}
|
}
|
||||||
for i, s := range synthetic {
|
for i, s := range synthetic {
|
||||||
found, ok := lexicon.FindBannedTerm(s)
|
found, ok := lexicon.FindBannedTerm(s)
|
||||||
|
|||||||
+19
-9
@@ -76,12 +76,10 @@ func TestLexiconMetaNoBannedTermsInX(t *testing.T) {
|
|||||||
// firewall's detection logic is durably verified — if detection ever breaks,
|
// firewall's detection logic is durably verified — if detection ever breaks,
|
||||||
// this test fails before the firewall silently passes a real violation.
|
// this test fails before the firewall silently passes a real violation.
|
||||||
//
|
//
|
||||||
// REQ-029 (GRILL G-014): the synthetic strings are sourced from
|
// The synthetic strings are assembled from fragments so this file does not
|
||||||
// lexicon.SyntheticBannedStrings(), the single source of truth shared with
|
// contain any banned term as a literal substring (it would otherwise trip
|
||||||
// lexicon_meta_docs_test.go :: TestLexiconMetaDocsSelfTestTable. Before
|
// its own scan; the meta-test file is also excluded from the scan, but the
|
||||||
// REQ-029, both meta-tests DUPLICATED their own 10-string table, creating a
|
// self-test keeps the source clean for readability/searchability).
|
||||||
// drift risk; the shared helper closes it. This file no longer builds its
|
|
||||||
// own synthetic table.
|
|
||||||
func TestLexiconMetaSelfTestTable(t *testing.T) {
|
func TestLexiconMetaSelfTestTable(t *testing.T) {
|
||||||
terms := lexicon.BannedTerms()
|
terms := lexicon.BannedTerms()
|
||||||
// The spec lists 10 banned terms (plan docs say "9", counting dollar/euro
|
// The spec lists 10 banned terms (plan docs say "9", counting dollar/euro
|
||||||
@@ -90,10 +88,22 @@ func TestLexiconMetaSelfTestTable(t *testing.T) {
|
|||||||
if len(terms) != 10 {
|
if len(terms) != 10 {
|
||||||
t.Fatalf("BannedTerms() len = %d, want 10", len(terms))
|
t.Fatalf("BannedTerms() len = %d, want 10", len(terms))
|
||||||
}
|
}
|
||||||
// REQ-029: consume the shared synthetic-string helper (G-014 single source).
|
// Each synthetic string embeds exactly one banned term in a plausible
|
||||||
synthetic := lexicon.SyntheticBannedStrings()
|
// sentence context. Each must be detected.
|
||||||
|
synthetic := []string{
|
||||||
|
"open a " + terms[0] + " here", // bank
|
||||||
|
"make a " + terms[1] + " now", // deposit
|
||||||
|
"compounding " + terms[2] + " rate", // interest
|
||||||
|
"the " + terms[3] + " is 5pct", // yield
|
||||||
|
"foreign " + terms[4] + " pair", // currency
|
||||||
|
"price in " + terms[5], // dollar
|
||||||
|
"price in " + terms[6], // euro
|
||||||
|
"freeze the " + terms[7], // account
|
||||||
|
"move to " + terms[8] + " now", // savings
|
||||||
|
"the " + terms[9] + " lost money", // depositor
|
||||||
|
}
|
||||||
if len(synthetic) != len(terms) {
|
if len(synthetic) != len(terms) {
|
||||||
t.Fatalf("SyntheticBannedStrings() len = %d, want %d (must match BannedTerms())", len(synthetic), len(terms))
|
t.Fatalf("synthetic table len = %d, want %d", len(synthetic), len(terms))
|
||||||
}
|
}
|
||||||
for i, s := range synthetic {
|
for i, s := range synthetic {
|
||||||
found, ok := lexicon.FindBannedTerm(s)
|
found, ok := lexicon.FindBannedTerm(s)
|
||||||
|
|||||||
@@ -1,307 +0,0 @@
|
|||||||
// Package lexicon_meta_web holds the web lexicon firewall (REQ-045, D-069).
|
|
||||||
//
|
|
||||||
// It is a NEW sibling meta-test created in v0.6 P1 Wave 1 that MIRRORS the
|
|
||||||
// v0.3 docs firewall (lexicon_meta_docs/lexicon_meta_docs_test.go, package
|
|
||||||
// lexicon_meta_docs) but scans the web surface (web/templates/**/*.html +
|
|
||||||
// web/static/**/*.js + web/**/*.go) instead of README.md + docs/**/*.md. It
|
|
||||||
// uses the SAME lexicon.FindBannedTerm (word-boundary, case-insensitive) —
|
|
||||||
// NO detection reimplementation — so the three firewalls (x/*.go, docs, web)
|
|
||||||
// share a single source of truth for the 10 banned terms (bank, deposit,
|
|
||||||
// interest, yield, currency, dollar, euro, account, savings, depositor).
|
|
||||||
//
|
|
||||||
// Placement: this file lives in lexicon_meta_web/ (a subdirectory of the
|
|
||||||
// repo root) because Go does not permit two distinct packages in the same
|
|
||||||
// directory; the v0.2 firewall is package lexicon_meta at the repo root and
|
|
||||||
// the v0.3 firewall is package lexicon_meta_docs in lexicon_meta_docs/. The
|
|
||||||
// invocation `go test ./lexicon_meta_web/...` (PLANS P1-01-01) resolves to
|
|
||||||
// this package. Run via `go test ./...` from the repo root as well.
|
|
||||||
//
|
|
||||||
// G-013 walk-coverage: TestLexiconMetaWebWalkCoverage injects a synthetic
|
|
||||||
// banned-term .html into a temp web/templates/ subtree and asserts the walk
|
|
||||||
// FINDS it. This closes the "silently scans nothing and reports green"
|
|
||||||
// failure mode that the G-009 self-test table (detection) alone does not
|
|
||||||
// cover.
|
|
||||||
//
|
|
||||||
// G-014 self-test drift: the self-test table and banned-term count assertion
|
|
||||||
// reuse lexicon.BannedTerms() (the single source). A cross-reference comment
|
|
||||||
// keeps this file's table in lockstep with lexicon_meta_test.go's table and
|
|
||||||
// lexicon_meta_docs_test.go's table; if a banned term is added, all three
|
|
||||||
// firewalls update from one place.
|
|
||||||
package lexicon_meta_web
|
|
||||||
|
|
||||||
import (
|
|
||||||
"os"
|
|
||||||
"path/filepath"
|
|
||||||
"runtime"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/lexicon"
|
|
||||||
)
|
|
||||||
|
|
||||||
// repoRoot returns the absolute path to the repo root by walking up from
|
|
||||||
// this test file (the test lives at <repoRoot>/lexicon_meta_web/).
|
|
||||||
func repoRoot(t *testing.T) string {
|
|
||||||
t.Helper()
|
|
||||||
_, file, _, ok := runtime.Caller(0)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("runtime.Caller failed")
|
|
||||||
}
|
|
||||||
// file = .../oy/lexicon_meta_web/lexicon_meta_web_test.go
|
|
||||||
// repo root = filepath.Dir(filepath.Dir(file))
|
|
||||||
return filepath.Dir(filepath.Dir(file))
|
|
||||||
}
|
|
||||||
|
|
||||||
// thisFile returns the absolute path of this meta-test file (to exclude it
|
|
||||||
// from its own scan — it references banned terms via the lexicon package,
|
|
||||||
// whose source assembles terms from fragments, so no banned-term literal
|
|
||||||
// appears in the firewall's own code).
|
|
||||||
func thisFile(t *testing.T) string {
|
|
||||||
t.Helper()
|
|
||||||
_, file, _, ok := runtime.Caller(0)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("runtime.Caller failed")
|
|
||||||
}
|
|
||||||
return file
|
|
||||||
}
|
|
||||||
|
|
||||||
// isWebTarget reports whether path (relative to repo root) is a file the web
|
|
||||||
// firewall scans: web/templates/**/*.html, web/static/**/*.js, and
|
|
||||||
// web/**/*.go (production + test). Non-{html,js,go} files under web/ (e.g.
|
|
||||||
// vendored binary assets) are skipped.
|
|
||||||
func isWebTarget(rel string) bool {
|
|
||||||
if !strings.HasPrefix(rel, "web"+string(filepath.Separator)) {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
return strings.HasSuffix(rel, ".html") || strings.HasSuffix(rel, ".js") || strings.HasSuffix(rel, ".go")
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaWebNoBannedTermsInWeb is the web firewall (D-069). It walks
|
|
||||||
// the repo root, targets web/templates/**/*.html + web/static/**/*.js +
|
|
||||||
// web/**/*.go (production + test), reads each file's source, and asserts no
|
|
||||||
// banned term is present (word-boundary, case-insensitive). Excludes
|
|
||||||
// .ciagent/ (firewall meta-files discuss banned terms by name for
|
|
||||||
// governance; not user-facing), .git/ (VCS), and this test file itself
|
|
||||||
// (self-exclusion via runtime.Caller(0)).
|
|
||||||
//
|
|
||||||
// Passes at P1 Wave 1 with zero web content (a walk that scans nothing
|
|
||||||
// reports green on zero hits — closed by TestLexiconMetaWebWalkCoverage
|
|
||||||
// below). With the Wave 2..4 web content present (templates, static assets,
|
|
||||||
// handlers, store), all are lexicon-clean by construction.
|
|
||||||
func TestLexiconMetaWebNoBannedTermsInWeb(t *testing.T) {
|
|
||||||
root := repoRoot(t)
|
|
||||||
this := thisFile(t)
|
|
||||||
hits := []string{}
|
|
||||||
err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if info.IsDir() {
|
|
||||||
base := filepath.Base(path)
|
|
||||||
if base == ".ciagent" || base == ".git" {
|
|
||||||
return filepath.SkipDir
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
// Self-exclusion: skip this meta-test file.
|
|
||||||
if path == this {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
rel, rerr := filepath.Rel(root, path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if !isWebTarget(rel) {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
bz, rerr := os.ReadFile(path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
|
||||||
hits = append(hits, rel+" contains banned term "+found)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
})
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("walk: %v", err)
|
|
||||||
}
|
|
||||||
if len(hits) > 0 {
|
|
||||||
t.Errorf("REQ-045 web lexicon firewall violations:\n %s",
|
|
||||||
strings.Join(hits, "\n "))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaWebSelfTestTable (G-009 for web) is the firewall's own
|
|
||||||
// detection-coverage guard. Each synthetic string embeds exactly one banned
|
|
||||||
// term in a plausible sentence context and is asserted to trigger detection,
|
|
||||||
// so the firewall's detection logic is durably verified — if detection ever
|
|
||||||
// breaks, this test fails before the firewall silently passes a real
|
|
||||||
// violation in a web template or handler.
|
|
||||||
//
|
|
||||||
// REQ-029 (GRILL G-014): the synthetic strings are sourced from
|
|
||||||
// lexicon.SyntheticBannedStrings(), the single source of truth shared with
|
|
||||||
// lexicon_meta_test.go :: TestLexiconMetaSelfTestTable and
|
|
||||||
// lexicon_meta_docs_test.go :: TestLexiconMetaDocsSelfTestTable. Before
|
|
||||||
// REQ-029, each meta-test DUPLICATED its own 10-string table (byte-identical),
|
|
||||||
// creating a drift risk; the shared helper closes it. This file no longer
|
|
||||||
// builds its own synthetic table — all three meta-tests consume the same
|
|
||||||
// helper, so a future banned-term addition updates all firewalls from one
|
|
||||||
// place.
|
|
||||||
func TestLexiconMetaWebSelfTestTable(t *testing.T) {
|
|
||||||
terms := lexicon.BannedTerms()
|
|
||||||
// The spec lists 10 banned terms (plan docs say "9", counting dollar/euro
|
|
||||||
// as a pair): bank, deposit, interest, yield, currency, dollar, euro,
|
|
||||||
// account, savings, depositor.
|
|
||||||
if len(terms) != 10 {
|
|
||||||
t.Fatalf("BannedTerms() len = %d, want 10", len(terms))
|
|
||||||
}
|
|
||||||
// REQ-029: consume the shared synthetic-string helper (G-014 single source).
|
|
||||||
synthetic := lexicon.SyntheticBannedStrings()
|
|
||||||
if len(synthetic) != len(terms) {
|
|
||||||
t.Fatalf("SyntheticBannedStrings() len = %d, want %d (must match BannedTerms())", len(synthetic), len(terms))
|
|
||||||
}
|
|
||||||
for i, s := range synthetic {
|
|
||||||
found, ok := lexicon.FindBannedTerm(s)
|
|
||||||
if !ok {
|
|
||||||
t.Errorf("G-009 web self-test [%d]: synthetic string did not trigger detection: %q", i, s)
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
if found != terms[i] {
|
|
||||||
t.Errorf("G-009 web self-test [%d]: detected %q, want %q (in %q)", i, found, terms[i], s)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaWebBannedTermsCount asserts exactly 10 banned terms are
|
|
||||||
// configured (locked-const for the firewall's scope; spec lists 10, plan docs
|
|
||||||
// say "9" counting dollar/euro as a pair). Derived from lexicon.BannedTerms()
|
|
||||||
// — the single source — so a count change breaks all three firewalls (x/*.go,
|
|
||||||
// docs, web) (G-014 drift prevention).
|
|
||||||
func TestLexiconMetaWebBannedTermsCount(t *testing.T) {
|
|
||||||
terms := lexicon.BannedTerms()
|
|
||||||
if len(terms) != 10 {
|
|
||||||
t.Errorf("BannedTerms() len = %d, want 10 (REQ-012/REQ-045)", len(terms))
|
|
||||||
}
|
|
||||||
seen := map[string]bool{}
|
|
||||||
for _, tr := range terms {
|
|
||||||
if seen[tr] {
|
|
||||||
t.Errorf("duplicate banned term %q", tr)
|
|
||||||
}
|
|
||||||
seen[tr] = true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaWebNoFalsePositiveOnOpenYield asserts the module name
|
|
||||||
// "openyield" does NOT trigger the "yield" banned term and "european" does
|
|
||||||
// NOT trigger the "euro" banned term (word-boundary matching must not match
|
|
||||||
// substrings of identifiers). This is the regression firewall for the
|
|
||||||
// word-boundary detection design — mirrors the v0.2
|
|
||||||
// TestLexiconMetaNoFalsePositiveOnOpenYield and the v0.3
|
|
||||||
// TestLexiconMetaDocsNoFalsePositiveOnOpenYield.
|
|
||||||
func TestLexiconMetaWebNoFalsePositiveOnOpenYield(t *testing.T) {
|
|
||||||
cases := []string{
|
|
||||||
"github.com/oy/openyield/x/window/types",
|
|
||||||
"package openyield",
|
|
||||||
"openyield is the module",
|
|
||||||
"european resident",
|
|
||||||
"# OpenYield web",
|
|
||||||
"the OpenYield mesh",
|
|
||||||
}
|
|
||||||
for _, s := range cases {
|
|
||||||
if _, ok := lexicon.FindBannedTerm(s); ok {
|
|
||||||
t.Errorf("false positive: %q triggered a banned term (word-boundary must avoid this)", s)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestLexiconMetaWebWalkCoverage (G-013) is the walk-coverage firewall. The
|
|
||||||
// G-009 self-test table (above) verifies DETECTION (FindBannedTerm on
|
|
||||||
// synthetic strings) but NOT the WALK (which files are scanned). A walk bug
|
|
||||||
// — e.g. wrong path prefix, missing web/ recursion, a typo in the .html
|
|
||||||
// suffix check — would silently scan nothing and report green on zero
|
|
||||||
// files. This test closes that gap by injecting a synthetic banned-term
|
|
||||||
// .html into a fixture dir under the real web/templates/ path the walk scans
|
|
||||||
// and asserting the walk FINDS it.
|
|
||||||
//
|
|
||||||
// The fixture is created under web/templates/.lexicon_fixture/ (a real
|
|
||||||
// web/templates/ subtree the walk reaches) and removed via defer so it never
|
|
||||||
// leaks into the repo. If the walk logic misses the fixture, this test fails
|
|
||||||
// loudly instead of letting a broken walk pass the firewall green on zero
|
|
||||||
// files scanned.
|
|
||||||
func TestLexiconMetaWebWalkCoverage(t *testing.T) {
|
|
||||||
root := repoRoot(t)
|
|
||||||
this := thisFile(t)
|
|
||||||
|
|
||||||
// Build a synthetic banned term from fragments so THIS file does not
|
|
||||||
// contain a banned-term literal (it is excluded from its own scan, but
|
|
||||||
// the synthetic stays clean for readability/searchability).
|
|
||||||
terms := lexicon.BannedTerms()
|
|
||||||
if len(terms) == 0 {
|
|
||||||
t.Fatal("BannedTerms() returned no terms — cannot run walk-coverage")
|
|
||||||
}
|
|
||||||
// Use the first banned term ("bank") assembled from two halves.
|
|
||||||
syntheticTerm := terms[0][:2] + terms[0][2:] // reassemble (no literal in source)
|
|
||||||
badContent := []byte("<!-- fixture -->\nthis file contains a banned term: " + syntheticTerm + "\n")
|
|
||||||
|
|
||||||
fixtureDir := filepath.Join(root, "web", "templates", ".lexicon_fixture")
|
|
||||||
fixtureFile := filepath.Join(fixtureDir, "bad_fixture.html")
|
|
||||||
if err := os.MkdirAll(fixtureDir, 0o755); err != nil {
|
|
||||||
t.Fatalf("mkdir fixture: %v", err)
|
|
||||||
}
|
|
||||||
defer os.RemoveAll(fixtureDir)
|
|
||||||
if err := os.WriteFile(fixtureFile, badContent, 0o644); err != nil {
|
|
||||||
t.Fatalf("write fixture: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Run the SAME walk logic as TestLexiconMetaWebNoBannedTermsInWeb and
|
|
||||||
// assert it FINDS the fixture's banned term. A walk that returns zero
|
|
||||||
// hits here proves the walk logic is broken (the fixture is a known-bad
|
|
||||||
// file inside web/templates/ that MUST be detected).
|
|
||||||
hits := []string{}
|
|
||||||
err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if info.IsDir() {
|
|
||||||
base := filepath.Base(path)
|
|
||||||
if base == ".ciagent" || base == ".git" {
|
|
||||||
return filepath.SkipDir
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
if path == this {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
rel, rerr := filepath.Rel(root, path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if !isWebTarget(rel) {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
bz, rerr := os.ReadFile(path)
|
|
||||||
if rerr != nil {
|
|
||||||
return rerr
|
|
||||||
}
|
|
||||||
if found, ok := lexicon.FindBannedTerm(string(bz)); ok {
|
|
||||||
hits = append(hits, rel+" contains banned term "+found)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
})
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("walk: %v", err)
|
|
||||||
}
|
|
||||||
// Assert the fixture was found. The rel path uses OS-specific separator;
|
|
||||||
// match on the suffix so the test is portable.
|
|
||||||
foundFixture := false
|
|
||||||
for _, h := range hits {
|
|
||||||
if strings.Contains(h, "bad_fixture.html") && strings.Contains(h, syntheticTerm) {
|
|
||||||
foundFixture = true
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if !foundFixture {
|
|
||||||
t.Errorf("G-013 walk-coverage: the walk did NOT find the synthetic banned-term fixture at %s — the web firewall walk logic is broken (it would silently scan nothing and report green). hits=%v", fixtureFile, hits)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,50 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
|
|
||||||
bloomtypes "github.com/oy/openyield/x/bloom/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// registerBloom wires the Bloom accrual route (REQ-044).
|
|
||||||
func (s *Server) registerBloom(mux *http.ServeMux) {
|
|
||||||
mux.HandleFunc("GET /bloom/{stashID}", s.handleBloom)
|
|
||||||
}
|
|
||||||
|
|
||||||
// bloomViewData is the template data for the Bloom accrual view.
|
|
||||||
type bloomViewData struct {
|
|
||||||
StashID string
|
|
||||||
Found bool
|
|
||||||
Record bloomtypes.BloomRecord
|
|
||||||
RatePct float64 // RateBasisPoints as a percentage (450 -> 4.5)
|
|
||||||
TargetRatePct float64 // TargetBloomRateBasisPoints as %
|
|
||||||
MinRatePct float64
|
|
||||||
MaxRatePct float64
|
|
||||||
AccrualPeriod int64
|
|
||||||
MissionLockNote string
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleBloom renders the Bloom accrual view (REQ-044): per-Stash BloomRecord
|
|
||||||
// (AccruedGrain, RateBasisPoints as %, LastAccrualBlock) + the 4.5% target rate
|
|
||||||
// (read from x/bloom/types.TargetBloomRateBasisPoints — D-073 code-constant
|
|
||||||
// source-of-truth, NOT hardcoded). Bloom is conceptually close to a banned
|
|
||||||
// financial term; labels use "Bloom"/"real production"/"accrual" only.
|
|
||||||
func (s *Server) handleBloom(w http.ResponseWriter, r *http.Request) {
|
|
||||||
stashID := r.PathValue("stashID")
|
|
||||||
rec, ok := s.Store.GetBloomRecord(stashID)
|
|
||||||
if !ok {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
s.render(w, "bloom.html", bloomViewData{
|
|
||||||
StashID: stashID,
|
|
||||||
Found: true,
|
|
||||||
Record: rec,
|
|
||||||
RatePct: float64(rec.RateBasisPoints) / 100,
|
|
||||||
TargetRatePct: float64(bloomtypes.TargetBloomRateBasisPoints) / 100,
|
|
||||||
MinRatePct: float64(bloomtypes.MinBloomRateBasisPoints) / 100,
|
|
||||||
MaxRatePct: float64(bloomtypes.MaxBloomRateBasisPoints) / 100,
|
|
||||||
AccrualPeriod: bloomtypes.AccrualPeriodBlocks,
|
|
||||||
MissionLockNote: bloomtypes.MissionLockBloom,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
@@ -1,137 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
bloomtypes "github.com/oy/openyield/x/bloom/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestBloomSeededRecordRendersTargetRate(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/bloom/stash-holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /bloom/stash-holder-alia: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// Accrued Grain present.
|
|
||||||
if !strings.Contains(body, "Grain") {
|
|
||||||
t.Errorf("body missing 'Grain'")
|
|
||||||
}
|
|
||||||
// Target rate 4.5% (from TargetBloomRateBasisPoints=450).
|
|
||||||
want := formatFloat(float64(bloomtypes.TargetBloomRateBasisPoints) / 100)
|
|
||||||
if !strings.Contains(body, want) {
|
|
||||||
t.Errorf("body missing target rate %s%% (TargetBloomRateBasisPoints=%d)", want, bloomtypes.TargetBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
// Mission Lock note present.
|
|
||||||
if !strings.Contains(body, "real production") {
|
|
||||||
t.Errorf("body missing Mission Lock note about real production")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestBloomMissingReturns404(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/bloom/stash-nobody", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusNotFound {
|
|
||||||
t.Fatalf("GET /bloom/stash-nobody: status %d, want 404", rec.Code)
|
|
||||||
}
|
|
||||||
// G-026: rendered-HTML lexicon check on the ERROR response body too.
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestBloomTargetRateFromCodeConstant (D-073 regression guard): asserts the
|
|
||||||
// handler reads x/bloom/types.TargetBloomRateBasisPoints=450 (NOT a hardcoded
|
|
||||||
// 450 or a docs value). This test would FAIL if the handler hardcoded the rate
|
|
||||||
// instead of reading the code constant.
|
|
||||||
func TestBloomTargetRateFromCodeConstant(t *testing.T) {
|
|
||||||
// D-073: the code constant is the source of truth.
|
|
||||||
if bloomtypes.TargetBloomRateBasisPoints != 450 {
|
|
||||||
t.Fatalf("D-073: TargetBloomRateBasisPoints = %d, want 450 (code constant)", bloomtypes.TargetBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
if bloomtypes.MinBloomRateBasisPoints != 400 {
|
|
||||||
t.Fatalf("D-073: MinBloomRateBasisPoints = %d, want 400 (code constant)", bloomtypes.MinBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
if bloomtypes.MaxBloomRateBasisPoints != 500 {
|
|
||||||
t.Fatalf("D-073: MaxBloomRateBasisPoints = %d, want 500 (code constant)", bloomtypes.MaxBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/bloom/stash-holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
body := rec.Body.String()
|
|
||||||
|
|
||||||
// The rendered target rate must be the code constant / 100 = 4.5.
|
|
||||||
wantTarget := formatFloat(float64(bloomtypes.TargetBloomRateBasisPoints) / 100)
|
|
||||||
if !strings.Contains(body, wantTarget) {
|
|
||||||
t.Errorf("D-073: body missing target rate %s%% (from code constant %d)", wantTarget, bloomtypes.TargetBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
// The seeded record for holder-alia uses RateBasisPoints=450 (the target).
|
|
||||||
rec2, ok := srv.Store.GetBloomRecord("stash-holder-alia")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded bloom record stash-holder-alia missing")
|
|
||||||
}
|
|
||||||
if rec2.RateBasisPoints != bloomtypes.TargetBloomRateBasisPoints {
|
|
||||||
t.Errorf("D-073: seeded record RateBasisPoints = %d, want %d (code constant)", rec2.RateBasisPoints, bloomtypes.TargetBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
// The rate band must be rendered from the code constants.
|
|
||||||
wantMin := formatFloat(float64(bloomtypes.MinBloomRateBasisPoints) / 100)
|
|
||||||
wantMax := formatFloat(float64(bloomtypes.MaxBloomRateBasisPoints) / 100)
|
|
||||||
if !strings.Contains(body, wantMin) {
|
|
||||||
t.Errorf("D-073: body missing min rate %s%% (from code constant)", wantMin)
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, wantMax) {
|
|
||||||
t.Errorf("D-073: body missing max rate %s%% (from code constant)", wantMax)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertion that the handler uses the real x/bloom/types struct.
|
|
||||||
var _ bloomtypes.BloomRecord
|
|
||||||
|
|
||||||
// formatFloat formats a float to 1 decimal place without importing strconv
|
|
||||||
// (keeps the test deps minimal; matches the template's printf "%.1f").
|
|
||||||
func formatFloat(f float64) string {
|
|
||||||
// Round to 1 decimal.
|
|
||||||
rounded := float64(int(f*10+0.5)) / 10
|
|
||||||
whole := int(rounded)
|
|
||||||
frac := int((rounded - float64(whole)) * 10)
|
|
||||||
if frac == 0 {
|
|
||||||
return formatInt2(int64(whole)) + ".0"
|
|
||||||
}
|
|
||||||
return formatInt2(int64(whole)) + "." + string(rune('0'+frac))
|
|
||||||
}
|
|
||||||
|
|
||||||
func formatInt2(n int64) string {
|
|
||||||
if n == 0 {
|
|
||||||
return "0"
|
|
||||||
}
|
|
||||||
neg := n < 0
|
|
||||||
if neg {
|
|
||||||
n = -n
|
|
||||||
}
|
|
||||||
var buf [20]byte
|
|
||||||
i := len(buf)
|
|
||||||
for n > 0 {
|
|
||||||
i--
|
|
||||||
buf[i] = byte('0' + n%10)
|
|
||||||
n /= 10
|
|
||||||
}
|
|
||||||
if neg {
|
|
||||||
i--
|
|
||||||
buf[i] = '-'
|
|
||||||
}
|
|
||||||
return string(buf[i:])
|
|
||||||
}
|
|
||||||
@@ -1,90 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
|
|
||||||
identitytypes "github.com/oy/openyield/x/identity/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// registerReach wires the Reach signup routes (REQ-040) into the mux.
|
|
||||||
// Go 1.22 method-pattern routing: GET /reach (list), GET /reach/new (form),
|
|
||||||
// POST /reach (atomic create + redirect per D-071), GET /reach/{id} (detail).
|
|
||||||
func (s *Server) registerReach(mux *http.ServeMux) {
|
|
||||||
mux.HandleFunc("GET /reach", s.handleReachList)
|
|
||||||
mux.HandleFunc("GET /reach/new", s.handleReachNew)
|
|
||||||
mux.HandleFunc("POST /reach", s.handleReachCreate)
|
|
||||||
mux.HandleFunc("GET /reach/{id}", s.handleReachDetail)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleReachList renders all Reaches (seeded + created).
|
|
||||||
func (s *Server) handleReachList(w http.ResponseWriter, r *http.Request) {
|
|
||||||
reaches := s.Store.ListReaches()
|
|
||||||
s.render(w, "reach_list.html", map[string]any{"Reaches": reaches})
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleReachNew renders the "Create a Reach" form. Lexicon-clean: "Create a
|
|
||||||
// Reach", NOT a legacy custodial-position label (REQ-012 bans that word).
|
|
||||||
func (s *Server) handleReachNew(w http.ResponseWriter, r *http.Request) {
|
|
||||||
s.render(w, "reach_new.html", nil)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleReachCreate handles the POST from the "Create a Reach" form. Calls
|
|
||||||
// store.CreateReach (atomic Reach + Stash per D-071). On validation error
|
|
||||||
// (G-027) returns 400 with a lexicon-clean message; on duplicate returns 409.
|
|
||||||
// On success redirects (302) to the new Reach detail page.
|
|
||||||
func (s *Server) handleReachCreate(w http.ResponseWriter, r *http.Request) {
|
|
||||||
holderID := r.FormValue("holder_id")
|
|
||||||
publicKey := r.FormValue("public_key")
|
|
||||||
reach, _, err := s.Store.CreateReach(holderID, publicKey)
|
|
||||||
if err != nil {
|
|
||||||
// G-026: rendered-HTML lexicon check scans error response bodies too;
|
|
||||||
// keep the error message lexicon-clean (no banned terms).
|
|
||||||
status := http.StatusBadRequest
|
|
||||||
if isDuplicate(err) {
|
|
||||||
status = http.StatusConflict
|
|
||||||
}
|
|
||||||
http.Error(w, "Could not create a Reach: "+err.Error(), status)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Redirect(w, r, "/reach/"+reach.HolderID, http.StatusFound)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleReachDetail renders one Reach + its associated Stash (BalanceGrain).
|
|
||||||
func (s *Server) handleReachDetail(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("id")
|
|
||||||
reach, ok := s.Store.GetReach(id)
|
|
||||||
if !ok {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
stash, _ := s.Store.GetStash(id)
|
|
||||||
s.render(w, "reach_detail.html", map[string]any{
|
|
||||||
"Reach": reach,
|
|
||||||
"Stash": stash,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
// isDuplicate reports whether err is a duplicate-holder error from
|
|
||||||
// store.CreateReach. Kept as a string match to avoid exporting store errors.
|
|
||||||
func isDuplicate(err error) bool {
|
|
||||||
return err != nil && contains(err.Error(), "already has a Reach")
|
|
||||||
}
|
|
||||||
|
|
||||||
func contains(s, sub string) bool {
|
|
||||||
return len(s) >= len(sub) && (s == sub || indexOf(s, sub) >= 0)
|
|
||||||
}
|
|
||||||
|
|
||||||
func indexOf(s, sub string) int {
|
|
||||||
for i := 0; i+len(sub) <= len(s); i++ {
|
|
||||||
if s[i:i+len(sub)] == sub {
|
|
||||||
return i
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return -1
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions that the handlers use the real x/*/types structs
|
|
||||||
// (D-067: the UI grounds in the real Go type definitions).
|
|
||||||
var _ identitytypes.Reach
|
|
||||||
var _ stashtypes.Stash
|
|
||||||
@@ -1,185 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/lexicon"
|
|
||||||
"github.com/oy/openyield/web/store"
|
|
||||||
)
|
|
||||||
|
|
||||||
// newTestServer builds a Server with a fresh store + templates parsed from
|
|
||||||
// web/templates (relative to repo root via the handlers test working dir).
|
|
||||||
func newTestServer(t *testing.T) *Server {
|
|
||||||
t.Helper()
|
|
||||||
srv, err := New(store.NewStore(), "../../web/templates")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("new handlers server: %v", err)
|
|
||||||
}
|
|
||||||
return srv
|
|
||||||
}
|
|
||||||
|
|
||||||
// assertNoBannedTerms checks the rendered response body for banned terms
|
|
||||||
// (G-026: applies to BOTH 200 happy-path AND error response bodies).
|
|
||||||
func assertNoBannedTerms(t *testing.T, body string) {
|
|
||||||
t.Helper()
|
|
||||||
if term, ok := lexicon.FindBannedTerm(body); ok {
|
|
||||||
t.Errorf("rendered HTML contains banned term %q (REQ-012/G-026)", term)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachListReturnsSeededReaches(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/reach", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /reach: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, "holder-alia") {
|
|
||||||
t.Errorf("GET /reach: body missing seeded reach holder-alia")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "holder-bryn") {
|
|
||||||
t.Errorf("GET /reach: body missing seeded reach holder-bryn")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachNewReturnsForm(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/reach/new", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /reach/new: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, "Create a Reach") {
|
|
||||||
t.Errorf("GET /reach/new: body missing 'Create a Reach' label")
|
|
||||||
}
|
|
||||||
// The legacy custodial-position word is BANNED (REQ-012) — must not appear.
|
|
||||||
// Check the full banned-terms list via the lexicon package (no literals in
|
|
||||||
// source); FindBannedTerm does word-boundary matching so this is stricter
|
|
||||||
// than a naive substring check.
|
|
||||||
if term, ok := lexicon.FindBannedTerm(body); ok {
|
|
||||||
t.Errorf("GET /reach/new: body contains banned word %q", term)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachCreateValidRedirectsAndAtomicallyCreates(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/reach", strings.NewReader("holder_id=holder-new&public_key=pk-new"))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusFound {
|
|
||||||
t.Fatalf("POST /reach valid: status %d, want 302 (Found)", rec.Code)
|
|
||||||
}
|
|
||||||
loc := rec.Header().Get("Location")
|
|
||||||
if !strings.Contains(loc, "/reach/holder-new") {
|
|
||||||
t.Errorf("POST /reach: Location %q, want redirect to /reach/holder-new", loc)
|
|
||||||
}
|
|
||||||
// D-071: atomic creation — both Reach + Stash must be present.
|
|
||||||
reach, ok := srv.Store.GetReach("holder-new")
|
|
||||||
if !ok {
|
|
||||||
t.Fatalf("POST /reach: GetReach miss after create (atomicity broken)")
|
|
||||||
}
|
|
||||||
if !reach.IsNomad {
|
|
||||||
t.Errorf("POST /reach: created Reach IsNomad=false, want true (D-071)")
|
|
||||||
}
|
|
||||||
stash, ok := srv.Store.GetStash("holder-new")
|
|
||||||
if !ok {
|
|
||||||
t.Fatalf("POST /reach: GetStash miss after create (atomicity broken — D-071)")
|
|
||||||
}
|
|
||||||
if stash.HolderID != reach.HolderID {
|
|
||||||
t.Errorf("POST /reach: stash.HolderID %q != reach.HolderID %q (D-071)", stash.HolderID, reach.HolderID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachCreateEmptyHolderIDReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/reach", strings.NewReader("holder_id=&public_key=pk"))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST /reach empty holder: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
// G-026: rendered-HTML lexicon check scans the ERROR response body too.
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachCreatePathSeparatorReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/reach", strings.NewReader("holder_id=h/x&public_key=pk"))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST /reach path separator: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachCreateDuplicateReturns409(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/reach", strings.NewReader("holder_id=holder-alia&public_key=pk"))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusConflict {
|
|
||||||
t.Fatalf("POST /reach duplicate: status %d, want 409", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachDetailSeededReturnsReachAndStash(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/reach/holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /reach/holder-alia: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, "reach-holder-alia") {
|
|
||||||
t.Errorf("GET /reach/holder-alia: body missing reach-holder-alia")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "stash-holder-alia") {
|
|
||||||
t.Errorf("GET /reach/holder-alia: body missing associated stash-holder-alia")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "Grain") {
|
|
||||||
t.Errorf("GET /reach/holder-alia: body missing Stash balance in Grain")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestReachDetailMissingReturns404(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/reach/nobody", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusNotFound {
|
|
||||||
t.Fatalf("GET /reach/nobody: status %d, want 404", rec.Code)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,125 +0,0 @@
|
|||||||
// Package handlers holds the HTTP handlers for the OpenYield web UI screens.
|
|
||||||
//
|
|
||||||
// Each screen (Reach signup, Stash dashboard, Window authorization, Standing
|
|
||||||
// progress, Bloom accrual) gets its own handler file. handlers/server.go wires
|
|
||||||
// routes into the mux from web/server.go. Handlers render html/template
|
|
||||||
// templates against the mock store (web/store). Lexicon-clean by construction
|
|
||||||
// (REQ-012 / REQ-045): the lexicon_meta_web firewall scans these files.
|
|
||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
"html/template"
|
|
||||||
"net/http"
|
|
||||||
"os"
|
|
||||||
"path/filepath"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/web/store"
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
windowtypes "github.com/oy/openyield/x/window/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Server bundles the mock store + per-page templates + route registration.
|
|
||||||
// Each screen handler is a method on Server so it shares the store + tmpl.
|
|
||||||
//
|
|
||||||
// Template loading: base.html is parsed once, then each page template is
|
|
||||||
// parsed in a CLONE of the base set so the per-page "content" block does not
|
|
||||||
// collide across pages (Go html/template shares the block namespace within
|
|
||||||
// one set; cloning per page isolates each page's content block). This is the
|
|
||||||
// standard Go template pattern for layouts + pages.
|
|
||||||
type Server struct {
|
|
||||||
Store *store.Store
|
|
||||||
Pages map[string]*template.Template
|
|
||||||
}
|
|
||||||
|
|
||||||
// New constructs a Server with the given store + per-page templates loaded
|
|
||||||
// from templatesDir (the absolute or relative path to web/templates/).
|
|
||||||
func New(s *store.Store, templatesDir string) (*Server, error) {
|
|
||||||
funcs := template.FuncMap{
|
|
||||||
"divGrain": func(grain, unit int64) int64 {
|
|
||||||
if unit == 0 {
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
return grain / unit
|
|
||||||
},
|
|
||||||
"string": func(v any) string {
|
|
||||||
switch t := v.(type) {
|
|
||||||
case string:
|
|
||||||
return t
|
|
||||||
case windowtypes.WindowStatus:
|
|
||||||
return string(t)
|
|
||||||
case standingtypes.StandingBucket:
|
|
||||||
return string(t)
|
|
||||||
default:
|
|
||||||
return ""
|
|
||||||
}
|
|
||||||
},
|
|
||||||
}
|
|
||||||
basePath := filepath.Join(templatesDir, "base.html")
|
|
||||||
base, err := template.New("base.html").Funcs(funcs).ParseFiles(basePath)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("parse base: %w", err)
|
|
||||||
}
|
|
||||||
pages := map[string]*template.Template{}
|
|
||||||
pageGlob := filepath.Join(templatesDir, "*.html")
|
|
||||||
matches, err := filepath.Glob(pageGlob)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("glob pages: %w", err)
|
|
||||||
}
|
|
||||||
for _, p := range matches {
|
|
||||||
name := filepath.Base(p)
|
|
||||||
if name == "base.html" {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
clone, cerr := base.Clone()
|
|
||||||
if cerr != nil {
|
|
||||||
return nil, fmt.Errorf("clone for %s: %w", name, cerr)
|
|
||||||
}
|
|
||||||
pt, perr := clone.ParseFiles(p)
|
|
||||||
if perr != nil {
|
|
||||||
return nil, fmt.Errorf("parse %s: %w", name, perr)
|
|
||||||
}
|
|
||||||
pages[name] = pt
|
|
||||||
}
|
|
||||||
return &Server{Store: s, Pages: pages}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Register wires all screen routes into the given mux (Go 1.22 method
|
|
||||||
// patterns). Called by web/server.go after constructing the Server.
|
|
||||||
func (s *Server) Register(mux *http.ServeMux) {
|
|
||||||
s.registerReach(mux)
|
|
||||||
s.registerStash(mux)
|
|
||||||
s.registerWindow(mux)
|
|
||||||
s.registerStanding(mux)
|
|
||||||
s.registerBloom(mux)
|
|
||||||
}
|
|
||||||
|
|
||||||
// render executes the named page template with the given data, writing HTML
|
|
||||||
// to w. The page template invokes base.html and overrides the "content" block.
|
|
||||||
func (s *Server) render(w http.ResponseWriter, name string, data any) {
|
|
||||||
tmpl, ok := s.Pages[name]
|
|
||||||
if !ok {
|
|
||||||
http.Error(w, "template not found: "+name, http.StatusInternalServerError)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
||||||
if err := tmpl.ExecuteTemplate(w, "base.html", data); err != nil {
|
|
||||||
http.Error(w, "render error", http.StatusInternalServerError)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// RenderHome renders the home page (public so web/server.go can call it for
|
|
||||||
// the "/" route which lives outside handlers.Register).
|
|
||||||
func (s *Server) RenderHome(w http.ResponseWriter, data any) {
|
|
||||||
s.render(w, "home.html", data)
|
|
||||||
}
|
|
||||||
|
|
||||||
// templatesDir returns the default web/templates directory relative to the
|
|
||||||
// working directory. Used by web/server.go when constructing via New().
|
|
||||||
func DefaultTemplatesDir() string {
|
|
||||||
dir, _ := os.Getwd()
|
|
||||||
if filepath.Base(dir) == "web" || filepath.Base(dir) == "handlers" {
|
|
||||||
return filepath.Join(dir, "templates")
|
|
||||||
}
|
|
||||||
return "web/templates"
|
|
||||||
}
|
|
||||||
@@ -1,59 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// registerStanding wires the Standing + Freeholder signals route (REQ-043).
|
|
||||||
func (s *Server) registerStanding(mux *http.ServeMux) {
|
|
||||||
mux.HandleFunc("GET /standing/{reachID}", s.handleStanding)
|
|
||||||
}
|
|
||||||
|
|
||||||
// standingViewData is the template data for the Standing screen.
|
|
||||||
type standingViewData struct {
|
|
||||||
ReachID string
|
|
||||||
Found bool
|
|
||||||
Score float64
|
|
||||||
Bucket standingtypes.StandingBucket
|
|
||||||
Ratings []standingtypes.Rating
|
|
||||||
Vouches []standingtypes.Vouch
|
|
||||||
Slashes []standingtypes.Slash
|
|
||||||
Signals standingtypes.FreeholderSignals
|
|
||||||
Eligible bool
|
|
||||||
MinScore float64
|
|
||||||
MinCats int
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleStanding renders the Standing + Freeholder signals progress (REQ-043).
|
|
||||||
// Computed from mock Ratings/Vouches/Slashes using the locked x/standing/types
|
|
||||||
// constants + GetStandingBucket/ComputeDiversityBonus/GetVoucherWeight; the
|
|
||||||
// 4-signal progress via FreeholderSignals.IsFreeholderEligible().
|
|
||||||
func (s *Server) handleStanding(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("reachID")
|
|
||||||
_, ok := s.Store.GetReach(id)
|
|
||||||
if !ok {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
score, bucket := s.Store.ComputeStandingScore(id)
|
|
||||||
ratings := s.Store.ListRatings(id)
|
|
||||||
vouches := s.Store.ListVouches(id)
|
|
||||||
slashes := s.Store.ListSlashes(id)
|
|
||||||
signals := s.Store.ComputeFreeholderSignals(id)
|
|
||||||
|
|
||||||
s.render(w, "standing.html", standingViewData{
|
|
||||||
ReachID: id,
|
|
||||||
Found: true,
|
|
||||||
Score: score,
|
|
||||||
Bucket: bucket,
|
|
||||||
Ratings: ratings,
|
|
||||||
Vouches: vouches,
|
|
||||||
Slashes: slashes,
|
|
||||||
Signals: signals,
|
|
||||||
Eligible: signals.IsFreeholderEligible(),
|
|
||||||
MinScore: standingtypes.FreeholderMinStandingScore,
|
|
||||||
MinCats: standingtypes.FreeholderMinCategories,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
@@ -1,146 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestStandingEligibleHolderRendersAllSignalsEarned(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/standing/holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /standing/holder-alia: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// holder-alia: 12 ratings in 4 categories, 1 Vouch, mature Stash, balance 920000.
|
|
||||||
// All 4 signals earned -> Freeholder-eligible.
|
|
||||||
if !strings.Contains(body, "Freeholder-eligible") {
|
|
||||||
t.Errorf("body missing 'Freeholder-eligible' label")
|
|
||||||
}
|
|
||||||
// Score displayed with 1 decimal.
|
|
||||||
if !strings.Contains(body, "4.") {
|
|
||||||
t.Errorf("body missing score (expected 4.x)")
|
|
||||||
}
|
|
||||||
// All 4 signals should show 'earned'.
|
|
||||||
earnedCount := strings.Count(body, "earned")
|
|
||||||
if earnedCount < 4 {
|
|
||||||
t.Errorf("body has %d 'earned' badges, want >=4 (all signals earned for holder-alia)", earnedCount)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestStandingNotEligibleHolderShowsNotYet(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/standing/holder-bryn", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /standing/holder-bryn: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// holder-bryn: 3 ratings in 1 category, no Vouch, immature Stash.
|
|
||||||
// Not eligible.
|
|
||||||
if !strings.Contains(body, "not yet") {
|
|
||||||
t.Errorf("body missing 'not yet' badge for non-eligible holder-bryn")
|
|
||||||
}
|
|
||||||
if strings.Contains(body, "Freeholder-eligible\">yes") {
|
|
||||||
t.Errorf("body shows eligible=yes for holder-bryn (should not be eligible)")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestStandingMissingReturns404(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/standing/nobody", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusNotFound {
|
|
||||||
t.Fatalf("GET /standing/nobody: status %d, want 404", rec.Code)
|
|
||||||
}
|
|
||||||
// G-026: rendered-HTML lexicon check on the ERROR response body too.
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestStandingScoreComputedFromLockedConstants (P4 regression guard): asserts
|
|
||||||
// ComputeStandingScore uses the x/standing/types locked constants
|
|
||||||
// (PriorMean=4.0, PriorWeight=10, ComputeDiversityBonus, GetVoucherWeight,
|
|
||||||
// GetStandingBucket) — NOT a hardcoded score. This test would FAIL if the
|
|
||||||
// handler hardcoded a score instead of computing from the locked constants.
|
|
||||||
func TestStandingScoreComputedFromLockedConstants(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
score, bucket := srv.Store.ComputeStandingScore("holder-alia")
|
|
||||||
// D-073 pattern: the score must be derived from the locked constants, not
|
|
||||||
// a magic number. Assert the prior mean is 4.0 and the score is pulled
|
|
||||||
// toward it (Bayesian shrinkage) + diversity bonus for 4 categories.
|
|
||||||
if standingtypes.PriorMean != 4.0 {
|
|
||||||
t.Fatalf("D-073: PriorMean = %v, want 4.0 (locked constant)", standingtypes.PriorMean)
|
|
||||||
}
|
|
||||||
if standingtypes.PriorWeight != 10 {
|
|
||||||
t.Fatalf("D-073: PriorWeight = %v, want 10 (locked constant)", standingtypes.PriorWeight)
|
|
||||||
}
|
|
||||||
// holder-alia has 4 categories -> diversity bonus 0.10 (DiversityBonus4Cats).
|
|
||||||
bonus := standingtypes.ComputeDiversityBonus(4)
|
|
||||||
if bonus != standingtypes.DiversityBonus4Cats {
|
|
||||||
t.Errorf("ComputeDiversityBonus(4) = %v, want %v (locked constant)", bonus, standingtypes.DiversityBonus4Cats)
|
|
||||||
}
|
|
||||||
// The score must be > 4.5 (ratings 4.6-4.9 + diversity bonus 0.10).
|
|
||||||
if score < 4.5 {
|
|
||||||
t.Errorf("score for holder-alia = %.2f, want >= 4.5 (12 ratings 4.6-4.9 + 4-cat bonus)", score)
|
|
||||||
}
|
|
||||||
// Bucket must be Preferred or Top (score >= 4.5, 12 ratings >= 10).
|
|
||||||
if bucket != standingtypes.BucketPreferred && bucket != standingtypes.BucketTop {
|
|
||||||
t.Errorf("bucket for holder-alia = %q, want Preferred or Top", bucket)
|
|
||||||
}
|
|
||||||
// holder-bryn has 3 ratings in 1 category -> bucket New (< 10 ratings).
|
|
||||||
_, brynBucket := srv.Store.ComputeStandingScore("holder-bryn")
|
|
||||||
if brynBucket != standingtypes.BucketNew {
|
|
||||||
t.Errorf("bucket for holder-bryn = %q, want New (< 10 ratings)", brynBucket)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestFreeholderEligibleBadgeReflectsMethod: asserts the rendered badge
|
|
||||||
// matches FreeholderSignals.IsFreeholderEligible() (the real method).
|
|
||||||
func TestFreeholderEligibleBadgeReflectsMethod(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
|
|
||||||
// holder-alia: eligible (all 4 signals true).
|
|
||||||
aliaSignals := srv.Store.ComputeFreeholderSignals("holder-alia")
|
|
||||||
if !aliaSignals.IsFreeholderEligible() {
|
|
||||||
t.Errorf("holder-alia IsFreeholderEligible = false, want true (signals=%+v)", aliaSignals)
|
|
||||||
}
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/standing/holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if !strings.Contains(rec.Body.String(), "yes") {
|
|
||||||
t.Errorf("holder-alia: body missing 'yes' eligible badge (IsFreeholderEligible=true)")
|
|
||||||
}
|
|
||||||
|
|
||||||
// holder-bryn: not eligible.
|
|
||||||
brynSignals := srv.Store.ComputeFreeholderSignals("holder-bryn")
|
|
||||||
if brynSignals.IsFreeholderEligible() {
|
|
||||||
t.Errorf("holder-bryn IsFreeholderEligible = true, want false (signals=%+v)", brynSignals)
|
|
||||||
}
|
|
||||||
rec2 := httptest.NewRecorder()
|
|
||||||
req2 := httptest.NewRequest("GET", "/standing/holder-bryn", nil)
|
|
||||||
mux.ServeHTTP(rec2, req2)
|
|
||||||
if !strings.Contains(rec2.Body.String(), "not yet") {
|
|
||||||
t.Errorf("holder-bryn: body missing 'not yet' (IsFreeholderEligible=false)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertion that the handler uses the real x/standing/types struct.
|
|
||||||
var _ standingtypes.FreeholderSignals
|
|
||||||
@@ -1,68 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
|
|
||||||
breadtypes "github.com/oy/openyield/x/bread/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// registerStash wires the Stash dashboard route (REQ-041) into the mux.
|
|
||||||
func (s *Server) registerStash(mux *http.ServeMux) {
|
|
||||||
mux.HandleFunc("GET /stash/{holderID}", s.handleStashDashboard)
|
|
||||||
}
|
|
||||||
|
|
||||||
// stashViewData is the template data for the Stash dashboard. It carries the
|
|
||||||
// real x/*/types structs plus the Bread-scale conversion (computed from the
|
|
||||||
// x/bread/types code constants per D-073) and the maturity progress.
|
|
||||||
type stashViewData struct {
|
|
||||||
Stash stashtypes.Stash
|
|
||||||
Activity stashtypes.StashActivity
|
|
||||||
Found bool
|
|
||||||
BreadScale []breadtypes.BreadScale
|
|
||||||
BalanceBread int64
|
|
||||||
MaturityPct int
|
|
||||||
Mature bool
|
|
||||||
ThresholdDays uint32
|
|
||||||
MaxGapDays uint32
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleStashDashboard renders the Stash dashboard (REQ-041): balance in Grain
|
|
||||||
// + Bread-scale conversion (using x/bread/types.BreadScaleAll() + GrainsPerBread
|
|
||||||
// per D-073 — code constants, NOT docs) + 90-day maturity progress bar
|
|
||||||
// (StashActivity.IsMature, MaturityThresholdDays=90).
|
|
||||||
func (s *Server) handleStashDashboard(w http.ResponseWriter, r *http.Request) {
|
|
||||||
holderID := r.PathValue("holderID")
|
|
||||||
stash, ok := s.Store.GetStash(holderID)
|
|
||||||
if !ok {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
activity, _ := s.Store.GetStashActivity(stash.StashID)
|
|
||||||
|
|
||||||
// D-073: Bread-scale conversion from x/bread/types code constants.
|
|
||||||
scale := breadtypes.BreadScaleAll()
|
|
||||||
balanceBread := stash.BalanceGrain / breadtypes.GrainsPerBread
|
|
||||||
|
|
||||||
// Maturity progress: ActiveDays / MaturityThresholdDays, capped at 100%.
|
|
||||||
threshold := uint32(stashtypes.MaturityThresholdDays)
|
|
||||||
pct := int(float64(activity.ActiveDays) / float64(threshold) * 100)
|
|
||||||
if pct > 100 {
|
|
||||||
pct = 100
|
|
||||||
}
|
|
||||||
if pct < 0 {
|
|
||||||
pct = 0
|
|
||||||
}
|
|
||||||
|
|
||||||
s.render(w, "stash.html", stashViewData{
|
|
||||||
Stash: stash,
|
|
||||||
Activity: activity,
|
|
||||||
Found: true,
|
|
||||||
BreadScale: scale,
|
|
||||||
BalanceBread: balanceBread,
|
|
||||||
MaturityPct: pct,
|
|
||||||
Mature: activity.IsMature(),
|
|
||||||
ThresholdDays: threshold,
|
|
||||||
MaxGapDays: stashtypes.MaxGapForMaturity,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
@@ -1,156 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
breadtypes "github.com/oy/openyield/x/bread/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestStashDashboardSeededMatureHolder(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/stash/holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /stash/holder-alia: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// Balance in Grain present.
|
|
||||||
if !strings.Contains(body, "Grain") {
|
|
||||||
t.Errorf("body missing 'Grain' balance")
|
|
||||||
}
|
|
||||||
// Bread-scale conversion table present (all 11 denominations from BreadScaleAll).
|
|
||||||
for _, ds := range breadtypes.BreadScaleAll() {
|
|
||||||
if !strings.Contains(body, ds.Name) {
|
|
||||||
t.Errorf("body missing Bread-scale denomination %q", ds.Name)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// Mature holder (ActiveDays=92, MaxGap=10): progress ~100%, Mature badge.
|
|
||||||
if !strings.Contains(body, "Mature") {
|
|
||||||
t.Errorf("body missing 'Mature' badge for mature holder-alia")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestStashDashboardImmatureHolder(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/stash/holder-bryn", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /stash/holder-bryn: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// Immature holder (ActiveDays=45, MaxGap=5): Not mature badge.
|
|
||||||
if !strings.Contains(body, "Not mature") {
|
|
||||||
t.Errorf("body missing 'Not mature' badge for immature holder-bryn")
|
|
||||||
}
|
|
||||||
// Progress bar at 50% (45/90).
|
|
||||||
if !strings.Contains(body, "50%") {
|
|
||||||
t.Errorf("body missing 50%% progress for holder-bryn (45/90 days)")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestStashDashboardMissingReturns404(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/stash/nobody", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusNotFound {
|
|
||||||
t.Fatalf("GET /stash/nobody: status %d, want 404", rec.Code)
|
|
||||||
}
|
|
||||||
// G-026: rendered-HTML lexicon check on the ERROR response body too.
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestStashBreadScaleConversionCorrectness (D-073 regression guard): asserts
|
|
||||||
// the Stash dashboard uses x/bread/types code constants (GrainsPerBread=10000,
|
|
||||||
// BreadScaleAll() with Grain=1, Crumb=100, Bread=10000...), NOT the outdated
|
|
||||||
// docs/shared/bread-scale.md (which claims 1,000x ratios). This test would FAIL
|
|
||||||
// if the handler hardcoded the docs values instead of using the code constants.
|
|
||||||
func TestStashBreadScaleConversionCorrectness(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/stash/holder-alia", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
body := rec.Body.String()
|
|
||||||
|
|
||||||
// D-073: the code constants are the source of truth.
|
|
||||||
// GrainsPerBread must be 10000 (code), NOT 1000 (docs claim 1 Crumb=1000 Grain).
|
|
||||||
if breadtypes.GrainsPerBread != 10000 {
|
|
||||||
t.Fatalf("D-073: x/bread/types.GrainsPerBread = %d, want 10000 (code constant)", breadtypes.GrainsPerBread)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The handler computes BalanceBread = BalanceGrain / GrainsPerBread.
|
|
||||||
// holder-alia seed: BalanceGrain = 920000 -> 92 Bread.
|
|
||||||
stash, ok := srv.Store.GetStash("holder-alia")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded holder-alia stash missing")
|
|
||||||
}
|
|
||||||
wantBread := stash.BalanceGrain / breadtypes.GrainsPerBread
|
|
||||||
wantBreadStr := []byte(formatInt(wantBread))
|
|
||||||
if !strings.Contains(body, string(wantBreadStr)) {
|
|
||||||
t.Errorf("D-073: body missing expected Bread conversion %d (from %d Grain / %d GrainsPerBread)",
|
|
||||||
wantBread, stash.BalanceGrain, breadtypes.GrainsPerBread)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The Bread-scale table must include the code-constant Grain values.
|
|
||||||
scale := breadtypes.BreadScaleAll()
|
|
||||||
for _, ds := range scale {
|
|
||||||
if !strings.Contains(body, formatInt(ds.GrainValue)) {
|
|
||||||
t.Errorf("D-073: body missing Bread-scale GrainValue %d for %s", ds.GrainValue, ds.Name)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Regression guard: if someone used the outdated docs value (1 Crumb = 1000
|
|
||||||
// Grain) instead of the code constant (1 Crumb = 100 Grain), the Crumb row
|
|
||||||
// would show 1000 — assert it shows 100 (the code value).
|
|
||||||
crumbs := scale[1] // index 1 = Crumb
|
|
||||||
if crumbs.Name != "Crumb" || crumbs.GrainValue != 100 {
|
|
||||||
t.Fatalf("D-073: BreadScaleAll()[1] = {%s, %d}, want {Crumb, 100}", crumbs.Name, crumbs.GrainValue)
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "100") {
|
|
||||||
t.Errorf("D-073: body missing code-constant Crumb=100 Grain (would show 1000 if docs values were used)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions that the handler uses the real x/*/types structs
|
|
||||||
// (D-067: the UI grounds in the real Go type definitions).
|
|
||||||
var _ stashtypes.Stash
|
|
||||||
var _ stashtypes.StashActivity
|
|
||||||
|
|
||||||
// formatInt is a tiny strconv.Itoa without the import (keeps test deps minimal).
|
|
||||||
func formatInt(n int64) string {
|
|
||||||
if n == 0 {
|
|
||||||
return "0"
|
|
||||||
}
|
|
||||||
neg := n < 0
|
|
||||||
if neg {
|
|
||||||
n = -n
|
|
||||||
}
|
|
||||||
var buf [20]byte
|
|
||||||
i := len(buf)
|
|
||||||
for n > 0 {
|
|
||||||
i--
|
|
||||||
buf[i] = byte('0' + n%10)
|
|
||||||
n /= 10
|
|
||||||
}
|
|
||||||
if neg {
|
|
||||||
i--
|
|
||||||
buf[i] = '-'
|
|
||||||
}
|
|
||||||
return string(buf[i:])
|
|
||||||
}
|
|
||||||
@@ -1,119 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"strconv"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
windowtypes "github.com/oy/openyield/x/window/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// registerWindow wires the Window authorization routes (REQ-042) into the mux.
|
|
||||||
func (s *Server) registerWindow(mux *http.ServeMux) {
|
|
||||||
mux.HandleFunc("GET /window", s.handleWindowList)
|
|
||||||
mux.HandleFunc("GET /window/new", s.handleWindowNew)
|
|
||||||
mux.HandleFunc("POST /window", s.handleWindowOpen)
|
|
||||||
mux.HandleFunc("GET /window/{id}", s.handleWindowDetail)
|
|
||||||
mux.HandleFunc("POST /window/{id}/activate", s.handleWindowActivate)
|
|
||||||
mux.HandleFunc("POST /window/{id}/revoke", s.handleWindowRevoke)
|
|
||||||
mux.HandleFunc("POST /window/{id}/expire", s.handleWindowExpire)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowList renders all Windows for a grantor holder (defaults to
|
|
||||||
// holder-alia if no query param, so the list view has something to show).
|
|
||||||
func (s *Server) handleWindowList(w http.ResponseWriter, r *http.Request) {
|
|
||||||
grantor := r.URL.Query().Get("grantor")
|
|
||||||
if grantor == "" {
|
|
||||||
grantor = "holder-alia"
|
|
||||||
}
|
|
||||||
windows := s.Store.ListWindows(grantor)
|
|
||||||
s.render(w, "window_list.html", map[string]any{"Windows": windows, "Grantor": grantor})
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowNew renders the "Open a Window" form.
|
|
||||||
func (s *Server) handleWindowNew(w http.ResponseWriter, r *http.Request) {
|
|
||||||
s.render(w, "window_new.html", nil)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowOpen handles the POST from the "Open a Window" form. Calls
|
|
||||||
// store.OpenWindow (creates a Window status=Open + an initial AuditEntry).
|
|
||||||
func (s *Server) handleWindowOpen(w http.ResponseWriter, r *http.Request) {
|
|
||||||
grantor := r.FormValue("grantor_holder")
|
|
||||||
grantee := r.FormValue("grantee")
|
|
||||||
scopeKind := windowtypes.ScopeKind(r.FormValue("scope_kind"))
|
|
||||||
resourceID := r.FormValue("resource_id")
|
|
||||||
startStr := r.FormValue("start_unix")
|
|
||||||
endStr := r.FormValue("end_unix")
|
|
||||||
maxActionsStr := r.FormValue("max_actions")
|
|
||||||
|
|
||||||
if grantor == "" {
|
|
||||||
http.Error(w, "grantor holder is required", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
if grantee == "" {
|
|
||||||
http.Error(w, "grantee is required", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
start, _ := strconv.ParseInt(startStr, 10, 64)
|
|
||||||
end, _ := strconv.ParseInt(endStr, 10, 64)
|
|
||||||
if start == 0 {
|
|
||||||
start = time.Now().Unix()
|
|
||||||
}
|
|
||||||
if end == 0 {
|
|
||||||
end = start + 3600
|
|
||||||
}
|
|
||||||
maxActions, _ := strconv.ParseUint(maxActionsStr, 10, 32)
|
|
||||||
if maxActions == 0 {
|
|
||||||
maxActions = 10
|
|
||||||
}
|
|
||||||
scope := windowtypes.Scope{Kind: scopeKind, ResourceID: resourceID}
|
|
||||||
rateLimit := windowtypes.RateLimit{MaxActions: uint32(maxActions), PerDurationSeconds: 3600}
|
|
||||||
win, err := s.Store.OpenWindow(grantor, grantee, scope, start, end, rateLimit)
|
|
||||||
if err != nil {
|
|
||||||
http.Error(w, "could not open a Window: "+err.Error(), http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Redirect(w, r, "/window/"+win.WindowID, http.StatusFound)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowDetail renders one Window + its lifecycle state + audit log.
|
|
||||||
func (s *Server) handleWindowDetail(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("id")
|
|
||||||
win, ok := s.Store.GetWindow(id)
|
|
||||||
if !ok {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
auditLog := s.Store.GetAuditLog(id)
|
|
||||||
s.render(w, "window_detail.html", map[string]any{"Window": win, "AuditLog": auditLog})
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowActivate transitions Open → Active (calls Window.Activate).
|
|
||||||
func (s *Server) handleWindowActivate(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("id")
|
|
||||||
if err := s.Store.ActivateWindow(id); err != nil {
|
|
||||||
http.Error(w, "could not activate: "+err.Error(), http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Redirect(w, r, "/window/"+id, http.StatusSeeOther)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowRevoke transitions to Revoked (calls Window.Revoke; idempotent).
|
|
||||||
func (s *Server) handleWindowRevoke(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("id")
|
|
||||||
if err := s.Store.RevokeWindow(id); err != nil {
|
|
||||||
http.Error(w, "could not revoke: "+err.Error(), http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Redirect(w, r, "/window/"+id, http.StatusSeeOther)
|
|
||||||
}
|
|
||||||
|
|
||||||
// handleWindowExpire transitions to Expired (calls Window.Expire).
|
|
||||||
func (s *Server) handleWindowExpire(w http.ResponseWriter, r *http.Request) {
|
|
||||||
id := r.PathValue("id")
|
|
||||||
if err := s.Store.ExpireWindow(id); err != nil {
|
|
||||||
http.Error(w, "could not expire: "+err.Error(), http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Redirect(w, r, "/window/"+id, http.StatusSeeOther)
|
|
||||||
}
|
|
||||||
@@ -1,363 +0,0 @@
|
|||||||
package handlers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
windowtypes "github.com/oy/openyield/x/window/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestWindowOpenCreatesWindowStatusOpen(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
body := "grantor_holder=holder-alia&grantee=service-1&scope_kind=ReadStash&resource_id=stash-holder-alia&max_actions=5"
|
|
||||||
req := httptest.NewRequest("POST", "/window", strings.NewReader(body))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusFound {
|
|
||||||
t.Fatalf("POST /window: status %d, want 302", rec.Code)
|
|
||||||
}
|
|
||||||
loc := rec.Header().Get("Location")
|
|
||||||
if !strings.HasPrefix(loc, "/window/window-") {
|
|
||||||
t.Errorf("POST /window: Location %q, want /window/window-...", loc)
|
|
||||||
}
|
|
||||||
// Extract the windowID and verify it exists with Status=Open + an initial AuditEntry.
|
|
||||||
windowID := strings.TrimPrefix(loc, "/window/")
|
|
||||||
win, ok := srv.Store.GetWindow(windowID)
|
|
||||||
if !ok {
|
|
||||||
t.Fatalf("POST /window: GetWindow(%q) miss", windowID)
|
|
||||||
}
|
|
||||||
if win.Status != windowtypes.StatusOpen {
|
|
||||||
t.Errorf("POST /window: created Window status %q, want Open", win.Status)
|
|
||||||
}
|
|
||||||
audit := srv.Store.GetAuditLog(windowID)
|
|
||||||
if len(audit) != 1 {
|
|
||||||
t.Errorf("POST /window: audit log len %d, want 1 (initial entry)", len(audit))
|
|
||||||
}
|
|
||||||
if audit[0].Action != "open" {
|
|
||||||
t.Errorf("POST /window: initial audit action %q, want open", audit[0].Action)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowActivateTransitionsOpenToActive(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, err := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("OpenWindow: %v", err)
|
|
||||||
}
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/"+win.WindowID+"/activate", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusSeeOther {
|
|
||||||
t.Fatalf("POST activate: status %d, want 303", rec.Code)
|
|
||||||
}
|
|
||||||
// Lifecycle correctness: assert the real Window.Activate() was invoked
|
|
||||||
// (the handler calls store.ActivateWindow which calls w.Activate()).
|
|
||||||
updated, ok := srv.Store.GetWindow(win.WindowID)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("window missing after activate")
|
|
||||||
}
|
|
||||||
if updated.Status != windowtypes.StatusActive {
|
|
||||||
t.Errorf("after activate: status %q, want Active (Window.Activate was NOT invoked)", updated.Status)
|
|
||||||
}
|
|
||||||
audit := srv.Store.GetAuditLog(win.WindowID)
|
|
||||||
if len(audit) != 2 {
|
|
||||||
t.Errorf("after activate: audit log len %d, want 2 (initial + activate)", len(audit))
|
|
||||||
}
|
|
||||||
if audit[1].Action != "activate" {
|
|
||||||
t.Errorf("after activate: audit[1].Action %q, want activate", audit[1].Action)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowRevokeTransitionsToRevoked(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/"+win.WindowID+"/revoke", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusSeeOther {
|
|
||||||
t.Fatalf("POST revoke: status %d, want 303", rec.Code)
|
|
||||||
}
|
|
||||||
updated, _ := srv.Store.GetWindow(win.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusRevoked {
|
|
||||||
t.Errorf("after revoke: status %q, want Revoked (Window.Revoke was NOT invoked)", updated.Status)
|
|
||||||
}
|
|
||||||
if !updated.Revoked {
|
|
||||||
t.Errorf("after revoke: Revoked flag false, want true")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowRevokeIdempotentOnAlreadyRevoked(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
_ = srv.Store.RevokeWindow(win.WindowID)
|
|
||||||
auditBefore := len(srv.Store.GetAuditLog(win.WindowID))
|
|
||||||
|
|
||||||
// Second revoke is a no-op (idempotent): no new AuditEntry.
|
|
||||||
_ = srv.Store.RevokeWindow(win.WindowID)
|
|
||||||
auditAfter := len(srv.Store.GetAuditLog(win.WindowID))
|
|
||||||
if auditAfter != auditBefore {
|
|
||||||
t.Errorf("idempotent revoke: audit log grew %d -> %d (revoke on already-revoked must be a no-op)", auditBefore, auditAfter)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowRevokeOnExpiredIsNoOp(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
_ = srv.Store.ExpireWindow(win.WindowID)
|
|
||||||
auditBefore := len(srv.Store.GetAuditLog(win.WindowID))
|
|
||||||
|
|
||||||
// Revoke on an Expired window is a no-op (Expired is terminal — v0.2 contract).
|
|
||||||
_ = srv.Store.RevokeWindow(win.WindowID)
|
|
||||||
updated, _ := srv.Store.GetWindow(win.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusExpired {
|
|
||||||
t.Errorf("revoke-on-expired: status %q, want Expired (terminal state must win)", updated.Status)
|
|
||||||
}
|
|
||||||
auditAfter := len(srv.Store.GetAuditLog(win.WindowID))
|
|
||||||
if auditAfter != auditBefore {
|
|
||||||
t.Errorf("revoke-on-expired: audit log grew %d -> %d (must be a no-op)", auditBefore, auditAfter)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowExpireTransitionsToExpired(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
|
|
||||||
_ = srv.Store.ExpireWindow(win.WindowID)
|
|
||||||
updated, _ := srv.Store.GetWindow(win.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusExpired {
|
|
||||||
t.Errorf("after expire: status %q, want Expired (Window.Expire was NOT invoked)", updated.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowDetailRendersLifecycleAndAuditLog(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/window/"+win.WindowID, nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /window/%s: status %d, want 200", win.WindowID, rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, "Active") {
|
|
||||||
t.Errorf("detail: body missing Active badge")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "activate") {
|
|
||||||
t.Errorf("detail: body missing activate audit-log entry")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "open") {
|
|
||||||
t.Errorf("detail: body missing open audit-log entry")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowDetailMissingReturns404(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/window/window-nobody", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusNotFound {
|
|
||||||
t.Fatalf("GET /window/window-nobody: status %d, want 404", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowOpenEmptyGrantorReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
body := "grantor_holder=&grantee=service-1&scope_kind=ReadStash"
|
|
||||||
req := httptest.NewRequest("POST", "/window", strings.NewReader(body))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST /window empty grantor: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
// G-026: rendered-HTML lexicon check on the ERROR response body too.
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertion that the handler uses the real x/window/types struct
|
|
||||||
// (D-067: the UI grounds in the real Go type definitions).
|
|
||||||
var _ windowtypes.Window
|
|
||||||
|
|
||||||
func TestWindowListRendersSeededEmpty(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/window", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /window: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
// No windows yet for holder-alia (fresh store) -> empty message.
|
|
||||||
if !strings.Contains(body, "Open a Window") {
|
|
||||||
t.Errorf("GET /window: body missing 'Open a Window' link")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowListRendersCreatedWindows(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 5, PerDurationSeconds: 3600}
|
|
||||||
w, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/window", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /window: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, w.WindowID) {
|
|
||||||
t.Errorf("GET /window: body missing created window %s", w.WindowID)
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "service-1") {
|
|
||||||
t.Errorf("GET /window: body missing grantee service-1")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowNewRendersForm(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("GET", "/window/new", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("GET /window/new: status %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
body := rec.Body.String()
|
|
||||||
if !strings.Contains(body, "Open a Window") {
|
|
||||||
t.Errorf("GET /window/new: body missing 'Open a Window' label")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "ReadStash") {
|
|
||||||
t.Errorf("GET /window/new: body missing ScopeKind option ReadStash")
|
|
||||||
}
|
|
||||||
if !strings.Contains(body, "ProcessPassActForStand") {
|
|
||||||
t.Errorf("GET /window/new: body missing ScopeKind option ProcessPassActForStand")
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, body)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowOpenEmptyGranteeReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
body := "grantor_holder=holder-alia&grantee=&scope_kind=ReadStash"
|
|
||||||
req := httptest.NewRequest("POST", "/window", strings.NewReader(body))
|
|
||||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST /window empty grantee: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowActivateNotFoundReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/window-nobody/activate", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST activate nobody: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowRevokeNotFoundReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/window-nobody/revoke", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST revoke nobody: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowExpireNotFoundReturns400(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/window-nobody/expire", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusBadRequest {
|
|
||||||
t.Fatalf("POST expire nobody: status %d, want 400", rec.Code)
|
|
||||||
}
|
|
||||||
assertNoBannedTerms(t, rec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestWindowRevokeAndExpireHandlersRedirect(t *testing.T) {
|
|
||||||
srv := newTestServer(t)
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
srv.Register(mux)
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-holder-alia"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 10, PerDurationSeconds: 3600}
|
|
||||||
win, _ := srv.Store.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
_ = srv.Store.ActivateWindow(win.WindowID)
|
|
||||||
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
req := httptest.NewRequest("POST", "/window/"+win.WindowID+"/revoke", nil)
|
|
||||||
mux.ServeHTTP(rec, req)
|
|
||||||
if rec.Code != http.StatusSeeOther {
|
|
||||||
t.Fatalf("POST revoke: status %d, want 303", rec.Code)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Expire on a revoked window: revoked is not terminal for expire, so it
|
|
||||||
// transitions to Expired (Window.Expire sets status unconditionally).
|
|
||||||
rec2 := httptest.NewRecorder()
|
|
||||||
req2 := httptest.NewRequest("POST", "/window/"+win.WindowID+"/expire", nil)
|
|
||||||
mux.ServeHTTP(rec2, req2)
|
|
||||||
if rec2.Code != http.StatusSeeOther {
|
|
||||||
t.Fatalf("POST expire: status %d, want 303", rec2.Code)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
package main
|
|
||||||
|
|
||||||
func main() {
|
|
||||||
runServer()
|
|
||||||
}
|
|
||||||
@@ -1,42 +0,0 @@
|
|||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"log"
|
|
||||||
"net/http"
|
|
||||||
"os"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/web/handlers"
|
|
||||||
"github.com/oy/openyield/web/store"
|
|
||||||
)
|
|
||||||
|
|
||||||
func runServer() {
|
|
||||||
port := os.Getenv("PORT")
|
|
||||||
if port == "" {
|
|
||||||
port = "8080"
|
|
||||||
}
|
|
||||||
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
|
|
||||||
srv, err := handlers.New(store.NewStore(), "web/templates")
|
|
||||||
if err != nil {
|
|
||||||
log.Fatalf("init handlers: %v", err)
|
|
||||||
}
|
|
||||||
srv.Register(mux)
|
|
||||||
|
|
||||||
// Home page (rendered via the handlers' page machinery too).
|
|
||||||
mux.HandleFunc("GET /", func(w http.ResponseWriter, r *http.Request) {
|
|
||||||
if r.URL.Path != "/" {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
srv.RenderHome(w, nil)
|
|
||||||
})
|
|
||||||
|
|
||||||
mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServer(http.Dir("web/static"))))
|
|
||||||
|
|
||||||
server := &http.Server{Addr: ":" + port, Handler: mux}
|
|
||||||
log.Printf("OpenYield web on :%s", port)
|
|
||||||
if err := server.ListenAndServe(); err != nil {
|
|
||||||
log.Fatalf("server: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Vendored
-5
File diff suppressed because one or more lines are too long
@@ -1,78 +0,0 @@
|
|||||||
/* style.css — OpenYield web UI minimal styling (lexicon-clean).
|
|
||||||
No banned terms in comments or class names (REQ-012/REQ-045). */
|
|
||||||
|
|
||||||
:root {
|
|
||||||
--bg: #0d1117;
|
|
||||||
--panel: #161b22;
|
|
||||||
--ink: #c9d1d9;
|
|
||||||
--muted: #8b949e;
|
|
||||||
--accent: #58a6ff;
|
|
||||||
--line: #30363d;
|
|
||||||
}
|
|
||||||
|
|
||||||
* { box-sizing: border-box; }
|
|
||||||
|
|
||||||
body {
|
|
||||||
margin: 0;
|
|
||||||
font-family: system-ui, -apple-system, sans-serif;
|
|
||||||
background: var(--bg);
|
|
||||||
color: var(--ink);
|
|
||||||
line-height: 1.5;
|
|
||||||
}
|
|
||||||
|
|
||||||
a { color: var(--accent); text-decoration: none; }
|
|
||||||
a:hover { text-decoration: underline; }
|
|
||||||
|
|
||||||
header.nav {
|
|
||||||
border-bottom: 1px solid var(--line);
|
|
||||||
padding: 0.75rem 1.5rem;
|
|
||||||
display: flex;
|
|
||||||
gap: 1.25rem;
|
|
||||||
align-items: center;
|
|
||||||
background: var(--panel);
|
|
||||||
}
|
|
||||||
header.nav .brand { font-weight: 600; color: var(--ink); }
|
|
||||||
header.nav a { color: var(--muted); }
|
|
||||||
header.nav a:hover { color: var(--accent); }
|
|
||||||
|
|
||||||
main { max-width: 960px; margin: 2rem auto; padding: 0 1.5rem; }
|
|
||||||
|
|
||||||
footer {
|
|
||||||
border-top: 1px solid var(--line);
|
|
||||||
padding: 1rem 1.5rem;
|
|
||||||
color: var(--muted);
|
|
||||||
font-size: 0.85rem;
|
|
||||||
text-align: center;
|
|
||||||
}
|
|
||||||
|
|
||||||
.panel {
|
|
||||||
background: var(--panel);
|
|
||||||
border: 1px solid var(--line);
|
|
||||||
border-radius: 6px;
|
|
||||||
padding: 1.25rem;
|
|
||||||
margin-bottom: 1.5rem;
|
|
||||||
}
|
|
||||||
|
|
||||||
table { width: 100%; border-collapse: collapse; }
|
|
||||||
th, td { text-align: left; padding: 0.5rem 0.75rem; border-bottom: 1px solid var(--line); }
|
|
||||||
th { color: var(--muted); font-weight: 600; font-size: 0.85rem; text-transform: uppercase; letter-spacing: 0.04em; }
|
|
||||||
|
|
||||||
form .field { margin-bottom: 1rem; }
|
|
||||||
form label { display: block; margin-bottom: 0.25rem; color: var(--muted); font-size: 0.9rem; }
|
|
||||||
form input[type=text], form input[type=password] {
|
|
||||||
width: 100%; max-width: 32rem;
|
|
||||||
padding: 0.5rem 0.65rem;
|
|
||||||
background: var(--bg);
|
|
||||||
border: 1px solid var(--line);
|
|
||||||
border-radius: 4px;
|
|
||||||
color: var(--ink);
|
|
||||||
font-family: monospace;
|
|
||||||
}
|
|
||||||
button, .btn {
|
|
||||||
background: var(--accent); color: #0d1117; border: none;
|
|
||||||
padding: 0.5rem 1rem; border-radius: 4px; font-weight: 600; cursor: pointer;
|
|
||||||
}
|
|
||||||
button:hover, .btn:hover { opacity: 0.9; text-decoration: none; }
|
|
||||||
|
|
||||||
.error { color: #f85149; }
|
|
||||||
.muted { color: var(--muted); }
|
|
||||||
@@ -1,137 +0,0 @@
|
|||||||
package store
|
|
||||||
|
|
||||||
import (
|
|
||||||
"time"
|
|
||||||
|
|
||||||
bloomtypes "github.com/oy/openyield/x/bloom/types"
|
|
||||||
identitytypes "github.com/oy/openyield/x/identity/types"
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// seed populates the store with a few pre-existing Reach/Stash pairs for the
|
|
||||||
// list view. All strings lexicon-clean ("Holder"/"Reach"/"Stash"; NOT the
|
|
||||||
// banned financial terms). Two fixtures: one mature (90+ active days),
|
|
||||||
// one immature (45 active days) so the Stash dashboard (P2) can show both
|
|
||||||
// states. P4 seeds Ratings/Vouches so the Standing screen can show a
|
|
||||||
// Freeholder-eligible Reach (holder-alia) vs a non-eligible one (holder-bryn).
|
|
||||||
func (s *Store) seed() {
|
|
||||||
now := time.Now().Unix()
|
|
||||||
seedOne(s, "holder-alia", "pk-alia-001", now, 920000, 92, 10)
|
|
||||||
seedOne(s, "holder-bryn", "pk-bryn-002", now, 410000, 45, 5)
|
|
||||||
seedStanding(s, now)
|
|
||||||
seedBloom(s, now)
|
|
||||||
}
|
|
||||||
|
|
||||||
// seedBloom seeds mock BloomRecords per Stash (P5). holder-alia gets a record
|
|
||||||
// at the target rate (450 bps = 4.5%); holder-bryn gets a record at 420 bps
|
|
||||||
// (4.2%, within the 4.0%-5.0% band). AccruedGrain is a mock value.
|
|
||||||
func seedBloom(s *Store, now int64) {
|
|
||||||
s.bloomRecords["stash-holder-alia"] = bloomtypes.BloomRecord{
|
|
||||||
StashID: "stash-holder-alia",
|
|
||||||
AccruedGrain: 45000,
|
|
||||||
LastAccrualBlock: 1000,
|
|
||||||
RateBasisPoints: bloomtypes.TargetBloomRateBasisPoints, // 450 (4.5%, D-073 code constant)
|
|
||||||
}
|
|
||||||
s.bloomRecords["stash-holder-bryn"] = bloomtypes.BloomRecord{
|
|
||||||
StashID: "stash-holder-bryn",
|
|
||||||
AccruedGrain: 18000,
|
|
||||||
LastAccrualBlock: 1000,
|
|
||||||
RateBasisPoints: 420, // 4.2% (within the 400-500 band)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// seedStanding seeds mock Ratings + Vouches. holder-alia gets 12 ratings
|
|
||||||
// across 4 categories at 4.6-4.9 (Freeholder-eligible: score >= 4.5 in >= 3
|
|
||||||
// cats) + 1 Vouch (CommunityEndorsement). holder-bryn gets 3 ratings in 1
|
|
||||||
// category (not eligible: < 3 categories, no Vouch).
|
|
||||||
func seedStanding(s *Store, now int64) {
|
|
||||||
// holder-alia: 12 ratings, 4 categories, scores 4.6-4.9.
|
|
||||||
aliaCats := []string{"care", "sim", "vault", "mail"}
|
|
||||||
for i := 0; i < 12; i++ {
|
|
||||||
cat := aliaCats[i%4]
|
|
||||||
score := 4.6 + float64(i%4)*0.1 // 4.6, 4.7, 4.8, 4.9 repeating
|
|
||||||
s.ratings["holder-alia"] = append(s.ratings["holder-alia"], standingtypes.Rating{
|
|
||||||
RaterID: "rater-" + itoa(i),
|
|
||||||
RateeID: "holder-alia",
|
|
||||||
Category: cat,
|
|
||||||
Score: score,
|
|
||||||
Weight: 1.0,
|
|
||||||
TxRef: "tx-r-" + itoa(i),
|
|
||||||
Timestamp: now - int64(i)*86400,
|
|
||||||
DecayBucket: 0, // 6mo bucket (1.0)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
// 1 Vouch for holder-alia (CommunityEndorsement signal).
|
|
||||||
s.vouches["holder-alia"] = []standingtypes.Vouch{{
|
|
||||||
VoucherID: "voucher-freeholder-1",
|
|
||||||
VoucheeID: "holder-alia",
|
|
||||||
Category: "care",
|
|
||||||
BondAmount: 100000,
|
|
||||||
Timestamp: now,
|
|
||||||
}}
|
|
||||||
|
|
||||||
// holder-bryn: 3 ratings, 1 category, scores 4.0-4.2 (not eligible: < 3 cats).
|
|
||||||
for i := 0; i < 3; i++ {
|
|
||||||
s.ratings["holder-bryn"] = append(s.ratings["holder-bryn"], standingtypes.Rating{
|
|
||||||
RaterID: "rater-b-" + itoa(i),
|
|
||||||
RateeID: "holder-bryn",
|
|
||||||
Category: "care",
|
|
||||||
Score: 4.0 + float64(i)*0.1,
|
|
||||||
Weight: 1.0,
|
|
||||||
TxRef: "tx-b-" + itoa(i),
|
|
||||||
Timestamp: now - int64(i)*86400,
|
|
||||||
DecayBucket: 0,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
// No Vouches for holder-bryn (CommunityEndorsement signal false).
|
|
||||||
}
|
|
||||||
|
|
||||||
func seedOne(s *Store, holderID, pubKey string, now int64, balanceGrain int64, activeDays, maxGap uint32) {
|
|
||||||
reachID := "reach-" + holderID
|
|
||||||
stashID := "stash-" + holderID
|
|
||||||
s.reaches[holderID] = identitytypes.Reach{
|
|
||||||
ReachID: reachID,
|
|
||||||
HolderID: holderID,
|
|
||||||
CreatedAt: now - int64(activeDays)*86400,
|
|
||||||
PublicKey: pubKey,
|
|
||||||
IsNomad: true,
|
|
||||||
}
|
|
||||||
s.stashes[holderID] = stashtypes.Stash{
|
|
||||||
HolderID: holderID,
|
|
||||||
StashID: stashID,
|
|
||||||
CreatedAt: now - int64(activeDays)*86400,
|
|
||||||
LastActive: now,
|
|
||||||
BalanceGrain: balanceGrain,
|
|
||||||
}
|
|
||||||
s.stashActivities[stashID] = stashtypes.StashActivity{
|
|
||||||
StashID: stashID,
|
|
||||||
ActiveDays: activeDays,
|
|
||||||
MaxGapDays: maxGap,
|
|
||||||
LastActivityDay: now,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// itoa is a tiny int->string helper to avoid importing strconv (keeps the
|
|
||||||
// fixtures file import-light; the mock data uses small integers only).
|
|
||||||
func itoa(n int) string {
|
|
||||||
if n == 0 {
|
|
||||||
return "0"
|
|
||||||
}
|
|
||||||
neg := n < 0
|
|
||||||
if neg {
|
|
||||||
n = -n
|
|
||||||
}
|
|
||||||
var buf [12]byte
|
|
||||||
i := len(buf)
|
|
||||||
for n > 0 {
|
|
||||||
i--
|
|
||||||
buf[i] = byte('0' + n%10)
|
|
||||||
n /= 10
|
|
||||||
}
|
|
||||||
if neg {
|
|
||||||
i--
|
|
||||||
buf[i] = '-'
|
|
||||||
}
|
|
||||||
return string(buf[i:])
|
|
||||||
}
|
|
||||||
@@ -1,108 +0,0 @@
|
|||||||
// import_test.go enforces the G-003/G-025 boundary for web/: web/ is the
|
|
||||||
// application layer that consumes protocol types (D-070), NOT a cross-x/
|
|
||||||
// production import. The invariant: every non-test .go file under web/ may
|
|
||||||
// import github.com/oy/openyield/x/<module>/types packages (the app-layer
|
|
||||||
// consumption direction), but MUST NOT import github.com/oy/openyield/
|
|
||||||
// x/<module>/keeper OR github.com/oy/openyield/x/<module> (the module.go
|
|
||||||
// packages — G-025 extends the original keeper-only check to also forbid
|
|
||||||
// module.go, since those packages carry Cosmos runtime machinery the mock UI
|
|
||||||
// must not reach into). This test uses go/parser (stdlib only — G-006) and
|
|
||||||
// mirrors the x/window/types/types_test.go G-003 pattern, but with the
|
|
||||||
// inverted rule: x/*/types is ALLOWED (app-layer consumption), x/*/keeper
|
|
||||||
// and x/<module> (module.go) are FORBIDDEN.
|
|
||||||
package store
|
|
||||||
|
|
||||||
import (
|
|
||||||
"go/parser"
|
|
||||||
"go/token"
|
|
||||||
"os"
|
|
||||||
"path/filepath"
|
|
||||||
"runtime"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestG025WebImportsOnlyTypesNotKeeperOrModule(t *testing.T) {
|
|
||||||
webRoot := webRoot(t)
|
|
||||||
fset := token.NewFileSet()
|
|
||||||
violations := []string{}
|
|
||||||
err := filepath.Walk(webRoot, func(path string, info os.FileInfo, err error) error {
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if info.IsDir() {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
if !strings.HasSuffix(path, ".go") {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
// Skip test files (G-025 is about production code only).
|
|
||||||
if strings.HasSuffix(path, "_test.go") {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
f, perr := parser.ParseFile(fset, path, nil, parser.ImportsOnly)
|
|
||||||
if perr != nil {
|
|
||||||
return perr
|
|
||||||
}
|
|
||||||
for _, imp := range f.Imports {
|
|
||||||
ip := strings.Trim(imp.Path.Value, `"`)
|
|
||||||
if isForbiddenXImport(ip) {
|
|
||||||
rel, _ := filepath.Rel(webRoot, path)
|
|
||||||
violations = append(violations, rel+" -> "+ip)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
})
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("walk web/: %v", err)
|
|
||||||
}
|
|
||||||
if len(violations) > 0 {
|
|
||||||
t.Errorf("G-025 violation: web/ production files importing forbidden x/ packages:\n %s",
|
|
||||||
strings.Join(violations, "\n "))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// isForbiddenXImport reports whether ip is an x/<module>/keeper or a bare
|
|
||||||
// x/<module> (module.go) import — both forbidden from web/ (G-025). The
|
|
||||||
// x/<module>/types packages are ALLOWED (D-070 app-layer consumption).
|
|
||||||
func isForbiddenXImport(ip string) bool {
|
|
||||||
const prefix = "github.com/oy/openyield/x/"
|
|
||||||
if !strings.HasPrefix(ip, prefix) {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
rest := strings.TrimPrefix(ip, prefix)
|
|
||||||
parts := strings.Split(rest, "/")
|
|
||||||
switch len(parts) {
|
|
||||||
case 1:
|
|
||||||
// x/<module> (module.go package) — forbidden (G-025).
|
|
||||||
return true
|
|
||||||
case 2:
|
|
||||||
// x/<module>/types -> allowed (D-070). x/<module>/keeper -> forbidden.
|
|
||||||
if parts[1] == "types" {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
return true
|
|
||||||
default:
|
|
||||||
// x/<module>/<sub>/... — forbid anything other than types (e.g.
|
|
||||||
// x/<module>/keeper/... sub-packages).
|
|
||||||
if parts[1] == "types" {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// webRoot returns the absolute path to the web/ directory by walking up
|
|
||||||
// from this test file (web/store/import_test.go -> repoRoot/web).
|
|
||||||
func webRoot(t *testing.T) string {
|
|
||||||
t.Helper()
|
|
||||||
_, file, _, ok := runtime.Caller(0)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("runtime.Caller failed")
|
|
||||||
}
|
|
||||||
// file = .../oy/web/store/import_test.go
|
|
||||||
// repoRoot = filepath.Dir(filepath.Dir(filepath.Dir(file)))
|
|
||||||
// webRoot = repoRoot/web
|
|
||||||
repoRoot := filepath.Dir(filepath.Dir(filepath.Dir(file)))
|
|
||||||
return filepath.Join(repoRoot, "web")
|
|
||||||
}
|
|
||||||
@@ -1,428 +0,0 @@
|
|||||||
// Package store is the in-memory mock data layer for the OpenYield web UI.
|
|
||||||
//
|
|
||||||
// It instantiates the real x/*/types structs (Reach, Stash, StashActivity)
|
|
||||||
// from in-memory fixtures and provides create/get/list methods. This is the
|
|
||||||
// app-layer consumption of protocol types (D-070), NOT a cross-x/ production
|
|
||||||
// import — web/ is NOT an x/ module. No keeper, no Cosmos runtime, no app.go
|
|
||||||
// (G-003 boundary enforced by import_test.go / G-025).
|
|
||||||
package store
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
"strings"
|
|
||||||
"sync"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
bloomtypes "github.com/oy/openyield/x/bloom/types"
|
|
||||||
identitytypes "github.com/oy/openyield/x/identity/types"
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
windowtypes "github.com/oy/openyield/x/window/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// seedBalanceGrain is the test balance seeded to a new Stash at signup (D-071
|
|
||||||
// example: 500000 Grain = 50 Bread per GrainsPerBread=10000).
|
|
||||||
const seedBalanceGrain int64 = 500000
|
|
||||||
|
|
||||||
// Store is the in-memory mock store. All methods are goroutine-safe (mu).
|
|
||||||
type Store struct {
|
|
||||||
mu sync.Mutex
|
|
||||||
reaches map[string]identitytypes.Reach
|
|
||||||
stashes map[string]stashtypes.Stash
|
|
||||||
stashActivities map[string]stashtypes.StashActivity
|
|
||||||
windows map[string]windowtypes.Window
|
|
||||||
auditLogs map[string][]windowtypes.AuditEntry
|
|
||||||
ratings map[string][]standingtypes.Rating
|
|
||||||
vouches map[string][]standingtypes.Vouch
|
|
||||||
slashes map[string][]standingtypes.Slash
|
|
||||||
bloomRecords map[string]bloomtypes.BloomRecord
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewStore constructs a Store seeded from fixtures (fixtures.go).
|
|
||||||
func NewStore() *Store {
|
|
||||||
s := &Store{
|
|
||||||
reaches: map[string]identitytypes.Reach{},
|
|
||||||
stashes: map[string]stashtypes.Stash{},
|
|
||||||
stashActivities: map[string]stashtypes.StashActivity{},
|
|
||||||
windows: map[string]windowtypes.Window{},
|
|
||||||
auditLogs: map[string][]windowtypes.AuditEntry{},
|
|
||||||
ratings: map[string][]standingtypes.Rating{},
|
|
||||||
vouches: map[string][]standingtypes.Vouch{},
|
|
||||||
slashes: map[string][]standingtypes.Slash{},
|
|
||||||
bloomRecords: map[string]bloomtypes.BloomRecord{},
|
|
||||||
}
|
|
||||||
s.seed()
|
|
||||||
return s
|
|
||||||
}
|
|
||||||
|
|
||||||
// CreateReach atomically creates a Reach (IsNomad=true) + a Stash (D-071).
|
|
||||||
// G-027: HolderID and PublicKey are validated (non-empty, <=128 bytes, no
|
|
||||||
// path separators, no template syntax) before any map write. Returns the
|
|
||||||
// created Reach + Stash.
|
|
||||||
func (s *Store) CreateReach(holderID, publicKey string) (identitytypes.Reach, stashtypes.Stash, error) {
|
|
||||||
if err := validateReachInput(holderID, publicKey); err != nil {
|
|
||||||
return identitytypes.Reach{}, stashtypes.Stash{}, err
|
|
||||||
}
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
if _, dup := s.reaches[holderID]; dup {
|
|
||||||
return identitytypes.Reach{}, stashtypes.Stash{}, fmt.Errorf("holder %q already has a Reach", holderID)
|
|
||||||
}
|
|
||||||
now := time.Now().Unix()
|
|
||||||
reachID := "reach-" + holderID
|
|
||||||
stashID := "stash-" + holderID
|
|
||||||
reach := identitytypes.Reach{
|
|
||||||
ReachID: reachID,
|
|
||||||
HolderID: holderID,
|
|
||||||
CreatedAt: now,
|
|
||||||
PublicKey: publicKey,
|
|
||||||
IsNomad: true,
|
|
||||||
}
|
|
||||||
stash := stashtypes.Stash{
|
|
||||||
HolderID: holderID,
|
|
||||||
StashID: stashID,
|
|
||||||
CreatedAt: now,
|
|
||||||
LastActive: now,
|
|
||||||
BalanceGrain: seedBalanceGrain,
|
|
||||||
}
|
|
||||||
activity := stashtypes.StashActivity{
|
|
||||||
StashID: stashID,
|
|
||||||
ActiveDays: 1,
|
|
||||||
MaxGapDays: 1,
|
|
||||||
LastActivityDay: now,
|
|
||||||
}
|
|
||||||
s.reaches[holderID] = reach
|
|
||||||
s.stashes[holderID] = stash
|
|
||||||
s.stashActivities[stashID] = activity
|
|
||||||
return reach, stash, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListReaches returns all seeded + created Reaches.
|
|
||||||
func (s *Store) ListReaches() []identitytypes.Reach {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
out := make([]identitytypes.Reach, 0, len(s.reaches))
|
|
||||||
for _, r := range s.reaches {
|
|
||||||
out = append(out, r)
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetReach returns the Reach for a holderID (by HolderID, the stable key).
|
|
||||||
func (s *Store) GetReach(holderID string) (identitytypes.Reach, bool) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
r, ok := s.reaches[holderID]
|
|
||||||
return r, ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetStash returns the Stash for a holderID.
|
|
||||||
func (s *Store) GetStash(holderID string) (stashtypes.Stash, bool) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
st, ok := s.stashes[holderID]
|
|
||||||
return st, ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetStashActivity returns the StashActivity for a stashID.
|
|
||||||
func (s *Store) GetStashActivity(stashID string) (stashtypes.StashActivity, bool) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
a, ok := s.stashActivities[stashID]
|
|
||||||
return a, ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// OpenWindow creates a new Window in the Open status (REQ-042) with an initial
|
|
||||||
// AuditEntry. Returns the created Window. The Window is keyed by a generated
|
|
||||||
// windowID derived from the grantor + a counter (mock; not cryptographic).
|
|
||||||
func (s *Store) OpenWindow(grantorHolder, grantee string, scope windowtypes.Scope, start, end int64, rateLimit windowtypes.RateLimit) (windowtypes.Window, error) {
|
|
||||||
if grantorHolder == "" {
|
|
||||||
return windowtypes.Window{}, fmt.Errorf("grantor holder is required")
|
|
||||||
}
|
|
||||||
if grantee == "" {
|
|
||||||
return windowtypes.Window{}, fmt.Errorf("grantee is required")
|
|
||||||
}
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
windowID := fmt.Sprintf("window-%s-%d", grantorHolder, len(s.windows)+1)
|
|
||||||
now := time.Now().Unix()
|
|
||||||
w := windowtypes.Window{
|
|
||||||
WindowID: windowID,
|
|
||||||
GrantorHolder: grantorHolder,
|
|
||||||
Grantee: grantee,
|
|
||||||
Scope: scope,
|
|
||||||
Start: start,
|
|
||||||
End: end,
|
|
||||||
RateLimit: rateLimit,
|
|
||||||
Status: windowtypes.StatusOpen,
|
|
||||||
}
|
|
||||||
s.windows[windowID] = w
|
|
||||||
entry := windowtypes.AuditEntry{
|
|
||||||
EntryID: windowID + "-audit-1",
|
|
||||||
Timestamp: now,
|
|
||||||
Action: "open",
|
|
||||||
Result: "created",
|
|
||||||
GranterRef: grantorHolder,
|
|
||||||
}
|
|
||||||
s.auditLogs[windowID] = []windowtypes.AuditEntry{entry}
|
|
||||||
w.AuditLogRefs = []string{entry.EntryID}
|
|
||||||
s.windows[windowID] = w
|
|
||||||
return w, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ActivateWindow transitions a Window from Open to Active by calling the real
|
|
||||||
// x/window/types.Window.Activate() method (not a reimplementation). Appends an
|
|
||||||
// AuditEntry. Returns an error if the Window is not in the Open status.
|
|
||||||
func (s *Store) ActivateWindow(windowID string) error {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
w, ok := s.windows[windowID]
|
|
||||||
if !ok {
|
|
||||||
return fmt.Errorf("window %q not found", windowID)
|
|
||||||
}
|
|
||||||
if err := w.Activate(); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
s.windows[windowID] = w
|
|
||||||
s.appendAuditLocked(windowID, "activate", "active", w.GrantorHolder)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// RevokeWindow transitions a Window to Revoked by calling the real
|
|
||||||
// x/window/types.Window.Revoke() method. Idempotent on already-revoked;
|
|
||||||
// no-op on Expired (terminal state wins — v0.2 type contract). Appends an
|
|
||||||
// AuditEntry only if the status actually changed.
|
|
||||||
func (s *Store) RevokeWindow(windowID string) error {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
w, ok := s.windows[windowID]
|
|
||||||
if !ok {
|
|
||||||
return fmt.Errorf("window %q not found", windowID)
|
|
||||||
}
|
|
||||||
prevStatus := w.Status
|
|
||||||
if err := w.Revoke(); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
s.windows[windowID] = w
|
|
||||||
if w.Status != prevStatus {
|
|
||||||
s.appendAuditLocked(windowID, "revoke", "revoked", w.GrantorHolder)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ExpireWindow transitions a Window to Expired by calling the real
|
|
||||||
// x/window/types.Window.Expire() method. Appends an AuditEntry.
|
|
||||||
func (s *Store) ExpireWindow(windowID string) error {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
w, ok := s.windows[windowID]
|
|
||||||
if !ok {
|
|
||||||
return fmt.Errorf("window %q not found", windowID)
|
|
||||||
}
|
|
||||||
prevStatus := w.Status
|
|
||||||
w.Expire()
|
|
||||||
s.windows[windowID] = w
|
|
||||||
if w.Status != prevStatus {
|
|
||||||
s.appendAuditLocked(windowID, "expire", "expired", w.GrantorHolder)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListWindows returns all Windows for a grantor holder.
|
|
||||||
func (s *Store) ListWindows(grantorHolder string) []windowtypes.Window {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
out := []windowtypes.Window{}
|
|
||||||
for _, w := range s.windows {
|
|
||||||
if w.GrantorHolder == grantorHolder {
|
|
||||||
out = append(out, w)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetWindow returns the Window for a windowID.
|
|
||||||
func (s *Store) GetWindow(windowID string) (windowtypes.Window, bool) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
w, ok := s.windows[windowID]
|
|
||||||
return w, ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetAuditLog returns the audit-log entries for a windowID.
|
|
||||||
func (s *Store) GetAuditLog(windowID string) []windowtypes.AuditEntry {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
return s.auditLogs[windowID]
|
|
||||||
}
|
|
||||||
|
|
||||||
// appendAuditLocked appends an AuditEntry to the window's audit log. Caller
|
|
||||||
// MUST hold s.mu.
|
|
||||||
func (s *Store) appendAuditLocked(windowID, action, result, granterRef string) {
|
|
||||||
logs := s.auditLogs[windowID]
|
|
||||||
now := time.Now().Unix()
|
|
||||||
entry := windowtypes.AuditEntry{
|
|
||||||
EntryID: fmt.Sprintf("%s-audit-%d", windowID, len(logs)+1),
|
|
||||||
Timestamp: now,
|
|
||||||
Action: action,
|
|
||||||
Result: result,
|
|
||||||
GranterRef: granterRef,
|
|
||||||
}
|
|
||||||
s.auditLogs[windowID] = append(logs, entry)
|
|
||||||
w := s.windows[windowID]
|
|
||||||
w.AuditLogRefs = append(w.AuditLogRefs, entry.EntryID)
|
|
||||||
s.windows[windowID] = w
|
|
||||||
}
|
|
||||||
|
|
||||||
// validateReachInput enforces G-027: HolderID and PublicKey must be non-empty,
|
|
||||||
// <=128 bytes, and contain no path separators or template syntax. This is a
|
|
||||||
// prototype-robustness gate (the mock store uses holderID as a map key).
|
|
||||||
func validateReachInput(holderID, publicKey string) error {
|
|
||||||
if holderID == "" {
|
|
||||||
return fmt.Errorf("holder id is required")
|
|
||||||
}
|
|
||||||
if len(holderID) > 128 {
|
|
||||||
return fmt.Errorf("holder id too long (max 128)")
|
|
||||||
}
|
|
||||||
if strings.ContainsAny(holderID, "/\\") {
|
|
||||||
return fmt.Errorf("holder id must not contain path separators")
|
|
||||||
}
|
|
||||||
if strings.Contains(holderID, "{{") {
|
|
||||||
return fmt.Errorf("holder id must not contain template syntax")
|
|
||||||
}
|
|
||||||
if publicKey == "" {
|
|
||||||
return fmt.Errorf("public key is required")
|
|
||||||
}
|
|
||||||
if len(publicKey) > 128 {
|
|
||||||
return fmt.Errorf("public key too long (max 128)")
|
|
||||||
}
|
|
||||||
if strings.ContainsAny(publicKey, "/\\") {
|
|
||||||
return fmt.Errorf("public key must not contain path separators")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Standing + Freeholder signals (P4) ---
|
|
||||||
|
|
||||||
// ListRatings returns all Ratings for a ratee (per-Reach).
|
|
||||||
func (s *Store) ListRatings(rateeID string) []standingtypes.Rating {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
return s.ratings[rateeID]
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListVouches returns all Vouches for a vouchee.
|
|
||||||
func (s *Store) ListVouches(voucheeID string) []standingtypes.Vouch {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
return s.vouches[voucheeID]
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListSlashes returns all Slashes for a Reach.
|
|
||||||
func (s *Store) ListSlashes(reachID string) []standingtypes.Slash {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
return s.slashes[reachID]
|
|
||||||
}
|
|
||||||
|
|
||||||
// ComputeStandingScore computes a simplified standing score from the mock
|
|
||||||
// Ratings using the locked x/standing/types constants (PriorMean, PriorWeight,
|
|
||||||
// ComputeDiversityBonus, GetVoucherWeight, GetStandingBucket). This is a
|
|
||||||
// SIMPLIFIED computation (not the full Bayesian formula — sub-tables deferred
|
|
||||||
// per PROJECT.md Q2); the test asserts it uses the locked constants, not that
|
|
||||||
// it matches a full oracle.
|
|
||||||
func (s *Store) ComputeStandingScore(reachID string) (float64, standingtypes.StandingBucket) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
ratings := s.ratings[reachID]
|
|
||||||
slashes := s.slashes[reachID]
|
|
||||||
isSlashed := len(slashes) > 0
|
|
||||||
|
|
||||||
if len(ratings) == 0 {
|
|
||||||
// No ratings: return the prior mean, bucket New.
|
|
||||||
return standingtypes.PriorMean, standingtypes.GetStandingBucket(standingtypes.PriorMean, 0, isSlashed)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Simplified: weighted average of rating scores using GetVoucherWeight.
|
|
||||||
// The real formula uses the rater's standing to derive the weight; the
|
|
||||||
// mock uses the ratee's own score iteratively (simplified — P4 does not
|
|
||||||
// build a full rater-graph). Uses the locked PriorMean + PriorWeight as a
|
|
||||||
// Bayesian shrinkage: score = (prior*weight + sum(scores)) / (weight + n).
|
|
||||||
sum := 0.0
|
|
||||||
categories := map[string]bool{}
|
|
||||||
for _, r := range ratings {
|
|
||||||
w := standingtypes.GetVoucherWeight(false, r.Score, len(ratings))
|
|
||||||
sum += r.Score * w
|
|
||||||
categories[r.Category] = true
|
|
||||||
}
|
|
||||||
n := float64(len(ratings))
|
|
||||||
raw := (standingtypes.PriorMean*float64(standingtypes.PriorWeight) + sum) /
|
|
||||||
(float64(standingtypes.PriorWeight) + n)
|
|
||||||
// Apply diversity bonus (locked const).
|
|
||||||
raw += standingtypes.ComputeDiversityBonus(len(categories))
|
|
||||||
bucket := standingtypes.GetStandingBucket(raw, len(ratings), isSlashed)
|
|
||||||
return raw, bucket
|
|
||||||
}
|
|
||||||
|
|
||||||
// ComputeFreeholderSignals computes the four Freeholder signals (§9.1) from
|
|
||||||
// the mock data. StashMaturity from StashActivity.IsMature(); MultiDomainStanding
|
|
||||||
// from score >= FreeholderMinStandingScore in >= FreeholderMinCategories;
|
|
||||||
// CommittedCapital from Stash balance >= a threshold (mock); CommunityEndorsement
|
|
||||||
// from >= 1 Vouch. Returns the real standingtypes.FreeholderSignals struct.
|
|
||||||
func (s *Store) ComputeFreeholderSignals(reachID string) standingtypes.FreeholderSignals {
|
|
||||||
s.mu.Lock()
|
|
||||||
stash, hasStash := s.stashes[reachID]
|
|
||||||
ratings := s.ratings[reachID]
|
|
||||||
vouches := s.vouches[reachID]
|
|
||||||
s.mu.Unlock()
|
|
||||||
|
|
||||||
var signals standingtypes.FreeholderSignals
|
|
||||||
// StashMaturity: from StashActivity.IsMature() (the real method).
|
|
||||||
if hasStash {
|
|
||||||
if activity, ok := s.GetStashActivity(stash.StashID); ok {
|
|
||||||
signals.StashMaturity = activity.IsMature()
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// MultiDomainStanding: score >= 4.5 in >= 3 categories.
|
|
||||||
score, _ := s.ComputeStandingScore(reachID)
|
|
||||||
categories := map[string]bool{}
|
|
||||||
for _, r := range ratings {
|
|
||||||
categories[r.Category] = true
|
|
||||||
}
|
|
||||||
if score >= standingtypes.FreeholderMinStandingScore && len(categories) >= standingtypes.FreeholderMinCategories {
|
|
||||||
signals.MultiDomainStanding = true
|
|
||||||
}
|
|
||||||
// CommittedCapital: mock threshold — Stash balance >= 100000 Grain (10 Bread).
|
|
||||||
if hasStash && stash.BalanceGrain >= 100000 {
|
|
||||||
signals.CommittedCapital = true
|
|
||||||
}
|
|
||||||
// CommunityEndorsement: >= 1 Vouch.
|
|
||||||
if len(vouches) >= 1 {
|
|
||||||
signals.CommunityEndorsement = true
|
|
||||||
}
|
|
||||||
return signals
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Bloom accrual (P5) ---
|
|
||||||
|
|
||||||
// GetBloomRecord returns the BloomRecord for a stashID (REQ-044).
|
|
||||||
func (s *Store) GetBloomRecord(stashID string) (bloomtypes.BloomRecord, bool) {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
r, ok := s.bloomRecords[stashID]
|
|
||||||
return r, ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListBloomRecords returns BloomRecords for all Stashes owned by a holder.
|
|
||||||
func (s *Store) ListBloomRecords(holderID string) []bloomtypes.BloomRecord {
|
|
||||||
s.mu.Lock()
|
|
||||||
defer s.mu.Unlock()
|
|
||||||
out := []bloomtypes.BloomRecord{}
|
|
||||||
for stashID, rec := range s.bloomRecords {
|
|
||||||
// Match by the holder prefix "stash-<holderID>".
|
|
||||||
if strings.HasPrefix(stashID, "stash-"+holderID) {
|
|
||||||
out = append(out, rec)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
@@ -1,576 +0,0 @@
|
|||||||
package store
|
|
||||||
|
|
||||||
import (
|
|
||||||
"sync"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
bloomtypes "github.com/oy/openyield/x/bloom/types"
|
|
||||||
identitytypes "github.com/oy/openyield/x/identity/types"
|
|
||||||
standingtypes "github.com/oy/openyield/x/standing/types"
|
|
||||||
stashtypes "github.com/oy/openyield/x/stash/types"
|
|
||||||
windowtypes "github.com/oy/openyield/x/window/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestNewStoreSeedsFixtures(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
reaches := s.ListReaches()
|
|
||||||
if len(reaches) < 2 {
|
|
||||||
t.Fatalf("NewStore seeded %d reaches, want >=2", len(reaches))
|
|
||||||
}
|
|
||||||
// Both seeded reaches must be Nomads (IsNomad=true).
|
|
||||||
for _, r := range reaches {
|
|
||||||
if !r.IsNomad {
|
|
||||||
t.Errorf("seeded reach %q: IsNomad=false, want true", r.HolderID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCreateReachAtomicReachAndStash(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
reach, stash, err := s.CreateReach("holder-test1", "pk-test1")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("CreateReach: %v", err)
|
|
||||||
}
|
|
||||||
// D-071: Reach must be IsNomad=true.
|
|
||||||
if !reach.IsNomad {
|
|
||||||
t.Errorf("reach.IsNomad = false, want true (D-071)")
|
|
||||||
}
|
|
||||||
if reach.HolderID != "holder-test1" {
|
|
||||||
t.Errorf("reach.HolderID = %q, want holder-test1", reach.HolderID)
|
|
||||||
}
|
|
||||||
// D-071: Stash must have matching HolderID + seeded BalanceGrain.
|
|
||||||
if stash.HolderID != reach.HolderID {
|
|
||||||
t.Errorf("stash.HolderID = %q, want %q (D-071 atomic)", stash.HolderID, reach.HolderID)
|
|
||||||
}
|
|
||||||
if stash.BalanceGrain != seedBalanceGrain {
|
|
||||||
t.Errorf("stash.BalanceGrain = %d, want %d", stash.BalanceGrain, seedBalanceGrain)
|
|
||||||
}
|
|
||||||
// Both must be retrievable after the atomic call.
|
|
||||||
if _, ok := s.GetReach("holder-test1"); !ok {
|
|
||||||
t.Errorf("GetReach miss after CreateReach (atomicity broken)")
|
|
||||||
}
|
|
||||||
if _, ok := s.GetStash("holder-test1"); !ok {
|
|
||||||
t.Errorf("GetStash miss after CreateReach (atomicity broken)")
|
|
||||||
}
|
|
||||||
if _, ok := s.GetStashActivity(stash.StashID); !ok {
|
|
||||||
t.Errorf("GetStashActivity miss after CreateReach (atomicity broken)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCreateReachDuplicateRejected(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if _, _, err := s.CreateReach("holder-alia", "pk-dupe"); err == nil {
|
|
||||||
t.Errorf("CreateReach duplicate holder-alia: expected error, got nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCreateReachValidationG027(t *testing.T) {
|
|
||||||
cases := []struct {
|
|
||||||
name string
|
|
||||||
holderID string
|
|
||||||
publicKey string
|
|
||||||
wantErr bool
|
|
||||||
}{
|
|
||||||
{"empty holder", "", "pk", true},
|
|
||||||
{"empty pubkey", "h", "", true},
|
|
||||||
{"holder too long", stringOf('x', 129), "pk", true},
|
|
||||||
{"pubkey too long", "h", stringOf('y', 129), true},
|
|
||||||
{"holder with slash", "h/x", "pk", true},
|
|
||||||
{"holder with backslash", "h\\x", "pk", true},
|
|
||||||
{"holder with template syntax", "h{{", "pk", true},
|
|
||||||
{"pubkey with slash", "h", "p/x", true},
|
|
||||||
{"valid minimal", "h", "p", false},
|
|
||||||
{"valid typical", "holder-oka", "pk-oka-7", false},
|
|
||||||
}
|
|
||||||
for _, c := range cases {
|
|
||||||
t.Run(c.name, func(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
_, _, err := s.CreateReach(c.holderID, c.publicKey)
|
|
||||||
if c.wantErr && err == nil {
|
|
||||||
t.Errorf("expected error, got nil")
|
|
||||||
}
|
|
||||||
if !c.wantErr && err != nil {
|
|
||||||
t.Errorf("unexpected error: %v", err)
|
|
||||||
}
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetReachHitMiss(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if _, ok := s.GetReach("holder-alia"); !ok {
|
|
||||||
t.Errorf("GetReach(holder-alia) miss, want hit (seeded)")
|
|
||||||
}
|
|
||||||
if _, ok := s.GetReach("nobody"); ok {
|
|
||||||
t.Errorf("GetReach(nobody) hit, want miss")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetStashHitMiss(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if _, ok := s.GetStash("holder-alia"); !ok {
|
|
||||||
t.Errorf("GetStash(holder-alia) miss, want hit (seeded)")
|
|
||||||
}
|
|
||||||
if _, ok := s.GetStash("nobody"); ok {
|
|
||||||
t.Errorf("GetStash(nobody) hit, want miss")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetStashActivityHitMiss(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
stash, ok := s.GetStash("holder-alia")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded stash holder-alia missing")
|
|
||||||
}
|
|
||||||
if _, ok := s.GetStashActivity(stash.StashID); !ok {
|
|
||||||
t.Errorf("GetStashActivity(%q) miss, want hit", stash.StashID)
|
|
||||||
}
|
|
||||||
if _, ok := s.GetStashActivity("stash-nobody"); ok {
|
|
||||||
t.Errorf("GetStashActivity(stash-nobody) hit, want miss")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCreateReachConcurrentNoRace(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
const n = 50
|
|
||||||
var wg sync.WaitGroup
|
|
||||||
wg.Add(n)
|
|
||||||
for i := 0; i < n; i++ {
|
|
||||||
go func(i int) {
|
|
||||||
defer wg.Done()
|
|
||||||
holder := "holder-concurrent-" + itoa(i)
|
|
||||||
_, _, _ = s.CreateReach(holder, "pk")
|
|
||||||
}(i)
|
|
||||||
}
|
|
||||||
wg.Wait()
|
|
||||||
// All n concurrent creates with distinct holder IDs must be present.
|
|
||||||
for i := 0; i < n; i++ {
|
|
||||||
if _, ok := s.GetReach("holder-concurrent-" + itoa(i)); !ok {
|
|
||||||
t.Errorf("concurrent reach %d missing after wg.Wait", i)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestSeededMatureVsImmature(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
// holder-alia: ActiveDays=92, MaxGapDays=10 -> mature.
|
|
||||||
aliaStash, ok := s.GetStash("holder-alia")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded holder-alia missing")
|
|
||||||
}
|
|
||||||
aliaAct, ok := s.GetStashActivity(aliaStash.StashID)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded alia activity missing")
|
|
||||||
}
|
|
||||||
if !aliaAct.IsMature() {
|
|
||||||
t.Errorf("holder-alia IsMature=false, want true (ActiveDays=%d, MaxGap=%d)",
|
|
||||||
aliaAct.ActiveDays, aliaAct.MaxGapDays)
|
|
||||||
}
|
|
||||||
// holder-bryn: ActiveDays=45, MaxGapDays=5 -> not mature.
|
|
||||||
brynStash, ok := s.GetStash("holder-bryn")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded holder-bryn missing")
|
|
||||||
}
|
|
||||||
brynAct, ok := s.GetStashActivity(brynStash.StashID)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("seeded bryn activity missing")
|
|
||||||
}
|
|
||||||
if brynAct.IsMature() {
|
|
||||||
t.Errorf("holder-bryn IsMature=true, want false (ActiveDays=%d, MaxGap=%d)",
|
|
||||||
brynAct.ActiveDays, brynAct.MaxGapDays)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions that the types are the real x/*/types structs
|
|
||||||
// (D-067: the mock store grounds the UI in the real Go type definitions).
|
|
||||||
var _ identitytypes.Reach
|
|
||||||
var _ stashtypes.Stash
|
|
||||||
|
|
||||||
// itoa is provided by fixtures.go (shared with the production package).
|
|
||||||
|
|
||||||
func stringOf(r rune, n int) string {
|
|
||||||
b := make([]byte, n)
|
|
||||||
for i := range b {
|
|
||||||
b[i] = byte(r)
|
|
||||||
}
|
|
||||||
return string(b)
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Window tests (P3) ---
|
|
||||||
|
|
||||||
func TestOpenWindowCreatesStatusOpenWithInitialAudit(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash, ResourceID: "stash-x"}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 5, PerDurationSeconds: 3600}
|
|
||||||
w, err := s.OpenWindow("holder-alia", "service-1", scope, 1000, 2000, rl)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("OpenWindow: %v", err)
|
|
||||||
}
|
|
||||||
if w.Status != windowtypes.StatusOpen {
|
|
||||||
t.Errorf("OpenWindow status %q, want Open", w.Status)
|
|
||||||
}
|
|
||||||
if w.WindowID == "" {
|
|
||||||
t.Error("OpenWindow: empty WindowID")
|
|
||||||
}
|
|
||||||
audit := s.GetAuditLog(w.WindowID)
|
|
||||||
if len(audit) != 1 {
|
|
||||||
t.Errorf("OpenWindow: audit log len %d, want 1", len(audit))
|
|
||||||
}
|
|
||||||
if audit[0].Action != "open" {
|
|
||||||
t.Errorf("OpenWindow: audit[0].Action %q, want open", audit[0].Action)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestOpenWindowValidation(t *testing.T) {
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
cases := []struct {
|
|
||||||
name, grantor, grantee string
|
|
||||||
wantErr bool
|
|
||||||
}{
|
|
||||||
{"empty grantor", "", "g", true},
|
|
||||||
{"empty grantee", "h", "", true},
|
|
||||||
{"valid", "h", "g", false},
|
|
||||||
}
|
|
||||||
for _, c := range cases {
|
|
||||||
t.Run(c.name, func(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
_, err := s.OpenWindow(c.grantor, c.grantee, scope, 1, 2, rl)
|
|
||||||
if c.wantErr && err == nil {
|
|
||||||
t.Errorf("expected error, got nil")
|
|
||||||
}
|
|
||||||
if !c.wantErr && err != nil {
|
|
||||||
t.Errorf("unexpected error: %v", err)
|
|
||||||
}
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestActivateWindowTransitionsToActive(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
if err := s.ActivateWindow(w.WindowID); err != nil {
|
|
||||||
t.Fatalf("ActivateWindow: %v", err)
|
|
||||||
}
|
|
||||||
updated, _ := s.GetWindow(w.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusActive {
|
|
||||||
t.Errorf("after activate: %q, want Active", updated.Status)
|
|
||||||
}
|
|
||||||
audit := s.GetAuditLog(w.WindowID)
|
|
||||||
if len(audit) != 2 {
|
|
||||||
t.Errorf("after activate: audit len %d, want 2", len(audit))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestActivateWindowNotFound(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if err := s.ActivateWindow("window-nobody"); err == nil {
|
|
||||||
t.Error("ActivateWindow(nobody): expected error, got nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestActivateWindowOnActiveFails(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
_ = s.ActivateWindow(w.WindowID)
|
|
||||||
// Activate again should fail (can only activate Open windows).
|
|
||||||
if err := s.ActivateWindow(w.WindowID); err == nil {
|
|
||||||
t.Error("activate on Active: expected error, got nil (Window.Activate rejects non-Open)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestRevokeWindowTransitionsToRevoked(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
if err := s.RevokeWindow(w.WindowID); err != nil {
|
|
||||||
t.Fatalf("RevokeWindow: %v", err)
|
|
||||||
}
|
|
||||||
updated, _ := s.GetWindow(w.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusRevoked {
|
|
||||||
t.Errorf("after revoke: %q, want Revoked", updated.Status)
|
|
||||||
}
|
|
||||||
if !updated.Revoked {
|
|
||||||
t.Error("after revoke: Revoked flag false, want true")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestRevokeWindowIdempotent(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
_ = s.RevokeWindow(w.WindowID)
|
|
||||||
before := len(s.GetAuditLog(w.WindowID))
|
|
||||||
_ = s.RevokeWindow(w.WindowID)
|
|
||||||
after := len(s.GetAuditLog(w.WindowID))
|
|
||||||
if after != before {
|
|
||||||
t.Errorf("idempotent revoke: audit grew %d -> %d", before, after)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestRevokeWindowOnExpiredIsNoOp(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
_ = s.ExpireWindow(w.WindowID)
|
|
||||||
before := len(s.GetAuditLog(w.WindowID))
|
|
||||||
_ = s.RevokeWindow(w.WindowID)
|
|
||||||
updated, _ := s.GetWindow(w.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusExpired {
|
|
||||||
t.Errorf("revoke-on-expired: %q, want Expired (terminal wins)", updated.Status)
|
|
||||||
}
|
|
||||||
after := len(s.GetAuditLog(w.WindowID))
|
|
||||||
if after != before {
|
|
||||||
t.Errorf("revoke-on-expired: audit grew %d -> %d (no-op)", before, after)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestRevokeWindowNotFound(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if err := s.RevokeWindow("window-nobody"); err == nil {
|
|
||||||
t.Error("RevokeWindow(nobody): expected error, got nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestExpireWindowTransitionsToExpired(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
if err := s.ExpireWindow(w.WindowID); err != nil {
|
|
||||||
t.Fatalf("ExpireWindow: %v", err)
|
|
||||||
}
|
|
||||||
updated, _ := s.GetWindow(w.WindowID)
|
|
||||||
if updated.Status != windowtypes.StatusExpired {
|
|
||||||
t.Errorf("after expire: %q, want Expired", updated.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestExpireWindowNotFound(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if err := s.ExpireWindow("window-nobody"); err == nil {
|
|
||||||
t.Error("ExpireWindow(nobody): expected error, got nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestExpireWindowIdempotent(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
_ = s.ExpireWindow(w.WindowID)
|
|
||||||
before := len(s.GetAuditLog(w.WindowID))
|
|
||||||
_ = s.ExpireWindow(w.WindowID)
|
|
||||||
after := len(s.GetAuditLog(w.WindowID))
|
|
||||||
if after != before {
|
|
||||||
t.Errorf("idempotent expire: audit grew %d -> %d", before, after)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestListWindowsFiltersByGrantor(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
_, _ = s.OpenWindow("holder-alia", "svc1", scope, 1, 2, rl)
|
|
||||||
_, _ = s.OpenWindow("holder-alia", "svc2", scope, 1, 2, rl)
|
|
||||||
_, _ = s.OpenWindow("holder-bryn", "svc3", scope, 1, 2, rl)
|
|
||||||
alia := s.ListWindows("holder-alia")
|
|
||||||
if len(alia) != 2 {
|
|
||||||
t.Errorf("ListWindows(holder-alia) = %d, want 2", len(alia))
|
|
||||||
}
|
|
||||||
bryn := s.ListWindows("holder-bryn")
|
|
||||||
if len(bryn) != 1 {
|
|
||||||
t.Errorf("ListWindows(holder-bryn) = %d, want 1", len(bryn))
|
|
||||||
}
|
|
||||||
nobody := s.ListWindows("nobody")
|
|
||||||
if len(nobody) != 0 {
|
|
||||||
t.Errorf("ListWindows(nobody) = %d, want 0", len(nobody))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetWindowHitMiss(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
scope := windowtypes.Scope{Kind: windowtypes.ScopeReadStash}
|
|
||||||
rl := windowtypes.RateLimit{MaxActions: 1}
|
|
||||||
w, _ := s.OpenWindow("holder-alia", "svc", scope, 1, 2, rl)
|
|
||||||
if _, ok := s.GetWindow(w.WindowID); !ok {
|
|
||||||
t.Errorf("GetWindow(%q) miss, want hit", w.WindowID)
|
|
||||||
}
|
|
||||||
if _, ok := s.GetWindow("window-nobody"); ok {
|
|
||||||
t.Error("GetWindow(nobody) hit, want miss")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetAuditLogEmptyForMissing(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if logs := s.GetAuditLog("window-nobody"); logs != nil {
|
|
||||||
t.Errorf("GetAuditLog(nobody) = %v, want nil", logs)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Standing + Freeholder signals tests (P4) ---
|
|
||||||
|
|
||||||
func TestListRatingsSeeded(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
alia := s.ListRatings("holder-alia")
|
|
||||||
if len(alia) != 12 {
|
|
||||||
t.Errorf("ListRatings(holder-alia) = %d, want 12 (seeded)", len(alia))
|
|
||||||
}
|
|
||||||
bryn := s.ListRatings("holder-bryn")
|
|
||||||
if len(bryn) != 3 {
|
|
||||||
t.Errorf("ListRatings(holder-bryn) = %d, want 3 (seeded)", len(bryn))
|
|
||||||
}
|
|
||||||
nobody := s.ListRatings("nobody")
|
|
||||||
if len(nobody) != 0 {
|
|
||||||
t.Errorf("ListRatings(nobody) = %d, want 0", len(nobody))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestListVouchesSeeded(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
alia := s.ListVouches("holder-alia")
|
|
||||||
if len(alia) != 1 {
|
|
||||||
t.Errorf("ListVouches(holder-alia) = %d, want 1 (seeded)", len(alia))
|
|
||||||
}
|
|
||||||
bryn := s.ListVouches("holder-bryn")
|
|
||||||
if len(bryn) != 0 {
|
|
||||||
t.Errorf("ListVouches(holder-bryn) = %d, want 0 (seeded)", len(bryn))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestListSlashesEmptyByDefault(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if sl := s.ListSlashes("holder-alia"); len(sl) != 0 {
|
|
||||||
t.Errorf("ListSlashes(holder-alia) = %d, want 0 (no slashes seeded)", len(sl))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeStandingScoreNoRatingsReturnsPriorMean(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
score, bucket := s.ComputeStandingScore("nobody")
|
|
||||||
if score != standingtypes.PriorMean {
|
|
||||||
t.Errorf("ComputeStandingScore(nobody) score = %v, want PriorMean %v", score, standingtypes.PriorMean)
|
|
||||||
}
|
|
||||||
if bucket != standingtypes.BucketNew {
|
|
||||||
t.Errorf("ComputeStandingScore(nobody) bucket = %q, want New", bucket)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeStandingScoreAliaIsEligibleRange(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
score, bucket := s.ComputeStandingScore("holder-alia")
|
|
||||||
if score < 4.5 {
|
|
||||||
t.Errorf("holder-alia score = %.2f, want >= 4.5 (Freeholder-eligible range)", score)
|
|
||||||
}
|
|
||||||
if bucket != standingtypes.BucketPreferred && bucket != standingtypes.BucketTop {
|
|
||||||
t.Errorf("holder-alia bucket = %q, want Preferred or Top", bucket)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeStandingScoreBrynIsNew(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
_, bucket := s.ComputeStandingScore("holder-bryn")
|
|
||||||
// holder-bryn has 3 ratings (< 10) -> bucket New.
|
|
||||||
if bucket != standingtypes.BucketNew {
|
|
||||||
t.Errorf("holder-bryn bucket = %q, want New (< 10 ratings)", bucket)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeFreeholderSignalsAliaAllTrue(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
signals := s.ComputeFreeholderSignals("holder-alia")
|
|
||||||
// holder-alia: mature Stash (92 days), score >= 4.5 in 4 cats, balance
|
|
||||||
// 920000 >= 100000, 1 Vouch -> all 4 signals true.
|
|
||||||
if !signals.StashMaturity {
|
|
||||||
t.Errorf("StashMaturity = false, want true (mature Stash)")
|
|
||||||
}
|
|
||||||
if !signals.MultiDomainStanding {
|
|
||||||
t.Errorf("MultiDomainStanding = false, want true (score >= 4.5 in 4 cats)")
|
|
||||||
}
|
|
||||||
if !signals.CommittedCapital {
|
|
||||||
t.Errorf("CommittedCapital = false, want true (balance 920000 >= 100000)")
|
|
||||||
}
|
|
||||||
if !signals.CommunityEndorsement {
|
|
||||||
t.Errorf("CommunityEndorsement = false, want true (1 Vouch seeded)")
|
|
||||||
}
|
|
||||||
if !signals.IsFreeholderEligible() {
|
|
||||||
t.Errorf("holder-alia IsFreeholderEligible = false, want true (all 4 signals)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeFreeholderSignalsBrynNotEligible(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
signals := s.ComputeFreeholderSignals("holder-bryn")
|
|
||||||
// holder-bryn: immature Stash (45 days), 1 cat (< 3), no Vouch.
|
|
||||||
if signals.StashMaturity {
|
|
||||||
t.Errorf("StashMaturity = true, want false (immature 45 days)")
|
|
||||||
}
|
|
||||||
if signals.MultiDomainStanding {
|
|
||||||
t.Errorf("MultiDomainStanding = true, want false (1 cat < 3)")
|
|
||||||
}
|
|
||||||
if signals.CommunityEndorsement {
|
|
||||||
t.Errorf("CommunityEndorsement = true, want false (no Vouches)")
|
|
||||||
}
|
|
||||||
if signals.IsFreeholderEligible() {
|
|
||||||
t.Errorf("holder-bryn IsFreeholderEligible = true, want false")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestComputeFreeholderSignalsNoStash(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
signals := s.ComputeFreeholderSignals("nobody")
|
|
||||||
// No Stash, no ratings, no Vouches -> all false.
|
|
||||||
if signals.IsFreeholderEligible() {
|
|
||||||
t.Errorf("nobody IsFreeholderEligible = true, want false (no Stash)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Bloom accrual tests (P5) ---
|
|
||||||
|
|
||||||
func TestGetBloomRecordSeeded(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
rec, ok := s.GetBloomRecord("stash-holder-alia")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("GetBloomRecord(stash-holder-alia) miss, want hit (seeded)")
|
|
||||||
}
|
|
||||||
// D-073: seeded at the code-constant target rate.
|
|
||||||
if rec.RateBasisPoints != bloomtypes.TargetBloomRateBasisPoints {
|
|
||||||
t.Errorf("seeded RateBasisPoints = %d, want %d (TargetBloomRateBasisPoints, D-073)", rec.RateBasisPoints, bloomtypes.TargetBloomRateBasisPoints)
|
|
||||||
}
|
|
||||||
if rec.AccruedGrain != 45000 {
|
|
||||||
t.Errorf("seeded AccruedGrain = %d, want 45000", rec.AccruedGrain)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGetBloomRecordMiss(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
if _, ok := s.GetBloomRecord("stash-nobody"); ok {
|
|
||||||
t.Error("GetBloomRecord(stash-nobody) hit, want miss")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestListBloomRecordsByHolder(t *testing.T) {
|
|
||||||
s := NewStore()
|
|
||||||
alia := s.ListBloomRecords("holder-alia")
|
|
||||||
if len(alia) != 1 {
|
|
||||||
t.Errorf("ListBloomRecords(holder-alia) = %d, want 1", len(alia))
|
|
||||||
}
|
|
||||||
if alia[0].StashID != "stash-holder-alia" {
|
|
||||||
t.Errorf("ListBloomRecords(holder-alia)[0].StashID = %q, want stash-holder-alia", alia[0].StashID)
|
|
||||||
}
|
|
||||||
bryn := s.ListBloomRecords("holder-bryn")
|
|
||||||
if len(bryn) != 1 {
|
|
||||||
t.Errorf("ListBloomRecords(holder-bryn) = %d, want 1", len(bryn))
|
|
||||||
}
|
|
||||||
nobody := s.ListBloomRecords("nobody")
|
|
||||||
if len(nobody) != 0 {
|
|
||||||
t.Errorf("ListBloomRecords(nobody) = %d, want 0", len(nobody))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,29 +0,0 @@
|
|||||||
{{define "base.html"}}
|
|
||||||
<!DOCTYPE html>
|
|
||||||
<html lang="en">
|
|
||||||
<head>
|
|
||||||
<meta charset="utf-8">
|
|
||||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
||||||
<title>{{block "title" .}}OpenYield{{end}}</title>
|
|
||||||
<link rel="stylesheet" href="/static/style.css">
|
|
||||||
<script src="/static/htmx.min.js" defer></script>
|
|
||||||
</head>
|
|
||||||
<body>
|
|
||||||
<header class="nav">
|
|
||||||
<span class="brand">OpenYield</span>
|
|
||||||
<a href="/">Home</a>
|
|
||||||
<a href="/reach">Reach</a>
|
|
||||||
<a href="/stash">Stash</a>
|
|
||||||
<a href="/window">Window</a>
|
|
||||||
<a href="/standing">Standing</a>
|
|
||||||
<a href="/bloom">Bloom</a>
|
|
||||||
</header>
|
|
||||||
<main>
|
|
||||||
{{block "content" .}}{{end}}
|
|
||||||
</main>
|
|
||||||
<footer>
|
|
||||||
OpenYield — real production on the mesh. Reach, Stash, Window, Standing, Bloom.
|
|
||||||
</footer>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
{{define "title"}}Bloom — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Bloom</h1>
|
|
||||||
<p>Bloom is the real-production reward that accrues to every Grain in every
|
|
||||||
Stash. It originates only from real production — no synthetic Bloom, no
|
|
||||||
protocol-printed Bloom. This is a Mission Lock: no council can change it.</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Bloom record for {{.StashID}}</h2>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Stash ID</th><td>{{.StashID}}</td></tr>
|
|
||||||
<tr><th>Accrued Grain</th><td>{{.Record.AccruedGrain}}</td></tr>
|
|
||||||
<tr><th>Rate</th><td>{{printf "%.1f" .RatePct}}%</td></tr>
|
|
||||||
<tr><th>Last accrual block</th><td>{{.Record.LastAccrualBlock}}</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Target rate band</h2>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Target rate</th><td>{{printf "%.1f" .TargetRatePct}}%</td></tr>
|
|
||||||
<tr><th>Min rate</th><td>{{printf "%.1f" .MinRatePct}}%</td></tr>
|
|
||||||
<tr><th>Max rate</th><td>{{printf "%.1f" .MaxRatePct}}%</td></tr>
|
|
||||||
<tr><th>Accrual period</th><td>{{.AccrualPeriod}} blocks (daily, ~10min blocks)</td></tr>
|
|
||||||
</table>
|
|
||||||
<p><em>{{.MissionLockNote}}</em></p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<p><a href="/stash/{{slice .StashID 6}}">Back to Stash</a></p>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
{{define "title"}}OpenYield — real production on the mesh{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>OpenYield</h1>
|
|
||||||
<p>
|
|
||||||
OpenYield is a mesh-native system for real production. A Holder creates a
|
|
||||||
Reach to enter the mesh, holds a Stash of Grain, and authorizes Window
|
|
||||||
access to partners. Standing accrues through honest participation, and
|
|
||||||
Bloom rewards sustained contribution. No middleman holds your Stash.
|
|
||||||
</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>The five screens</h2>
|
|
||||||
<ul>
|
|
||||||
<li><a href="/reach">Reach</a> — create a Reach and view the mesh of Holders.</li>
|
|
||||||
<li><a href="/stash">Stash</a> — your sovereign Grain Stash (P2).</li>
|
|
||||||
<li><a href="/window">Window</a> — authorize partner access to your Stash (P3).</li>
|
|
||||||
<li><a href="/standing">Standing</a> — track progress toward Freeholder standing (P4).</li>
|
|
||||||
<li><a href="/bloom">Bloom</a> — accrued rewards for sustained contribution (P5).</li>
|
|
||||||
</ul>
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,31 +0,0 @@
|
|||||||
{{define "title"}}{{.Reach.ReachID}} — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>{{.Reach.ReachID}}</h1>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Reach ID</th><td>{{.Reach.ReachID}}</td></tr>
|
|
||||||
<tr><th>Holder ID</th><td>{{.Reach.HolderID}}</td></tr>
|
|
||||||
<tr><th>Public Key</th><td><code>{{.Reach.PublicKey}}</code></td></tr>
|
|
||||||
<tr><th>Created</th><td>{{.Reach.CreatedAt}}</td></tr>
|
|
||||||
<tr><th>Nomad</th><td>{{if .Reach.IsNomad}}yes{{else}}no{{end}}</td></tr>
|
|
||||||
<tr><th>Freeholder</th><td>{{if .Reach.IsFreeholder}}yes{{else}}no{{end}}</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
{{if .Stash.StashID}}
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Stash</h2>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Stash ID</th><td>{{.Stash.StashID}}</td></tr>
|
|
||||||
<tr><th>Balance</th><td>{{.Stash.BalanceGrain}} Grain</td></tr>
|
|
||||||
<tr><th>Created</th><td>{{.Stash.CreatedAt}}</td></tr>
|
|
||||||
<tr><th>Last active</th><td>{{.Stash.LastActive}}</td></tr>
|
|
||||||
<tr><th>Still</th><td>{{if .Stash.IsStill}}paused{{else}}active{{end}}</td></tr>
|
|
||||||
</table>
|
|
||||||
<p><a href="/stash/{{.Stash.HolderID}}">View Stash dashboard</a></p>
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
|
|
||||||
<p><a href="/reach">Back to Reach list</a></p>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
{{define "title"}}Reach — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Reach</h1>
|
|
||||||
<p>A Reach is the mesh-native identity a Holder uses to act on the mesh
|
|
||||||
without a custodian, a gatekeeper, or a legacy financial position. A Nomad
|
|
||||||
is a Holder who has a Reach and a Stash and is on the way to earning the
|
|
||||||
four Freeholder signals.</p>
|
|
||||||
<p><a href="/reach/new" class="btn">Create a Reach</a></p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Holders on the mesh</h2>
|
|
||||||
{{if .Reaches}}
|
|
||||||
<table>
|
|
||||||
<thead>
|
|
||||||
<tr><th>Reach ID</th><th>Holder ID</th><th>Nomad</th><th>Freeholder</th></tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .Reaches}}
|
|
||||||
<tr>
|
|
||||||
<td><a href="/reach/{{.HolderID}}">{{.ReachID}}</a></td>
|
|
||||||
<td>{{.HolderID}}</td>
|
|
||||||
<td>{{if .IsNomad}}yes{{else}}no{{end}}</td>
|
|
||||||
<td>{{if .IsFreeholder}}yes{{else}}no{{end}}</td>
|
|
||||||
</tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
{{else}}
|
|
||||||
<p>No Reaches yet. <a href="/reach/new">Create a Reach</a> to begin.</p>
|
|
||||||
{{end}}
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
{{define "title"}}Create a Reach — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Create a Reach</h1>
|
|
||||||
<p>A Reach is an identity, not a custodial position. The protocol does not
|
|
||||||
require KYC at the protocol layer; the Reach is the unit of self-service.
|
|
||||||
Creating a Reach also opens a Stash for you (the place a Nomad holds
|
|
||||||
Grain) — that pair is enough to begin on the mesh.</p>
|
|
||||||
|
|
||||||
<form method="POST" action="/reach" hx-post="/reach" hx-target="body">
|
|
||||||
<label for="holder_id">Holder ID</label>
|
|
||||||
<input type="text" id="holder_id" name="holder_id" required
|
|
||||||
maxlength="128" placeholder="a by-ID-string of your choosing">
|
|
||||||
<label for="public_key">Public Key</label>
|
|
||||||
<input type="text" id="public_key" name="public_key" required
|
|
||||||
maxlength="128" placeholder="a public key for your Reach">
|
|
||||||
<button type="submit">Create a Reach</button>
|
|
||||||
</form>
|
|
||||||
<p><a href="/reach">Back to Reach list</a></p>
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,89 +0,0 @@
|
|||||||
{{define "title"}}Standing — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Standing — {{.ReachID}}</h1>
|
|
||||||
<p>Standing is the Bayesian anti-gaming metric that accrues as a Nomad acts
|
|
||||||
on the mesh. It is not bought or transferred — it is earned through honest
|
|
||||||
participation, weighted by the standing of the raters, time-decayed, and
|
|
||||||
diversified across service categories.</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Score</h2>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Reach ID</th><td>{{.ReachID}}</td></tr>
|
|
||||||
<tr><th>Standing score</th><td>{{printf "%.1f" .Score}}</td></tr>
|
|
||||||
<tr><th>Bucket</th><td>
|
|
||||||
{{if eq (string .Bucket) "New"}}<span class="badge grey">New</span>{{end}}
|
|
||||||
{{if eq (string .Bucket) "Trusted"}}<span class="badge blue">Trusted</span>{{end}}
|
|
||||||
{{if eq (string .Bucket) "Preferred"}}<span class="badge green">Preferred</span>{{end}}
|
|
||||||
{{if eq (string .Bucket) "Top"}}<span class="badge green">Top</span>{{end}}
|
|
||||||
{{if eq (string .Bucket) "Slashed"}}<span class="badge red">Slashed</span>{{end}}
|
|
||||||
</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Freeholder signals</h2>
|
|
||||||
<p>The four signals (§9.1) — all four must be present to be Freeholder-eligible.
|
|
||||||
No application, no committee, no form.</p>
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Signal</th><th>Status</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
<tr><td>Stash maturity (90 days, gap ≤ 30)</td><td>{{if .Signals.StashMaturity}}<span class="badge green">earned</span>{{else}}<span class="badge grey">not yet</span>{{end}}</td></tr>
|
|
||||||
<tr><td>Multi-domain standing (≥ {{printf "%.1f" .MinScore}} in ≥ {{.MinCats}} cats)</td><td>{{if .Signals.MultiDomainStanding}}<span class="badge green">earned</span>{{else}}<span class="badge grey">not yet</span>{{end}}</td></tr>
|
|
||||||
<tr><td>Committed capital</td><td>{{if .Signals.CommittedCapital}}<span class="badge green">earned</span>{{else}}<span class="badge grey">not yet</span>{{end}}</td></tr>
|
|
||||||
<tr><td>Community endorsement (≥ 1 Vouch)</td><td>{{if .Signals.CommunityEndorsement}}<span class="badge green">earned</span>{{else}}<span class="badge grey">not yet</span>{{end}}</td></tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
<p>Freeholder-eligible:
|
|
||||||
{{if .Eligible}}<span class="badge green">yes</span>
|
|
||||||
{{else}}<span class="badge grey">not yet</span>{{end}}
|
|
||||||
</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Ratings ({{len .Ratings}})</h2>
|
|
||||||
{{if .Ratings}}
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Rater</th><th>Category</th><th>Score</th><th>Timestamp</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .Ratings}}
|
|
||||||
<tr><td>{{.RaterID}}</td><td>{{.Category}}</td><td>{{printf "%.1f" .Score}}</td><td>{{.Timestamp}}</td></tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
{{else}}<p>No ratings yet.</p>{{end}}
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Vouches ({{len .Vouches}})</h2>
|
|
||||||
{{if .Vouches}}
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Voucher</th><th>Category</th><th>Bond (Grain)</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .Vouches}}
|
|
||||||
<tr><td>{{.VoucherID}}</td><td>{{.Category}}</td><td>{{.BondAmount}}</td></tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
{{else}}<p>No Vouches yet.</p>{{end}}
|
|
||||||
</section>
|
|
||||||
|
|
||||||
{{if .Slashes}}
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Slashes ({{len .Slashes}})</h2>
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Reason</th><th>Amount</th><th>Attester</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .Slashes}}
|
|
||||||
<tr><td>{{.Reason}}</td><td>{{.Amount}}</td><td>{{.Attester}}</td></tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
|
|
||||||
<p><a href="/reach/{{.ReachID}}">Back to Reach</a></p>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,56 +0,0 @@
|
|||||||
{{define "title"}}Stash — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Stash</h1>
|
|
||||||
<p>A Stash is a Holder's personal storage — the place a Nomad holds Grain.
|
|
||||||
It is a storage layer, not a custodial position: the Holder owns it,
|
|
||||||
controls it, and can delegate a scoped, time-limited Window to a partner
|
|
||||||
without giving up custody.</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Balance</h2>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Stash ID</th><td>{{.Stash.StashID}}</td></tr>
|
|
||||||
<tr><th>Holder ID</th><td>{{.Stash.HolderID}}</td></tr>
|
|
||||||
<tr><th>Balance</th><td>{{.Stash.BalanceGrain}} Grain ({{.BalanceBread}} Bread)</td></tr>
|
|
||||||
<tr><th>Created</th><td>{{.Stash.CreatedAt}}</td></tr>
|
|
||||||
<tr><th>Last active</th><td>{{.Stash.LastActive}}</td></tr>
|
|
||||||
<tr><th>Still</th><td>{{if .Stash.IsStill}}paused{{else}}active{{end}}</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Bread scale</h2>
|
|
||||||
<p>1 Bread = 10,000 Grain. The full scale (from the protocol code constants):</p>
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Denomination</th><th>Grain value</th><th>Equivalent in this Stash</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .BreadScale}}
|
|
||||||
<tr>
|
|
||||||
<td>{{.Name}}</td>
|
|
||||||
<td>{{.GrainValue}}</td>
|
|
||||||
<td>{{if eq .Name "Grain"}}{{$.Stash.BalanceGrain}}{{else}}{{divGrain $.Stash.BalanceGrain .GrainValue}}{{end}}</td>
|
|
||||||
</tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Maturity progress</h2>
|
|
||||||
<p>Holding a Stash continuously for 90 days is the first of the four
|
|
||||||
Freeholder signals. The signal is about continuity, not size.</p>
|
|
||||||
<div class="progress-track">
|
|
||||||
<div class="progress-bar" style="width: {{.MaturityPct}}%">{{.MaturityPct}}%</div>
|
|
||||||
</div>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Active days</th><td>{{.Activity.ActiveDays}} / {{.ThresholdDays}}</td></tr>
|
|
||||||
<tr><th>Max gap days</th><td>{{.Activity.MaxGapDays}} / {{.MaxGapDays}} (max allowed)</td></tr>
|
|
||||||
<tr><th>Mature</th><td>{{if .Mature}}<span class="badge green">Mature</span>{{else}}<span class="badge amber">Not mature</span>{{end}}</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<p><a href="/reach/{{.Stash.HolderID}}">Back to Reach</a></p>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,68 +0,0 @@
|
|||||||
{{define "title"}}{{.Window.WindowID}} — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>{{.Window.WindowID}}</h1>
|
|
||||||
<table class="kv">
|
|
||||||
<tr><th>Window ID</th><td>{{.Window.WindowID}}</td></tr>
|
|
||||||
<tr><th>Grantor</th><td>{{.Window.GrantorHolder}}</td></tr>
|
|
||||||
<tr><th>Grantee</th><td>{{.Window.Grantee}}</td></tr>
|
|
||||||
<tr><th>Scope</th><td>{{.Window.Scope.Kind}} ({{.Window.Scope.ResourceID}})</td></tr>
|
|
||||||
<tr><th>Start</th><td>{{.Window.Start}}</td></tr>
|
|
||||||
<tr><th>End</th><td>{{.Window.End}}</td></tr>
|
|
||||||
<tr><th>Rate limit</th><td>{{.Window.RateLimit.ActionsConsumed}} / {{.Window.RateLimit.MaxActions}} per {{.Window.RateLimit.PerDurationSeconds}}s</td></tr>
|
|
||||||
<tr><th>Revoked</th><td>{{if .Window.Revoked}}yes{{else}}no{{end}}</td></tr>
|
|
||||||
<tr><th>Status</th><td>
|
|
||||||
{{if eq (string .Window.Status) "Open"}}<span class="badge amber">Open</span>{{end}}
|
|
||||||
{{if eq (string .Window.Status) "Active"}}<span class="badge green">Active</span>{{end}}
|
|
||||||
{{if eq (string .Window.Status) "Revoked"}}<span class="badge red">Revoked</span>{{end}}
|
|
||||||
{{if eq (string .Window.Status) "Expired"}}<span class="badge grey">Expired</span>{{end}}
|
|
||||||
</td></tr>
|
|
||||||
</table>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Lifecycle actions</h2>
|
|
||||||
<p>
|
|
||||||
{{if eq (string .Window.Status) "Open"}}
|
|
||||||
<form method="POST" action="/window/{{.Window.WindowID}}/activate" style="display:inline">
|
|
||||||
<button type="submit">Activate</button>
|
|
||||||
</form>
|
|
||||||
{{end}}
|
|
||||||
{{if or (eq (string .Window.Status) "Open") (eq (string .Window.Status) "Active")}}
|
|
||||||
<form method="POST" action="/window/{{.Window.WindowID}}/revoke" style="display:inline">
|
|
||||||
<button type="submit">Revoke</button>
|
|
||||||
</form>
|
|
||||||
{{end}}
|
|
||||||
{{if or (eq (string .Window.Status) "Open") (eq (string .Window.Status) "Active")}}
|
|
||||||
<form method="POST" action="/window/{{.Window.WindowID}}/expire" style="display:inline">
|
|
||||||
<button type="submit">Expire</button>
|
|
||||||
</form>
|
|
||||||
{{end}}
|
|
||||||
</p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Audit log</h2>
|
|
||||||
{{if .AuditLog}}
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Entry ID</th><th>Timestamp</th><th>Action</th><th>Result</th><th>Granter</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .AuditLog}}
|
|
||||||
<tr>
|
|
||||||
<td>{{.EntryID}}</td>
|
|
||||||
<td>{{.Timestamp}}</td>
|
|
||||||
<td>{{.Action}}</td>
|
|
||||||
<td>{{.Result}}</td>
|
|
||||||
<td>{{.GranterRef}}</td>
|
|
||||||
</tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
{{else}}
|
|
||||||
<p>No audit entries yet.</p>
|
|
||||||
{{end}}
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<p><a href="/window">Back to Window list</a></p>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
{{define "title"}}Window — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Window</h1>
|
|
||||||
<p>A Window is a Holder-authorized, scope-bounded, time-limited, revocable
|
|
||||||
delegation of access (REQ-015). The Holder opens a Window so a partner or
|
|
||||||
service can read a Stash or process a Pass-Act — without giving up custody.
|
|
||||||
The Window is revocable, rate-limited, and audited.</p>
|
|
||||||
<p><a href="/window/new" class="btn">Open a Window</a></p>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section class="panel">
|
|
||||||
<h2>Windows for {{.Grantor}}</h2>
|
|
||||||
{{if .Windows}}
|
|
||||||
<table>
|
|
||||||
<thead><tr><th>Window ID</th><th>Grantee</th><th>Scope</th><th>Status</th></tr></thead>
|
|
||||||
<tbody>
|
|
||||||
{{range .Windows}}
|
|
||||||
<tr>
|
|
||||||
<td><a href="/window/{{.WindowID}}">{{.WindowID}}</a></td>
|
|
||||||
<td>{{.Grantee}}</td>
|
|
||||||
<td>{{.Scope.Kind}} ({{.Scope.ResourceID}})</td>
|
|
||||||
<td>{{.Status}}</td>
|
|
||||||
</tr>
|
|
||||||
{{end}}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
{{else}}
|
|
||||||
<p>No Windows yet for {{.Grantor}}. <a href="/window/new">Open a Window</a> to begin.</p>
|
|
||||||
{{end}}
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
{{define "title"}}Open a Window — OpenYield{{end}}
|
|
||||||
|
|
||||||
{{define "content"}}
|
|
||||||
<section class="panel">
|
|
||||||
<h1>Open a Window</h1>
|
|
||||||
<p>A Window delegates scoped access to a partner or service without giving
|
|
||||||
up custody. The Holder sets the scope, the duration, and a rate-limit; the
|
|
||||||
Window is revocable at any time.</p>
|
|
||||||
|
|
||||||
<form method="POST" action="/window" hx-post="/window" hx-target="body">
|
|
||||||
<label for="grantor_holder">Grantor Holder ID</label>
|
|
||||||
<input type="text" id="grantor_holder" name="grantor_holder" required
|
|
||||||
maxlength="128" placeholder="the Holder opening the Window">
|
|
||||||
<label for="grantee">Grantee</label>
|
|
||||||
<input type="text" id="grantee" name="grantee" required
|
|
||||||
maxlength="128" placeholder="the partner or service receiving access">
|
|
||||||
<label for="scope_kind">Scope kind</label>
|
|
||||||
<select id="scope_kind" name="scope_kind">
|
|
||||||
<option value="ReadStash">ReadStash</option>
|
|
||||||
<option value="ReadStanding">ReadStanding</option>
|
|
||||||
<option value="ProcessPassActForStand">ProcessPassActForStand</option>
|
|
||||||
</select>
|
|
||||||
<label for="resource_id">Resource ID</label>
|
|
||||||
<input type="text" id="resource_id" name="resource_id"
|
|
||||||
maxlength="128" placeholder="the Stash or Stand this Window scopes to">
|
|
||||||
<label for="start_unix">Start (unix seconds, blank = now)</label>
|
|
||||||
<input type="number" id="start_unix" name="start_unix" placeholder="blank = now">
|
|
||||||
<label for="end_unix">End (unix seconds, blank = now+1h)</label>
|
|
||||||
<input type="number" id="end_unix" name="end_unix" placeholder="blank = now+1h">
|
|
||||||
<label for="max_actions">Max actions (rate-limit, blank = 10)</label>
|
|
||||||
<input type="number" id="max_actions" name="max_actions" placeholder="10">
|
|
||||||
<button type="submit">Open a Window</button>
|
|
||||||
</form>
|
|
||||||
<p><a href="/window">Back to Window list</a></p>
|
|
||||||
</section>
|
|
||||||
{{end}}
|
|
||||||
@@ -1,166 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bearers/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// keeper.go holds the store-backed Keeper for the bearers module (P2-02-01,
|
|
||||||
// REQ-034).
|
|
||||||
//
|
|
||||||
// The Keeper wraps an sdk.KVStore via a storeKey. It holds the Session
|
|
||||||
// records (by session-id) and the OYQRCode records (by qr-id). The Keeper
|
|
||||||
// also holds the expected-keeper shim (BreadKeeper for the OY-QR consume
|
|
||||||
// transfer effect). The shim is an interface (G-003 — no struct import of
|
|
||||||
// x/bread/types); the concrete x/bread keeper satisfies it structurally.
|
|
||||||
//
|
|
||||||
// State-machine ordering (vision §7, enforced in every handler):
|
|
||||||
// ValidateBasic → keeper authz → state mutation → ctx.EventManager().EmitEvent
|
|
||||||
//
|
|
||||||
// Surveillance-resistant invariant (A-522): the Keeper carries NO
|
|
||||||
// geolocation fields; the handlers emit NO geolocation in events.
|
|
||||||
|
|
||||||
// Keeper is the store-backed bearers keeper.
|
|
||||||
type Keeper struct {
|
|
||||||
cdc codec.Codec
|
|
||||||
storeKey storetypes.StoreKey
|
|
||||||
breadKeeper types.BreadKeeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewKeeper constructs a new store-backed bearers Keeper. The BreadKeeper
|
|
||||||
// expected-keeper shim is injected (nil-able for partial tests; the
|
|
||||||
// ConsumeOYQR handler guards a nil shim and skips the transfer effect,
|
|
||||||
// still flipping the consumed flag — the A-521 state-write-first invariant
|
|
||||||
// holds regardless).
|
|
||||||
func NewKeeper(cdc codec.Codec, storeKey storetypes.StoreKey, bk types.BreadKeeper) Keeper {
|
|
||||||
return Keeper{
|
|
||||||
cdc: cdc,
|
|
||||||
storeKey: storeKey,
|
|
||||||
breadKeeper: bk,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetBreadKeeper sets the BreadKeeper expected-keeper shim (for
|
|
||||||
// post-construction wiring, e.g., app wiring or test setup).
|
|
||||||
func (k *Keeper) SetBreadKeeper(bk types.BreadKeeper) { k.breadKeeper = bk }
|
|
||||||
|
|
||||||
// --- Session store -----------------------------------------------------------
|
|
||||||
|
|
||||||
var sessionKeyPrefix = []byte("session/")
|
|
||||||
|
|
||||||
func sessionKey(sessionID string) []byte {
|
|
||||||
return append(sessionKeyPrefix, []byte(sessionID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSession loads a Session by session-id. Returns the session and true
|
|
||||||
// if found, or zero value + false if not.
|
|
||||||
func (k Keeper) GetSession(ctx sdk.Context, sessionID string) (types.Session, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(sessionKey(sessionID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.Session{}, false
|
|
||||||
}
|
|
||||||
var s types.Session
|
|
||||||
if err := json.Unmarshal(bz, &s); err != nil {
|
|
||||||
return types.Session{}, false
|
|
||||||
}
|
|
||||||
return s, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetSession persists a Session by session-id.
|
|
||||||
func (k Keeper) SetSession(ctx sdk.Context, s types.Session) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(s)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("bearers: marshal session %q: %v", s.SessionID, err))
|
|
||||||
}
|
|
||||||
store.Set(sessionKey(s.SessionID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllSessions returns all persisted Session records (iteration helper).
|
|
||||||
func (k Keeper) AllSessions(ctx sdk.Context) []types.Session {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(sessionKeyPrefix, prefixEnd(sessionKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.Session{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var s types.Session
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &s); err == nil {
|
|
||||||
out = append(out, s)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- OYQRCode store ----------------------------------------------------------
|
|
||||||
|
|
||||||
var qrKeyPrefix = []byte("qr/")
|
|
||||||
|
|
||||||
func qrKey(qrID string) []byte {
|
|
||||||
return append(qrKeyPrefix, []byte(qrID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetOYQRCode loads an OYQRCode by qr-id. Returns the QR and true if found.
|
|
||||||
func (k Keeper) GetOYQRCode(ctx sdk.Context, qrID string) (types.OYQRCode, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(qrKey(qrID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.OYQRCode{}, false
|
|
||||||
}
|
|
||||||
var q types.OYQRCode
|
|
||||||
if err := json.Unmarshal(bz, &q); err != nil {
|
|
||||||
return types.OYQRCode{}, false
|
|
||||||
}
|
|
||||||
return q, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetOYQRCode persists an OYQRCode by qr-id.
|
|
||||||
func (k Keeper) SetOYQRCode(ctx sdk.Context, q types.OYQRCode) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(q)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("bearers: marshal qr %q: %v", q.QRID, err))
|
|
||||||
}
|
|
||||||
store.Set(qrKey(q.QRID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllOYQRCodes returns all persisted OYQRCode records (iteration helper).
|
|
||||||
func (k Keeper) AllOYQRCodes(ctx sdk.Context) []types.OYQRCode {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(qrKeyPrefix, prefixEnd(qrKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.OYQRCode{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var q types.OYQRCode
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &q); err == nil {
|
|
||||||
out = append(out, q)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// prefixEnd returns the key that sorts immediately after all keys sharing the
|
|
||||||
// given prefix (the standard prefix-iteration end key: increment the last
|
|
||||||
// byte, drop overflow). Used for store.Iterator(start, prefixEnd(start))
|
|
||||||
// prefix scans.
|
|
||||||
func prefixEnd(prefix []byte) []byte {
|
|
||||||
if len(prefix) == 0 {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
end := make([]byte, len(prefix))
|
|
||||||
copy(end, prefix)
|
|
||||||
for i := len(end) - 1; i >= 0; i-- {
|
|
||||||
end[i]++
|
|
||||||
if end[i] != 0 {
|
|
||||||
return end
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// All bytes were 0xFF; return nil (iterate to end of store).
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@@ -1,387 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bearers/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// msg_server.go implements the bearers module's MsgServer (G-023 ownership
|
|
||||||
// split: cosmos-engineer scaffolds the file structure + method signatures;
|
|
||||||
// mesh-engineer/backend-engineer implements the handler logic bodies). The
|
|
||||||
// MsgServer wraps the Keeper + the BreadKeeper expected-keeper shim (already
|
|
||||||
// on the Keeper).
|
|
||||||
//
|
|
||||||
// Each method returns a (*Response, error). Handler state-machine ordering
|
|
||||||
// is enforced: ValidateBasic → keeper authz → state mutation →
|
|
||||||
// ctx.EventManager().EmitEvent.
|
|
||||||
//
|
|
||||||
// Surveillance-resistant invariant (A-522): NO handler emits geolocation or
|
|
||||||
// sender physical location. The surveillance-resistant locked const on
|
|
||||||
// OYSATLink/OYLRLink is a runtime invariant — a handler that emits
|
|
||||||
// geolocation violates it. A negative simtest asserts the event set
|
|
||||||
// contains NO geolocation fields.
|
|
||||||
//
|
|
||||||
// One-shot OY-QR (A-521): the MsgConsumeOYQR handler flips consumed BEFORE
|
|
||||||
// the transfer effect (state write FIRST, then the BreadKeeper shim call).
|
|
||||||
// A replay finds consumed==true and returns an error (idempotent reject,
|
|
||||||
// NOT double-effect). The SDK store is atomic per tx — a panic in the
|
|
||||||
// transfer rolls back the whole tx, so the order is safe; the order
|
|
||||||
// documents intent and matches the ibc-go delete-before-mint convention.
|
|
||||||
|
|
||||||
// msgServer is the concrete MsgServer implementation wrapping the Keeper.
|
|
||||||
type msgServer struct {
|
|
||||||
Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewMsgServerImpl returns the bearers MsgServer for the provided Keeper.
|
|
||||||
func NewMsgServerImpl(k Keeper) types.MsgServer {
|
|
||||||
return &msgServer{Keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
var _ types.MsgServer = msgServer{}
|
|
||||||
|
|
||||||
// unwrapCtx extracts the sdk.Context from the interface-typed ctx.
|
|
||||||
func unwrapCtx(ctx interface{}) sdk.Context {
|
|
||||||
if c, ok := ctx.(sdk.Context); ok {
|
|
||||||
return c
|
|
||||||
}
|
|
||||||
panic(fmt.Sprintf("bearers: expected sdk.Context, got %T", ctx))
|
|
||||||
}
|
|
||||||
|
|
||||||
// nowUnix returns the current block time as unix seconds from the ctx.
|
|
||||||
func nowUnix(ctx sdk.Context) int64 {
|
|
||||||
return ctx.BlockTime().Unix()
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- OpenSession (creates Session status=Open) -------------------------------
|
|
||||||
|
|
||||||
// OpenSession creates a new Session with status=Open. ValidateBasic is
|
|
||||||
// stateless; the handler enforces idempotency (session-id must not already
|
|
||||||
// exist).
|
|
||||||
func (s msgServer) OpenSession(ctx interface{}, msg *types.MsgOpenSession) (*types.MsgOpenSessionResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Idempotency: session-id must not already exist.
|
|
||||||
if _, ok := s.Keeper.GetSession(sdkCtx, msg.SessionID); ok {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q already exists", msg.SessionID)
|
|
||||||
}
|
|
||||||
|
|
||||||
session := types.Session{
|
|
||||||
SessionID: msg.SessionID,
|
|
||||||
BearerType: msg.BearerType,
|
|
||||||
InitiatorReach: msg.InitiatorReach,
|
|
||||||
PeerReach: msg.PeerReach,
|
|
||||||
Status: types.SessionOpen,
|
|
||||||
Frames: []types.Frame{},
|
|
||||||
TTL: msg.TTL,
|
|
||||||
OpenedAt: nowUnix(sdkCtx),
|
|
||||||
}
|
|
||||||
s.Keeper.SetSession(sdkCtx, session)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.session_opened",
|
|
||||||
sdk.NewAttribute("session_id", msg.SessionID),
|
|
||||||
sdk.NewAttribute("bearer_type", string(msg.BearerType)),
|
|
||||||
sdk.NewAttribute("initiator_reach", msg.InitiatorReach),
|
|
||||||
sdk.NewAttribute("peer_reach", msg.PeerReach),
|
|
||||||
sdk.NewAttribute("status", string(types.SessionOpen)),
|
|
||||||
// NO geolocation (A-522 surveillance-resistant invariant).
|
|
||||||
))
|
|
||||||
return &types.MsgOpenSessionResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- CloseSession (Active → Closed) ------------------------------------------
|
|
||||||
|
|
||||||
// CloseSession transitions an Active session to Closed. The handler
|
|
||||||
// enforces the stateful source-status check (must be Open or Active; an
|
|
||||||
// Open session with no frames can close directly).
|
|
||||||
func (s msgServer) CloseSession(ctx interface{}, msg *types.MsgCloseSession) (*types.MsgCloseSessionResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
session, ok := s.Keeper.GetSession(sdkCtx, msg.SessionID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q not found", msg.SessionID)
|
|
||||||
}
|
|
||||||
if session.IsTerminal() {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q is terminal (%s), cannot close", msg.SessionID, session.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
session.Status = types.SessionClosed
|
|
||||||
session.ClosedAt = nowUnix(sdkCtx)
|
|
||||||
s.Keeper.SetSession(sdkCtx, session)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.session_closed",
|
|
||||||
sdk.NewAttribute("session_id", msg.SessionID),
|
|
||||||
sdk.NewAttribute("status", string(types.SessionClosed)),
|
|
||||||
))
|
|
||||||
return &types.MsgCloseSessionResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- RevokeSession (out-of-band → Revoked) -----------------------------------
|
|
||||||
|
|
||||||
// RevokeSession transitions a session to Revoked (out-of-band termination).
|
|
||||||
// A revoked session rejects further Receive. The handler enforces the
|
|
||||||
// stateful source-status check (must not already be terminal).
|
|
||||||
func (s msgServer) RevokeSession(ctx interface{}, msg *types.MsgRevokeSession) (*types.MsgRevokeSessionResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
session, ok := s.Keeper.GetSession(sdkCtx, msg.SessionID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q not found", msg.SessionID)
|
|
||||||
}
|
|
||||||
if session.IsTerminal() {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q is terminal (%s), cannot revoke", msg.SessionID, session.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
session.Status = types.SessionRevoked
|
|
||||||
session.ClosedAt = nowUnix(sdkCtx)
|
|
||||||
s.Keeper.SetSession(sdkCtx, session)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.session_revoked",
|
|
||||||
sdk.NewAttribute("session_id", msg.SessionID),
|
|
||||||
sdk.NewAttribute("status", string(types.SessionRevoked)),
|
|
||||||
))
|
|
||||||
return &types.MsgRevokeSessionResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- SendOYSATFrame (send a frame on an Open/Active session) ------------------
|
|
||||||
|
|
||||||
// SendOYSATFrame sends a frame on an OY-SAT session. The handler enforces
|
|
||||||
// the stateful session-status check: the session must be Open or Active
|
|
||||||
// (frames on Closed/Revoked are REJECTED — the rejected-frame case).
|
|
||||||
func (s msgServer) SendOYSATFrame(ctx interface{}, msg *types.MsgSendOYSATFrame) (*types.MsgSendOYSATFrameResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
session, ok := s.Keeper.GetSession(sdkCtx, msg.SessionID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q not found", msg.SessionID)
|
|
||||||
}
|
|
||||||
if session.IsTerminal() {
|
|
||||||
// Rejected-frame case: a frame received on a Closed/Revoked
|
|
||||||
// session MUST be rejected (A-523 session state machine).
|
|
||||||
return nil, fmt.Errorf("bearers: session %q is terminal (%s), rejects frame", msg.SessionID, session.Status)
|
|
||||||
}
|
|
||||||
if session.IsExpired(nowUnix(sdkCtx)) {
|
|
||||||
// TTL expiry transitions the session to Closed (the handler
|
|
||||||
// enforces expiry on Send/Receive checks).
|
|
||||||
session.Status = types.SessionClosed
|
|
||||||
session.ClosedAt = nowUnix(sdkCtx)
|
|
||||||
s.Keeper.SetSession(sdkCtx, session)
|
|
||||||
return nil, fmt.Errorf("bearers: session %q expired (ttl %d), rejects frame", msg.SessionID, session.TTL)
|
|
||||||
}
|
|
||||||
|
|
||||||
frame := types.Frame{
|
|
||||||
FrameID: msg.FrameID,
|
|
||||||
SenderReach: msg.Signer,
|
|
||||||
PayloadBytes: msg.PayloadBytes,
|
|
||||||
SentAt: nowUnix(sdkCtx),
|
|
||||||
}
|
|
||||||
session.Frames = append(session.Frames, frame)
|
|
||||||
s.Keeper.SetSession(sdkCtx, session)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.frame_sent",
|
|
||||||
sdk.NewAttribute("session_id", msg.SessionID),
|
|
||||||
sdk.NewAttribute("frame_id", msg.FrameID),
|
|
||||||
sdk.NewAttribute("sender_reach", msg.Signer),
|
|
||||||
// NO geolocation (A-522 surveillance-resistant invariant).
|
|
||||||
))
|
|
||||||
return &types.MsgSendOYSATFrameResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- ReceiveOYSATFrame (ack a frame; Open → Active on first ack) -------------
|
|
||||||
|
|
||||||
// ReceiveOYSATFrame acknowledges receipt of an OY-SAT frame. The handler
|
|
||||||
// transitions the session Open → Active on the first ack. The handler
|
|
||||||
// enforces the stateful session-status check: the session must be Open or
|
|
||||||
// Active (acks on Closed/Revoked are REJECTED — the rejected-frame case).
|
|
||||||
func (s msgServer) ReceiveOYSATFrame(ctx interface{}, msg *types.MsgReceiveOYSATFrame) (*types.MsgReceiveOYSATFrameResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
session, ok := s.Keeper.GetSession(sdkCtx, msg.SessionID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q not found", msg.SessionID)
|
|
||||||
}
|
|
||||||
if session.IsTerminal() {
|
|
||||||
// Rejected-frame case: an ack received on a Closed/Revoked
|
|
||||||
// session MUST be rejected (A-523 session state machine).
|
|
||||||
return nil, fmt.Errorf("bearers: session %q is terminal (%s), rejects ack", msg.SessionID, session.Status)
|
|
||||||
}
|
|
||||||
if session.IsExpired(nowUnix(sdkCtx)) {
|
|
||||||
session.Status = types.SessionClosed
|
|
||||||
session.ClosedAt = nowUnix(sdkCtx)
|
|
||||||
s.Keeper.SetSession(sdkCtx, session)
|
|
||||||
return nil, fmt.Errorf("bearers: session %q expired (ttl %d), rejects ack", msg.SessionID, session.TTL)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Find the named frame; mark it received.
|
|
||||||
found := false
|
|
||||||
for i := range session.Frames {
|
|
||||||
if session.Frames[i].FrameID == msg.FrameID {
|
|
||||||
session.Frames[i].Received = true
|
|
||||||
found = true
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if !found {
|
|
||||||
return nil, fmt.Errorf("bearers: frame %q not found on session %q", msg.FrameID, msg.SessionID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Open → Active on the first ack.
|
|
||||||
if session.Status == types.SessionOpen {
|
|
||||||
session.Status = types.SessionActive
|
|
||||||
}
|
|
||||||
s.Keeper.SetSession(sdkCtx, session)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.frame_received",
|
|
||||||
sdk.NewAttribute("session_id", msg.SessionID),
|
|
||||||
sdk.NewAttribute("frame_id", msg.FrameID),
|
|
||||||
sdk.NewAttribute("status", string(session.Status)),
|
|
||||||
// NO geolocation (A-522 surveillance-resistant invariant).
|
|
||||||
))
|
|
||||||
return &types.MsgReceiveOYSATFrameResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- IssueOYQR (issue a one-shot OY-QR, consumed=false) ----------------------
|
|
||||||
|
|
||||||
// IssueOYQR issues a one-shot OY-QR (consumed=false). The handler enforces
|
|
||||||
// idempotency (qr-id must not already exist).
|
|
||||||
func (s msgServer) IssueOYQR(ctx interface{}, msg *types.MsgIssueOYQR) (*types.MsgIssueOYQRResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Idempotency: qr-id must not already exist.
|
|
||||||
if _, ok := s.Keeper.GetOYQRCode(sdkCtx, msg.QRID); ok {
|
|
||||||
return nil, fmt.Errorf("bearers: qr %q already exists", msg.QRID)
|
|
||||||
}
|
|
||||||
|
|
||||||
qr := types.OYQRCode{
|
|
||||||
QRID: msg.QRID,
|
|
||||||
PayloadBytes: msg.PayloadBytes,
|
|
||||||
Consumed: false,
|
|
||||||
IssuerReachID: msg.IssuerReachID,
|
|
||||||
AmountGrain: msg.AmountGrain,
|
|
||||||
ExpiresAt: msg.ExpiresAt,
|
|
||||||
}
|
|
||||||
s.Keeper.SetOYQRCode(sdkCtx, qr)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.qr_issued",
|
|
||||||
sdk.NewAttribute("qr_id", msg.QRID),
|
|
||||||
sdk.NewAttribute("issuer_reach", msg.IssuerReachID),
|
|
||||||
sdk.NewAttribute("amount_grain", fmt.Sprintf("%d", msg.AmountGrain)),
|
|
||||||
sdk.NewAttribute("consumed", "false"),
|
|
||||||
// NO geolocation (A-522 surveillance-resistant invariant).
|
|
||||||
))
|
|
||||||
return &types.MsgIssueOYQRResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- ConsumeOYQR (one-shot; A-521 consumed-flip-before-effect) ---------------
|
|
||||||
|
|
||||||
// ConsumeOYQR is the canonical one-shot handler (A-521). The ordering is:
|
|
||||||
// 1. load QR
|
|
||||||
// 2. assert !consumed (replay firewall — a replay finds consumed==true
|
|
||||||
// and returns an error; idempotent reject, NOT double-effect)
|
|
||||||
// 3. assert expires-at > now (the QR is still valid)
|
|
||||||
// 4. FLIP consumed=true (state write FIRST — A-521)
|
|
||||||
// 5. emit transfer effect via BreadKeeper shim (the SDK store is atomic
|
|
||||||
// per tx — a panic in the transfer rolls back the whole tx, so the
|
|
||||||
// order is safe; the order documents intent and matches the ibc-go
|
|
||||||
// delete-before-mint convention)
|
|
||||||
// 6. emit event
|
|
||||||
// 7. return
|
|
||||||
//
|
|
||||||
// A nil BreadKeeper shim is permitted (the handler still flips consumed —
|
|
||||||
// the A-521 state-write-first invariant holds regardless; the transfer
|
|
||||||
// effect is skipped, which is the simtest behavior when the shim is not
|
|
||||||
// wired). This keeps the one-shot replay firewall intact even without the
|
|
||||||
// x/bread keeper wired.
|
|
||||||
func (s msgServer) ConsumeOYQR(ctx interface{}, msg *types.MsgConsumeOYQR) (*types.MsgConsumeOYQRResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// 1. Load QR.
|
|
||||||
qr, ok := s.Keeper.GetOYQRCode(sdkCtx, msg.QRID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bearers: qr %q not found", msg.QRID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// 2. Replay firewall: a consumed QR rejects further consumes
|
|
||||||
// (idempotent reject, NOT double-effect — A-521).
|
|
||||||
if qr.Consumed {
|
|
||||||
return nil, fmt.Errorf("bearers: qr %q already consumed (one-shot — A-521)", msg.QRID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// 3. Expiry check: the QR must still be valid (expires-at > now).
|
|
||||||
now := nowUnix(sdkCtx)
|
|
||||||
if qr.ExpiresAt <= now {
|
|
||||||
// Flip consumed to prevent a late replay (the QR is expired,
|
|
||||||
// but we mark it consumed to lock the one-shot semantics; the
|
|
||||||
// consume itself fails).
|
|
||||||
qr.Consumed = true
|
|
||||||
s.Keeper.SetOYQRCode(sdkCtx, qr)
|
|
||||||
return nil, fmt.Errorf("bearers: qr %q expired (expires-at %d <= now %d)", msg.QRID, qr.ExpiresAt, now)
|
|
||||||
}
|
|
||||||
|
|
||||||
// 4. FLIP consumed=true (state write FIRST — A-521). This is the
|
|
||||||
// replay firewall: any subsequent consume finds consumed==true
|
|
||||||
// and returns the error above (idempotent reject).
|
|
||||||
qr.Consumed = true
|
|
||||||
s.Keeper.SetOYQRCode(sdkCtx, qr)
|
|
||||||
|
|
||||||
// 5. Emit transfer effect via BreadKeeper shim. A nil shim is
|
|
||||||
// permitted (the consumed flip already happened — the A-521
|
|
||||||
// invariant holds; the transfer is skipped in the unwired case).
|
|
||||||
var transferErr error
|
|
||||||
if s.Keeper.breadKeeper != nil {
|
|
||||||
transferErr = s.Keeper.breadKeeper.TransferGrain(qr.IssuerReachID, msg.ConsumerReachID, qr.AmountGrain)
|
|
||||||
}
|
|
||||||
if transferErr != nil {
|
|
||||||
// The transfer failed AFTER the consumed flip. The SDK store
|
|
||||||
// is atomic per tx — returning the error rolls back the
|
|
||||||
// consumed flip too (the QR is restored to consumed=false).
|
|
||||||
// This is the correct behavior: a failed transfer does NOT
|
|
||||||
// burn the one-shot QR. The order (flip first, transfer
|
|
||||||
// second) documents intent and matches the ibc-go
|
|
||||||
// delete-before-mint convention; the atomicity guarantee
|
|
||||||
// makes the order safe.
|
|
||||||
return nil, fmt.Errorf("bearers: qr %q transfer effect failed: %w", msg.QRID, transferErr)
|
|
||||||
}
|
|
||||||
|
|
||||||
// 6. Emit event.
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.qr_consumed",
|
|
||||||
sdk.NewAttribute("qr_id", msg.QRID),
|
|
||||||
sdk.NewAttribute("issuer_reach", qr.IssuerReachID),
|
|
||||||
sdk.NewAttribute("consumer_reach", msg.ConsumerReachID),
|
|
||||||
sdk.NewAttribute("amount_grain", fmt.Sprintf("%d", qr.AmountGrain)),
|
|
||||||
sdk.NewAttribute("consumed", "true"),
|
|
||||||
// NO geolocation (A-522 surveillance-resistant invariant).
|
|
||||||
))
|
|
||||||
return &types.MsgConsumeOYQRResponse{}, nil
|
|
||||||
}
|
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -1,130 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bearers/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// transport.go holds the store-backed BearerTransport impl (P2-02-01,
|
|
||||||
// REQ-034, A-522). The v0.2 BearerTransport Go interface (Send, Receive,
|
|
||||||
// Status) gains a store-backed runtime impl: the keeper IS the transport
|
|
||||||
// for simtest purposes — no hardware/RF Go libraries (D-054).
|
|
||||||
//
|
|
||||||
// The transport wraps the keeper's session store. Send appends a frame to
|
|
||||||
// the session's Frames slice. Receive marks the frame received (and
|
|
||||||
// transitions the session Open → Active on first ack). Status reports
|
|
||||||
// whether the session is Open or Active (i.e., still carrying traffic).
|
|
||||||
//
|
|
||||||
// Surveillance-resistant invariant (A-522): the transport carries NO
|
|
||||||
// geolocation / sender physical location fields. The surveillance-resistant
|
|
||||||
// locked const on OYSATLink/OYLRLink is a runtime invariant — the transport
|
|
||||||
// MUST NOT emit geolocation in events. A negative simtest asserts the event
|
|
||||||
// set contains NO geolocation fields.
|
|
||||||
|
|
||||||
// StoreTransport is the store-backed BearerTransport impl. It wraps a
|
|
||||||
// Keeper + the sdk.Context (bound at construction so the BearerTransport
|
|
||||||
// interface methods can stay parameterless per the v0.2 interface contract).
|
|
||||||
// The transport operates on a single session-id (a transport instance is
|
|
||||||
// scoped to one session — the bearer is a per-session handle in the simtest
|
|
||||||
// runtime).
|
|
||||||
type StoreTransport struct {
|
|
||||||
keeper Keeper
|
|
||||||
ctx sdk.Context
|
|
||||||
sessionID string
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewStoreTransport constructs a store-backed BearerTransport scoped to the
|
|
||||||
// named session. The session must already exist (Open or Active). The
|
|
||||||
// transport reads/writes the session's Frames slice via the keeper store.
|
|
||||||
func NewStoreTransport(k Keeper, ctx sdk.Context, sessionID string) *StoreTransport {
|
|
||||||
return &StoreTransport{keeper: k, ctx: ctx, sessionID: sessionID}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertion: StoreTransport satisfies the v0.2 BearerTransport
|
|
||||||
// interface (D-029, REQ-034). The interface contract is Send/Receive/Status
|
|
||||||
// (parameterless except Send takes a payload).
|
|
||||||
var _ types.BearerTransport = (*StoreTransport)(nil)
|
|
||||||
|
|
||||||
// Send dispatches a payload via the bearer. The store-backed impl appends
|
|
||||||
// the payload as a new Frame on the session's Frames slice. Returns an
|
|
||||||
// error if the session is not found or is terminal (Closed/Revoked) — a
|
|
||||||
// terminal session rejects further Send calls.
|
|
||||||
func (t *StoreTransport) Send(payload []byte) error {
|
|
||||||
s, ok := t.keeper.GetSession(t.ctx, t.sessionID)
|
|
||||||
if !ok {
|
|
||||||
return fmt.Errorf("bearers: session %q not found", t.sessionID)
|
|
||||||
}
|
|
||||||
if s.IsTerminal() {
|
|
||||||
return fmt.Errorf("bearers: session %q is terminal (%s), rejects Send", t.sessionID, s.Status)
|
|
||||||
}
|
|
||||||
frame := types.Frame{
|
|
||||||
FrameID: fmt.Sprintf("%s-frame-%d", t.sessionID, len(s.Frames)+1),
|
|
||||||
SenderReach: s.InitiatorReach,
|
|
||||||
PayloadBytes: payload,
|
|
||||||
SentAt: t.ctx.BlockTime().Unix(),
|
|
||||||
}
|
|
||||||
s.Frames = append(s.Frames, frame)
|
|
||||||
t.keeper.SetSession(t.ctx, s)
|
|
||||||
t.ctx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.frame_sent",
|
|
||||||
sdk.NewAttribute("session_id", t.sessionID),
|
|
||||||
sdk.NewAttribute("frame_id", frame.FrameID),
|
|
||||||
sdk.NewAttribute("sender_reach", frame.SenderReach),
|
|
||||||
// NO geolocation (A-522 surveillance-resistant invariant).
|
|
||||||
))
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Receive accepts an inbound payload from the bearer. The store-backed impl
|
|
||||||
// marks the first unreceived frame as Received and transitions the session
|
|
||||||
// Open → Active on the first ack. Returns the payload and an error if the
|
|
||||||
// bearer has no inbound (unreceived) payload or the session is terminal.
|
|
||||||
func (t *StoreTransport) Receive() ([]byte, error) {
|
|
||||||
s, ok := t.keeper.GetSession(t.ctx, t.sessionID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q not found", t.sessionID)
|
|
||||||
}
|
|
||||||
if s.IsTerminal() {
|
|
||||||
return nil, fmt.Errorf("bearers: session %q is terminal (%s), rejects Receive", t.sessionID, s.Status)
|
|
||||||
}
|
|
||||||
// Find the first unreceived frame.
|
|
||||||
var received *types.Frame
|
|
||||||
for i := range s.Frames {
|
|
||||||
if !s.Frames[i].Received {
|
|
||||||
s.Frames[i].Received = true
|
|
||||||
received = &s.Frames[i]
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if received == nil {
|
|
||||||
return nil, fmt.Errorf("bearers: no inbound frame on session %q", t.sessionID)
|
|
||||||
}
|
|
||||||
// Open → Active on the first ack.
|
|
||||||
if s.Status == types.SessionOpen {
|
|
||||||
s.Status = types.SessionActive
|
|
||||||
}
|
|
||||||
t.keeper.SetSession(t.ctx, s)
|
|
||||||
t.ctx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bearers.frame_received",
|
|
||||||
sdk.NewAttribute("session_id", t.sessionID),
|
|
||||||
sdk.NewAttribute("frame_id", received.FrameID),
|
|
||||||
sdk.NewAttribute("status", string(s.Status)),
|
|
||||||
// NO geolocation (A-522 surveillance-resistant invariant).
|
|
||||||
))
|
|
||||||
return received.PayloadBytes, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Status reports the bearer's current reachability (true = reachable). The
|
|
||||||
// store-backed impl reports true iff the session exists and is Open or
|
|
||||||
// Active (still carrying traffic). A terminal or missing session is
|
|
||||||
// unreachable.
|
|
||||||
func (t *StoreTransport) Status() bool {
|
|
||||||
s, ok := t.keeper.GetSession(t.ctx, t.sessionID)
|
|
||||||
if !ok {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
return s.Status == types.SessionOpen || s.Status == types.SessionActive
|
|
||||||
}
|
|
||||||
@@ -1,79 +0,0 @@
|
|||||||
package bearers
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/types/module"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bearers/keeper"
|
|
||||||
"github.com/oy/openyield/x/bearers/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// module.go holds the bearers module's AppModule + RegisterServices
|
|
||||||
// (P2-02-01, REQ-034).
|
|
||||||
//
|
|
||||||
// The AppModule wraps the Keeper and registers the MsgServer via
|
|
||||||
// RegisterServices. This is the simtest-grade AppModule (D-054): the
|
|
||||||
// RegisterServices wires the hand-rolled MsgServer (no protobuf codegen per
|
|
||||||
// the skeleton's zero-codegen style). The MsgServer is constructed directly
|
|
||||||
// and exposed via the module for test wiring.
|
|
||||||
|
|
||||||
// ConsensusVersion is the bearers module's consensus version (AppModule).
|
|
||||||
const ConsensusVersion = 1
|
|
||||||
|
|
||||||
// AppModule is the bearers application module (simtest-grade — D-054).
|
|
||||||
type AppModule struct {
|
|
||||||
keeper keeper.Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewAppModule constructs a new bearers AppModule. The BreadKeeper
|
|
||||||
// expected-keeper shim is injected (nil-able for partial tests).
|
|
||||||
func NewAppModule(cdc codec.Codec, storeKey storetypes.StoreKey, bk types.BreadKeeper) AppModule {
|
|
||||||
k := keeper.NewKeeper(cdc, storeKey, bk)
|
|
||||||
return AppModule{keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
// RegisterServices registers the bearers MsgServer. Simtest-grade wiring:
|
|
||||||
// the MsgServer is constructed from the keeper and exposed via the module's
|
|
||||||
// MsgServer method (tests use NewMsgServerImpl directly).
|
|
||||||
func (am AppModule) RegisterServices(cfg module.Configurator) {
|
|
||||||
_ = cfg
|
|
||||||
}
|
|
||||||
|
|
||||||
// MsgServer returns the bearers MsgServer for this module's keeper.
|
|
||||||
func (am AppModule) MsgServer() types.MsgServer {
|
|
||||||
return keeper.NewMsgServerImpl(am.keeper)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Name returns the module name.
|
|
||||||
func (AppModule) Name() string { return types.ModuleName }
|
|
||||||
|
|
||||||
// ConsensusVersion implements AppModule.ConsensusVersion.
|
|
||||||
func (AppModule) ConsensusVersion() uint64 { return ConsensusVersion }
|
|
||||||
|
|
||||||
// InitGenesis performs genesis initialization for the bearers module.
|
|
||||||
func (am AppModule) InitGenesis(ctx sdk.Context, cdc codec.JSONCodec, data json.RawMessage) {
|
|
||||||
var gs types.GenesisState
|
|
||||||
cdc.MustUnmarshalJSON(data, &gs)
|
|
||||||
for _, s := range gs.Sessions {
|
|
||||||
am.keeper.SetSession(ctx, s)
|
|
||||||
}
|
|
||||||
for _, q := range gs.QRs {
|
|
||||||
am.keeper.SetOYQRCode(ctx, q)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ExportGenesis returns the exported genesis state as raw bytes.
|
|
||||||
func (am AppModule) ExportGenesis(ctx sdk.Context, cdc codec.JSONCodec) json.RawMessage {
|
|
||||||
sessions := am.keeper.AllSessions(ctx)
|
|
||||||
qrs := am.keeper.AllOYQRCodes(ctx)
|
|
||||||
gs := types.GenesisState{Sessions: sessions, QRs: qrs}
|
|
||||||
return cdc.MustMarshalJSON(&gs)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions: AppModule implements the module interface stubs.
|
|
||||||
var _ module.HasName = AppModule{}
|
|
||||||
var _ module.HasConsensusVersion = AppModule{}
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
// expected_keepers.go holds the Go INTERFACE for the cross-module keeper
|
|
||||||
// x/bearers depends on (G-003 firewall — ibc-go expected-keepers convention).
|
|
||||||
//
|
|
||||||
// x/bearers's MsgConsumeOYQR handler drives a one-shot grain transfer via
|
|
||||||
// the x/bread keeper (by-ID-string on the reach-ids — the issuer-reach-id
|
|
||||||
// and consumer-reach-id). The dependency is expressed as an INTERFACE
|
|
||||||
// defined HERE (in x/bearers/types), NOT as a struct import of
|
|
||||||
// x/bread/types. The x/bread keeper satisfies this interface structurally;
|
|
||||||
// the handler depends on the interface, preserving G-003's intent (no
|
|
||||||
// cross-module struct coupling, no import cycles).
|
|
||||||
//
|
|
||||||
// Test-only cross-package imports (the G-003 test exemption) remain exempt:
|
|
||||||
// a simtest may import both x/bearers/keeper and x/bread/keeper to wire the
|
|
||||||
// BreadKeeper shim in a test setup.
|
|
||||||
|
|
||||||
// BreadKeeper is the expected-keeper interface for x/bread (G-003). The
|
|
||||||
// bearers MsgConsumeOYQR handler calls it for the OY-QR one-shot transfer
|
|
||||||
// effect: TransferGrain moves grain from the issuer-reach to the
|
|
||||||
// consumer-reach (by-ID-string — the lexicon-clean holder identifier, NOT
|
|
||||||
// a banned financial-holder lexicon; use Holder/Reach).
|
|
||||||
//
|
|
||||||
// The reach-ids are by-ID-string at the type level (G-003) and stay
|
|
||||||
// by-ID-string at the runtime level (this interface takes strings, not a
|
|
||||||
// x/bread struct). No struct import of x/bread/types.
|
|
||||||
type BreadKeeper interface {
|
|
||||||
// TransferGrain moves grain from the from-reach to the to-reach (by
|
|
||||||
// reach-id string). Returns an error if the transfer fails (e.g.,
|
|
||||||
// insufficient grain, unknown reach-id). The bearers handler flips
|
|
||||||
// the OY-QR consumed flag FIRST (state write — A-521), THEN invokes
|
|
||||||
// this transfer effect; a panic in the transfer rolls back the whole
|
|
||||||
// tx (SDK store is atomic per tx — the order documents intent and
|
|
||||||
// matches the ibc-go delete-before-mint convention).
|
|
||||||
TransferGrain(fromReach, toReach string, amount int64) error
|
|
||||||
}
|
|
||||||
@@ -1,473 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// msg_bearer.go holds the bearers module's Msg* types implementing sdk.Msg
|
|
||||||
// (G-006 controlled exception: types/ gains the cosmos-sdk import for
|
|
||||||
// sdk.Msg — D-055; the invariant/lexicon tests in *_test.go stay stdlib-only
|
|
||||||
// per G-024, isolated from this msg_*.go file). Each Msg carries a
|
|
||||||
// ValidateBasic (stateless) and GetSigners.
|
|
||||||
//
|
|
||||||
// The seven bearer Msg types drive the OY-SAT frame transport + OY-QR
|
|
||||||
// one-shot consume + session lifecycle (REQ-034):
|
|
||||||
// - MsgSendOYSATFrame: send a frame on an OY-SAT session.
|
|
||||||
// - MsgReceiveOYSATFrame: acknowledge receipt of a frame (transitions the
|
|
||||||
// session Open → Active on first ack).
|
|
||||||
// - MsgIssueOYQR: issue a one-shot OY-QR (consumed=false).
|
|
||||||
// - MsgConsumeOYQR: consume a one-shot OY-QR — flips consumed BEFORE the
|
|
||||||
// transfer effect (A-521); replay finds consumed==true and errors.
|
|
||||||
// - MsgOpenSession: open a new session (status=Open).
|
|
||||||
// - MsgCloseSession: close a session (Active → Closed).
|
|
||||||
// - MsgRevokeSession: revoke a session (out-of-band → Revoked).
|
|
||||||
//
|
|
||||||
// All cross-module refs are by-ID-string (G-003): session-id is this
|
|
||||||
// session's ID; qr-id is this QR's ID; reach-ids are by-ID-string user
|
|
||||||
// identifiers. GetSigners returns the signer reach-ids encoded as
|
|
||||||
// sdk.AccAddress bytes. The reach-id is the lexicon-clean holder
|
|
||||||
// identifier (G-003 — NOT a banned financial-holder lexicon; use
|
|
||||||
// Holder/Reach).
|
|
||||||
//
|
|
||||||
// Surveillance-resistant invariant (A-522): NO Msg carries geolocation or
|
|
||||||
// sender physical location fields. The handler MUST NOT emit geolocation
|
|
||||||
// in events. A negative simtest asserts the event set contains NO
|
|
||||||
// geolocation fields.
|
|
||||||
|
|
||||||
// --- MsgSendOYSATFrame --------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgSendOYSATFrame sends a frame on an OY-SAT session. ValidateBasic is
|
|
||||||
// stateless: non-empty session-id, non-empty frame payload, non-empty
|
|
||||||
// signer. The handler enforces the stateful session-status check (the
|
|
||||||
// session must be Open or Active — frames on Closed/Revoked are rejected).
|
|
||||||
type MsgSendOYSATFrame struct {
|
|
||||||
SessionID string `json:"session_id" yaml:"session_id"`
|
|
||||||
FrameID string `json:"frame_id" yaml:"frame_id"`
|
|
||||||
PayloadBytes []byte `json:"payload_bytes" yaml:"payload_bytes"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message (sdk.Msg = proto.Message).
|
|
||||||
func (m *MsgSendOYSATFrame) Reset() { *m = MsgSendOYSATFrame{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgSendOYSATFrame) String() string {
|
|
||||||
return fmt.Sprintf("MsgSendOYSATFrame{SessionID:%s FrameID:%s Signer:%s}",
|
|
||||||
m.SessionID, m.FrameID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgSendOYSATFrame) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty session-id, non-empty
|
|
||||||
// frame payload, non-empty signer.
|
|
||||||
func (m *MsgSendOYSATFrame) ValidateBasic() error {
|
|
||||||
if m.SessionID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty session-id")
|
|
||||||
}
|
|
||||||
if len(m.PayloadBytes) == 0 {
|
|
||||||
return fmt.Errorf("bearers: empty frame payload")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bearers: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgSendOYSATFrame) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgReceiveOYSATFrame -----------------------------------------------------
|
|
||||||
|
|
||||||
// MsgReceiveOYSATFrame acknowledges receipt of an OY-SAT frame. The handler
|
|
||||||
// transitions the session Open → Active on the first ack. ValidateBasic is
|
|
||||||
// stateless: non-empty session-id, non-empty frame-id, non-empty signer.
|
|
||||||
type MsgReceiveOYSATFrame struct {
|
|
||||||
SessionID string `json:"session_id" yaml:"session_id"`
|
|
||||||
FrameID string `json:"frame_id" yaml:"frame_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgReceiveOYSATFrame) Reset() { *m = MsgReceiveOYSATFrame{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgReceiveOYSATFrame) String() string {
|
|
||||||
return fmt.Sprintf("MsgReceiveOYSATFrame{SessionID:%s FrameID:%s Signer:%s}",
|
|
||||||
m.SessionID, m.FrameID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgReceiveOYSATFrame) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty session-id, non-empty
|
|
||||||
// frame-id, non-empty signer.
|
|
||||||
func (m *MsgReceiveOYSATFrame) ValidateBasic() error {
|
|
||||||
if m.SessionID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty session-id")
|
|
||||||
}
|
|
||||||
if m.FrameID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty frame-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bearers: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgReceiveOYSATFrame) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgIssueOYQR -------------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgIssueOYQR issues a one-shot OY-QR (consumed=false). ValidateBasic is
|
|
||||||
// stateless: non-empty qr-id, non-empty issuer-reach-id, non-empty payload,
|
|
||||||
// expires-at > 0 (the handler asserts expires-at > now at consume time, not
|
|
||||||
// issue time — but a zero/negative expires-at is rejected as malformed).
|
|
||||||
type MsgIssueOYQR struct {
|
|
||||||
QRID string `json:"qr_id" yaml:"qr_id"`
|
|
||||||
IssuerReachID string `json:"issuer_reach_id" yaml:"issuer_reach_id"`
|
|
||||||
PayloadBytes []byte `json:"payload_bytes" yaml:"payload_bytes"`
|
|
||||||
AmountGrain int64 `json:"amount_grain" yaml:"amount_grain"`
|
|
||||||
ExpiresAt int64 `json:"expires_at" yaml:"expires_at"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgIssueOYQR) Reset() { *m = MsgIssueOYQR{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgIssueOYQR) String() string {
|
|
||||||
return fmt.Sprintf("MsgIssueOYQR{QRID:%s IssuerReachID:%s AmountGrain:%d ExpiresAt:%d Signer:%s}",
|
|
||||||
m.QRID, m.IssuerReachID, m.AmountGrain, m.ExpiresAt, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgIssueOYQR) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty qr-id, non-empty
|
|
||||||
// issuer-reach-id, non-empty payload, amount > 0, expires-at > 0, non-empty
|
|
||||||
// signer. The handler asserts expires-at > now at consume time (the
|
|
||||||
// stateful check); a zero/negative expires-at is rejected as malformed here.
|
|
||||||
func (m *MsgIssueOYQR) ValidateBasic() error {
|
|
||||||
if m.QRID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty qr-id")
|
|
||||||
}
|
|
||||||
if m.IssuerReachID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty issuer-reach-id")
|
|
||||||
}
|
|
||||||
if len(m.PayloadBytes) == 0 {
|
|
||||||
return fmt.Errorf("bearers: empty qr payload")
|
|
||||||
}
|
|
||||||
if m.AmountGrain <= 0 {
|
|
||||||
return fmt.Errorf("bearers: amount-grain must be > 0")
|
|
||||||
}
|
|
||||||
if m.ExpiresAt <= 0 {
|
|
||||||
return fmt.Errorf("bearers: expires-at must be > 0")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bearers: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgIssueOYQR) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgConsumeOYQR ----------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgConsumeOYQR consumes a one-shot OY-QR. The handler is the canonical
|
|
||||||
// one-shot handler (A-521): load QR → assert !consumed → assert expires-at
|
|
||||||
// > now → FLIP consumed=true (state write FIRST) → emit transfer effect
|
|
||||||
// via BreadKeeper shim → emit event → return. A replay finds consumed==true
|
|
||||||
// and returns an error (idempotent reject, NOT double-effect).
|
|
||||||
//
|
|
||||||
// ValidateBasic is stateless: non-empty qr-id, non-empty consumer-reach-id,
|
|
||||||
// non-empty signer.
|
|
||||||
type MsgConsumeOYQR struct {
|
|
||||||
QRID string `json:"qr_id" yaml:"qr_id"`
|
|
||||||
ConsumerReachID string `json:"consumer_reach_id" yaml:"consumer_reach_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgConsumeOYQR) Reset() { *m = MsgConsumeOYQR{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgConsumeOYQR) String() string {
|
|
||||||
return fmt.Sprintf("MsgConsumeOYQR{QRID:%s ConsumerReachID:%s Signer:%s}",
|
|
||||||
m.QRID, m.ConsumerReachID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgConsumeOYQR) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty qr-id, non-empty
|
|
||||||
// consumer-reach-id, non-empty signer.
|
|
||||||
func (m *MsgConsumeOYQR) ValidateBasic() error {
|
|
||||||
if m.QRID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty qr-id")
|
|
||||||
}
|
|
||||||
if m.ConsumerReachID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty consumer-reach-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bearers: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgConsumeOYQR) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgOpenSession ----------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgOpenSession opens a new bearer session (status=Open). ValidateBasic is
|
|
||||||
// stateless: non-empty session-id, valid bearer-type, non-empty
|
|
||||||
// initiator-reach, non-empty peer-reach, non-empty signer.
|
|
||||||
type MsgOpenSession struct {
|
|
||||||
SessionID string `json:"session_id" yaml:"session_id"`
|
|
||||||
BearerType BearerType `json:"bearer_type" yaml:"bearer_type"`
|
|
||||||
InitiatorReach string `json:"initiator_reach" yaml:"initiator_reach"`
|
|
||||||
PeerReach string `json:"peer_reach" yaml:"peer_reach"`
|
|
||||||
TTL int64 `json:"ttl" yaml:"ttl"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgOpenSession) Reset() { *m = MsgOpenSession{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgOpenSession) String() string {
|
|
||||||
return fmt.Sprintf("MsgOpenSession{SessionID:%s BearerType:%s InitiatorReach:%s PeerReach:%s TTL:%d Signer:%s}",
|
|
||||||
m.SessionID, m.BearerType, m.InitiatorReach, m.PeerReach, m.TTL, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgOpenSession) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty session-id, known
|
|
||||||
// bearer-type, non-empty initiator-reach, non-empty peer-reach, non-empty
|
|
||||||
// signer. ttl may be 0 (never expires).
|
|
||||||
func (m *MsgOpenSession) ValidateBasic() error {
|
|
||||||
if m.SessionID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty session-id")
|
|
||||||
}
|
|
||||||
if !knownBearerType(m.BearerType) {
|
|
||||||
return fmt.Errorf("bearers: unknown bearer-type %q", m.BearerType)
|
|
||||||
}
|
|
||||||
if m.InitiatorReach == "" {
|
|
||||||
return fmt.Errorf("bearers: empty initiator-reach")
|
|
||||||
}
|
|
||||||
if m.PeerReach == "" {
|
|
||||||
return fmt.Errorf("bearers: empty peer-reach")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bearers: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgOpenSession) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgCloseSession ---------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgCloseSession closes a session (Active → Closed). ValidateBasic is
|
|
||||||
// stateless: non-empty session-id, non-empty signer.
|
|
||||||
type MsgCloseSession struct {
|
|
||||||
SessionID string `json:"session_id" yaml:"session_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgCloseSession) Reset() { *m = MsgCloseSession{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgCloseSession) String() string {
|
|
||||||
return fmt.Sprintf("MsgCloseSession{SessionID:%s Signer:%s}", m.SessionID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgCloseSession) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty session-id and signer.
|
|
||||||
func (m *MsgCloseSession) ValidateBasic() error {
|
|
||||||
if m.SessionID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty session-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bearers: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgCloseSession) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgRevokeSession --------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgRevokeSession revokes a session (out-of-band → Revoked). A revoked
|
|
||||||
// session rejects further Receive. ValidateBasic is stateless: non-empty
|
|
||||||
// session-id, non-empty signer.
|
|
||||||
type MsgRevokeSession struct {
|
|
||||||
SessionID string `json:"session_id" yaml:"session_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgRevokeSession) Reset() { *m = MsgRevokeSession{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgRevokeSession) String() string {
|
|
||||||
return fmt.Sprintf("MsgRevokeSession{SessionID:%s Signer:%s}", m.SessionID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgRevokeSession) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty session-id and signer.
|
|
||||||
func (m *MsgRevokeSession) ValidateBasic() error {
|
|
||||||
if m.SessionID == "" {
|
|
||||||
return fmt.Errorf("bearers: empty session-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bearers: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgRevokeSession) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgServer interface + Response types -----------------------------------
|
|
||||||
|
|
||||||
// MsgServer is the bearers module's message server interface (one method per
|
|
||||||
// Msg*). The keeper's msg_server.go implements this; module.go's
|
|
||||||
// RegisterServices wires the implementation. This is the hand-rolled
|
|
||||||
// equivalent of the protobuf-generated MsgServer interface (no codegen per
|
|
||||||
// the skeleton's zero-codegen style).
|
|
||||||
type MsgServer interface {
|
|
||||||
SendOYSATFrame(ctx interface{}, msg *MsgSendOYSATFrame) (*MsgSendOYSATFrameResponse, error)
|
|
||||||
ReceiveOYSATFrame(ctx interface{}, msg *MsgReceiveOYSATFrame) (*MsgReceiveOYSATFrameResponse, error)
|
|
||||||
IssueOYQR(ctx interface{}, msg *MsgIssueOYQR) (*MsgIssueOYQRResponse, error)
|
|
||||||
ConsumeOYQR(ctx interface{}, msg *MsgConsumeOYQR) (*MsgConsumeOYQRResponse, error)
|
|
||||||
OpenSession(ctx interface{}, msg *MsgOpenSession) (*MsgOpenSessionResponse, error)
|
|
||||||
CloseSession(ctx interface{}, msg *MsgCloseSession) (*MsgCloseSessionResponse, error)
|
|
||||||
RevokeSession(ctx interface{}, msg *MsgRevokeSession) (*MsgRevokeSessionResponse, error)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Response types (hand-rolled equivalents of the protobuf-generated response
|
|
||||||
// wrappers; empty bodies — the response is the state mutation + event).
|
|
||||||
|
|
||||||
// MsgSendOYSATFrameResponse is the response to MsgSendOYSATFrame.
|
|
||||||
type MsgSendOYSATFrameResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgSendOYSATFrameResponse) Reset() { *m = MsgSendOYSATFrameResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgSendOYSATFrameResponse) String() string { return "MsgSendOYSATFrameResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgSendOYSATFrameResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgReceiveOYSATFrameResponse is the response to MsgReceiveOYSATFrame.
|
|
||||||
type MsgReceiveOYSATFrameResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgReceiveOYSATFrameResponse) Reset() { *m = MsgReceiveOYSATFrameResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgReceiveOYSATFrameResponse) String() string { return "MsgReceiveOYSATFrameResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgReceiveOYSATFrameResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgIssueOYQRResponse is the response to MsgIssueOYQR.
|
|
||||||
type MsgIssueOYQRResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgIssueOYQRResponse) Reset() { *m = MsgIssueOYQRResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgIssueOYQRResponse) String() string { return "MsgIssueOYQRResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgIssueOYQRResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgConsumeOYQRResponse is the response to MsgConsumeOYQR.
|
|
||||||
type MsgConsumeOYQRResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgConsumeOYQRResponse) Reset() { *m = MsgConsumeOYQRResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgConsumeOYQRResponse) String() string { return "MsgConsumeOYQRResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgConsumeOYQRResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgOpenSessionResponse is the response to MsgOpenSession.
|
|
||||||
type MsgOpenSessionResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgOpenSessionResponse) Reset() { *m = MsgOpenSessionResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgOpenSessionResponse) String() string { return "MsgOpenSessionResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgOpenSessionResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgCloseSessionResponse is the response to MsgCloseSession.
|
|
||||||
type MsgCloseSessionResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgCloseSessionResponse) Reset() { *m = MsgCloseSessionResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgCloseSessionResponse) String() string { return "MsgCloseSessionResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgCloseSessionResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgRevokeSessionResponse is the response to MsgRevokeSession.
|
|
||||||
type MsgRevokeSessionResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgRevokeSessionResponse) Reset() { *m = MsgRevokeSessionResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgRevokeSessionResponse) String() string { return "MsgRevokeSessionResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgRevokeSessionResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// --- Helpers ----------------------------------------------------------------
|
|
||||||
|
|
||||||
// knownBearerType reports whether bt is one of the six BearerType values.
|
|
||||||
func knownBearerType(bt BearerType) bool {
|
|
||||||
for _, b := range AllBearers() {
|
|
||||||
if b.Type == bt {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
@@ -1,121 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
// session.go holds the bearers runtime Session struct + lifecycle enum
|
|
||||||
// (P2-01-01, REQ-034). The Session is the runtime state object for a bearer
|
|
||||||
// transport conversation: a sequence of frames bound by a session-id, with
|
|
||||||
// Open/Active/Closed/Revoked lifecycle (mirrors the v0.2 Window primitive's
|
|
||||||
// lifecycle per A-523).
|
|
||||||
//
|
|
||||||
// All cross-module references are by-ID-string (G-003): initiator-reach and
|
|
||||||
// peer-reach are reach-id strings (the lexicon-clean holder identifier — NOT
|
|
||||||
// a banned financial-holder lexicon; use Holder/Reach). bearer-type is a
|
|
||||||
// BearerType enum value defined in types.go (same package — no cross-module
|
|
||||||
// import).
|
|
||||||
//
|
|
||||||
// Surveillance-resistant invariant (vision §14, A-522): the Session carries
|
|
||||||
// NO geolocation / sender physical location fields. The surveillance-
|
|
||||||
// resistant locked const on OYSATLink/OYLRLink is a runtime invariant —
|
|
||||||
// the handler MUST NOT emit geolocation in events. A negative simtest
|
|
||||||
// asserts the event set contains NO geolocation fields.
|
|
||||||
|
|
||||||
// SessionStatus is the session lifecycle (A-523 — mirrors Window's
|
|
||||||
// Open/Active/Closed/Revoked shape for consistency with the v0.2 Window
|
|
||||||
// primitive).
|
|
||||||
type SessionStatus string
|
|
||||||
|
|
||||||
const (
|
|
||||||
// SessionOpen is the initial state: a session has been declared but no
|
|
||||||
// frame has been acknowledged yet.
|
|
||||||
SessionOpen SessionStatus = "Open"
|
|
||||||
// SessionActive is the state after the first frame is acknowledged
|
|
||||||
// (received). The session is carrying traffic.
|
|
||||||
SessionActive SessionStatus = "Active"
|
|
||||||
// SessionClosed is the terminal success state: the last frame was
|
|
||||||
// delivered or the ttl expired.
|
|
||||||
SessionClosed SessionStatus = "Closed"
|
|
||||||
// SessionRevoked is the out-of-band termination state: a RevokeSession
|
|
||||||
// handler flipped the status. A revoked session rejects further Receive.
|
|
||||||
SessionRevoked SessionStatus = "Revoked"
|
|
||||||
)
|
|
||||||
|
|
||||||
// AllSessionStatuses returns all four SessionStatus values in lifecycle
|
|
||||||
// order. Locked-const test asserts exactly 4 entries.
|
|
||||||
func AllSessionStatuses() []SessionStatus {
|
|
||||||
return []SessionStatus{
|
|
||||||
SessionOpen,
|
|
||||||
SessionActive,
|
|
||||||
SessionClosed,
|
|
||||||
SessionRevoked,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// SessionStatusCount is the locked count of SessionStatus enum values.
|
|
||||||
// A regression firewall: adding/removing/renaming a status breaks this
|
|
||||||
// const's test.
|
|
||||||
const SessionStatusCount = 4
|
|
||||||
|
|
||||||
// Frame is a single bearer transport frame within a Session (REQ-034). A
|
|
||||||
// frame is a unit of payload sent via the bearer transport (OY-SAT satellite
|
|
||||||
// frame, OY-QR paper QR, etc.). The frame carries the payload-bytes and the
|
|
||||||
// sender-reach-id (the lexicon-clean holder identifier — NOT a geolocation
|
|
||||||
// or physical location; surveillance-resistant invariant A-522).
|
|
||||||
type Frame struct {
|
|
||||||
FrameID string `json:"frame_id" yaml:"frame_id"`
|
|
||||||
SenderReach string `json:"sender_reach" yaml:"sender_reach"`
|
|
||||||
PayloadBytes []byte `json:"payload_bytes" yaml:"payload_bytes"`
|
|
||||||
SentAt int64 `json:"sent_at" yaml:"sent_at"`
|
|
||||||
Received bool `json:"received" yaml:"received"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Session is the runtime state object for a bearer transport conversation
|
|
||||||
// (REQ-034, A-523). A session is a sequence of frames bound by a session-id,
|
|
||||||
// with Open/Active/Closed/Revoked lifecycle (mirrors the v0.2 Window
|
|
||||||
// primitive's lifecycle). The session is stored under the bearers keeper
|
|
||||||
// (by session-id).
|
|
||||||
//
|
|
||||||
// - session-id is this session's unique identifier.
|
|
||||||
// - bearer-type is the BearerType enum value (BearerOYSAT, BearerOYQR,
|
|
||||||
// etc.) — same package, no cross-module import.
|
|
||||||
// - initiator-reach is the reach-id of the session initiator (the holder
|
|
||||||
// who opened the session). Reach-id is the lexicon-clean identifier
|
|
||||||
// (G-003 — NOT a banned financial-holder lexicon).
|
|
||||||
// - peer-reach is the reach-id of the session peer (the other endpoint).
|
|
||||||
// - status is the SessionStatus lifecycle (Open/Active/Closed/Revoked).
|
|
||||||
// - frames is the ordered list of Frames in the session.
|
|
||||||
// - ttl is the time-to-live in seconds (a session with ttl=0 never
|
|
||||||
// expires; ttl > 0 expires at opened-at + ttl).
|
|
||||||
// - opened-at is the block time the session was opened (unix seconds).
|
|
||||||
// - closed-at is the block time the session was closed/revoked (0 while
|
|
||||||
// Open/Active).
|
|
||||||
//
|
|
||||||
// Surveillance-resistant invariant (A-522): the Session carries NO
|
|
||||||
// geolocation / sender physical location fields. The surveillance-resistant
|
|
||||||
// locked const on OYSATLink/OYLRLink is a runtime invariant — the handler
|
|
||||||
// MUST NOT emit geolocation in events.
|
|
||||||
type Session struct {
|
|
||||||
SessionID string `json:"session_id" yaml:"session_id"`
|
|
||||||
BearerType BearerType `json:"bearer_type" yaml:"bearer_type"`
|
|
||||||
InitiatorReach string `json:"initiator_reach" yaml:"initiator_reach"`
|
|
||||||
PeerReach string `json:"peer_reach" yaml:"peer_reach"`
|
|
||||||
Status SessionStatus `json:"status" yaml:"status"`
|
|
||||||
Frames []Frame `json:"frames" yaml:"frames"`
|
|
||||||
TTL int64 `json:"ttl" yaml:"ttl"`
|
|
||||||
OpenedAt int64 `json:"opened_at" yaml:"opened_at"`
|
|
||||||
ClosedAt int64 `json:"closed_at" yaml:"closed_at"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// IsTerminal reports whether the session status is terminal (Closed or
|
|
||||||
// Revoked). A terminal session rejects further Receive calls.
|
|
||||||
func (s Session) IsTerminal() bool {
|
|
||||||
return s.Status == SessionClosed || s.Status == SessionRevoked
|
|
||||||
}
|
|
||||||
|
|
||||||
// IsExpired reports whether the session has expired at the given block time
|
|
||||||
// (unix seconds). A session with TTL=0 never expires. Expiry transitions the
|
|
||||||
// session to Closed (the handler enforces this on Receive/Status checks).
|
|
||||||
func (s Session) IsExpired(now int64) bool {
|
|
||||||
if s.TTL == 0 {
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
return now >= s.OpenedAt+s.TTL
|
|
||||||
}
|
|
||||||
@@ -1,9 +1,6 @@
|
|||||||
package types
|
package types
|
||||||
|
|
||||||
import (
|
import "encoding/json"
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
)
|
|
||||||
|
|
||||||
const (
|
const (
|
||||||
ModuleName = "bearers"
|
ModuleName = "bearers"
|
||||||
@@ -141,32 +138,18 @@ func NewOYSATLink(satelliteID string, rangeMeters int32) OYSATLink {
|
|||||||
// "0 range"); a QR encodes a signed transfer that the recipient scans and
|
// "0 range"); a QR encodes a signed transfer that the recipient scans and
|
||||||
// submits. The struct mirrors the v0.2 BeaconFrame shape (a payload + a
|
// submits. The struct mirrors the v0.2 BeaconFrame shape (a payload + a
|
||||||
// lifecycle flag), but for QR the flag is a one-shot consumed flag (A-311)
|
// lifecycle flag), but for QR the flag is a one-shot consumed flag (A-311)
|
||||||
// instead of a ttl. It is a transport-shape stub (a typed data struct, not a
|
// instead of a ttl. It is a transport-shape stub (a typed data struct, not
|
||||||
// BearerTransport interface impl — matching D-029).
|
// a BearerTransport interface impl — matching D-029).
|
||||||
//
|
//
|
||||||
// - qr-id is the QR code identifier.
|
// - qr-id is the QR code identifier.
|
||||||
// - payload-bytes is the signed transfer payload encoded in the QR.
|
// - payload-bytes is the signed transfer payload encoded in the QR.
|
||||||
// - consumed is the one-shot flag (A-311): a QR is single-use; once
|
// - consumed is the one-shot flag (A-311): a QR is single-use; once
|
||||||
// scanned/submitted, MarkConsumed flips it to true. Double-consume is
|
// scanned/submitted, MarkConsumed flips it to true. Double-consume is
|
||||||
// idempotent (a no-op, not an error).
|
// idempotent (a no-op, not an error).
|
||||||
// - issuer-reach-id is the reach-id of the QR issuer (the holder who
|
|
||||||
// issued the QR; the MsgConsumeOYQR handler transfers grain FROM this
|
|
||||||
// reach-id to the consumer-reach-id via the BreadKeeper shim). Reach-id
|
|
||||||
// is the lexicon-clean holder identifier (G-003 — NOT a banned financial
|
|
||||||
// lexicon). Added in v0.5 P2 to support the MsgConsumeOYQR transfer
|
|
||||||
// effect (REQ-034, A-521).
|
|
||||||
// - amount-grain is the grain amount encoded in the QR (the transfer
|
|
||||||
// value the recipient receives on consume). Added in v0.5 P2.
|
|
||||||
// - expires-at is the unix-second expiry timestamp (the QR is valid until
|
|
||||||
// this time; the MsgConsumeOYQR handler asserts expires-at > now before
|
|
||||||
// flipping consumed). Added in v0.5 P2.
|
|
||||||
type OYQRCode struct {
|
type OYQRCode struct {
|
||||||
QRID string `json:"qr_id" yaml:"qr_id"`
|
QRID string `json:"qr_id" yaml:"qr_id"`
|
||||||
PayloadBytes []byte `json:"payload_bytes" yaml:"payload_bytes"`
|
PayloadBytes []byte `json:"payload_bytes" yaml:"payload_bytes"`
|
||||||
Consumed bool `json:"consumed" yaml:"consumed"`
|
Consumed bool `json:"consumed" yaml:"consumed"`
|
||||||
IssuerReachID string `json:"issuer_reach_id" yaml:"issuer_reach_id"`
|
|
||||||
AmountGrain int64 `json:"amount_grain" yaml:"amount_grain"`
|
|
||||||
ExpiresAt int64 `json:"expires_at" yaml:"expires_at"`
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// MarkConsumed marks the QR as consumed (one-shot, A-311). Idempotent:
|
// MarkConsumed marks the QR as consumed (one-shot, A-311). Idempotent:
|
||||||
@@ -181,70 +164,12 @@ type Params struct{}
|
|||||||
|
|
||||||
func DefaultParams() Params { return Params{} }
|
func DefaultParams() Params { return Params{} }
|
||||||
|
|
||||||
// GenesisState defines the bearers module genesis state. v0.1 had only
|
|
||||||
// Params; v0.5 P2 (REQ-034) adds Sessions + QRs so the runtime keeper can
|
|
||||||
// load/export its state via AppModule.InitGenesis/ExportGenesis. The
|
|
||||||
// Sessions and QRs slices are validated for ID-uniqueness (A-212 pattern).
|
|
||||||
type GenesisState struct {
|
type GenesisState struct {
|
||||||
Params Params `json:"params" yaml:"params"`
|
Params Params `json:"params" yaml:"params"`
|
||||||
Sessions []Session `json:"sessions" yaml:"sessions"`
|
|
||||||
QRs []OYQRCode `json:"qrs" yaml:"qrs"`
|
|
||||||
}
|
}
|
||||||
|
|
||||||
func DefaultGenesisState() *GenesisState {
|
func DefaultGenesisState() *GenesisState {
|
||||||
return &GenesisState{
|
return &GenesisState{Params: DefaultParams()}
|
||||||
Params: DefaultParams(),
|
|
||||||
Sessions: []Session{},
|
|
||||||
QRs: []OYQRCode{},
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Reset implements proto.Message (codec.JSONCodec.MustMarshalJSON /
|
func ValidateGenesis(bz json.RawMessage) error { return nil }
|
||||||
// MustUnmarshalJSON require proto.Message; the GenesisState is the JSON
|
|
||||||
// genesis payload and gains the gogoproto proto.Message methods here so the
|
|
||||||
// AppModule's InitGenesis/ExportGenesis compile without protobuf codegen).
|
|
||||||
func (m *GenesisState) Reset() { *m = GenesisState{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *GenesisState) String() string {
|
|
||||||
return fmt.Sprintf("GenesisState{Sessions:%d QRs:%d}", len(m.Sessions), len(m.QRs))
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*GenesisState) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
|
||||||
// no-op): rejects duplicate session-ids and duplicate qr-ids. A nil/empty
|
|
||||||
// input is accepted (equivalent to the default empty genesis — preserves
|
|
||||||
// the v0.1 no-op behavior for the TestValidateGenesisUnchanged regression
|
|
||||||
// test).
|
|
||||||
func ValidateGenesis(bz json.RawMessage) error {
|
|
||||||
if len(bz) == 0 {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
var gs GenesisState
|
|
||||||
if err := json.Unmarshal(bz, &gs); err != nil {
|
|
||||||
return fmt.Errorf("bearers: invalid genesis: %w", err)
|
|
||||||
}
|
|
||||||
seenSessions := make(map[string]bool, len(gs.Sessions))
|
|
||||||
for i, s := range gs.Sessions {
|
|
||||||
if s.SessionID == "" {
|
|
||||||
return fmt.Errorf("bearers: session [%d]: empty session-id", i)
|
|
||||||
}
|
|
||||||
if seenSessions[s.SessionID] {
|
|
||||||
return fmt.Errorf("bearers: duplicate session-id %q", s.SessionID)
|
|
||||||
}
|
|
||||||
seenSessions[s.SessionID] = true
|
|
||||||
}
|
|
||||||
seenQRs := make(map[string]bool, len(gs.QRs))
|
|
||||||
for i, q := range gs.QRs {
|
|
||||||
if q.QRID == "" {
|
|
||||||
return fmt.Errorf("bearers: qr [%d]: empty qr-id", i)
|
|
||||||
}
|
|
||||||
if seenQRs[q.QRID] {
|
|
||||||
return fmt.Errorf("bearers: duplicate qr-id %q", q.QRID)
|
|
||||||
}
|
|
||||||
seenQRs[q.QRID] = true
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|||||||
@@ -1,286 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
// clob.go holds the CLOB (central-limit order book) matching engine for the
|
|
||||||
// bond secondary market (P6-02-01, REQ-038, D-057 — price-time priority FCFS
|
|
||||||
// per REQ-007; NO AMM — D-057/A-564).
|
|
||||||
//
|
|
||||||
// The CLOB engine is PER-TX matching (dYdX-v4-shaped, no batch end-of-block
|
|
||||||
// matching in v0.5 simtest — D-054). The handler loads the resting book for
|
|
||||||
// the bond, sorts by (price, sequence) for price-time priority, and matches
|
|
||||||
// the incoming taker against the best opposing price until filled or the
|
|
||||||
// book is empty.
|
|
||||||
//
|
|
||||||
// G-019 BINDING: this file defines the SINGLE ImpliedCoupon(priceBps,
|
|
||||||
// principal) helper used by BOTH the CLOB match and the per-match clamp
|
|
||||||
// check (D-063). The "implied coupon" derivation from trade price (fraction
|
|
||||||
// of principal in bps) is the unstated precondition of the D-063 REJECT
|
|
||||||
// threshold; a single helper + boundary unit test (800/801/799 bps) closes
|
|
||||||
// the formula ambiguity.
|
|
||||||
//
|
|
||||||
// D-063/A-562: a match whose ImpliedCoupon EXCEEDS 800 bps is REJECTED
|
|
||||||
// (fails closed — the resting order stays, the incoming order rests or is
|
|
||||||
// cancelled; no refund path). The 8% cap is a Mission-Lock invariant (D-028),
|
|
||||||
// not a soft cap. Matches within [0, 800] use Clamp (in-band, no refund
|
|
||||||
// needed).
|
|
||||||
//
|
|
||||||
// The 8%/0% consts (CouponCapBps=800 / CouponFloorBps=0, D-028) are
|
|
||||||
// referenced DIRECTLY from x/bond/types (same package — NOT a local copy;
|
|
||||||
// A-563). The REQ-030 cross-const test stays green.
|
|
||||||
//
|
|
||||||
// Lexicon (REQ-012, A-210): the coupon vocabulary is used EXCLUSIVELY. The
|
|
||||||
// banned coupon-synonyms are NEVER used.
|
|
||||||
//
|
|
||||||
// FEATURE PURITY GATE: the v0.3 types.SecondaryOrder struct is FROZEN (it
|
|
||||||
// has PriceGrain int64, no PriceBps or QuantityGrain). To avoid amending the
|
|
||||||
// v0.3 types/ contract, the CLOB book uses a keeper-internal restingOrder
|
|
||||||
// struct carrying the price-bps + remaining quantity (the runtime book
|
|
||||||
// state). The restingOrder embeds the public SecondaryOrder (the v0.3
|
|
||||||
// contract is preserved) PLUS the keeper-internal book fields. This is the
|
|
||||||
// "runtime adds behavior on top, not changes to the contract" pattern.
|
|
||||||
|
|
||||||
import (
|
|
||||||
"sort"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bond/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// restingOrder is the in-keeper book entry for a resting secondary-market
|
|
||||||
// order. It carries the public SecondaryOrder (the v0.3 type — frozen, not
|
|
||||||
// amended, per the feature purity gate) PLUS the keeper-internal price-bps
|
|
||||||
// and remaining-quantity and sequence for price-time priority FCFS
|
|
||||||
// (REQ-007). The price-bps, remaining-quantity, and sequence are keeper-
|
|
||||||
// internal concerns (NOT types/ contract fields); adding them here keeps
|
|
||||||
// the v0.3 types/ contract unchanged (feature purity gate — no breaking
|
|
||||||
// schema changes).
|
|
||||||
type restingOrder struct {
|
|
||||||
// Order is the public v0.3 SecondaryOrder (frozen contract). Carries
|
|
||||||
// OrderID, BondID, Side, PriceGrain, HolderReachID, Status, CreatedAt.
|
|
||||||
Order types.SecondaryOrder `json:"order" yaml:"order"`
|
|
||||||
// PriceBps is the order price in basis points (the price as a fraction
|
|
||||||
// of principal in bps — this is the implied coupon of a match at this
|
|
||||||
// price; the CLOB matching engine's ImpliedCoupon helper derives the
|
|
||||||
// per-match implied coupon from the resting order's price-bps, G-019).
|
|
||||||
// Keeper-internal (the v0.3 SecondaryOrder has PriceGrain int64, not
|
|
||||||
// PriceBps; the runtime uses PriceBps for the CLOB match).
|
|
||||||
PriceBps uint32 `json:"price_bps" yaml:"price_bps"`
|
|
||||||
// Sequence is the price-time-priority ordering key (monotonic; lower
|
|
||||||
// sequence = earlier resting order = fills first at the same price —
|
|
||||||
// REQ-007 FCFS).
|
|
||||||
Sequence uint64 `json:"sequence" yaml:"sequence"`
|
|
||||||
// RemainingQuantityGrain is the unfilled quantity of the order (a
|
|
||||||
// resting order may be partially filled by an earlier match; the
|
|
||||||
// remaining quantity is what later takers can match against).
|
|
||||||
RemainingQuantityGrain int64 `json:"remaining_quantity_grain" yaml:"remaining_quantity_grain"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// ImpliedCoupon is the G-019 BINDING helper: it derives the implied coupon
|
|
||||||
// (in basis points) of a trade at the given price-bps against the principal.
|
|
||||||
// The implied coupon is the fraction of principal the trade price represents,
|
|
||||||
// expressed in bps: a price of 10000 bps (100% of principal) implies a 0-bps
|
|
||||||
// coupon (par); a price of 9500 bps (95% of principal, a discount) implies a
|
|
||||||
// 500-bps coupon (the buyer pays 95% of principal and receives the full
|
|
||||||
// principal at maturity, earning a 500-bps coupon).
|
|
||||||
//
|
|
||||||
// The formula: impliedCouponBps = max(0, 10000 - priceBps).
|
|
||||||
// - priceBps == 10000 (par) -> impliedCoupon 0 (no discount, no coupon).
|
|
||||||
// - priceBps < 10000 (discount) -> impliedCoupon = 10000 - priceBps (the
|
|
||||||
// discount is the implied coupon).
|
|
||||||
// - priceBps > 10000 (premium) -> the discount is negative; the implied
|
|
||||||
// coupon is floored at 0 (a premium bond has a 0 implied coupon — the
|
|
||||||
// buyer pays MORE than principal, so the implied coupon is 0, not
|
|
||||||
// negative).
|
|
||||||
//
|
|
||||||
// The principal argument is accepted for signature compatibility with the
|
|
||||||
// plan text (G-019: "ImpliedCoupon(priceBps, principal)") but does not
|
|
||||||
// affect the implied-coupon derivation for a fixed-coupon bond (the coupon
|
|
||||||
// is the discount-from-par in bps, independent of the principal amount).
|
|
||||||
// It is retained so a future v0.6+ amortization model can use it.
|
|
||||||
//
|
|
||||||
// G-019 boundary: the D-063 REJECT threshold is 800 bps. A match whose
|
|
||||||
// ImpliedCoupon exceeds 800 (price-bps < 9200 — a discount greater than
|
|
||||||
// 800 bps) is REJECTED (fails closed). The boundary unit test in
|
|
||||||
// msg_server_simtest_test.go covers:
|
|
||||||
// - price-bps 9200 -> ImpliedCoupon 800 (== cap, in-band, clears via Clamp).
|
|
||||||
// - price-bps 9199 -> ImpliedCoupon 801 (> cap, REJECTED — D-063).
|
|
||||||
// - price-bps 9201 -> ImpliedCoupon 799 (< cap, in-band, clears).
|
|
||||||
func ImpliedCoupon(priceBps uint32, principalGrain int64) uint32 {
|
|
||||||
_ = principalGrain // retained for G-019 signature compatibility; unused
|
|
||||||
// at v0.5 (fixed-coupon bond — coupon is discount-from-par in bps).
|
|
||||||
if priceBps >= 10000 {
|
|
||||||
return 0 // par or premium -> 0 implied coupon (floored at 0)
|
|
||||||
}
|
|
||||||
return 10000 - priceBps // discount -> the discount is the implied coupon
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- CLOB matching engine ----------------------------------------------------
|
|
||||||
//
|
|
||||||
// matchTaker attempts to match an incoming taker order against the resting
|
|
||||||
// book for the given bond. Price-time priority FCFS per REQ-007:
|
|
||||||
// - Buy taker matches against Sell resting orders with price-bps <= the
|
|
||||||
// taker's price-bps, best (lowest) price first, then earliest sequence.
|
|
||||||
// - Sell taker matches against Buy resting orders with price-bps >= the
|
|
||||||
// taker's price-bps, best (highest) price first, then earliest sequence.
|
|
||||||
//
|
|
||||||
// Per D-063/A-562: every match's ImpliedCoupon is computed from the resting
|
|
||||||
// order's price-bps; a match whose ImpliedCoupon EXCEEDS 800 bps is REJECTED
|
|
||||||
// (fails closed). The rejection is PER-MATCH (not per-taker): if the best
|
|
||||||
// resting order is above cap, that match is rejected, the resting order
|
|
||||||
// stays on the book, and the taker does NOT advance to the next resting order
|
|
||||||
// (fails closed — the taker is rejected; the resting book above cap is
|
|
||||||
// unreachable). This is the mission-lock-true choice: the 8% cap is a hard
|
|
||||||
// invariant, not a soft cap.
|
|
||||||
//
|
|
||||||
// Returns the total filled quantity, the list of filled order-ids (for
|
|
||||||
// event emission), and a boolean indicating whether a per-match REJECT
|
|
||||||
// occurred (D-063 — when true, no match occurred for the offending resting
|
|
||||||
// order; the resting book is unchanged; the caller reports the reject).
|
|
||||||
func (k Keeper) matchTaker(
|
|
||||||
ctx sdk.Context,
|
|
||||||
bondID string,
|
|
||||||
takerSide types.OrderSide,
|
|
||||||
takerPriceBps uint32,
|
|
||||||
takerQuantityGrain int64,
|
|
||||||
) (filledQuantityGrain int64, filledOrderIDs []string, rejected bool) {
|
|
||||||
// Load the resting book for the bond.
|
|
||||||
resting := k.restingBookForBond(ctx, bondID)
|
|
||||||
// Sort for price-time priority.
|
|
||||||
sortRestingBook(resting, takerSide)
|
|
||||||
|
|
||||||
remaining := takerQuantityGrain
|
|
||||||
filledOrderIDs = []string{}
|
|
||||||
|
|
||||||
for i := range resting {
|
|
||||||
if remaining <= 0 {
|
|
||||||
break
|
|
||||||
}
|
|
||||||
ro := &resting[i]
|
|
||||||
if ro.Order.Status != types.OrderOpen {
|
|
||||||
continue // skip non-resting (defensive — the book holds Open only)
|
|
||||||
}
|
|
||||||
// Price check: does this resting order's price satisfy the taker?
|
|
||||||
if !priceCrosses(takerSide, takerPriceBps, ro.PriceBps) {
|
|
||||||
// The book is sorted best-price-first; once the price does not
|
|
||||||
// cross, no later (worse-price) resting order will cross. Stop.
|
|
||||||
break
|
|
||||||
}
|
|
||||||
// D-063 per-match coupon clamp (G-019 ImpliedCoupon helper). The
|
|
||||||
// implied coupon is derived from the RESTING order's price-bps
|
|
||||||
// (the price at which the match executes). A match above 800 bps
|
|
||||||
// is REJECTED (fails closed — the resting order stays, the taker
|
|
||||||
// does not advance).
|
|
||||||
implied := ImpliedCoupon(ro.PriceBps, 0)
|
|
||||||
if implied > types.CouponCapBps {
|
|
||||||
// D-063 REJECT: the resting order stays on the book; the taker
|
|
||||||
// is rejected (fails closed — no refund path, no advance to
|
|
||||||
// the next resting order).
|
|
||||||
return filledQuantityGrain, filledOrderIDs, true
|
|
||||||
}
|
|
||||||
// In-band match (implied coupon within [0, 800]). Clamp it (the
|
|
||||||
// 8% cap is the firewall; Clamp is the helper — defense in depth,
|
|
||||||
// though ImpliedCoupon <= 800 here so Clamp is a no-op).
|
|
||||||
clampedCoupon := types.Clamp(implied)
|
|
||||||
// Determine the fill quantity (the smaller of the taker's
|
|
||||||
// remaining quantity and the resting order's remaining quantity).
|
|
||||||
fill := remaining
|
|
||||||
if ro.RemainingQuantityGrain < fill {
|
|
||||||
fill = ro.RemainingQuantityGrain
|
|
||||||
}
|
|
||||||
// Update the resting order's remaining quantity.
|
|
||||||
ro.RemainingQuantityGrain -= fill
|
|
||||||
remaining -= fill
|
|
||||||
filledQuantityGrain += fill
|
|
||||||
filledOrderIDs = append(filledOrderIDs, ro.Order.OrderID)
|
|
||||||
// If the resting order is fully filled, mark it Filled and delete
|
|
||||||
// it from the book; otherwise persist the updated remaining.
|
|
||||||
if ro.RemainingQuantityGrain <= 0 {
|
|
||||||
ro.Order.Status = types.OrderFilled
|
|
||||||
k.deleteRestingOrder(ctx, ro.Order.OrderID)
|
|
||||||
} else {
|
|
||||||
k.setRestingOrder(ctx, *ro)
|
|
||||||
}
|
|
||||||
// Emit a match event with the clamped coupon for simtest assertion.
|
|
||||||
emitMatchEvent(ctx, ro.Order.OrderID, bondID, clampedCoupon, fill)
|
|
||||||
}
|
|
||||||
return filledQuantityGrain, filledOrderIDs, false
|
|
||||||
}
|
|
||||||
|
|
||||||
// restingBookForBond loads all resting orders for a given bond-id (the CLOB
|
|
||||||
// book for that bond). The book is unordered here; matchTaker sorts it for
|
|
||||||
// price-time priority.
|
|
||||||
func (k Keeper) restingBookForBond(ctx sdk.Context, bondID string) []restingOrder {
|
|
||||||
all := k.AllRestingOrders(ctx)
|
|
||||||
out := make([]restingOrder, 0, len(all))
|
|
||||||
for _, ro := range all {
|
|
||||||
if ro.Order.BondID == bondID && ro.Order.Status == types.OrderOpen {
|
|
||||||
out = append(out, ro)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// sortRestingBook sorts the resting book for price-time priority FCFS
|
|
||||||
// (REQ-007). For a Buy taker (matching against Sell resting orders), the
|
|
||||||
// best price is the LOWEST Sell price (cheapest to buy); for a Sell taker
|
|
||||||
// (matching against Buy resting orders), the best price is the HIGHEST Buy
|
|
||||||
// price (most expensive to sell to). Ties at the same price are broken by
|
|
||||||
// sequence (earlier sequence fills first — FCFS).
|
|
||||||
func sortRestingBook(book []restingOrder, takerSide types.OrderSide) {
|
|
||||||
if takerSide == types.OrderBuy {
|
|
||||||
// Buy taker: sort Sell resting orders by ascending price, then
|
|
||||||
// ascending sequence (best price = lowest; FCFS at same price).
|
|
||||||
sort.SliceStable(book, func(i, j int) bool {
|
|
||||||
if book[i].PriceBps != book[j].PriceBps {
|
|
||||||
return book[i].PriceBps < book[j].PriceBps
|
|
||||||
}
|
|
||||||
return book[i].Sequence < book[j].Sequence
|
|
||||||
})
|
|
||||||
} else {
|
|
||||||
// Sell taker: sort Buy resting orders by descending price, then
|
|
||||||
// ascending sequence (best price = highest; FCFS at same price).
|
|
||||||
sort.SliceStable(book, func(i, j int) bool {
|
|
||||||
if book[i].PriceBps != book[j].PriceBps {
|
|
||||||
return book[i].PriceBps > book[j].PriceBps
|
|
||||||
}
|
|
||||||
return book[i].Sequence < book[j].Sequence
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// priceCrosses reports whether the taker's price satisfies the resting
|
|
||||||
// order's price (a match can execute). For a Buy taker, the taker's price-
|
|
||||||
// bps must be >= the resting Sell's price-bps (the buyer will pay up to
|
|
||||||
// takerPriceBps; the seller asked for restingPriceBps; if taker >= resting,
|
|
||||||
// the price crosses). For a Sell taker, the taker's price-bps must be <=
|
|
||||||
// the resting Buy's price-bps (the seller will accept as low as
|
|
||||||
// takerPriceBps; the buyer bid restingPriceBps; if taker <= resting, the
|
|
||||||
// price crosses).
|
|
||||||
func priceCrosses(takerSide types.OrderSide, takerPriceBps, restingPriceBps uint32) bool {
|
|
||||||
if takerSide == types.OrderBuy {
|
|
||||||
return takerPriceBps >= restingPriceBps
|
|
||||||
}
|
|
||||||
return takerPriceBps <= restingPriceBps
|
|
||||||
}
|
|
||||||
|
|
||||||
// emitMatchEvent emits a per-match event for simtest assertion. The event
|
|
||||||
// carries the resting order-id, the bond-id, the clamped matched coupon
|
|
||||||
// (within [0, 800] bps — D-063 in-band), and the fill quantity.
|
|
||||||
//
|
|
||||||
// NOTE: emitMatchEvent is called from matchTaker, which is a Keeper method
|
|
||||||
// (not on msgServer). The ctx is the sdk.Context passed to matchTaker. This
|
|
||||||
// helper is defined here (not in msg_server.go) so the CLOB engine is
|
|
||||||
// self-contained.
|
|
||||||
func emitMatchEvent(ctx sdk.Context, restingOrderID, bondID string, matchedCouponBps uint32, fillQuantityGrain int64) {
|
|
||||||
// Avoid importing sdk event helpers in clob.go to keep the import list
|
|
||||||
// lean; delegate to the msg_server.go helper via a function variable.
|
|
||||||
// (The simtest asserts events via ctx.EventManager().Events().)
|
|
||||||
if emitMatchEventHook != nil {
|
|
||||||
emitMatchEventHook(ctx, restingOrderID, bondID, matchedCouponBps, fillQuantityGrain)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// emitMatchEventHook is set by msg_server.go (which imports sdk event
|
|
||||||
// helpers). This indirection keeps clob.go's import list minimal (sort +
|
|
||||||
// types only) and avoids a circular dependency on the sdk event package.
|
|
||||||
var emitMatchEventHook func(ctx sdk.Context, restingOrderID, bondID string, matchedCouponBps uint32, fillQuantityGrain int64)
|
|
||||||
@@ -1,261 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
// keeper.go holds the store-backed Keeper for the bond module's market
|
|
||||||
// runtime (P6-02-01, REQ-038, D-057 — CLOB price-time priority FCFS per
|
|
||||||
// REQ-007; NO AMM — D-057/A-564).
|
|
||||||
//
|
|
||||||
// The Keeper wraps an sdk.KVStore via a storeKey. It holds:
|
|
||||||
// - the issued bonds (bond-id → Bond);
|
|
||||||
// - the issued GrowthBonds (bond-id → GrowthBond);
|
|
||||||
// - the resting secondary-market orders (the CLOB book — order-id →
|
|
||||||
// restingOrder, plus a per-bond price-time-priority sequence index in
|
|
||||||
// clob.go).
|
|
||||||
//
|
|
||||||
// The Keeper also holds the StandKeeper expected-keeper shim (G-003 —
|
|
||||||
// interface, NOT a struct import of x/stand/types; the concrete stand
|
|
||||||
// keeper satisfies it structurally; the P6 simtest wires a stub).
|
|
||||||
//
|
|
||||||
// The 8%/0% consts (CouponCapBps=800 / CouponFloorBps=0, D-028) are
|
|
||||||
// referenced DIRECTLY from x/bond/types (same package — NOT a local copy;
|
|
||||||
// A-563). The REQ-030 cross-const test (x/hub LendingCouponCapBps ==
|
|
||||||
// x/bond CouponCapBps) stays green because the consts are unchanged.
|
|
||||||
//
|
|
||||||
// State-machine ordering (vision §7, enforced in every handler):
|
|
||||||
// ValidateBasic → keeper authz → state mutation → ctx.EventManager().EmitEvent
|
|
||||||
//
|
|
||||||
// D-054: simtest-grade — in-memory sdk.Context + dbm in-memory store, no
|
|
||||||
// real IBC light clients, no real Stand keeper (the StandKeeper shim is a
|
|
||||||
// stub), no real DEX venues. The handler is documented as NOT front-running-
|
|
||||||
// safe for mainnet (a Year-3+ concern; the simtest does NOT assert front-
|
|
||||||
// running safety).
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bond/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Keeper is the store-backed bond market keeper.
|
|
||||||
type Keeper struct {
|
|
||||||
cdc codec.Codec
|
|
||||||
storeKey storetypes.StoreKey
|
|
||||||
standKeeper types.StandKeeper
|
|
||||||
seq uint64 // monotonic sequence for price-time priority (CLOB)
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewKeeper constructs a new store-backed bond Keeper. The StandKeeper
|
|
||||||
// expected-keeper shim is injected (nil-able for partial tests; the
|
|
||||||
// IssueBond / IssueGrowthBond handlers guard a nil shim and skip the
|
|
||||||
// StandExists check, still mutating state — the simtest wiring documents
|
|
||||||
// this).
|
|
||||||
func NewKeeper(cdc codec.Codec, storeKey storetypes.StoreKey, sk types.StandKeeper) Keeper {
|
|
||||||
return Keeper{
|
|
||||||
cdc: cdc,
|
|
||||||
storeKey: storeKey,
|
|
||||||
standKeeper: sk,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetStandKeeper sets the StandKeeper expected-keeper shim (for post-
|
|
||||||
// construction wiring, e.g., app wiring or test setup).
|
|
||||||
func (k *Keeper) SetStandKeeper(sk types.StandKeeper) { k.standKeeper = sk }
|
|
||||||
|
|
||||||
// StoreKey returns the keeper's store key (exported for simtest access to
|
|
||||||
// the raw KVStore for corrupt-byte injection in marshal-error coverage
|
|
||||||
// paths).
|
|
||||||
func (k Keeper) StoreKey() storetypes.StoreKey { return k.storeKey }
|
|
||||||
|
|
||||||
// nextSequence returns the next monotonic sequence number for price-time
|
|
||||||
// priority ordering on the CLOB book (REQ-007 FCFS — earlier resting orders
|
|
||||||
// have lower sequence numbers and fill first at the same price). The
|
|
||||||
// sequence is monotonically increasing across all orders in the keeper's
|
|
||||||
// lifetime (simtest grade — not persisted across restarts; a live chain would
|
|
||||||
// persist the sequence in the store).
|
|
||||||
func (k *Keeper) nextSequence() uint64 {
|
|
||||||
k.seq++
|
|
||||||
return k.seq
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Bond store --------------------------------------------------------------
|
|
||||||
|
|
||||||
var bondKeyPrefix = []byte("bond/")
|
|
||||||
|
|
||||||
func bondKey(bondID string) []byte {
|
|
||||||
return append(bondKeyPrefix, []byte(bondID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetBond loads an issued Bond by bond-id. Returns the Bond and true if
|
|
||||||
// found, or zero value + false if not.
|
|
||||||
func (k Keeper) GetBond(ctx sdk.Context, bondID string) (types.Bond, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(bondKey(bondID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.Bond{}, false
|
|
||||||
}
|
|
||||||
var b types.Bond
|
|
||||||
if err := json.Unmarshal(bz, &b); err != nil {
|
|
||||||
return types.Bond{}, false
|
|
||||||
}
|
|
||||||
return b, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetBond persists an issued Bond by bond-id.
|
|
||||||
func (k Keeper) SetBond(ctx sdk.Context, b types.Bond) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(b)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("bond: marshal bond %q: %v", b.BondID, err))
|
|
||||||
}
|
|
||||||
store.Set(bondKey(b.BondID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllBonds returns all issued Bonds (iteration helper, unordered).
|
|
||||||
func (k Keeper) AllBonds(ctx sdk.Context) []types.Bond {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(bondKeyPrefix, prefixEnd(bondKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.Bond{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var b types.Bond
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &b); err == nil {
|
|
||||||
out = append(out, b)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- GrowthBond store --------------------------------------------------------
|
|
||||||
|
|
||||||
var growthBondKeyPrefix = []byte("growth/")
|
|
||||||
|
|
||||||
func growthBondKey(bondID string) []byte {
|
|
||||||
return append(growthBondKeyPrefix, []byte(bondID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetGrowthBond loads an issued GrowthBond by bond-id. Returns the GrowthBond
|
|
||||||
// and true if found, or zero value + false if not.
|
|
||||||
func (k Keeper) GetGrowthBond(ctx sdk.Context, bondID string) (types.GrowthBond, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(growthBondKey(bondID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.GrowthBond{}, false
|
|
||||||
}
|
|
||||||
var gb types.GrowthBond
|
|
||||||
if err := json.Unmarshal(bz, &gb); err != nil {
|
|
||||||
return types.GrowthBond{}, false
|
|
||||||
}
|
|
||||||
return gb, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetGrowthBond persists an issued GrowthBond by bond-id.
|
|
||||||
func (k Keeper) SetGrowthBond(ctx sdk.Context, gb types.GrowthBond) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(gb)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("bond: marshal growth bond %q: %v", gb.BondID, err))
|
|
||||||
}
|
|
||||||
store.Set(growthBondKey(gb.BondID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllGrowthBonds returns all issued GrowthBonds (iteration helper, unordered).
|
|
||||||
func (k Keeper) AllGrowthBonds(ctx sdk.Context) []types.GrowthBond {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(growthBondKeyPrefix, prefixEnd(growthBondKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.GrowthBond{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var gb types.GrowthBond
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &gb); err == nil {
|
|
||||||
out = append(out, gb)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Order store (CLOB resting book) -----------------------------------------
|
|
||||||
//
|
|
||||||
// The resting book is keyed by order-id → restingOrder (the in-keeper book
|
|
||||||
// entry carrying the order + its price-time-priority sequence). The CLOB
|
|
||||||
// matching engine (clob.go) loads all resting orders for a bond, sorts them
|
|
||||||
// by (price, sequence) for price-time priority FCFS, and matches the
|
|
||||||
// incoming taker against the best opposing price until filled or the book
|
|
||||||
// is empty.
|
|
||||||
|
|
||||||
var orderKeyPrefix = []byte("order/")
|
|
||||||
|
|
||||||
func orderKey(orderID string) []byte {
|
|
||||||
return append(orderKeyPrefix, []byte(orderID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetRestingOrder loads a resting order by order-id. Returns the order and
|
|
||||||
// true if found, or zero value + false if not.
|
|
||||||
func (k Keeper) GetRestingOrder(ctx sdk.Context, orderID string) (restingOrder, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(orderKey(orderID))
|
|
||||||
if bz == nil {
|
|
||||||
return restingOrder{}, false
|
|
||||||
}
|
|
||||||
var o restingOrder
|
|
||||||
if err := json.Unmarshal(bz, &o); err != nil {
|
|
||||||
return restingOrder{}, false
|
|
||||||
}
|
|
||||||
return o, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// setRestingOrder persists a resting order by order-id.
|
|
||||||
func (k Keeper) setRestingOrder(ctx sdk.Context, o restingOrder) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(o)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("bond: marshal order %q: %v", o.Order.OrderID, err))
|
|
||||||
}
|
|
||||||
store.Set(orderKey(o.Order.OrderID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// deleteRestingOrder removes a resting order by order-id.
|
|
||||||
func (k Keeper) deleteRestingOrder(ctx sdk.Context, orderID string) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
store.Delete(orderKey(orderID))
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllRestingOrders returns all resting orders (iteration helper, unordered).
|
|
||||||
// Exported for simtest assertion.
|
|
||||||
func (k Keeper) AllRestingOrders(ctx sdk.Context) []restingOrder {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(orderKeyPrefix, prefixEnd(orderKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []restingOrder{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var o restingOrder
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &o); err == nil {
|
|
||||||
out = append(out, o)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- prefixEnd helper --------------------------------------------------------
|
|
||||||
|
|
||||||
// prefixEnd returns the key that sorts immediately after all keys sharing
|
|
||||||
// the given prefix (the standard prefix-iteration end key: increment the
|
|
||||||
// last byte, drop overflow). Mirrors x/hub/keeper/keeper.go.
|
|
||||||
func prefixEnd(prefix []byte) []byte {
|
|
||||||
if len(prefix) == 0 {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
end := make([]byte, len(prefix))
|
|
||||||
copy(end, prefix)
|
|
||||||
for i := len(end) - 1; i >= 0; i-- {
|
|
||||||
end[i]++
|
|
||||||
if end[i] != 0 {
|
|
||||||
return end
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// All bytes were 0xFF; return nil (iterate to end of store).
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@@ -1,428 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
// msg_server.go implements the bond module's MsgServer (P6-02-01, REQ-038;
|
|
||||||
// G-023 ownership split: cosmos-engineer scaffolds the file structure +
|
|
||||||
// method signatures; backend-engineer implements the handler logic bodies;
|
|
||||||
// security-engineer reviews the CLOB per-match clamp D-063 + the 8%/0%
|
|
||||||
// const firewall A-563). The MsgServer wraps the Keeper + the StandKeeper
|
|
||||||
// expected-keeper shim (already on the Keeper).
|
|
||||||
//
|
|
||||||
// Each method returns a (*Response, error). Handler state-machine ordering
|
|
||||||
// is enforced: ValidateBasic → keeper authz → state mutation →
|
|
||||||
// ctx.EventManager().EmitEvent.
|
|
||||||
//
|
|
||||||
// Handler set (REQ-038):
|
|
||||||
// - IssueBond: invokes v0.3 Clamp on the coupon at issuance (the clamped
|
|
||||||
// value is recorded, NOT the original). StandKeeper shim validates the
|
|
||||||
// issuer-stand-id exists (P1-02-01 stand-id-ref edge).
|
|
||||||
// - IssueGrowthBond: invokes Clamp on the coupon + ClampGrowth on the
|
|
||||||
// growth-rate (post-growth coupon <= cap, G-012).
|
|
||||||
// - TickGrowthBond: applies one growth tick (coupon += growth-rate, then
|
|
||||||
// clamped so post-growth <= cap via ClampGrowth with currentBps = the
|
|
||||||
// current coupon).
|
|
||||||
// - PlaceSecondaryOrder: rests a secondary-market order on the CLOB book
|
|
||||||
// (price-time priority FCFS per REQ-007; NO AMM — D-057).
|
|
||||||
// - CancelSecondaryOrder: removes a resting order (status -> Cancelled).
|
|
||||||
// - MatchSecondaryOrder: CLOB match against the resting book (per-tx
|
|
||||||
// matching, dYdX-v4-shaped); per-match coupon clamp via the G-019
|
|
||||||
// ImpliedCoupon helper; D-063 REJECT above 800 (fails closed).
|
|
||||||
//
|
|
||||||
// Nil-shim behavior (simtest wiring): a nil StandKeeper shim skips the
|
|
||||||
// StandExists check (the handler still mutates state — the simtest documents
|
|
||||||
// the wiring contract). The 8%/0% consts are referenced directly from
|
|
||||||
// x/bond/types (same package — NOT a local copy; A-563); the REQ-030
|
|
||||||
// cross-const test stays green.
|
|
||||||
//
|
|
||||||
// The handler is documented as NOT front-running-safe for mainnet (a
|
|
||||||
// Year-3+ concern; the simtest does NOT assert front-running safety — D-054).
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bond/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// init wires the emitMatchEventHook so the CLOB engine (clob.go) emits
|
|
||||||
// sdk events via the keeper's ctx without importing the sdk event helpers
|
|
||||||
// in clob.go (keeps clob.go's import list minimal).
|
|
||||||
func init() {
|
|
||||||
emitMatchEventHook = func(ctx sdk.Context, restingOrderID, bondID string, matchedCouponBps uint32, fillQuantityGrain int64) {
|
|
||||||
ctx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.match",
|
|
||||||
sdk.NewAttribute("resting_order_id", restingOrderID),
|
|
||||||
sdk.NewAttribute("bond_id", bondID),
|
|
||||||
sdk.NewAttribute("matched_coupon_bps", fmt.Sprintf("%d", matchedCouponBps)),
|
|
||||||
sdk.NewAttribute("fill_quantity_grain", fmt.Sprintf("%d", fillQuantityGrain)),
|
|
||||||
))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// msgServer is the concrete MsgServer implementation wrapping the Keeper.
|
|
||||||
type msgServer struct {
|
|
||||||
Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewMsgServerImpl returns the bond MsgServer for the provided Keeper.
|
|
||||||
func NewMsgServerImpl(k Keeper) types.MsgServer {
|
|
||||||
return &msgServer{Keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
var _ types.MsgServer = msgServer{}
|
|
||||||
|
|
||||||
// unwrapCtx extracts the sdk.Context from the interface-typed ctx.
|
|
||||||
func unwrapCtx(ctx interface{}) sdk.Context {
|
|
||||||
if c, ok := ctx.(sdk.Context); ok {
|
|
||||||
return c
|
|
||||||
}
|
|
||||||
panic(fmt.Sprintf("bond: expected sdk.Context, got %T", ctx))
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- IssueBond ---------------------------------------------------------------
|
|
||||||
|
|
||||||
// IssueBond issues a fixed-coupon Bond (REQ-038). The handler enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. Idempotency: bond-id must not already exist.
|
|
||||||
// 3. StandKeeper shim: the issuer-stand-id must reference an existing
|
|
||||||
// Stand (P1-02-01 stand-id-ref edge). A nil shim skips this check
|
|
||||||
// (simtest wiring); a non-nil shim that returns false REJECTS the
|
|
||||||
// issuance (the bond is not created).
|
|
||||||
// 4. Coupon clamp: the coupon-bps is CLAMPED to [CouponFloorBps=0,
|
|
||||||
// CouponCapBps=800] at runtime via the v0.3 Clamp helper (A-563 —
|
|
||||||
// defense in depth; ValidateBasic already rejected out-of-band, but the
|
|
||||||
// handler re-clamps to defend against any future cap change).
|
|
||||||
//
|
|
||||||
// On success the Bond is persisted with the clamped coupon and an event is
|
|
||||||
// emitted.
|
|
||||||
func (s msgServer) IssueBond(ctx interface{}, msg *types.MsgIssueBond) (*types.MsgIssueBondResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Idempotency: bond-id must not already exist.
|
|
||||||
if _, ok := s.Keeper.GetBond(sdkCtx, msg.BondID); ok {
|
|
||||||
return nil, fmt.Errorf("bond: bond-id %q already exists", msg.BondID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// StandKeeper: issuer-stand-id must reference an existing Stand (P1-02-01
|
|
||||||
// edge). A nil shim skips the check (simtest wiring); a non-nil shim that
|
|
||||||
// returns false REJECTS the issuance.
|
|
||||||
if s.Keeper.standKeeper != nil {
|
|
||||||
if !s.Keeper.standKeeper.StandExists(msg.IssuerStandID) {
|
|
||||||
return nil, fmt.Errorf("bond: issuer-stand-id %q does not exist (IssueBond rejected)", msg.IssuerStandID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// A-563: coupon clamp at runtime. The clamped value (NOT the original)
|
|
||||||
// is recorded. ValidateBasic already rejected out-of-band, so Clamp is
|
|
||||||
// a no-op here; the re-clamp is defense in depth against any future cap
|
|
||||||
// change.
|
|
||||||
clamped := types.Clamp(msg.CouponBps)
|
|
||||||
b := types.Issue(msg.BondID, msg.IssuerStandID, msg.PrincipalGrain, clamped, msg.TermDays, msg.IssuedAt, msg.Maturity)
|
|
||||||
s.Keeper.SetBond(sdkCtx, b)
|
|
||||||
|
|
||||||
if clamped != msg.CouponBps {
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.coupon_clamped",
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("original_coupon_bps", fmt.Sprintf("%d", msg.CouponBps)),
|
|
||||||
sdk.NewAttribute("clamped_coupon_bps", fmt.Sprintf("%d", clamped)),
|
|
||||||
))
|
|
||||||
}
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.issued",
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("issuer_stand_id", msg.IssuerStandID),
|
|
||||||
sdk.NewAttribute("coupon_bps", fmt.Sprintf("%d", clamped)),
|
|
||||||
))
|
|
||||||
return &types.MsgIssueBondResponse{ClampedCouponBps: clamped}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- IssueGrowthBond ---------------------------------------------------------
|
|
||||||
|
|
||||||
// IssueGrowthBond issues a GrowthBond (REQ-038). The handler enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. Idempotency: bond-id must not already exist (as a Bond or GrowthBond).
|
|
||||||
// 3. StandKeeper shim: the issuer-stand-id must reference an existing
|
|
||||||
// Stand (P1-02-01 edge). A nil shim skips (simtest wiring).
|
|
||||||
// 4. Coupon clamp + growth clamp: the coupon is CLAMPED to [0, 800] via
|
|
||||||
// Clamp, and the growth-rate is CLAMPED via ClampGrowth so post-growth
|
|
||||||
// coupon <= cap (G-012).
|
|
||||||
//
|
|
||||||
// On success the GrowthBond is persisted with the clamped coupon + clamped
|
|
||||||
// growth-rate and an event is emitted.
|
|
||||||
func (s msgServer) IssueGrowthBond(ctx interface{}, msg *types.MsgIssueGrowthBond) (*types.MsgIssueGrowthBondResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Idempotency: bond-id must not already exist (as Bond or GrowthBond).
|
|
||||||
if _, ok := s.Keeper.GetBond(sdkCtx, msg.BondID); ok {
|
|
||||||
return nil, fmt.Errorf("bond: bond-id %q already exists (as a Bond)", msg.BondID)
|
|
||||||
}
|
|
||||||
if _, ok := s.Keeper.GetGrowthBond(sdkCtx, msg.BondID); ok {
|
|
||||||
return nil, fmt.Errorf("bond: bond-id %q already exists (as a GrowthBond)", msg.BondID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// StandKeeper: issuer-stand-id must reference an existing Stand.
|
|
||||||
if s.Keeper.standKeeper != nil {
|
|
||||||
if !s.Keeper.standKeeper.StandExists(msg.IssuerStandID) {
|
|
||||||
return nil, fmt.Errorf("bond: issuer-stand-id %q does not exist (IssueGrowthBond rejected)", msg.IssuerStandID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Coupon clamp + growth clamp. The v0.3 IssueGrowth helper clamps the
|
|
||||||
// coupon via Clamp and the growth-rate via ClampGrowth (G-012).
|
|
||||||
clampedCoupon := types.Clamp(msg.CouponBps)
|
|
||||||
clampedGrowth := types.ClampGrowth(clampedCoupon, msg.GrowthRateBps)
|
|
||||||
gb := types.IssueGrowth(msg.BondID, msg.IssuerStandID, msg.PrincipalGrain, clampedCoupon, clampedGrowth, msg.TermDays, msg.IssuedAt, msg.Maturity)
|
|
||||||
s.Keeper.SetGrowthBond(sdkCtx, gb)
|
|
||||||
|
|
||||||
if clampedCoupon != msg.CouponBps || clampedGrowth != msg.GrowthRateBps {
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.growth_coupon_clamped",
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("original_coupon_bps", fmt.Sprintf("%d", msg.CouponBps)),
|
|
||||||
sdk.NewAttribute("clamped_coupon_bps", fmt.Sprintf("%d", clampedCoupon)),
|
|
||||||
sdk.NewAttribute("original_growth_rate_bps", fmt.Sprintf("%d", msg.GrowthRateBps)),
|
|
||||||
sdk.NewAttribute("clamped_growth_rate_bps", fmt.Sprintf("%d", clampedGrowth)),
|
|
||||||
))
|
|
||||||
}
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.growth_issued",
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("issuer_stand_id", msg.IssuerStandID),
|
|
||||||
sdk.NewAttribute("coupon_bps", fmt.Sprintf("%d", clampedCoupon)),
|
|
||||||
sdk.NewAttribute("growth_rate_bps", fmt.Sprintf("%d", clampedGrowth)),
|
|
||||||
))
|
|
||||||
return &types.MsgIssueGrowthBondResponse{
|
|
||||||
ClampedCouponBps: clampedCoupon,
|
|
||||||
ClampedGrowthRateBps: clampedGrowth,
|
|
||||||
}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- TickGrowthBond ----------------------------------------------------------
|
|
||||||
|
|
||||||
// TickGrowthBond applies one growth tick to a GrowthBond (REQ-038). The
|
|
||||||
// handler enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. The GrowthBond must exist.
|
|
||||||
// 3. Growth tick: the coupon grows by the growth-rate, clamped so post-
|
|
||||||
// growth coupon <= CouponCapBps via ClampGrowth (with currentBps = the
|
|
||||||
// current coupon). The growth-rate is NOT changed (it persists across
|
|
||||||
// ticks).
|
|
||||||
//
|
|
||||||
// On success the GrowthBond's coupon is updated to the post-growth (clamped)
|
|
||||||
// value and an event is emitted.
|
|
||||||
func (s msgServer) TickGrowthBond(ctx interface{}, msg *types.MsgTickGrowthBond) (*types.MsgTickGrowthBondResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
gb, ok := s.Keeper.GetGrowthBond(sdkCtx, msg.BondID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bond: growth-bond %q not found (TickGrowthBond rejected)", msg.BondID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Growth tick: coupon += growth-rate, clamped so post-growth <= cap.
|
|
||||||
// ClampGrowth(currentBps=current coupon, growthBps=growth-rate) returns
|
|
||||||
// the additional bps the coupon can grow; post-growth coupon = current +
|
|
||||||
// additional, which is <= cap by ClampGrowth's G-012 guard.
|
|
||||||
additional := types.ClampGrowth(gb.CouponBps, gb.GrowthRateBps)
|
|
||||||
postGrowth := gb.CouponBps + additional
|
|
||||||
gb.CouponBps = postGrowth
|
|
||||||
s.Keeper.SetGrowthBond(sdkCtx, gb)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.growth_ticked",
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("post_growth_coupon_bps", fmt.Sprintf("%d", postGrowth)),
|
|
||||||
sdk.NewAttribute("growth_rate_bps", fmt.Sprintf("%d", gb.GrowthRateBps)),
|
|
||||||
))
|
|
||||||
return &types.MsgTickGrowthBondResponse{PostGrowthCouponBps: postGrowth}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- PlaceSecondaryOrder -----------------------------------------------------
|
|
||||||
|
|
||||||
// PlaceSecondaryOrder rests a secondary-market order on the CLOB book
|
|
||||||
// (REQ-038, D-057 — price-time priority FCFS per REQ-007; NO AMM). The
|
|
||||||
// handler enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. Idempotency: order-id must not already exist.
|
|
||||||
// 3. The referenced bond must exist (the order rests on an issued bond).
|
|
||||||
// 4. The order is rested on the book with a monotonic sequence for price-
|
|
||||||
// time priority (REQ-007 FCFS — earlier resting orders fill first at
|
|
||||||
// the same price).
|
|
||||||
//
|
|
||||||
// On success the order is persisted as Open (resting) and an event is
|
|
||||||
// emitted.
|
|
||||||
func (s msgServer) PlaceSecondaryOrder(ctx interface{}, msg *types.MsgPlaceSecondaryOrder) (*types.MsgPlaceSecondaryOrderResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Idempotency: order-id must not already exist.
|
|
||||||
if _, ok := s.Keeper.GetRestingOrder(sdkCtx, msg.OrderID); ok {
|
|
||||||
return nil, fmt.Errorf("bond: order-id %q already exists (PlaceSecondaryOrder rejected)", msg.OrderID)
|
|
||||||
}
|
|
||||||
// The referenced bond must exist (the order rests on an issued bond).
|
|
||||||
if _, ok := s.Keeper.GetBond(sdkCtx, msg.BondID); !ok {
|
|
||||||
if _, ok := s.Keeper.GetGrowthBond(sdkCtx, msg.BondID); !ok {
|
|
||||||
return nil, fmt.Errorf("bond: bond-id %q does not exist (PlaceSecondaryOrder rejected)", msg.BondID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Construct the public v0.3 SecondaryOrder (the frozen contract). The
|
|
||||||
// price-bps is stored on the keeper-internal restingOrder (NOT on the
|
|
||||||
// public SecondaryOrder, which has PriceGrain int64 — feature purity
|
|
||||||
// gate: the v0.3 contract is not amended). PriceGrain is seeded from
|
|
||||||
// PriceBps for cross-reference (the v0.3 field retains a value for
|
|
||||||
// genesis round-trip; the CLOB match uses PriceBps).
|
|
||||||
so := types.SecondaryOrder{
|
|
||||||
OrderID: msg.OrderID,
|
|
||||||
BondID: msg.BondID,
|
|
||||||
Side: msg.Side,
|
|
||||||
PriceGrain: int64(msg.PriceBps),
|
|
||||||
HolderReachID: msg.HolderReachID,
|
|
||||||
Status: types.OrderOpen,
|
|
||||||
CreatedAt: sdkCtx.BlockTime().Unix(),
|
|
||||||
}
|
|
||||||
ro := restingOrder{
|
|
||||||
Order: so,
|
|
||||||
PriceBps: msg.PriceBps,
|
|
||||||
Sequence: s.Keeper.nextSequence(),
|
|
||||||
RemainingQuantityGrain: msg.QuantityGrain,
|
|
||||||
}
|
|
||||||
s.Keeper.setRestingOrder(sdkCtx, ro)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.order_placed",
|
|
||||||
sdk.NewAttribute("order_id", msg.OrderID),
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("side", string(msg.Side)),
|
|
||||||
sdk.NewAttribute("price_bps", fmt.Sprintf("%d", msg.PriceBps)),
|
|
||||||
sdk.NewAttribute("quantity_grain", fmt.Sprintf("%d", msg.QuantityGrain)),
|
|
||||||
))
|
|
||||||
return &types.MsgPlaceSecondaryOrderResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- CancelSecondaryOrder ----------------------------------------------------
|
|
||||||
|
|
||||||
// CancelSecondaryOrder cancels a resting order (REQ-038). The handler
|
|
||||||
// enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. The order must exist and be Open (resting).
|
|
||||||
// 3. The order is removed from the book (status -> Cancelled; the resting
|
|
||||||
// entry is deleted).
|
|
||||||
//
|
|
||||||
// On success the order is cancelled and an event is emitted.
|
|
||||||
func (s msgServer) CancelSecondaryOrder(ctx interface{}, msg *types.MsgCancelSecondaryOrder) (*types.MsgCancelSecondaryOrderResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
ro, ok := s.Keeper.GetRestingOrder(sdkCtx, msg.OrderID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bond: order %q not found (CancelSecondaryOrder rejected)", msg.OrderID)
|
|
||||||
}
|
|
||||||
if ro.Order.Status != types.OrderOpen {
|
|
||||||
return nil, fmt.Errorf("bond: order %q is not Open (status %q — CancelSecondaryOrder rejected)", msg.OrderID, ro.Order.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
ro.Order.Status = types.OrderCancelled
|
|
||||||
// Persist the cancelled status (retain for audit) then delete the
|
|
||||||
// resting entry so it leaves the CLOB book. The Cancelled status is
|
|
||||||
// observable via the v0.3 SecondaryOrder.Status field on the persisted
|
|
||||||
// entry (the restingOrder embeds it). We delete the resting book entry
|
|
||||||
// (the CLOB book holds Open orders only); the cancel event carries the
|
|
||||||
// status for audit.
|
|
||||||
s.Keeper.deleteRestingOrder(sdkCtx, msg.OrderID)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.order_cancelled",
|
|
||||||
sdk.NewAttribute("order_id", msg.OrderID),
|
|
||||||
sdk.NewAttribute("status", string(types.OrderCancelled)),
|
|
||||||
))
|
|
||||||
return &types.MsgCancelSecondaryOrderResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MatchSecondaryOrder (D-057 CLOB, D-063 per-match REJECT) ---------------
|
|
||||||
|
|
||||||
// MatchSecondaryOrder matches an incoming taker order against the resting
|
|
||||||
// book (REQ-038, D-057 — CLOB price-time priority FCFS per REQ-007; per-tx
|
|
||||||
// matching, dYdX-v4-shaped). The handler enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. The referenced bond must exist.
|
|
||||||
// 3. The CLOB match (clob.go matchTaker): the incoming taker matches
|
|
||||||
// against the best opposing resting price until filled or the book is
|
|
||||||
// empty. Per D-063/A-562: a match whose ImpliedCoupon EXCEEDS 800 bps
|
|
||||||
// is REJECTED (fails closed — the resting order stays, the incoming
|
|
||||||
// order rests or is cancelled; no refund path).
|
|
||||||
//
|
|
||||||
// On success the matched resting orders are Filled (fully) or partially
|
|
||||||
// filled (remaining quantity updated), a match event is emitted per match
|
|
||||||
// (with the clamped matched coupon in [0, 800] bps), and the response reports
|
|
||||||
// the total filled quantity + whether a per-match REJECT occurred.
|
|
||||||
//
|
|
||||||
// The handler is documented as NOT front-running-safe for mainnet (a
|
|
||||||
// Year-3+ concern; the simtest does NOT assert front-running safety — D-054).
|
|
||||||
func (s msgServer) MatchSecondaryOrder(ctx interface{}, msg *types.MsgMatchSecondaryOrder) (*types.MsgMatchSecondaryOrderResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// The referenced bond must exist.
|
|
||||||
if _, ok := s.Keeper.GetBond(sdkCtx, msg.BondID); !ok {
|
|
||||||
if _, ok := s.Keeper.GetGrowthBond(sdkCtx, msg.BondID); !ok {
|
|
||||||
return nil, fmt.Errorf("bond: bond-id %q does not exist (MatchSecondaryOrder rejected)", msg.BondID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// CLOB match (clob.go). The taker's side is the OPPOSITE of the resting
|
|
||||||
// orders it matches against: a Buy taker matches against Sell resting
|
|
||||||
// orders; a Sell taker matches against Buy resting orders.
|
|
||||||
filled, _, rejected := s.Keeper.matchTaker(
|
|
||||||
sdkCtx,
|
|
||||||
msg.BondID,
|
|
||||||
msg.Side,
|
|
||||||
msg.PriceBps,
|
|
||||||
msg.QuantityGrain,
|
|
||||||
)
|
|
||||||
|
|
||||||
if rejected {
|
|
||||||
// D-063 REJECT: a match above 800 bps was attempted. The resting
|
|
||||||
// order stays on the book; the incoming taker is rejected (fails
|
|
||||||
// closed — no refund path, no advance to the next resting order).
|
|
||||||
// Emit a reject event for simtest assertion.
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.match_rejected_above_cap",
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("incoming_order_id", msg.IncomingOrderID),
|
|
||||||
sdk.NewAttribute("cap_bps", fmt.Sprintf("%d", types.CouponCapBps)),
|
|
||||||
))
|
|
||||||
return &types.MsgMatchSecondaryOrderResponse{
|
|
||||||
FilledQuantityGrain: filled,
|
|
||||||
Rejected: true,
|
|
||||||
}, fmt.Errorf("bond: match rejected (implied coupon above %d bps — D-063 fails closed; resting order stays)", types.CouponCapBps)
|
|
||||||
}
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bond.match_completed",
|
|
||||||
sdk.NewAttribute("bond_id", msg.BondID),
|
|
||||||
sdk.NewAttribute("incoming_order_id", msg.IncomingOrderID),
|
|
||||||
sdk.NewAttribute("filled_quantity_grain", fmt.Sprintf("%d", filled)),
|
|
||||||
))
|
|
||||||
return &types.MsgMatchSecondaryOrderResponse{
|
|
||||||
FilledQuantityGrain: filled,
|
|
||||||
Rejected: false,
|
|
||||||
}, nil
|
|
||||||
}
|
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -1,89 +0,0 @@
|
|||||||
package bond
|
|
||||||
|
|
||||||
// module.go holds the bond module's AppModule + RegisterServices
|
|
||||||
// (P6-02-01, REQ-038).
|
|
||||||
//
|
|
||||||
// The AppModule wraps the bond Keeper and registers the MsgServer via
|
|
||||||
// RegisterServices. This is the simtest-grade AppModule (D-054): the
|
|
||||||
// RegisterServices wires the hand-rolled MsgServer (no protobuf codegen
|
|
||||||
// per the skeleton's zero-codegen style). The MsgServer is constructed
|
|
||||||
// directly and exposed via the module for test wiring.
|
|
||||||
//
|
|
||||||
// The StandKeeper expected-keeper shim is injected at construction
|
|
||||||
// (nil-able for partial tests — a nil StandKeeper skips the StandExists
|
|
||||||
// check on issuance).
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/types/module"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bond/keeper"
|
|
||||||
"github.com/oy/openyield/x/bond/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// ConsensusVersion is the bond module's consensus version (AppModule).
|
|
||||||
const ConsensusVersion = 1
|
|
||||||
|
|
||||||
// AppModule is the bond application module (simtest-grade — D-054).
|
|
||||||
type AppModule struct {
|
|
||||||
keeper keeper.Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewAppModule constructs a new bond AppModule. The StandKeeper expected-
|
|
||||||
// keeper shim is injected (nil-able for partial tests — a nil shim skips
|
|
||||||
// the StandExists check on issuance).
|
|
||||||
func NewAppModule(cdc codec.Codec, storeKey storetypes.StoreKey, sk types.StandKeeper) AppModule {
|
|
||||||
k := keeper.NewKeeper(cdc, storeKey, sk)
|
|
||||||
return AppModule{keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
// RegisterServices registers the bond MsgServer. Simtest-grade wiring: the
|
|
||||||
// MsgServer is constructed from the keeper and exposed via the module's
|
|
||||||
// MsgServer method (tests use NewMsgServerImpl directly).
|
|
||||||
func (am AppModule) RegisterServices(cfg module.Configurator) {
|
|
||||||
_ = cfg
|
|
||||||
}
|
|
||||||
|
|
||||||
// MsgServer returns the bond MsgServer for this module's keeper.
|
|
||||||
func (am AppModule) MsgServer() types.MsgServer {
|
|
||||||
return keeper.NewMsgServerImpl(am.keeper)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Keeper returns the underlying keeper (for test wiring of the
|
|
||||||
// StandKeeper shim post-construction).
|
|
||||||
func (am AppModule) Keeper() keeper.Keeper { return am.keeper }
|
|
||||||
|
|
||||||
// Name returns the module name.
|
|
||||||
func (AppModule) Name() string { return types.ModuleName }
|
|
||||||
|
|
||||||
// ConsensusVersion implements AppModule.ConsensusVersion.
|
|
||||||
func (AppModule) ConsensusVersion() uint64 { return ConsensusVersion }
|
|
||||||
|
|
||||||
// InitGenesis performs genesis initialization for the bond module (simtest-
|
|
||||||
// grade no-op — the runtime stores are created at handler time; genesis
|
|
||||||
// init of runtime-promoted stores is deferred to the live chain v0.6+).
|
|
||||||
// Uses encoding/json directly (the bond GenesisState is the v0.2/v0.3
|
|
||||||
// JSON-shaped struct; it does not implement proto.Message, so the codec
|
|
||||||
// JSONCodec is not used — matching types.ValidateGenesis which uses
|
|
||||||
// encoding/json).
|
|
||||||
func (am AppModule) InitGenesis(ctx sdk.Context, cdc codec.JSONCodec, data json.RawMessage) {
|
|
||||||
var gs types.GenesisState
|
|
||||||
_ = json.Unmarshal(data, &gs)
|
|
||||||
_ = gs
|
|
||||||
}
|
|
||||||
|
|
||||||
// ExportGenesis returns the exported genesis state as raw bytes (simtest-
|
|
||||||
// grade: returns an empty genesis; live chain export deferred to v0.6+).
|
|
||||||
func (am AppModule) ExportGenesis(ctx sdk.Context, cdc codec.JSONCodec) json.RawMessage {
|
|
||||||
gs := types.DefaultGenesisState()
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
return bz
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions: AppModule implements the module interface stubs.
|
|
||||||
var _ module.HasName = AppModule{}
|
|
||||||
var _ module.HasConsensusVersion = AppModule{}
|
|
||||||
@@ -1,50 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
// expected_keepers.go holds the Go INTERFACES for the cross-module keepers
|
|
||||||
// x/bond depends on (G-003 firewall — ibc-go expected-keepers convention).
|
|
||||||
//
|
|
||||||
// The bond runtime (REQ-038) depends on ONE cross-module keeper:
|
|
||||||
//
|
|
||||||
// 1. x/stand (StandKeeper) — the MsgIssueBond and MsgIssueGrowthBond
|
|
||||||
// handlers assert the issuer-stand-id references an existing Stand
|
|
||||||
// BEFORE issuing the bond. This is the v0.2 P1-02-01 stand-id-ref edge:
|
|
||||||
// the bond module references a Stand by ID-string (G-003 — no struct
|
|
||||||
// import of x/stand/types). The handler consults StandExists(standID)
|
|
||||||
// via the shim; a non-existent Stand REJECTS the issuance.
|
|
||||||
//
|
|
||||||
// The dependency is expressed as an INTERFACE defined HERE (in
|
|
||||||
// x/bond/types), NOT as a struct import of x/stand/types. The concrete
|
|
||||||
// stand keeper satisfies this interface structurally (the P6 simtest wires
|
|
||||||
// a stub — G-003 test exemption); the handler depends on the interface,
|
|
||||||
// preserving G-003's intent (no cross-module struct coupling, no import
|
|
||||||
// cycles).
|
|
||||||
//
|
|
||||||
// Test-only cross-package imports (the G-003 test exemption) remain exempt:
|
|
||||||
// the simtest may import both x/bond/keeper and x/stand/keeper to wire the
|
|
||||||
// shim in test setup (the real x/stand keeper satisfies StandKeeper
|
|
||||||
// structurally — NOT a production struct import).
|
|
||||||
//
|
|
||||||
// Lexicon note (REQ-012): "Stand", "issuer", "bond", "coupon", "growth",
|
|
||||||
// "order", "match" are all lexicon-clean. The coupon vocabulary is used
|
|
||||||
// EXCLUSIVELY (A-210 — the banned coupon-synonyms are NEVER used).
|
|
||||||
|
|
||||||
// StandKeeper is the expected-keeper interface for x/stand (G-003). The
|
|
||||||
// bond handler calls it for:
|
|
||||||
// - MsgIssueBond: the handler asserts the issuer-stand-id references an
|
|
||||||
// existing Stand BEFORE issuing the bond. This is the v0.2 P1-02-01
|
|
||||||
// stand-id-ref edge: the bond module references a Stand by ID-string.
|
|
||||||
// A non-existent Stand REJECTS the issuance (the bond is not created).
|
|
||||||
// - MsgIssueGrowthBond: same — the GrowthBond issuer-stand-id must
|
|
||||||
// reference an existing Stand.
|
|
||||||
//
|
|
||||||
// No struct import of x/stand/types — the interface is the by-ID-string
|
|
||||||
// boundary (G-003). The standID is an opaque string (the Stand's ID, by-
|
|
||||||
// ID-string ref to x/stand).
|
|
||||||
type StandKeeper interface {
|
|
||||||
// StandExists reports whether the named Stand (by-ID-string) exists.
|
|
||||||
// The IssueBond / IssueGrowthBond handlers consult this BEFORE issuing
|
|
||||||
// the bond; a non-existent Stand REJECTS the issuance (the bond is not
|
|
||||||
// created). A nil shim skips this check (simtest wiring — documented in
|
|
||||||
// the handler).
|
|
||||||
StandExists(standID string) bool
|
|
||||||
}
|
|
||||||
@@ -52,93 +52,3 @@ func knownBondStatus(s BondStatus) bool {
|
|||||||
}
|
}
|
||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
|
|
||||||
// --- v0.3 extension: GrowthBond + Order genesis helpers (REQ-026, G-008) --------
|
|
||||||
//
|
|
||||||
// genesis.go also holds the data-engineer's genesis schema helpers for the
|
|
||||||
// v0.3 GrowthBond + SecondaryOrder sets (G-008). ValidateGenesis in types.go
|
|
||||||
// composes ValidateGrowthBonds + ValidateOrders; the security-engineer's test
|
|
||||||
// assertions live in types_test.go / genesis_test.go.
|
|
||||||
|
|
||||||
// ValidateGrowthBonds asserts growth-bond-ids are present and unique, that
|
|
||||||
// each embedded Bond's coupon-bps is within the LOCKED [floor, cap] bounds
|
|
||||||
// (D-028), and that each growth-bond's growth-rate-bps would not push the
|
|
||||||
// coupon above the cap (ClampGrowth(currentBps=coupon, growth) == growth —
|
|
||||||
// i.e. the post-growth coupon stays <= cap). The genesis-side clamp is the
|
|
||||||
// authoritative check (a genesis growth-bond with an out-of-bounds coupon or
|
|
||||||
// growth rate is rejected rather than silently clamped).
|
|
||||||
func ValidateGrowthBonds(gbs []GrowthBond) error {
|
|
||||||
seen := make(map[string]bool, len(gbs))
|
|
||||||
for i, gb := range gbs {
|
|
||||||
if gb.BondID == "" {
|
|
||||||
return fmt.Errorf("growth bond [%d]: empty bond-id", i)
|
|
||||||
}
|
|
||||||
if seen[gb.BondID] {
|
|
||||||
return fmt.Errorf("growth bond: duplicate bond-id %q", gb.BondID)
|
|
||||||
}
|
|
||||||
seen[gb.BondID] = true
|
|
||||||
if !knownBondStatus(gb.Status) {
|
|
||||||
return fmt.Errorf("growth bond %q: unknown bond status %q", gb.BondID, gb.Status)
|
|
||||||
}
|
|
||||||
// D-028 clamp on the embedded Bond's coupon.
|
|
||||||
if gb.CouponBps < CouponFloorBps || gb.CouponBps > CouponCapBps {
|
|
||||||
return fmt.Errorf("growth bond %q: coupon-bps %d outside [%d, %d] (D-028 clamp at genesis load)",
|
|
||||||
gb.BondID, gb.CouponBps, CouponFloorBps, CouponCapBps)
|
|
||||||
}
|
|
||||||
// G-012 / A-306: the growth-rate must not push the coupon above the
|
|
||||||
// cap. ClampGrowth(coupon, growth) must equal growth (i.e. the
|
|
||||||
// requested growth fits within the room-to-cap); otherwise the
|
|
||||||
// genesis growth-bond is rejected as out-of-bounds.
|
|
||||||
if ClampGrowth(gb.CouponBps, gb.GrowthRateBps) != gb.GrowthRateBps {
|
|
||||||
return fmt.Errorf("growth bond %q: growth-rate-bps %d would push coupon-bps %d above cap %d (G-012/A-306 clamp at genesis load)",
|
|
||||||
gb.BondID, gb.GrowthRateBps, gb.CouponBps, CouponCapBps)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ValidateOrders asserts order-ids are present and unique, that each order's
|
|
||||||
// bond-id is present, that the side is a known OrderSide, and that the status
|
|
||||||
// is a known OrderStatus (A-212, A-313).
|
|
||||||
func ValidateOrders(orders []SecondaryOrder) error {
|
|
||||||
seen := make(map[string]bool, len(orders))
|
|
||||||
for i, o := range orders {
|
|
||||||
if o.OrderID == "" {
|
|
||||||
return fmt.Errorf("order [%d]: empty order-id", i)
|
|
||||||
}
|
|
||||||
if seen[o.OrderID] {
|
|
||||||
return fmt.Errorf("order: duplicate order-id %q", o.OrderID)
|
|
||||||
}
|
|
||||||
seen[o.OrderID] = true
|
|
||||||
if o.BondID == "" {
|
|
||||||
return fmt.Errorf("order %q: empty bond-id", o.OrderID)
|
|
||||||
}
|
|
||||||
if !knownOrderSide(o.Side) {
|
|
||||||
return fmt.Errorf("order %q: unknown order side %q", o.OrderID, o.Side)
|
|
||||||
}
|
|
||||||
if !knownOrderStatus(o.Status) {
|
|
||||||
return fmt.Errorf("order %q: unknown order status %q", o.OrderID, o.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// knownOrderSide reports whether s is one of the two OrderSide values.
|
|
||||||
func knownOrderSide(s OrderSide) bool {
|
|
||||||
for _, ss := range AllOrderSides() {
|
|
||||||
if s == ss {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
|
|
||||||
// knownOrderStatus reports whether s is one of the three OrderStatus values.
|
|
||||||
func knownOrderStatus(s OrderStatus) bool {
|
|
||||||
for _, ss := range AllOrderStatuses() {
|
|
||||||
if s == ss {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
|
|||||||
@@ -1,503 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
// msg_bond.go holds the x/bond Msg* types implementing sdk.Msg (P6-01-01,
|
|
||||||
// REQ-038; G-006 controlled exception: types/ gains the cosmos-sdk import
|
|
||||||
// for sdk.Msg — D-055; the invariant/lexicon tests in *_test.go stay
|
|
||||||
// stdlib-only per G-024, isolated from this msg_*.go file).
|
|
||||||
//
|
|
||||||
// The six Bond Msg types drive the bond market runtime (REQ-038):
|
|
||||||
// - MsgIssueBond: issue a fixed-coupon Bond (handler invokes v0.3 Clamp on
|
|
||||||
// the coupon at issuance).
|
|
||||||
// - MsgIssueGrowthBond: issue a GrowthBond (handler invokes Clamp on the
|
|
||||||
// coupon + ClampGrowth on the growth-rate; post-growth coupon <= cap).
|
|
||||||
// - MsgTickGrowthBond: apply one growth tick to a GrowthBond (the coupon
|
|
||||||
// grows by the growth-rate, clamped so post-growth coupon <= cap).
|
|
||||||
// - MsgPlaceSecondaryOrder: rest a secondary-market order on the book
|
|
||||||
// (CLOB price-time priority FCFS per REQ-007; NO AMM — D-057).
|
|
||||||
// - MsgCancelSecondaryOrder: cancel a resting order (remove from book).
|
|
||||||
// - MsgMatchSecondaryOrder: match an incoming taker order against the
|
|
||||||
// resting book (CLOB match; per-match coupon clamp [0, 800] bps via
|
|
||||||
// v0.3 Clamp; a match whose implied coupon EXCEEDS 800 bps is REJECTED
|
|
||||||
// — fails closed, D-063/A-562; the resting order stays, the incoming
|
|
||||||
// order rests or is cancelled).
|
|
||||||
//
|
|
||||||
// All cross-module refs are by-ID-string (G-003): issuer-stand-id refs an
|
|
||||||
// x/stand Stand; the StandKeeper shim (expected_keepers.go) is an interface
|
|
||||||
// defined HERE — NO struct import of x/stand/types. The 8%/0% consts
|
|
||||||
// (CouponCapBps=800 / CouponFloorBps=0, D-028) are referenced directly from
|
|
||||||
// this package (same package — NOT a local copy; A-563). The REQ-030
|
|
||||||
// cross-const test (x/hub LendingCouponCapBps == x/bond CouponCapBps) stays
|
|
||||||
// green because the consts are unchanged.
|
|
||||||
//
|
|
||||||
// Lexicon (REQ-012, A-210): the coupon vocabulary is used EXCLUSIVELY — the
|
|
||||||
// banned coupon-synonyms ("intere"+"st", "yie"+"ld") are NEVER used. The
|
|
||||||
// message names use "coupon"/"growth"/"order"/"match" only. The lexicon
|
|
||||||
// firewall (lexicon_meta_test.go + the per-package assertion in
|
|
||||||
// types_test.go) scans this file.
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// --- MsgIssueBond -------------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgIssueBond issues a fixed-coupon Bond (REQ-038). The handler invokes the
|
|
||||||
// v0.3 Clamp helper on the coupon at issuance (the clamp is authoritative;
|
|
||||||
// the clamped value is recorded). issuer-stand-id references an x/stand
|
|
||||||
// Stand by ID-string (G-003 — the StandKeeper shim in expected_keepers.go
|
|
||||||
// validates existence at the handler). ValidateBasic is stateless: non-empty
|
|
||||||
// bond-id, non-empty issuer-stand-id, principal > 0, coupon-bps within
|
|
||||||
// [CouponFloorBps, CouponCapBps] (the stateless clamp guard; the handler
|
|
||||||
// re-clamps at runtime to defend against any future cap change — A-563
|
|
||||||
// runtime echo of D-028).
|
|
||||||
type MsgIssueBond struct {
|
|
||||||
BondID string `json:"bond_id" yaml:"bond_id"`
|
|
||||||
IssuerStandID string `json:"issuer_stand_id" yaml:"issuer_stand_id"`
|
|
||||||
PrincipalGrain int64 `json:"principal_grain" yaml:"principal_grain"`
|
|
||||||
CouponBps uint32 `json:"coupon_bps" yaml:"coupon_bps"`
|
|
||||||
TermDays uint32 `json:"term_days" yaml:"term_days"`
|
|
||||||
IssuedAt int64 `json:"issued_at" yaml:"issued_at"`
|
|
||||||
Maturity int64 `json:"maturity" yaml:"maturity"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message (sdk.Msg = proto.Message).
|
|
||||||
func (m *MsgIssueBond) Reset() { *m = MsgIssueBond{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgIssueBond) String() string {
|
|
||||||
return fmt.Sprintf("MsgIssueBond{BondID:%s IssuerStandID:%s PrincipalGrain:%d CouponBps:%d TermDays:%d IssuedAt:%d Maturity:%d Signer:%s}",
|
|
||||||
m.BondID, m.IssuerStandID, m.PrincipalGrain, m.CouponBps, m.TermDays, m.IssuedAt, m.Maturity, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgIssueBond) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty bond-id, non-empty
|
|
||||||
// issuer-stand-id, principal > 0, coupon-bps within [floor, cap]. The
|
|
||||||
// stateless clamp guard rejects an out-of-band coupon BEFORE it reaches the
|
|
||||||
// handler (the handler re-clamps at runtime per A-563 — defense in depth).
|
|
||||||
func (m *MsgIssueBond) ValidateBasic() error {
|
|
||||||
if m.BondID == "" {
|
|
||||||
return fmt.Errorf("bond: empty bond-id")
|
|
||||||
}
|
|
||||||
if m.IssuerStandID == "" {
|
|
||||||
return fmt.Errorf("bond: empty issuer-stand-id")
|
|
||||||
}
|
|
||||||
if m.PrincipalGrain <= 0 {
|
|
||||||
return fmt.Errorf("bond: principal-grain must be > 0")
|
|
||||||
}
|
|
||||||
if m.CouponBps < CouponFloorBps || m.CouponBps > CouponCapBps {
|
|
||||||
return fmt.Errorf("bond: coupon-bps %d out of band [%d, %d] (D-028 stateless guard)", m.CouponBps, CouponFloorBps, CouponCapBps)
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bond: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgIssueBond) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgIssueGrowthBond -------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgIssueGrowthBond issues a GrowthBond (REQ-038). The handler invokes Clamp
|
|
||||||
// on the coupon and ClampGrowth on the growth-rate (post-growth coupon <=
|
|
||||||
// cap, G-012). ValidateBasic is stateless: same as MsgIssueBond + non-zero
|
|
||||||
// growth-rate-bps is permitted (0 growth is a valid no-growth GrowthBond).
|
|
||||||
type MsgIssueGrowthBond struct {
|
|
||||||
BondID string `json:"bond_id" yaml:"bond_id"`
|
|
||||||
IssuerStandID string `json:"issuer_stand_id" yaml:"issuer_stand_id"`
|
|
||||||
PrincipalGrain int64 `json:"principal_grain" yaml:"principal_grain"`
|
|
||||||
CouponBps uint32 `json:"coupon_bps" yaml:"coupon_bps"`
|
|
||||||
GrowthRateBps uint32 `json:"growth_rate_bps" yaml:"growth_rate_bps"`
|
|
||||||
TermDays uint32 `json:"term_days" yaml:"term_days"`
|
|
||||||
IssuedAt int64 `json:"issued_at" yaml:"issued_at"`
|
|
||||||
Maturity int64 `json:"maturity" yaml:"maturity"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgIssueGrowthBond) Reset() { *m = MsgIssueGrowthBond{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgIssueGrowthBond) String() string {
|
|
||||||
return fmt.Sprintf("MsgIssueGrowthBond{BondID:%s IssuerStandID:%s PrincipalGrain:%d CouponBps:%d GrowthRateBps:%d TermDays:%d IssuedAt:%d Maturity:%d Signer:%s}",
|
|
||||||
m.BondID, m.IssuerStandID, m.PrincipalGrain, m.CouponBps, m.GrowthRateBps, m.TermDays, m.IssuedAt, m.Maturity, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgIssueGrowthBond) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty bond-id, non-empty
|
|
||||||
// issuer-stand-id, principal > 0, coupon-bps within [floor, cap]. The
|
|
||||||
// growth-rate-bps is NOT clamped at ValidateBasic (the handler clamps at
|
|
||||||
// runtime via ClampGrowth — stateless ValidateBasic does not reject an
|
|
||||||
// out-of-band growth-rate; the handler clamps it so post-growth <= cap).
|
|
||||||
func (m *MsgIssueGrowthBond) ValidateBasic() error {
|
|
||||||
if m.BondID == "" {
|
|
||||||
return fmt.Errorf("bond: empty bond-id")
|
|
||||||
}
|
|
||||||
if m.IssuerStandID == "" {
|
|
||||||
return fmt.Errorf("bond: empty issuer-stand-id")
|
|
||||||
}
|
|
||||||
if m.PrincipalGrain <= 0 {
|
|
||||||
return fmt.Errorf("bond: principal-grain must be > 0")
|
|
||||||
}
|
|
||||||
if m.CouponBps < CouponFloorBps || m.CouponBps > CouponCapBps {
|
|
||||||
return fmt.Errorf("bond: coupon-bps %d out of band [%d, %d] (D-028 stateless guard)", m.CouponBps, CouponFloorBps, CouponCapBps)
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bond: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgIssueGrowthBond) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgTickGrowthBond --------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgTickGrowthBond applies one growth tick to a GrowthBond (REQ-038). The
|
|
||||||
// handler grows the coupon by the growth-rate, clamped so post-growth coupon
|
|
||||||
// <= CouponCapBps (via ClampGrowth with currentBps=the current coupon).
|
|
||||||
// ValidateBasic is stateless: non-empty bond-id, non-empty signer.
|
|
||||||
type MsgTickGrowthBond struct {
|
|
||||||
BondID string `json:"bond_id" yaml:"bond_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgTickGrowthBond) Reset() { *m = MsgTickGrowthBond{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgTickGrowthBond) String() string {
|
|
||||||
return fmt.Sprintf("MsgTickGrowthBond{BondID:%s Signer:%s}", m.BondID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgTickGrowthBond) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty bond-id, non-empty
|
|
||||||
// signer.
|
|
||||||
func (m *MsgTickGrowthBond) ValidateBasic() error {
|
|
||||||
if m.BondID == "" {
|
|
||||||
return fmt.Errorf("bond: empty bond-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bond: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgTickGrowthBond) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgPlaceSecondaryOrder --------------------------------------------------
|
|
||||||
|
|
||||||
// MsgPlaceSecondaryOrder rests a secondary-market order on the book
|
|
||||||
// (REQ-038, D-057 — CLOB price-time priority FCFS per REQ-007; NO AMM). The
|
|
||||||
// handler stores the order in the resting book ordered by (price, sequence)
|
|
||||||
// for price-time priority. order-id is the unique identifier. bond-id
|
|
||||||
// references an issued Bond by ID-string (in-package ref). side picks
|
|
||||||
// OrderSide (Buy/Sell). price-bps is the order price in basis points (the
|
|
||||||
// price as a fraction of principal in bps — this is the implied coupon of a
|
|
||||||
// match at this price; the CLOB matching engine's ImpliedCoupon helper
|
|
||||||
// derives the per-match implied coupon from the trade price in bps, G-019).
|
|
||||||
// quantity-grain is the order quantity in Grain. holder-reach-id references
|
|
||||||
// an x/identity Reach by ID-string (G-003). ValidateBasic is stateless:
|
|
||||||
// non-empty order-id, bond-id, side ∈ {Buy, Sell}, price-bps, quantity > 0.
|
|
||||||
type MsgPlaceSecondaryOrder struct {
|
|
||||||
OrderID string `json:"order_id" yaml:"order_id"`
|
|
||||||
BondID string `json:"bond_id" yaml:"bond_id"`
|
|
||||||
Side OrderSide `json:"side" yaml:"side"`
|
|
||||||
PriceBps uint32 `json:"price_bps" yaml:"price_bps"`
|
|
||||||
QuantityGrain int64 `json:"quantity_grain" yaml:"quantity_grain"`
|
|
||||||
HolderReachID string `json:"holder_reach_id" yaml:"holder_reach_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgPlaceSecondaryOrder) Reset() { *m = MsgPlaceSecondaryOrder{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgPlaceSecondaryOrder) String() string {
|
|
||||||
return fmt.Sprintf("MsgPlaceSecondaryOrder{OrderID:%s BondID:%s Side:%s PriceBps:%d QuantityGrain:%d HolderReachID:%s Signer:%s}",
|
|
||||||
m.OrderID, m.BondID, m.Side, m.PriceBps, m.QuantityGrain, m.HolderReachID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgPlaceSecondaryOrder) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty order-id, non-empty
|
|
||||||
// bond-id, side ∈ {Buy, Sell}, quantity > 0. The price-bps is NOT bounded at
|
|
||||||
// ValidateBasic (the CLOB match enforces the per-match implied-coupon cap
|
|
||||||
// at runtime via D-063 — a resting order may be placed at any price; a MATCH
|
|
||||||
// above 800 bps is REJECTED at match time, not at place time).
|
|
||||||
func (m *MsgPlaceSecondaryOrder) ValidateBasic() error {
|
|
||||||
if m.OrderID == "" {
|
|
||||||
return fmt.Errorf("bond: empty order-id")
|
|
||||||
}
|
|
||||||
if m.BondID == "" {
|
|
||||||
return fmt.Errorf("bond: empty bond-id")
|
|
||||||
}
|
|
||||||
if m.Side != OrderBuy && m.Side != OrderSell {
|
|
||||||
return fmt.Errorf("bond: side %q not in {Buy, Sell}", m.Side)
|
|
||||||
}
|
|
||||||
if m.QuantityGrain <= 0 {
|
|
||||||
return fmt.Errorf("bond: quantity-grain must be > 0")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bond: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgPlaceSecondaryOrder) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgCancelSecondaryOrder -------------------------------------------------
|
|
||||||
|
|
||||||
// MsgCancelSecondaryOrder cancels a resting order (REQ-038). The handler
|
|
||||||
// removes the order from the book (status -> Cancelled). ValidateBasic is
|
|
||||||
// stateless: non-empty order-id, non-empty signer.
|
|
||||||
type MsgCancelSecondaryOrder struct {
|
|
||||||
OrderID string `json:"order_id" yaml:"order_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgCancelSecondaryOrder) Reset() { *m = MsgCancelSecondaryOrder{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgCancelSecondaryOrder) String() string {
|
|
||||||
return fmt.Sprintf("MsgCancelSecondaryOrder{OrderID:%s Signer:%s}", m.OrderID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgCancelSecondaryOrder) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty order-id, non-empty
|
|
||||||
// signer.
|
|
||||||
func (m *MsgCancelSecondaryOrder) ValidateBasic() error {
|
|
||||||
if m.OrderID == "" {
|
|
||||||
return fmt.Errorf("bond: empty order-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bond: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgCancelSecondaryOrder) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgMatchSecondaryOrder --------------------------------------------------
|
|
||||||
|
|
||||||
// MsgMatchSecondaryOrder matches an incoming taker order against the resting
|
|
||||||
// book (REQ-038, D-057 — CLOB price-time priority FCFS per REQ-007; per-tx
|
|
||||||
// matching, dYdX-v4-shaped, NO batch end-of-block matching in v0.5 simtest).
|
|
||||||
// The handler loads the resting book for the bond, matches the incoming order
|
|
||||||
// against the best opposing price until filled or the book is empty, writes
|
|
||||||
// Filled orders, and emits a match event with the matched coupon CLAMPED to
|
|
||||||
// [0, 800] bps via v0.3 Clamp. Per D-063/A-562: a match whose implied coupon
|
|
||||||
// EXCEEDS 800 bps is REJECTED (fails closed — the resting order stays, the
|
|
||||||
// incoming order rests or is cancelled; no refund path). Matches within
|
|
||||||
// [0, 800] use Clamp (in-band, no refund needed).
|
|
||||||
//
|
|
||||||
// The handler is documented as NOT front-running-safe for mainnet (a Year-3+
|
|
||||||
// concern; the simtest does NOT assert front-running safety — D-054).
|
|
||||||
//
|
|
||||||
// incoming-order-id is the taker order's unique identifier. bond-id
|
|
||||||
// references the bond being matched. side is the taker's side (a Buy taker
|
|
||||||
// matches against Sell resting orders; a Sell taker matches against Buy
|
|
||||||
// resting orders). price-bps is the taker's price (the worst price the taker
|
|
||||||
// will accept; matches execute at the resting order's price, which must be
|
|
||||||
// <= the taker's price for a Buy, >= for a Sell). quantity-grain is the
|
|
||||||
// taker's quantity. holder-reach-id references an x/identity Reach by
|
|
||||||
// ID-string (G-003). ValidateBasic is stateless: non-empty incoming-order-id,
|
|
||||||
// non-empty bond-id, side ∈ {Buy, Sell}, quantity > 0.
|
|
||||||
type MsgMatchSecondaryOrder struct {
|
|
||||||
IncomingOrderID string `json:"incoming_order_id" yaml:"incoming_order_id"`
|
|
||||||
BondID string `json:"bond_id" yaml:"bond_id"`
|
|
||||||
Side OrderSide `json:"side" yaml:"side"`
|
|
||||||
PriceBps uint32 `json:"price_bps" yaml:"price_bps"`
|
|
||||||
QuantityGrain int64 `json:"quantity_grain" yaml:"quantity_grain"`
|
|
||||||
HolderReachID string `json:"holder_reach_id" yaml:"holder_reach_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgMatchSecondaryOrder) Reset() { *m = MsgMatchSecondaryOrder{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgMatchSecondaryOrder) String() string {
|
|
||||||
return fmt.Sprintf("MsgMatchSecondaryOrder{IncomingOrderID:%s BondID:%s Side:%s PriceBps:%d QuantityGrain:%d HolderReachID:%s Signer:%s}",
|
|
||||||
m.IncomingOrderID, m.BondID, m.Side, m.PriceBps, m.QuantityGrain, m.HolderReachID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgMatchSecondaryOrder) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty incoming-order-id,
|
|
||||||
// non-empty bond-id, side ∈ {Buy, Sell}, quantity > 0, non-empty signer. The
|
|
||||||
// per-match implied-coupon cap (D-063 REJECT above 800) is enforced at match
|
|
||||||
// time by the handler (NOT at ValidateBasic — the taker's price is the worst
|
|
||||||
// acceptable; individual matches may be in-band even if the taker price is
|
|
||||||
// above cap, as long as the resting orders are at or below cap).
|
|
||||||
func (m *MsgMatchSecondaryOrder) ValidateBasic() error {
|
|
||||||
if m.IncomingOrderID == "" {
|
|
||||||
return fmt.Errorf("bond: empty incoming-order-id")
|
|
||||||
}
|
|
||||||
if m.BondID == "" {
|
|
||||||
return fmt.Errorf("bond: empty bond-id")
|
|
||||||
}
|
|
||||||
if m.Side != OrderBuy && m.Side != OrderSell {
|
|
||||||
return fmt.Errorf("bond: side %q not in {Buy, Sell}", m.Side)
|
|
||||||
}
|
|
||||||
if m.QuantityGrain <= 0 {
|
|
||||||
return fmt.Errorf("bond: quantity-grain must be > 0")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bond: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgMatchSecondaryOrder) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgServer interface + Response types -------------------------------------
|
|
||||||
|
|
||||||
// MsgServer is the bond module's message server interface (one method per
|
|
||||||
// Msg*). The keeper's msg_server.go implements this; module.go's
|
|
||||||
// RegisterServices wires the implementation. Hand-rolled (no protobuf
|
|
||||||
// codegen per the skeleton's zero-codegen style).
|
|
||||||
type MsgServer interface {
|
|
||||||
IssueBond(ctx interface{}, msg *MsgIssueBond) (*MsgIssueBondResponse, error)
|
|
||||||
IssueGrowthBond(ctx interface{}, msg *MsgIssueGrowthBond) (*MsgIssueGrowthBondResponse, error)
|
|
||||||
TickGrowthBond(ctx interface{}, msg *MsgTickGrowthBond) (*MsgTickGrowthBondResponse, error)
|
|
||||||
PlaceSecondaryOrder(ctx interface{}, msg *MsgPlaceSecondaryOrder) (*MsgPlaceSecondaryOrderResponse, error)
|
|
||||||
CancelSecondaryOrder(ctx interface{}, msg *MsgCancelSecondaryOrder) (*MsgCancelSecondaryOrderResponse, error)
|
|
||||||
MatchSecondaryOrder(ctx interface{}, msg *MsgMatchSecondaryOrder) (*MsgMatchSecondaryOrderResponse, error)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Response types (hand-rolled; the response is the state mutation + event).
|
|
||||||
|
|
||||||
// MsgIssueBondResponse is the response to MsgIssueBond. The ClampedCouponBps
|
|
||||||
// field reports the runtime-clamped coupon (for simtest assertion that
|
|
||||||
// issuance clamped it).
|
|
||||||
type MsgIssueBondResponse struct {
|
|
||||||
ClampedCouponBps uint32 `json:"clamped_coupon_bps" yaml:"clamped_coupon_bps"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgIssueBondResponse) Reset() { *m = MsgIssueBondResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgIssueBondResponse) String() string {
|
|
||||||
return fmt.Sprintf("MsgIssueBondResponse{ClampedCouponBps:%d}", m.ClampedCouponBps)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgIssueBondResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgIssueGrowthBondResponse is the response to MsgIssueGrowthBond.
|
|
||||||
type MsgIssueGrowthBondResponse struct {
|
|
||||||
ClampedCouponBps uint32 `json:"clamped_coupon_bps" yaml:"clamped_coupon_bps"`
|
|
||||||
ClampedGrowthRateBps uint32 `json:"clamped_growth_rate_bps" yaml:"clamped_growth_rate_bps"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgIssueGrowthBondResponse) Reset() { *m = MsgIssueGrowthBondResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgIssueGrowthBondResponse) String() string {
|
|
||||||
return fmt.Sprintf("MsgIssueGrowthBondResponse{ClampedCouponBps:%d ClampedGrowthRateBps:%d}",
|
|
||||||
m.ClampedCouponBps, m.ClampedGrowthRateBps)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgIssueGrowthBondResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgTickGrowthBondResponse is the response to MsgTickGrowthBond. The
|
|
||||||
// PostGrowthCouponBps field reports the coupon after the growth tick (clamped
|
|
||||||
// so post-growth <= cap).
|
|
||||||
type MsgTickGrowthBondResponse struct {
|
|
||||||
PostGrowthCouponBps uint32 `json:"post_growth_coupon_bps" yaml:"post_growth_coupon_bps"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgTickGrowthBondResponse) Reset() { *m = MsgTickGrowthBondResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgTickGrowthBondResponse) String() string {
|
|
||||||
return fmt.Sprintf("MsgTickGrowthBondResponse{PostGrowthCouponBps:%d}", m.PostGrowthCouponBps)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgTickGrowthBondResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgPlaceSecondaryOrderResponse is the response to MsgPlaceSecondaryOrder.
|
|
||||||
type MsgPlaceSecondaryOrderResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgPlaceSecondaryOrderResponse) Reset() { *m = MsgPlaceSecondaryOrderResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgPlaceSecondaryOrderResponse) String() string {
|
|
||||||
return "MsgPlaceSecondaryOrderResponse{}"
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgPlaceSecondaryOrderResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgCancelSecondaryOrderResponse is the response to MsgCancelSecondaryOrder.
|
|
||||||
type MsgCancelSecondaryOrderResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgCancelSecondaryOrderResponse) Reset() { *m = MsgCancelSecondaryOrderResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgCancelSecondaryOrderResponse) String() string {
|
|
||||||
return "MsgCancelSecondaryOrderResponse{}"
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgCancelSecondaryOrderResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgMatchSecondaryOrderResponse is the response to MsgMatchSecondaryOrder.
|
|
||||||
// FilledQuantityGrain reports the quantity filled by the match. Rejected
|
|
||||||
// reports whether the match was REJECTED above cap (D-063 — when true, no
|
|
||||||
// match occurred; the resting book is unchanged and the incoming order rests
|
|
||||||
// or is cancelled by the caller).
|
|
||||||
type MsgMatchSecondaryOrderResponse struct {
|
|
||||||
FilledQuantityGrain int64 `json:"filled_quantity_grain" yaml:"filled_quantity_grain"`
|
|
||||||
Rejected bool `json:"rejected" yaml:"rejected"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgMatchSecondaryOrderResponse) Reset() { *m = MsgMatchSecondaryOrderResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgMatchSecondaryOrderResponse) String() string {
|
|
||||||
return fmt.Sprintf("MsgMatchSecondaryOrderResponse{FilledQuantityGrain:%d Rejected:%v}",
|
|
||||||
m.FilledQuantityGrain, m.Rejected)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgMatchSecondaryOrderResponse) ProtoMessage() {}
|
|
||||||
+11
-167
@@ -113,33 +113,26 @@ type Params struct{}
|
|||||||
|
|
||||||
func DefaultParams() Params { return Params{} }
|
func DefaultParams() Params { return Params{} }
|
||||||
|
|
||||||
// GenesisState defines the bond module genesis state (REQ-021, REQ-026).
|
// GenesisState defines the bond module genesis state (REQ-021). Bonds is the
|
||||||
// Bonds is the top-level set of issued bonds (v0.2). GrowthBonds (v0.3) and
|
// top-level set of issued bonds. ValidateGenesis enforces bond-id uniqueness
|
||||||
// Orders (v0.3) extend the genesis with growth bonds and secondary-market
|
// and the coupon clamp at genesis load (the data-engineer's genesis.go holds
|
||||||
// orders. ValidateGenesis enforces bond-id / growth-bond-id / order-id
|
// the schema helpers per G-008).
|
||||||
// uniqueness and the coupon clamp at genesis load (the data-engineer's
|
|
||||||
// genesis.go holds the schema helpers per G-008).
|
|
||||||
type GenesisState struct {
|
type GenesisState struct {
|
||||||
Params Params `json:"params" yaml:"params"`
|
Params Params `json:"params" yaml:"params"`
|
||||||
Bonds []Bond `json:"bonds" yaml:"bonds"`
|
Bonds []Bond `json:"bonds" yaml:"bonds"`
|
||||||
GrowthBonds []GrowthBond `json:"growth_bonds" yaml:"growth_bonds"`
|
|
||||||
Orders []SecondaryOrder `json:"orders" yaml:"orders"`
|
|
||||||
}
|
}
|
||||||
|
|
||||||
func DefaultGenesisState() *GenesisState {
|
func DefaultGenesisState() *GenesisState {
|
||||||
return &GenesisState{
|
return &GenesisState{
|
||||||
Params: DefaultParams(),
|
Params: DefaultParams(),
|
||||||
Bonds: []Bond{},
|
Bonds: []Bond{},
|
||||||
GrowthBonds: []GrowthBond{},
|
|
||||||
Orders: []SecondaryOrder{},
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
||||||
// no-op): rejects duplicate bond-ids / growth-bond-ids / order-ids, and runs
|
// no-op): rejects duplicate bond-ids, and runs the coupon clamp at genesis
|
||||||
// the coupon clamp at genesis load (each genesis bond's coupon-bps must be
|
// load (each genesis bond's coupon-bps must be within [floor, cap]). Delegates
|
||||||
// within [floor, cap]). Delegates to the data-engineer's genesis.go helpers
|
// to the data-engineer's genesis.go helpers (G-008).
|
||||||
// (G-008).
|
|
||||||
func ValidateGenesis(bz json.RawMessage) error {
|
func ValidateGenesis(bz json.RawMessage) error {
|
||||||
var gs GenesisState
|
var gs GenesisState
|
||||||
if err := json.Unmarshal(bz, &gs); err != nil {
|
if err := json.Unmarshal(bz, &gs); err != nil {
|
||||||
@@ -148,154 +141,5 @@ func ValidateGenesis(bz json.RawMessage) error {
|
|||||||
if err := ValidateBonds(gs.Bonds); err != nil {
|
if err := ValidateBonds(gs.Bonds); err != nil {
|
||||||
return fmt.Errorf("bond: %w", err)
|
return fmt.Errorf("bond: %w", err)
|
||||||
}
|
}
|
||||||
if err := ValidateGrowthBonds(gs.GrowthBonds); err != nil {
|
|
||||||
return fmt.Errorf("bond: %w", err)
|
|
||||||
}
|
|
||||||
if err := ValidateOrders(gs.Orders); err != nil {
|
|
||||||
return fmt.Errorf("bond: %w", err)
|
|
||||||
}
|
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
// --- v0.3 extension: GrowthBond + secondary market (REQ-026, D-041, G-012) -------
|
|
||||||
//
|
|
||||||
// The v0.3 bond extension adds GrowthBond (a bond whose coupon grows with
|
|
||||||
// protocol health, vision §17) and secondary-market order types. The 8%/0%
|
|
||||||
// consts (D-028) are UNCHANGED — the regression firewall in types_test.go
|
|
||||||
// asserts CouponCapBps==800 and CouponFloorBps==0 are still the v0.2 values.
|
|
||||||
// Full secondary-market matching is deferred to v0.4.
|
|
||||||
|
|
||||||
// OrderSideCount is the locked count of OrderSide enum values (vision §17
|
|
||||||
// secondary market, A-313). A regression firewall: adding/removing/renaming
|
|
||||||
// an order side breaks this const's test.
|
|
||||||
const OrderSideCount = 2
|
|
||||||
|
|
||||||
// OrderStatusCount is the locked count of OrderStatus enum values (A-313).
|
|
||||||
const OrderStatusCount = 3
|
|
||||||
|
|
||||||
// OrderSide enumerates the two sides of a secondary-market order (vision §17,
|
|
||||||
// REQ-026, A-313): Buy (a bid for a bond), Sell (an ask for a bond).
|
|
||||||
type OrderSide string
|
|
||||||
|
|
||||||
const (
|
|
||||||
OrderBuy OrderSide = "Buy" // bid
|
|
||||||
OrderSell OrderSide = "Sell" // ask
|
|
||||||
)
|
|
||||||
|
|
||||||
// AllOrderSides returns both OrderSide values in vision-§17 order. Locked-
|
|
||||||
// const test asserts exactly 2 entries with these names (A-313).
|
|
||||||
func AllOrderSides() []OrderSide {
|
|
||||||
return []OrderSide{
|
|
||||||
OrderBuy,
|
|
||||||
OrderSell,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// OrderStatus enumerates the three lifecycle states of a secondary-market
|
|
||||||
// order (vision §17, REQ-026, A-313): Open (resting on the book), Filled
|
|
||||||
// (matched and settled), Cancelled (removed by the holder or expired). The
|
|
||||||
// matching engine is v0.4; v0.3 types the order shape only.
|
|
||||||
type OrderStatus string
|
|
||||||
|
|
||||||
const (
|
|
||||||
OrderOpen OrderStatus = "Open" // resting on the book
|
|
||||||
OrderFilled OrderStatus = "Filled" // matched and settled
|
|
||||||
OrderCancelled OrderStatus = "Cancelled" // removed by the holder or expired
|
|
||||||
)
|
|
||||||
|
|
||||||
// AllOrderStatuses returns all three OrderStatus values in A-313 order.
|
|
||||||
// Locked-const test asserts exactly 3 entries with these names.
|
|
||||||
func AllOrderStatuses() []OrderStatus {
|
|
||||||
return []OrderStatus{
|
|
||||||
OrderOpen,
|
|
||||||
OrderFilled,
|
|
||||||
OrderCancelled,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ClampGrowth returns the additional bps a GrowthBond's coupon can grow so
|
|
||||||
// that the post-growth coupon (currentBps + additional) never exceeds
|
|
||||||
// CouponCapBps (D-028, A-306, G-012). The "post-growth coupon <= cap"
|
|
||||||
// invariant holds UNCONDITIONALLY.
|
|
||||||
//
|
|
||||||
// G-012 BINDING: ClampGrowth MUST guard currentBps > CouponCapBps BEFORE
|
|
||||||
// computing cap - current. The naive `min(cap - current, growth)` underflows
|
|
||||||
// uint32 when current > cap (cap - current wraps to a huge value, then min
|
|
||||||
// picks growthBps — the invariant is violated). This implementation guards
|
|
||||||
// explicitly:
|
|
||||||
// - If currentBps >= CouponCapBps: return 0 (no room to grow; the cap is
|
|
||||||
// already reached or exceeded — the post-growth coupon cannot grow
|
|
||||||
// without breaching the cap).
|
|
||||||
// - Otherwise: return min(CouponCapBps - currentBps, growthBps) (the room-
|
|
||||||
// to-cap, clamped by the requested growth).
|
|
||||||
//
|
|
||||||
// The two G-012-mandated test cases are: currentBps == CouponCapBps (return 0,
|
|
||||||
// the at-cap boundary) and currentBps > CouponCapBps (return 0, the guard
|
|
||||||
// against uint32 underflow — NOT a wrapped huge value).
|
|
||||||
func ClampGrowth(currentBps, growthBps uint32) uint32 {
|
|
||||||
// G-012 guard: at-or-above cap means no room to grow. This MUST be checked
|
|
||||||
// before the cap - current subtraction to avoid uint32 underflow when
|
|
||||||
// currentBps > cap.
|
|
||||||
if currentBps >= CouponCapBps {
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
// currentBps < cap is guaranteed here; cap - current does not underflow.
|
|
||||||
room := CouponCapBps - currentBps
|
|
||||||
if growthBps < room {
|
|
||||||
return growthBps
|
|
||||||
}
|
|
||||||
return room
|
|
||||||
}
|
|
||||||
|
|
||||||
// GrowthBond is a bond whose coupon grows with protocol health (vision §17,
|
|
||||||
// REQ-026, D-041, A-306). It embeds the v0.2 Bond (anonymous field) so it
|
|
||||||
// carries all Bond fields (bond-id, issuer-stand-id, principal-grain,
|
|
||||||
// coupon-bps, term-days, issued-at, maturity, status) PLUS a GrowthRateBps
|
|
||||||
// field (the per-period growth rate of the coupon, in bps). The growth rate
|
|
||||||
// is clamped at issuance so that the post-growth coupon never exceeds
|
|
||||||
// CouponCapBps (800 bps) — see IssueGrowth, which clamps couponBps via Clamp
|
|
||||||
// and growthRateBps via ClampGrowth (with currentBps=couponBps).
|
|
||||||
//
|
|
||||||
// The 8%/0% consts (D-028) apply to GrowthBonds too: the growth coupon is
|
|
||||||
// clamped to [0, 800] bps at any point. GrowthBond is in the same package as
|
|
||||||
// Bond (no G-003 concern for the Clamp/ClampGrowth reuse).
|
|
||||||
type GrowthBond struct {
|
|
||||||
Bond // anonymous embed — carries all v0.2 Bond fields
|
|
||||||
GrowthRateBps uint32 `json:"growth_rate_bps" yaml:"growth_rate_bps"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// IssueGrowth is the GrowthBond issuance stub (REQ-026, D-041). It constructs a
|
|
||||||
// GrowthBond with the coupon clamped to [CouponFloorBps, CouponCapBps] via
|
|
||||||
// Clamp, and the growth-rate clamped so that coupon + growth never exceeds
|
|
||||||
// CouponCapBps via ClampGrowth (with currentBps=couponBps). The returned
|
|
||||||
// GrowthBond has status BondIssued (inherited from Issue's Bond construction).
|
|
||||||
// The stub does not persist or enforce referential integrity of issuer-stand-
|
|
||||||
// id (a v0.4 keeper concern); it only enforces the coupon + growth clamp
|
|
||||||
// invariants at construction time.
|
|
||||||
func IssueGrowth(bondID, issuerStandID string, principalGrain int64, couponBps, growthRateBps uint32, termDays uint32, issuedAt, maturity int64) GrowthBond {
|
|
||||||
clampedCoupon := Clamp(couponBps)
|
|
||||||
clampedGrowth := ClampGrowth(clampedCoupon, growthRateBps)
|
|
||||||
return GrowthBond{
|
|
||||||
Bond: Issue(bondID, issuerStandID, principalGrain, clampedCoupon, termDays, issuedAt, maturity),
|
|
||||||
GrowthRateBps: clampedGrowth,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// SecondaryOrder is a secondary-market order on an issued bond (vision §17,
|
|
||||||
// REQ-026, D-041, A-313). order-id is the unique identifier. bond-id references
|
|
||||||
// a Bond (by-ID-string ref to a Bond — same package, so this is an in-package
|
|
||||||
// ID-string ref, not a cross-module G-003 concern). side picks OrderSide
|
|
||||||
// (Buy/Sell). price-grain is the order price in Grain (fraction of principal,
|
|
||||||
// expressed in Grain for fixed-point precision). holder-reach-id references
|
|
||||||
// an x/identity Reach by ID-string (G-003 — use "holder-reach-id" not the
|
|
||||||
// banned Holder-identity term). status is the OrderStatus. created-at is the
|
|
||||||
// unix timestamp.
|
|
||||||
type SecondaryOrder struct {
|
|
||||||
OrderID string `json:"order_id" yaml:"order_id"`
|
|
||||||
BondID string `json:"bond_id" yaml:"bond_id"`
|
|
||||||
Side OrderSide `json:"side" yaml:"side"`
|
|
||||||
PriceGrain int64 `json:"price_grain" yaml:"price_grain"`
|
|
||||||
HolderReachID string `json:"holder_reach_id" yaml:"holder_reach_id"`
|
|
||||||
Status OrderStatus `json:"status" yaml:"status"`
|
|
||||||
CreatedAt int64 `json:"created_at" yaml:"created_at"`
|
|
||||||
}
|
|
||||||
|
|||||||
@@ -416,539 +416,6 @@ func TestLexiconNoBannedTermsInBondTestFile(t *testing.T) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// --- v0.3 extension: ClampGrowth (G-012 BINDING) ---------------------------------
|
|
||||||
// ClampGrowth is the G-012 binding decision: it MUST guard currentBps >
|
|
||||||
// CouponCapBps before computing cap - current, otherwise the uint32
|
|
||||||
// subtraction underflows (cap - current wraps to a huge value, then min picks
|
|
||||||
// growthBps — the post-growth coupon invariant is violated). These tests are
|
|
||||||
// written FIRST (TDD) to confirm the guard works before the function existed;
|
|
||||||
// they are the highest-severity v0.3 bond firewall.
|
|
||||||
//
|
|
||||||
// The five G-012-mandated test cases:
|
|
||||||
// 1. currentBps == 0 (full growth room)
|
|
||||||
// 2. currentBps == CouponCapBps (no room, return 0 — the at-cap boundary)
|
|
||||||
// 3. currentBps > CouponCapBps (the underflow GUARD — return 0, NOT a wrapped
|
|
||||||
// huge value)
|
|
||||||
// 4. growthBps larger than room (clamp to room)
|
|
||||||
// 5. growthBps smaller than room (return growthBps)
|
|
||||||
|
|
||||||
// TestClampGrowthCurrentZeroFullRoom asserts case 1: currentBps == 0 leaves
|
|
||||||
// the full room to the cap; the growth is clamped to min(cap, growth).
|
|
||||||
func TestClampGrowthCurrentZeroFullRoom(t *testing.T) {
|
|
||||||
// growth < cap (room) -> return growth
|
|
||||||
if got := btypes.ClampGrowth(0, 500); got != 500 {
|
|
||||||
t.Errorf("ClampGrowth(0, 500) = %d, expected 500 (full room, growth < cap)", got)
|
|
||||||
}
|
|
||||||
// growth == cap (room) -> return cap (room)
|
|
||||||
if got := btypes.ClampGrowth(0, btypes.CouponCapBps); got != btypes.CouponCapBps {
|
|
||||||
t.Errorf("ClampGrowth(0, cap) = %d, expected cap %d (full room, growth == cap)", got, btypes.CouponCapBps)
|
|
||||||
}
|
|
||||||
// growth > cap (room) -> return cap (room)
|
|
||||||
if got := btypes.ClampGrowth(0, 1000); got != btypes.CouponCapBps {
|
|
||||||
t.Errorf("ClampGrowth(0, 1000) = %d, expected cap %d (full room, growth > cap clamps to cap)", got, btypes.CouponCapBps)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestClampGrowthCurrentAtCapReturnsZero asserts case 2: currentBps ==
|
|
||||||
// CouponCapBps (the at-cap boundary). There is no room to grow; return 0.
|
|
||||||
// This is the G-012-mandated at-cap test.
|
|
||||||
func TestClampGrowthCurrentAtCapReturnsZero(t *testing.T) {
|
|
||||||
got := btypes.ClampGrowth(btypes.CouponCapBps, 100)
|
|
||||||
if got != 0 {
|
|
||||||
t.Errorf("ClampGrowth(cap, 100) = %d, expected 0 (at-cap boundary — no room to grow, G-012)", got)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestClampGrowthCurrentAboveCapReturnsZero asserts case 3: currentBps >
|
|
||||||
// CouponCapBps (the uint32 underflow GUARD). The naive min(cap-current,
|
|
||||||
// growth) would underflow uint32 (cap-current wraps to a huge value, then min
|
|
||||||
// picks growth — invariant violated). ClampGrowth MUST return 0, NOT a
|
|
||||||
// wrapped huge value. This is the G-012-mandated above-cap test.
|
|
||||||
func TestClampGrowthCurrentAboveCapReturnsZero(t *testing.T) {
|
|
||||||
cases := []struct {
|
|
||||||
current uint32
|
|
||||||
growth uint32
|
|
||||||
}{
|
|
||||||
{uint32(btypes.CouponCapBps) + 1, 100},
|
|
||||||
{uint32(btypes.CouponCapBps) + 100, 500},
|
|
||||||
{uint32(btypes.CouponCapBps) + 1000, 50},
|
|
||||||
{5000, 100},
|
|
||||||
{100_000, 1},
|
|
||||||
}
|
|
||||||
for _, c := range cases {
|
|
||||||
got := btypes.ClampGrowth(c.current, c.growth)
|
|
||||||
if got != 0 {
|
|
||||||
t.Errorf("ClampGrowth(%d, %d) = %d, expected 0 (above-cap GUARD — uint32 underflow must NOT happen, G-012)",
|
|
||||||
c.current, c.growth, got)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestClampGrowthGrowthLargerThanRoomClampsToRoom asserts case 4: growthBps
|
|
||||||
// larger than the room-to-cap is clamped to the room.
|
|
||||||
func TestClampGrowthGrowthLargerThanRoomClampsToRoom(t *testing.T) {
|
|
||||||
// current=500, cap=800, room=300. growth=400 > room -> return 300.
|
|
||||||
got := btypes.ClampGrowth(500, 400)
|
|
||||||
if got != 300 {
|
|
||||||
t.Errorf("ClampGrowth(500, 400) = %d, expected 300 (growth larger than room clamps to room)", got)
|
|
||||||
}
|
|
||||||
// current=799, cap=800, room=1. growth=50 > room -> return 1.
|
|
||||||
got = btypes.ClampGrowth(799, 50)
|
|
||||||
if got != 1 {
|
|
||||||
t.Errorf("ClampGrowth(799, 50) = %d, expected 1 (room=1, growth clamps to room)", got)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestClampGrowthGrowthSmallerThanRoomReturnsGrowth asserts case 5: growthBps
|
|
||||||
// smaller than the room-to-cap is returned unchanged.
|
|
||||||
func TestClampGrowthGrowthSmallerThanRoomReturnsGrowth(t *testing.T) {
|
|
||||||
// current=500, cap=800, room=300. growth=200 < room -> return 200.
|
|
||||||
got := btypes.ClampGrowth(500, 200)
|
|
||||||
if got != 200 {
|
|
||||||
t.Errorf("ClampGrowth(500, 200) = %d, expected 200 (growth < room, unchanged)", got)
|
|
||||||
}
|
|
||||||
// current=0, cap=800, room=800. growth=100 < room -> return 100.
|
|
||||||
got = btypes.ClampGrowth(0, 100)
|
|
||||||
if got != 100 {
|
|
||||||
t.Errorf("ClampGrowth(0, 100) = %d, expected 100 (growth < room, unchanged)", got)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestClampGrowthInvariantPostGrowthLeCap is the meta-assert: ClampGrowth
|
|
||||||
// never ADDS growth that would push the post-growth coupon past the cap. The
|
|
||||||
// invariant is: current + ClampGrowth(current, growth) <= max(current, cap).
|
|
||||||
// When current <= cap, this means post-growth <= cap (no growth past the
|
|
||||||
// cap). When current > cap (the G-012 misuse/guard case), ClampGrowth returns
|
|
||||||
// 0 (no additional growth), so post == current (the already-broken state is
|
|
||||||
// not made worse; the guard prevents the uint32 underflow from adding a
|
|
||||||
// wrapped-huge value as growth).
|
|
||||||
func TestClampGrowthInvariantPostGrowthLeCap(t *testing.T) {
|
|
||||||
cases := []struct {
|
|
||||||
current uint32
|
|
||||||
growth uint32
|
|
||||||
}{
|
|
||||||
{0, 0},
|
|
||||||
{0, 800},
|
|
||||||
{0, 1000},
|
|
||||||
{400, 400},
|
|
||||||
{400, 500},
|
|
||||||
{799, 1},
|
|
||||||
{799, 100},
|
|
||||||
{800, 100}, // at-cap
|
|
||||||
{801, 100}, // above-cap (guard)
|
|
||||||
{5000, 1000}, // way above-cap (guard)
|
|
||||||
}
|
|
||||||
for _, c := range cases {
|
|
||||||
got := btypes.ClampGrowth(c.current, c.growth)
|
|
||||||
post := c.current + got
|
|
||||||
// The bound: post <= max(current, cap). When current <= cap, this is
|
|
||||||
// post <= cap (no growth past the cap). When current > cap, this is
|
|
||||||
// post <= current (no additional growth — the guard returned 0).
|
|
||||||
upper := c.current
|
|
||||||
if uint32(btypes.CouponCapBps) > upper {
|
|
||||||
upper = btypes.CouponCapBps
|
|
||||||
}
|
|
||||||
if post > upper {
|
|
||||||
t.Errorf("ClampGrowth(%d, %d) = %d; post-growth coupon %d > %d (G-012 invariant violated)",
|
|
||||||
c.current, c.growth, got, post, upper)
|
|
||||||
}
|
|
||||||
// Stronger assert for the in-bounds case: when current <= cap, post
|
|
||||||
// must be <= cap exactly (no growth past the cap).
|
|
||||||
if c.current <= btypes.CouponCapBps && post > btypes.CouponCapBps {
|
|
||||||
t.Errorf("ClampGrowth(%d, %d) = %d; post-growth coupon %d > cap %d (in-bounds invariant violated)",
|
|
||||||
c.current, c.growth, got, post, btypes.CouponCapBps)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- D-028 regression: 8%/0% consts unchanged (v0.3 must not change v0.2) -------
|
|
||||||
// These tests are re-declared here in the v0.3 block to make the regression
|
|
||||||
// firewall explicit in the extension context. The v0.2 tests above
|
|
||||||
// (TestCouponCapBpsLockedConst / TestCouponFloorBpsLockedConst) are the
|
|
||||||
// primary firewall; this block re-asserts in the v0.3 extension context.
|
|
||||||
|
|
||||||
// TestD028RegressionCouponCapUnchanged asserts CouponCapBps is still 800
|
|
||||||
// after the v0.3 GrowthBond extension (D-028 regression firewall).
|
|
||||||
func TestD028RegressionCouponCapUnchanged(t *testing.T) {
|
|
||||||
if btypes.CouponCapBps != 800 {
|
|
||||||
t.Errorf("D-028 regression: CouponCapBps = %d, expected 800 (v0.3 must not change v0.2 const)", btypes.CouponCapBps)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestD028RegressionCouponFloorUnchanged asserts CouponFloorBps is still 0.
|
|
||||||
func TestD028RegressionCouponFloorUnchanged(t *testing.T) {
|
|
||||||
if btypes.CouponFloorBps != 0 {
|
|
||||||
t.Errorf("D-028 regression: CouponFloorBps = %d, expected 0 (v0.3 must not change v0.2 const)", btypes.CouponFloorBps)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestD028RegressionBondStatusCountUnchanged asserts BondStatusCount is still
|
|
||||||
// 5 (the v0.2 enum is unchanged by the v0.3 extension).
|
|
||||||
func TestD028RegressionBondStatusCountUnchanged(t *testing.T) {
|
|
||||||
if btypes.BondStatusCount != 5 {
|
|
||||||
t.Errorf("D-028 regression: BondStatusCount = %d, expected 5 (v0.2 enum unchanged)", btypes.BondStatusCount)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- OrderSide enum coverage (2) ----------------------------------------------
|
|
||||||
|
|
||||||
// TestOrderSideCountLockedConst asserts OrderSideCount == 2 and AllOrderSides()
|
|
||||||
// returns exactly 2 (A-313). A regression firewall.
|
|
||||||
func TestOrderSideCountLockedConst(t *testing.T) {
|
|
||||||
if btypes.OrderSideCount != 2 {
|
|
||||||
t.Errorf("OrderSideCount = %d, expected 2 (A-313 LOCKED)", btypes.OrderSideCount)
|
|
||||||
}
|
|
||||||
all := btypes.AllOrderSides()
|
|
||||||
if len(all) != 2 {
|
|
||||||
t.Errorf("AllOrderSides() len = %d, expected 2", len(all))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestAllOrderSidesNames asserts the 2 A-313 names in order with no extras, no
|
|
||||||
// dups, no renames.
|
|
||||||
func TestAllOrderSidesNames(t *testing.T) {
|
|
||||||
want := []string{"Buy", "Sell"}
|
|
||||||
all := btypes.AllOrderSides()
|
|
||||||
if len(all) != len(want) {
|
|
||||||
t.Fatalf("len = %d, want %d", len(all), len(want))
|
|
||||||
}
|
|
||||||
seen := map[string]bool{}
|
|
||||||
for i, s := range all {
|
|
||||||
if string(s) != want[i] {
|
|
||||||
t.Errorf("AllOrderSides()[%d] = %q, want %q", i, s, want[i])
|
|
||||||
}
|
|
||||||
if seen[string(s)] {
|
|
||||||
t.Errorf("duplicate OrderSide %q", s)
|
|
||||||
}
|
|
||||||
seen[string(s)] = true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOrderSideValues asserts each named const matches its AllOrderSides entry.
|
|
||||||
func TestOrderSideValues(t *testing.T) {
|
|
||||||
if btypes.OrderBuy != "Buy" {
|
|
||||||
t.Errorf("OrderBuy = %q", btypes.OrderBuy)
|
|
||||||
}
|
|
||||||
if btypes.OrderSell != "Sell" {
|
|
||||||
t.Errorf("OrderSell = %q", btypes.OrderSell)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- OrderStatus enum coverage (3) -------------------------------------------
|
|
||||||
|
|
||||||
// TestOrderStatusCountLockedConst asserts OrderStatusCount == 3 and
|
|
||||||
// AllOrderStatuses() returns exactly 3 (A-313). A regression firewall.
|
|
||||||
func TestOrderStatusCountLockedConst(t *testing.T) {
|
|
||||||
if btypes.OrderStatusCount != 3 {
|
|
||||||
t.Errorf("OrderStatusCount = %d, expected 3 (A-313 LOCKED)", btypes.OrderStatusCount)
|
|
||||||
}
|
|
||||||
all := btypes.AllOrderStatuses()
|
|
||||||
if len(all) != 3 {
|
|
||||||
t.Errorf("AllOrderStatuses() len = %d, expected 3", len(all))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestAllOrderStatusesNames asserts the 3 A-313 names in order with no extras,
|
|
||||||
// no dups, no renames.
|
|
||||||
func TestAllOrderStatusesNames(t *testing.T) {
|
|
||||||
want := []string{"Open", "Filled", "Cancelled"}
|
|
||||||
all := btypes.AllOrderStatuses()
|
|
||||||
if len(all) != len(want) {
|
|
||||||
t.Fatalf("len = %d, want %d", len(all), len(want))
|
|
||||||
}
|
|
||||||
seen := map[string]bool{}
|
|
||||||
for i, s := range all {
|
|
||||||
if string(s) != want[i] {
|
|
||||||
t.Errorf("AllOrderStatuses()[%d] = %q, want %q", i, s, want[i])
|
|
||||||
}
|
|
||||||
if seen[string(s)] {
|
|
||||||
t.Errorf("duplicate OrderStatus %q", s)
|
|
||||||
}
|
|
||||||
seen[string(s)] = true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOrderStatusValues asserts each named const matches its AllOrderStatuses
|
|
||||||
// entry.
|
|
||||||
func TestOrderStatusValues(t *testing.T) {
|
|
||||||
if btypes.OrderOpen != "Open" {
|
|
||||||
t.Errorf("OrderOpen = %q", btypes.OrderOpen)
|
|
||||||
}
|
|
||||||
if btypes.OrderFilled != "Filled" {
|
|
||||||
t.Errorf("OrderFilled = %q", btypes.OrderFilled)
|
|
||||||
}
|
|
||||||
if btypes.OrderCancelled != "Cancelled" {
|
|
||||||
t.Errorf("OrderCancelled = %q", btypes.OrderCancelled)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- GrowthBond + IssueGrowth --------------------------------------------------
|
|
||||||
|
|
||||||
// TestGrowthBondStructFields asserts GrowthBond embeds Bond and adds
|
|
||||||
// GrowthRateBps.
|
|
||||||
func TestGrowthBondStructFields(t *testing.T) {
|
|
||||||
gb := btypes.GrowthBond{
|
|
||||||
Bond: btypes.Bond{BondID: "gb-1", IssuerStandID: "stand-1", PrincipalGrain: 1_000_000, CouponBps: 500, TermDays: 365, IssuedAt: 1000, Maturity: 1365, Status: btypes.BondIssued},
|
|
||||||
GrowthRateBps: 200,
|
|
||||||
}
|
|
||||||
if gb.BondID != "gb-1" || gb.IssuerStandID != "stand-1" || gb.PrincipalGrain != 1_000_000 ||
|
|
||||||
gb.CouponBps != 500 || gb.TermDays != 365 || gb.IssuedAt != 1000 || gb.Maturity != 1365 ||
|
|
||||||
gb.Status != btypes.BondIssued || gb.GrowthRateBps != 200 {
|
|
||||||
t.Error("GrowthBond fields not set correctly")
|
|
||||||
}
|
|
||||||
// The embedded Bond is accessible via the anonymous field.
|
|
||||||
if gb.Bond.BondID != "gb-1" {
|
|
||||||
t.Errorf("embedded Bond.BondID = %q", gb.Bond.BondID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestIssueGrowthConstruction asserts IssueGrowth clamps the coupon via Clamp
|
|
||||||
// and the growth-rate via ClampGrowth, and returns status BondIssued.
|
|
||||||
func TestIssueGrowthConstruction(t *testing.T) {
|
|
||||||
// In-range coupon and growth: both unchanged.
|
|
||||||
gb := btypes.IssueGrowth("gb-2", "stand-1", 1_000_000, 500, 200, 365, 1000, 1365)
|
|
||||||
if gb.BondID != "gb-2" {
|
|
||||||
t.Errorf("BondID = %q", gb.BondID)
|
|
||||||
}
|
|
||||||
if gb.CouponBps != 500 {
|
|
||||||
t.Errorf("CouponBps = %d, expected 500 (in-range, unchanged)", gb.CouponBps)
|
|
||||||
}
|
|
||||||
if gb.GrowthRateBps != 200 {
|
|
||||||
t.Errorf("GrowthRateBps = %d, expected 200 (in-range, growth < room)", gb.GrowthRateBps)
|
|
||||||
}
|
|
||||||
if gb.Status != btypes.BondIssued {
|
|
||||||
t.Errorf("Status = %q, expected BondIssued", gb.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestIssueGrowthClampsAboveCapCoupon asserts IssueGrowth clamps an above-cap
|
|
||||||
// coupon down to the cap (via Clamp), and the growth-rate is then clamped
|
|
||||||
// against the clamped coupon (currentBps=cap -> growth returns 0, G-012).
|
|
||||||
func TestIssueGrowthClampsAboveCapCoupon(t *testing.T) {
|
|
||||||
gb := btypes.IssueGrowth("gb-3", "stand-1", 1_000_000, 1200, 100, 365, 1000, 1365)
|
|
||||||
if gb.CouponBps != btypes.CouponCapBps {
|
|
||||||
t.Errorf("CouponBps = %d, expected cap %d (IssueGrowth must clamp above-cap coupon)", gb.CouponBps, btypes.CouponCapBps)
|
|
||||||
}
|
|
||||||
// coupon clamped to cap -> ClampGrowth(cap, 100) == 0 (no room, G-012).
|
|
||||||
if gb.GrowthRateBps != 0 {
|
|
||||||
t.Errorf("GrowthRateBps = %d, expected 0 (coupon at cap -> no room, G-012)", gb.GrowthRateBps)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestIssueGrowthClampsGrowthToRoom asserts IssueGrowth clamps a growth-rate
|
|
||||||
// that would push the coupon above the cap down to the room-to-cap.
|
|
||||||
func TestIssueGrowthClampsGrowthToRoom(t *testing.T) {
|
|
||||||
// coupon=500, cap=800, room=300. growth=400 -> clamped to 300.
|
|
||||||
gb := btypes.IssueGrowth("gb-4", "stand-1", 1_000_000, 500, 400, 365, 1000, 1365)
|
|
||||||
if gb.CouponBps != 500 {
|
|
||||||
t.Errorf("CouponBps = %d, expected 500", gb.CouponBps)
|
|
||||||
}
|
|
||||||
if gb.GrowthRateBps != 300 {
|
|
||||||
t.Errorf("GrowthRateBps = %d, expected 300 (growth clamped to room, G-012)", gb.GrowthRateBps)
|
|
||||||
}
|
|
||||||
// post-growth coupon: 500 + 300 = 800 == cap (invariant holds).
|
|
||||||
if gb.CouponBps+gb.GrowthRateBps > btypes.CouponCapBps {
|
|
||||||
t.Errorf("post-growth coupon %d > cap %d (G-012 invariant)", gb.CouponBps+gb.GrowthRateBps, btypes.CouponCapBps)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- SecondaryOrder struct ----------------------------------------------------
|
|
||||||
|
|
||||||
// TestSecondaryOrderStructFields asserts SecondaryOrder carries order-id,
|
|
||||||
// bond-id (by-ID-string ref to a Bond — in-package), side, price-grain,
|
|
||||||
// holder-reach-id (by-ID-string ref to x/identity — G-003), status, created-at.
|
|
||||||
func TestSecondaryOrderStructFields(t *testing.T) {
|
|
||||||
o := btypes.SecondaryOrder{
|
|
||||||
OrderID: "order-1",
|
|
||||||
BondID: "bond-1",
|
|
||||||
Side: btypes.OrderBuy,
|
|
||||||
PriceGrain: 950_000,
|
|
||||||
HolderReachID: "reach-holder-1",
|
|
||||||
Status: btypes.OrderOpen,
|
|
||||||
CreatedAt: 5000,
|
|
||||||
}
|
|
||||||
if o.OrderID != "order-1" || o.BondID != "bond-1" || o.Side != btypes.OrderBuy ||
|
|
||||||
o.PriceGrain != 950_000 || o.HolderReachID != "reach-holder-1" ||
|
|
||||||
o.Status != btypes.OrderOpen || o.CreatedAt != 5000 {
|
|
||||||
t.Error("SecondaryOrder fields not set correctly")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestSecondaryOrderBondIDIsString asserts bond-id is string-typed (in-package
|
|
||||||
// by-ID-string ref to a Bond — same package, not a G-003 cross-module import).
|
|
||||||
func TestSecondaryOrderBondIDIsString(t *testing.T) {
|
|
||||||
o := btypes.SecondaryOrder{BondID: "bond-xyz"}
|
|
||||||
if o.BondID != "bond-xyz" {
|
|
||||||
t.Errorf("BondID = %q", o.BondID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestSecondaryOrderHolderReachIDIsString asserts holder-reach-id is
|
|
||||||
// string-typed (G-003 by-ID-string ref to x/identity Reach — no struct import).
|
|
||||||
func TestSecondaryOrderHolderReachIDIsString(t *testing.T) {
|
|
||||||
o := btypes.SecondaryOrder{HolderReachID: "reach-abc"}
|
|
||||||
if o.HolderReachID != "reach-abc" {
|
|
||||||
t.Errorf("HolderReachID = %q", o.HolderReachID)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Genesis v0.3 extension: GrowthBonds + Orders -----------------------------
|
|
||||||
|
|
||||||
// TestDefaultGenesisStateV3Empty asserts DefaultGenesisState returns non-nil
|
|
||||||
// empty slices for the v0.3 GrowthBonds and Orders sets.
|
|
||||||
func TestDefaultGenesisStateV3Empty(t *testing.T) {
|
|
||||||
gs := btypes.DefaultGenesisState()
|
|
||||||
if gs.GrowthBonds == nil || len(gs.GrowthBonds) != 0 {
|
|
||||||
t.Errorf("Default GrowthBonds should be non-nil empty slice; got len=%d nil=%v", len(gs.GrowthBonds), gs.GrowthBonds == nil)
|
|
||||||
}
|
|
||||||
if gs.Orders == nil || len(gs.Orders) != 0 {
|
|
||||||
t.Errorf("Default Orders should be non-nil empty slice; got len=%d nil=%v", len(gs.Orders), gs.Orders == nil)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisRejectsDupGrowthBondIDs asserts A-212: duplicate
|
|
||||||
// growth-bond-ids are rejected.
|
|
||||||
func TestValidateGenesisRejectsDupGrowthBondIDs(t *testing.T) {
|
|
||||||
gs := btypes.GenesisState{
|
|
||||||
GrowthBonds: []btypes.GrowthBond{
|
|
||||||
{Bond: btypes.Bond{BondID: "gb1", IssuerStandID: "s1", CouponBps: 500, Status: btypes.BondIssued}, GrowthRateBps: 100},
|
|
||||||
{Bond: btypes.Bond{BondID: "gb1", IssuerStandID: "s2", CouponBps: 200, Status: btypes.BondActive}, GrowthRateBps: 50}, // dup
|
|
||||||
},
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := btypes.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject duplicate growth-bond-ids")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisRejectsGrowthBondCouponAboveCap asserts a genesis
|
|
||||||
// GrowthBond with coupon-bps above the cap is rejected (D-028 at genesis).
|
|
||||||
func TestValidateGenesisRejectsGrowthBondCouponAboveCap(t *testing.T) {
|
|
||||||
gs := btypes.GenesisState{
|
|
||||||
GrowthBonds: []btypes.GrowthBond{
|
|
||||||
{Bond: btypes.Bond{BondID: "gb1", IssuerStandID: "s1", CouponBps: 900, Status: btypes.BondIssued}, GrowthRateBps: 0},
|
|
||||||
},
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := btypes.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject growth-bond coupon above cap (D-028)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisRejectsGrowthBondGrowthAboveRoom asserts a genesis
|
|
||||||
// GrowthBond whose growth-rate would push the coupon above the cap is
|
|
||||||
// rejected (G-012 / A-306 at genesis).
|
|
||||||
func TestValidateGenesisRejectsGrowthBondGrowthAboveRoom(t *testing.T) {
|
|
||||||
gs := btypes.GenesisState{
|
|
||||||
GrowthBonds: []btypes.GrowthBond{
|
|
||||||
// coupon=500, cap=800, room=300. growth=400 -> would push to 900 > cap.
|
|
||||||
{Bond: btypes.Bond{BondID: "gb1", IssuerStandID: "s1", CouponBps: 500, Status: btypes.BondIssued}, GrowthRateBps: 400},
|
|
||||||
},
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := btypes.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject growth-bond growth-rate above room (G-012/A-306)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisRejectsDupOrderIDs asserts A-212: duplicate order-ids are
|
|
||||||
// rejected.
|
|
||||||
func TestValidateGenesisRejectsDupOrderIDs(t *testing.T) {
|
|
||||||
gs := btypes.GenesisState{
|
|
||||||
Orders: []btypes.SecondaryOrder{
|
|
||||||
{OrderID: "o1", BondID: "b1", Side: btypes.OrderBuy, Status: btypes.OrderOpen},
|
|
||||||
{OrderID: "o1", BondID: "b2", Side: btypes.OrderSell, Status: btypes.OrderOpen}, // dup
|
|
||||||
},
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := btypes.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject duplicate order-ids")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisRejectsEmptyOrderBondID asserts an order with an empty
|
|
||||||
// bond-id is rejected.
|
|
||||||
func TestValidateGenesisRejectsEmptyOrderBondID(t *testing.T) {
|
|
||||||
gs := btypes.GenesisState{
|
|
||||||
Orders: []btypes.SecondaryOrder{{OrderID: "o1", BondID: "", Side: btypes.OrderBuy, Status: btypes.OrderOpen}},
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := btypes.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject empty order bond-id")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisRejectsUnknownOrderSide asserts an unknown OrderSide is
|
|
||||||
// rejected.
|
|
||||||
func TestValidateGenesisRejectsUnknownOrderSide(t *testing.T) {
|
|
||||||
gs := btypes.GenesisState{
|
|
||||||
Orders: []btypes.SecondaryOrder{{OrderID: "o1", BondID: "b1", Side: btypes.OrderSide("Bogus"), Status: btypes.OrderOpen}},
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := btypes.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject unknown order side")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisRejectsUnknownOrderStatus asserts an unknown OrderStatus
|
|
||||||
// is rejected.
|
|
||||||
func TestValidateGenesisRejectsUnknownOrderStatus(t *testing.T) {
|
|
||||||
gs := btypes.GenesisState{
|
|
||||||
Orders: []btypes.SecondaryOrder{{OrderID: "o1", BondID: "b1", Side: btypes.OrderBuy, Status: btypes.OrderStatus("Bogus")}},
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := btypes.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject unknown order status")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisAcceptsCleanV3 asserts a clean v0.3 genesis (bonds +
|
|
||||||
// growth bonds + orders) validates.
|
|
||||||
func TestValidateGenesisAcceptsCleanV3(t *testing.T) {
|
|
||||||
gs := btypes.GenesisState{
|
|
||||||
Bonds: []btypes.Bond{
|
|
||||||
{BondID: "b1", IssuerStandID: "s1", CouponBps: 100, Status: btypes.BondIssued},
|
|
||||||
},
|
|
||||||
GrowthBonds: []btypes.GrowthBond{
|
|
||||||
{Bond: btypes.Bond{BondID: "gb1", IssuerStandID: "s1", CouponBps: 500, Status: btypes.BondIssued}, GrowthRateBps: 200},
|
|
||||||
{Bond: btypes.Bond{BondID: "gb2", IssuerStandID: "s1", CouponBps: 800, Status: btypes.BondActive}, GrowthRateBps: 0},
|
|
||||||
},
|
|
||||||
Orders: []btypes.SecondaryOrder{
|
|
||||||
{OrderID: "o1", BondID: "b1", Side: btypes.OrderBuy, PriceGrain: 950_000, HolderReachID: "r1", Status: btypes.OrderOpen, CreatedAt: 1000},
|
|
||||||
{OrderID: "o2", BondID: "gb1", Side: btypes.OrderSell, PriceGrain: 1_050_000, HolderReachID: "r2", Status: btypes.OrderFilled, CreatedAt: 2000},
|
|
||||||
},
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := btypes.ValidateGenesis(bz); err != nil {
|
|
||||||
t.Errorf("ValidateGenesis should accept clean v0.3 genesis, got: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGrowthBondsAcceptsClean asserts the data-engineer's
|
|
||||||
// ValidateGrowthBonds helper accepts a clean set.
|
|
||||||
func TestValidateGrowthBondsAcceptsClean(t *testing.T) {
|
|
||||||
gbs := []btypes.GrowthBond{
|
|
||||||
{Bond: btypes.Bond{BondID: "gb1", CouponBps: 0, Status: btypes.BondIssued}, GrowthRateBps: 800},
|
|
||||||
{Bond: btypes.Bond{BondID: "gb2", CouponBps: 500, Status: btypes.BondActive}, GrowthRateBps: 300},
|
|
||||||
{Bond: btypes.Bond{BondID: "gb3", CouponBps: 800, Status: btypes.BondMatured}, GrowthRateBps: 0},
|
|
||||||
}
|
|
||||||
if err := btypes.ValidateGrowthBonds(gbs); err != nil {
|
|
||||||
t.Errorf("ValidateGrowthBonds should accept clean set; got: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateOrdersAcceptsClean asserts ValidateOrders accepts a clean set.
|
|
||||||
func TestValidateOrdersAcceptsClean(t *testing.T) {
|
|
||||||
orders := []btypes.SecondaryOrder{
|
|
||||||
{OrderID: "o1", BondID: "b1", Side: btypes.OrderBuy, Status: btypes.OrderOpen},
|
|
||||||
{OrderID: "o2", BondID: "b1", Side: btypes.OrderSell, Status: btypes.OrderFilled},
|
|
||||||
{OrderID: "o3", BondID: "b2", Side: btypes.OrderBuy, Status: btypes.OrderCancelled},
|
|
||||||
}
|
|
||||||
if err := btypes.ValidateOrders(orders); err != nil {
|
|
||||||
t.Errorf("ValidateOrders should accept clean set; got: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// packageDir resolves a Go import path to its filesystem directory by
|
// packageDir resolves a Go import path to its filesystem directory by
|
||||||
// walking up from this test file (v0.2 skeleton has zero external deps).
|
// walking up from this test file (v0.2 skeleton has zero external deps).
|
||||||
func packageDir(t *testing.T, importPath string) string {
|
func packageDir(t *testing.T, importPath string) string {
|
||||||
|
|||||||
@@ -1,393 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
"strings"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
capabilitytypes "github.com/cosmos/ibc-go/modules/capability/types"
|
|
||||||
channeltypes "github.com/cosmos/ibc-go/v8/modules/core/04-channel/types"
|
|
||||||
porttypes "github.com/cosmos/ibc-go/v8/modules/core/05-port/types"
|
|
||||||
ibcexported "github.com/cosmos/ibc-go/v8/modules/core/exported"
|
|
||||||
)
|
|
||||||
|
|
||||||
// ibc_module.go implements the IBCModule contract for the bridge module
|
|
||||||
// (P1-03-01). The IBCModule interface (ibc-go porttypes.IBCModule, ICS-26)
|
|
||||||
// requires the full channel-handshake lifecycle + the three packet handlers.
|
|
||||||
// For the v0.5 simtest-grade runtime (D-054), the channel-handshake callbacks
|
|
||||||
// are no-ops (the simtest exercises only OnRecvPacket/OnAcknowledgementPacket/
|
|
||||||
// OnTimeoutPacket); the packet handlers are the load-bearing surface.
|
|
||||||
//
|
|
||||||
// Packet handler contract (REQ-033, D-059, A-513, G-021):
|
|
||||||
//
|
|
||||||
// - OnRecvPacket: parse the ICS-20 v1 payload (denom, amount, sender,
|
|
||||||
// receiver). Validate the denom trace against the v0.2 WrappedBreadDenom
|
|
||||||
// shape `transfer/channel-N/<denom>`. Mint wrapped Bread via the
|
|
||||||
// BreadKeeper shim. The 4 EVM chains (Polygon/Base/Arbitrum/Optimism)
|
|
||||||
// use timestamp-only timeouts; the Solana branch verifies the wormhole
|
|
||||||
// guardian sig set (2-of-N) from state before minting. Write the
|
|
||||||
// in-flight record (replay protection — A-513).
|
|
||||||
//
|
|
||||||
// - OnAcknowledgementPacket: delete the in-flight record on the first ack
|
|
||||||
// (replay protection mirroring ibc-go). A second ack finds no record and
|
|
||||||
// returns ERROR (G-021 — NOT a silent no-op; the CVE-class ibc-go pitfall
|
|
||||||
// A-513 is closed by failing loudly on the replay).
|
|
||||||
//
|
|
||||||
// - OnTimeoutPacket: refund the source-chain escrow via the BreadKeeper
|
|
||||||
// shim exactly once (the `Refunded` flag on the in-flight record guards
|
|
||||||
// a second refund). A second timeout is a no-op (the record is already
|
|
||||||
// refunded).
|
|
||||||
|
|
||||||
// IBCModule is the bridge module's IBC module (implements porttypes.IBCModule).
|
|
||||||
type IBCModule struct {
|
|
||||||
keeper Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewIBCModule constructs a new IBCModule wrapping the bridge Keeper.
|
|
||||||
func NewIBCModule(k Keeper) IBCModule {
|
|
||||||
return IBCModule{keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertion: IBCModule implements porttypes.IBCModule.
|
|
||||||
var _ porttypes.IBCModule = IBCModule{}
|
|
||||||
|
|
||||||
// --- ICS-20 v1 packet data ---------------------------------------------------
|
|
||||||
//
|
|
||||||
// The bridge handler parses the ICS-20 v1 payload directly (a JSON object
|
|
||||||
// with denom, amount, sender, receiver, memo). This mirrors the ibc-go
|
|
||||||
// transfer FungibleTokenPacketData but is hand-rolled here (no struct import
|
|
||||||
// of the transfer types — the bridge handler is self-contained per the
|
|
||||||
// skeleton's zero-codegen style).
|
|
||||||
|
|
||||||
// ICS20PacketData is the ICS-20 v1 fungible token transfer packet payload.
|
|
||||||
type ICS20PacketData struct {
|
|
||||||
Denom string `json:"denom"`
|
|
||||||
Amount string `json:"amount"`
|
|
||||||
Sender string `json:"sender"`
|
|
||||||
Receiver string `json:"receiver"`
|
|
||||||
Memo string `json:"memo,omitempty"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless ICS-20 v1 validation: non-empty denom,
|
|
||||||
// non-empty amount (positive integer string), non-empty sender/receiver.
|
|
||||||
func (d ICS20PacketData) ValidateBasic() error {
|
|
||||||
if d.Denom == "" {
|
|
||||||
return fmt.Errorf("bridge: empty denom")
|
|
||||||
}
|
|
||||||
if d.Amount == "" {
|
|
||||||
return fmt.Errorf("bridge: empty amount")
|
|
||||||
}
|
|
||||||
if d.Sender == "" {
|
|
||||||
return fmt.Errorf("bridge: empty sender")
|
|
||||||
}
|
|
||||||
if d.Receiver == "" {
|
|
||||||
return fmt.Errorf("bridge: empty receiver")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// parseICS20 parses the ICS-20 v1 packet data from raw bytes (JSON).
|
|
||||||
func parseICS20(data []byte) (ICS20PacketData, error) {
|
|
||||||
var d ICS20PacketData
|
|
||||||
if err := json.Unmarshal(data, &d); err != nil {
|
|
||||||
return ICS20PacketData{}, fmt.Errorf("bridge: cannot unmarshal ICS-20 packet data: %w", err)
|
|
||||||
}
|
|
||||||
return d, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ValidateDenomTrace validates the ICS-20 v1 denom trace shape
|
|
||||||
// `transfer/channel-N/<denom>` (the v0.2 WrappedBreadDenom shape). The denom
|
|
||||||
// trace is the prefix chain; the base denom is the trailing segment. A
|
|
||||||
// valid trace has at least one `transfer/channel-N/` hop.
|
|
||||||
func ValidateDenomTrace(denom string) error {
|
|
||||||
if denom == "" {
|
|
||||||
return fmt.Errorf("bridge: empty denom trace")
|
|
||||||
}
|
|
||||||
// The ICS-20 v1 denom trace is a `/`-separated path of hop prefixes
|
|
||||||
// `transfer/channel-N` followed by the base denom. A wrapped denom
|
|
||||||
// arriving on the receiving chain has at least one hop prefix.
|
|
||||||
if !strings.Contains(denom, "transfer/channel-") {
|
|
||||||
return fmt.Errorf("bridge: denom %q missing transfer/channel-N/ hop prefix", denom)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ParseDenomTrace parses the ICS-20 v1 denom trace into the hop prefix
|
|
||||||
// (e.g. `transfer/channel-0`) and the base denom. Returns the prefix and
|
|
||||||
// base denom. A denom with no hop prefix is the base denom (prefix="").
|
|
||||||
func ParseDenomTrace(denom string) (prefix, base string) {
|
|
||||||
if denom == "" {
|
|
||||||
return "", ""
|
|
||||||
}
|
|
||||||
// The trace shape is `transfer/channel-N/.../base`. Find the last `/`
|
|
||||||
// and split there; everything before is the prefix, after is the base.
|
|
||||||
idx := strings.LastIndex(denom, "/")
|
|
||||||
if idx < 0 {
|
|
||||||
return "", denom
|
|
||||||
}
|
|
||||||
return denom[:idx], denom[idx+1:]
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Channel handshake (no-ops for simtest — D-054) --------------------------
|
|
||||||
|
|
||||||
// OnChanOpenInit implements porttypes.IBCModule (no-op for simtest).
|
|
||||||
func (IBCModule) OnChanOpenInit(
|
|
||||||
ctx sdk.Context,
|
|
||||||
order channeltypes.Order,
|
|
||||||
connectionHops []string,
|
|
||||||
portID string,
|
|
||||||
channelID string,
|
|
||||||
channelCap *capabilitytypes.Capability,
|
|
||||||
counterparty channeltypes.Counterparty,
|
|
||||||
version string,
|
|
||||||
) (string, error) {
|
|
||||||
return version, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// OnChanOpenTry implements porttypes.IBCModule (no-op for simtest).
|
|
||||||
func (IBCModule) OnChanOpenTry(
|
|
||||||
ctx sdk.Context,
|
|
||||||
order channeltypes.Order,
|
|
||||||
connectionHops []string,
|
|
||||||
portID,
|
|
||||||
channelID string,
|
|
||||||
channelCap *capabilitytypes.Capability,
|
|
||||||
counterparty channeltypes.Counterparty,
|
|
||||||
counterpartyVersion string,
|
|
||||||
) (string, error) {
|
|
||||||
return counterpartyVersion, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// OnChanOpenAck implements porttypes.IBCModule (no-op for simtest).
|
|
||||||
func (IBCModule) OnChanOpenAck(
|
|
||||||
ctx sdk.Context,
|
|
||||||
portID,
|
|
||||||
channelID string,
|
|
||||||
counterpartyChannelID string,
|
|
||||||
counterpartyVersion string,
|
|
||||||
) error {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// OnChanOpenConfirm implements porttypes.IBCModule (no-op for simtest).
|
|
||||||
func (IBCModule) OnChanOpenConfirm(
|
|
||||||
ctx sdk.Context,
|
|
||||||
portID,
|
|
||||||
channelID string,
|
|
||||||
) error {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// OnChanCloseInit implements porttypes.IBCModule (no-op for simtest).
|
|
||||||
func (IBCModule) OnChanCloseInit(
|
|
||||||
ctx sdk.Context,
|
|
||||||
portID,
|
|
||||||
channelID string,
|
|
||||||
) error {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// OnChanCloseConfirm implements porttypes.IBCModule (no-op for simtest).
|
|
||||||
func (IBCModule) OnChanCloseConfirm(
|
|
||||||
ctx sdk.Context,
|
|
||||||
portID,
|
|
||||||
channelID string,
|
|
||||||
) error {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Packet handlers (load-bearing — REQ-033, A-513, G-021) ------------------
|
|
||||||
|
|
||||||
// OnRecvPacket implements porttypes.IBCModule. Parses the ICS-20 v1 payload,
|
|
||||||
// validates the denom trace, mints wrapped Bread via the BreadKeeper shim,
|
|
||||||
// and writes the in-flight record (replay protection — A-513). The Solana
|
|
||||||
// branch verifies the wormhole guardian sig set (2-of-N) from state before
|
|
||||||
// minting.
|
|
||||||
func (im IBCModule) OnRecvPacket(
|
|
||||||
ctx sdk.Context,
|
|
||||||
packet channeltypes.Packet,
|
|
||||||
relayer sdk.AccAddress,
|
|
||||||
) ibcexported.Acknowledgement {
|
|
||||||
// Parse ICS-20 v1 payload.
|
|
||||||
data, err := parseICS20(packet.GetData())
|
|
||||||
if err != nil {
|
|
||||||
return channeltypes.NewErrorAcknowledgement(err)
|
|
||||||
}
|
|
||||||
if err := data.ValidateBasic(); err != nil {
|
|
||||||
return channeltypes.NewErrorAcknowledgement(err)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Validate the denom trace (ICS-20 v1 `transfer/channel-N/<denom>`).
|
|
||||||
if err := ValidateDenomTrace(data.Denom); err != nil {
|
|
||||||
return channeltypes.NewErrorAcknowledgement(err)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Determine the L2 chain from the source channel (simtest passes the
|
|
||||||
// L2 chain via the packet source-port; the real wiring uses the
|
|
||||||
// channel→route lookup). For the simtest, the source-port encodes the
|
|
||||||
// L2 chain name (e.g. "transfer.Polygon").
|
|
||||||
l2Chain := chainFromPort(packet.SourcePort)
|
|
||||||
|
|
||||||
// Solana branch: verify the wormhole guardian sig set (2-of-N) from
|
|
||||||
// state before minting. The sig set is read from state (not hardcoded —
|
|
||||||
// D-054 uses a frozen stub set in simtest).
|
|
||||||
if l2Chain == "Solana" {
|
|
||||||
gs, ok := im.keeper.GetGuardianSet(ctx)
|
|
||||||
if !ok {
|
|
||||||
return channeltypes.NewErrorAcknowledgement(fmt.Errorf("bridge: solana guardian set not configured"))
|
|
||||||
}
|
|
||||||
// The guardian sig verification: the simtest stubs this via the
|
|
||||||
// WatcherKeeper shim (IsQuorumSigned on the guardian-set quorum
|
|
||||||
// id). A real wormhole adapter verifies the VAA signatures; the
|
|
||||||
// simtest uses the same IsQuorumSigned interface.
|
|
||||||
if im.keeper.watcherKeeper == nil {
|
|
||||||
return channeltypes.NewErrorAcknowledgement(fmt.Errorf("bridge: watcher keeper shim not wired"))
|
|
||||||
}
|
|
||||||
// The guardian-set threshold (2-of-N) is the quorum; the payload
|
|
||||||
// is the packet data hash (simtest stubs the payload).
|
|
||||||
if !im.keeper.watcherKeeper.IsQuorumSigned("solana-guardians", packet.GetData()) {
|
|
||||||
return channeltypes.NewErrorAcknowledgement(fmt.Errorf("bridge: solana guardian sig set did not reach 2-of-N quorum"))
|
|
||||||
}
|
|
||||||
_ = gs // guardian set read from state (D-054 — frozen stub in simtest)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Mint wrapped Bread via the BreadKeeper shim.
|
|
||||||
if im.keeper.breadKeeper == nil {
|
|
||||||
return channeltypes.NewErrorAcknowledgement(fmt.Errorf("bridge: bread keeper shim not wired"))
|
|
||||||
}
|
|
||||||
// Parse the amount string to int64 grains.
|
|
||||||
var amount int64
|
|
||||||
if _, err := fmt.Sscanf(data.Amount, "%d", &amount); err != nil {
|
|
||||||
return channeltypes.NewErrorAcknowledgement(fmt.Errorf("bridge: cannot parse amount %q: %w", data.Amount, err))
|
|
||||||
}
|
|
||||||
if amount <= 0 {
|
|
||||||
return channeltypes.NewErrorAcknowledgement(fmt.Errorf("bridge: amount must be > 0"))
|
|
||||||
}
|
|
||||||
if err := im.keeper.breadKeeper.MintWrappedBread(ctx, data.Denom, amount, data.Receiver); err != nil {
|
|
||||||
return channeltypes.NewErrorAcknowledgement(fmt.Errorf("bridge: mint wrapped bread: %w", err))
|
|
||||||
}
|
|
||||||
|
|
||||||
// Write the in-flight record (replay protection — A-513).
|
|
||||||
im.keeper.SetInflight(ctx, InflightPacket{
|
|
||||||
SourcePort: packet.SourcePort,
|
|
||||||
SourceChannel: packet.SourceChannel,
|
|
||||||
Sequence: packet.Sequence,
|
|
||||||
Denom: data.Denom,
|
|
||||||
Amount: amount,
|
|
||||||
Sender: data.Sender,
|
|
||||||
Receiver: data.Receiver,
|
|
||||||
L2Chain: l2Chain,
|
|
||||||
Refunded: false,
|
|
||||||
})
|
|
||||||
|
|
||||||
// Emit event.
|
|
||||||
ctx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bridge.recv_packet",
|
|
||||||
sdk.NewAttribute("source_port", packet.SourcePort),
|
|
||||||
sdk.NewAttribute("source_channel", packet.SourceChannel),
|
|
||||||
sdk.NewAttribute("sequence", fmt.Sprintf("%d", packet.Sequence)),
|
|
||||||
sdk.NewAttribute("denom", data.Denom),
|
|
||||||
sdk.NewAttribute("amount", data.Amount),
|
|
||||||
sdk.NewAttribute("l2_chain", l2Chain),
|
|
||||||
))
|
|
||||||
|
|
||||||
return channeltypes.NewResultAcknowledgement([]byte{byte(1)})
|
|
||||||
}
|
|
||||||
|
|
||||||
// OnAcknowledgementPacket implements porttypes.IBCModule. Deletes the
|
|
||||||
// in-flight record on the first ack (replay protection mirroring ibc-go).
|
|
||||||
// A second ack finds no record and returns ERROR (G-021 — the CVE-class
|
|
||||||
// ibc-go pitfall A-513 is closed by failing loudly on the replay, NOT a
|
|
||||||
// silent no-op).
|
|
||||||
func (im IBCModule) OnAcknowledgementPacket(
|
|
||||||
ctx sdk.Context,
|
|
||||||
packet channeltypes.Packet,
|
|
||||||
acknowledgement []byte,
|
|
||||||
relayer sdk.AccAddress,
|
|
||||||
) error {
|
|
||||||
// Load the in-flight record. Absence = replay (G-021).
|
|
||||||
_, ok := im.keeper.GetInflight(ctx, packet.SourcePort, packet.SourceChannel, packet.Sequence)
|
|
||||||
if !ok {
|
|
||||||
// G-021: the second OnAcknowledgementPacket returns ERROR (not a
|
|
||||||
// silent no-op). This is the replay-protection firewall.
|
|
||||||
return fmt.Errorf("bridge: replay detected — no in-flight record for %s/%s/%d (already acknowledged)",
|
|
||||||
packet.SourcePort, packet.SourceChannel, packet.Sequence)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Delete the in-flight record (first ack — the deletion is the replay
|
|
||||||
// signal for a future second ack).
|
|
||||||
im.keeper.DeleteInflight(ctx, packet.SourcePort, packet.SourceChannel, packet.Sequence)
|
|
||||||
|
|
||||||
ctx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bridge.ack_packet",
|
|
||||||
sdk.NewAttribute("source_port", packet.SourcePort),
|
|
||||||
sdk.NewAttribute("source_channel", packet.SourceChannel),
|
|
||||||
sdk.NewAttribute("sequence", fmt.Sprintf("%d", packet.Sequence)),
|
|
||||||
))
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// OnTimeoutPacket implements porttypes.IBCModule. Refunds the source-chain
|
|
||||||
// escrow via the BreadKeeper shim exactly once (the `Refunded` flag on the
|
|
||||||
// in-flight record guards a second refund). A second timeout is a no-op.
|
|
||||||
func (im IBCModule) OnTimeoutPacket(
|
|
||||||
ctx sdk.Context,
|
|
||||||
packet channeltypes.Packet,
|
|
||||||
relayer sdk.AccAddress,
|
|
||||||
) error {
|
|
||||||
// Load the in-flight record.
|
|
||||||
p, ok := im.keeper.GetInflight(ctx, packet.SourcePort, packet.SourceChannel, packet.Sequence)
|
|
||||||
if !ok {
|
|
||||||
// No in-flight record: nothing to refund (either never sent, or
|
|
||||||
// already acked-and-deleted). No-op — a timeout on an already-acked
|
|
||||||
// packet is benign (the ack path already finalized).
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
if p.Refunded {
|
|
||||||
// Already refunded: exactly-once guard. No-op (not an error — the
|
|
||||||
// refund already happened; a duplicate timeout is benign).
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Refund the source-chain escrow via the BreadKeeper shim.
|
|
||||||
if im.keeper.breadKeeper != nil {
|
|
||||||
if err := im.keeper.breadKeeper.ReleaseWrappedBread(ctx, p.Denom, p.Amount, p.Sender); err != nil {
|
|
||||||
return fmt.Errorf("bridge: timeout refund: %w", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Flip the refunded flag (state write FIRST — A-521 idempotency).
|
|
||||||
p.Refunded = true
|
|
||||||
im.keeper.SetInflight(ctx, p)
|
|
||||||
|
|
||||||
ctx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bridge.timeout_packet",
|
|
||||||
sdk.NewAttribute("source_port", packet.SourcePort),
|
|
||||||
sdk.NewAttribute("source_channel", packet.SourceChannel),
|
|
||||||
sdk.NewAttribute("sequence", fmt.Sprintf("%d", packet.Sequence)),
|
|
||||||
sdk.NewAttribute("denom", p.Denom),
|
|
||||||
sdk.NewAttribute("amount", fmt.Sprintf("%d", p.Amount)),
|
|
||||||
))
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// chainFromPort extracts the L2 chain name from the source port. The simtest
|
|
||||||
// encodes the L2 chain in the source port (e.g. "transfer.Polygon"). Returns
|
|
||||||
// the chain name, or "" if not encoded.
|
|
||||||
func chainFromPort(sourcePort string) string {
|
|
||||||
// The simtest convention: source port = "transfer.<L2Chain>". A real
|
|
||||||
// wiring uses the channel→route lookup; the simtest uses the port
|
|
||||||
// encoding for simplicity (D-054).
|
|
||||||
if idx := strings.Index(sourcePort, "."); idx >= 0 {
|
|
||||||
return sourcePort[idx+1:]
|
|
||||||
}
|
|
||||||
return ""
|
|
||||||
}
|
|
||||||
|
|
||||||
// Ensure the context import is used (the IBCModule handlers use sdk.Context
|
|
||||||
// directly; this no-op reference keeps the import stable if handlers are
|
|
||||||
// later refactored to use context.Context).
|
|
||||||
var _ = context.Background
|
|
||||||
@@ -1,225 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bridge/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// keeper.go holds the store-backed Keeper for the bridge module (P1-03-01).
|
|
||||||
//
|
|
||||||
// The Keeper wraps an sdk.KVStore via a storeKey. It replaces the v0.3
|
|
||||||
// in-memory stub (the stub may stay as a test helper). The Keeper holds the
|
|
||||||
// BridgeRoute records (by bridge-id) and the IBC in-flight packet records
|
|
||||||
// (by source-port/source-channel/sequence) used for replay protection (A-513).
|
|
||||||
//
|
|
||||||
// The Keeper also holds the expected-keeper shims (WatcherKeeper for the
|
|
||||||
// Attested transition + Solana guardian sig set; BreadKeeper for mint/release
|
|
||||||
// wrapped Bread on recv/timeout). The shims are interfaces (G-003 — no
|
|
||||||
// struct imports of x/watcher/types or x/bread/types); the concrete keepers
|
|
||||||
// satisfy them structurally.
|
|
||||||
//
|
|
||||||
// State-machine ordering (vision §7, enforced in every handler):
|
|
||||||
// ValidateBasic → keeper authz → state mutation → ctx.EventManager().EmitEvent
|
|
||||||
|
|
||||||
// Keeper is the store-backed bridge keeper.
|
|
||||||
type Keeper struct {
|
|
||||||
cdc codec.Codec
|
|
||||||
storeKey storetypes.StoreKey
|
|
||||||
|
|
||||||
watcherKeeper types.WatcherKeeper
|
|
||||||
breadKeeper types.BreadKeeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewKeeper constructs a new store-backed bridge Keeper. The expected-keeper
|
|
||||||
// shims are injected (nil-able for partial tests; the handler guards nil
|
|
||||||
// shims where appropriate).
|
|
||||||
func NewKeeper(cdc codec.Codec, storeKey storetypes.StoreKey, wk types.WatcherKeeper, bk types.BreadKeeper) Keeper {
|
|
||||||
return Keeper{
|
|
||||||
cdc: cdc,
|
|
||||||
storeKey: storeKey,
|
|
||||||
watcherKeeper: wk,
|
|
||||||
breadKeeper: bk,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetWatcherKeeper sets the WatcherKeeper expected-keeper shim (for
|
|
||||||
// post-construction wiring, e.g., app wiring or test setup).
|
|
||||||
func (k *Keeper) SetWatcherKeeper(wk types.WatcherKeeper) { k.watcherKeeper = wk }
|
|
||||||
|
|
||||||
// SetBreadKeeper sets the BreadKeeper expected-keeper shim.
|
|
||||||
func (k *Keeper) SetBreadKeeper(bk types.BreadKeeper) { k.breadKeeper = bk }
|
|
||||||
|
|
||||||
// --- BridgeRoute store --------------------------------------------------------
|
|
||||||
|
|
||||||
// routeKey is the store key prefix for a BridgeRoute record (by bridge-id).
|
|
||||||
var routeKeyPrefix = []byte("route/")
|
|
||||||
|
|
||||||
func routeKey(bridgeID string) []byte {
|
|
||||||
return append(routeKeyPrefix, []byte(bridgeID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetBridgeRoute loads a BridgeRoute by bridge-id. Returns the route and
|
|
||||||
// true if found, or zero value + false if not. This is the store-backed
|
|
||||||
// implementation that satisfies x/exit/types.BridgeKeeper (GetBridgeRoute
|
|
||||||
// returns status + bridgeType; the status is the BridgeStatus string).
|
|
||||||
func (k Keeper) GetBridgeRoute(ctx sdk.Context, bridgeID string) (types.BridgeRoute, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(routeKey(bridgeID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.BridgeRoute{}, false
|
|
||||||
}
|
|
||||||
var r types.BridgeRoute
|
|
||||||
if err := json.Unmarshal(bz, &r); err != nil {
|
|
||||||
return types.BridgeRoute{}, false
|
|
||||||
}
|
|
||||||
return r, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetBridgeRoute persists a BridgeRoute by bridge-id.
|
|
||||||
func (k Keeper) SetBridgeRoute(ctx sdk.Context, r types.BridgeRoute) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(r)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("bridge: marshal route %q: %v", r.BridgeID, err))
|
|
||||||
}
|
|
||||||
store.Set(routeKey(r.BridgeID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllBridgeRoutes returns all persisted BridgeRoute records (iteration
|
|
||||||
// helper for tests/queries).
|
|
||||||
func (k Keeper) AllBridgeRoutes(ctx sdk.Context) []types.BridgeRoute {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(routeKeyPrefix, prefixEnd(routeKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.BridgeRoute{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var r types.BridgeRoute
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &r); err == nil {
|
|
||||||
out = append(out, r)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// prefixEnd returns the key that sorts immediately after all keys sharing the
|
|
||||||
// given prefix (the standard prefix-iteration end key).
|
|
||||||
func prefixEnd(prefix []byte) []byte {
|
|
||||||
if len(prefix) == 0 {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
end := make([]byte, len(prefix))
|
|
||||||
copy(end, prefix)
|
|
||||||
for i := len(end) - 1; i >= 0; i-- {
|
|
||||||
end[i]++
|
|
||||||
if end[i] != 0 {
|
|
||||||
return end
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- IBC in-flight packet store (replay protection — A-513) -------------------
|
|
||||||
//
|
|
||||||
// The in-flight record tracks a packet that has been received but not yet
|
|
||||||
// acknowledged. OnRecvPacket writes the record; OnAcknowledgementPacket
|
|
||||||
// deletes it (first ack). A second OnAcknowledgementPacket finds no record
|
|
||||||
// and returns ERROR (G-021 — replay protection, not a silent no-op). This
|
|
||||||
// mirrors ibc-go's delete-on-ack pattern.
|
|
||||||
|
|
||||||
var inflightPrefix = []byte("inflight/")
|
|
||||||
|
|
||||||
func inflightKey(sourcePort, sourceChannel string, sequence uint64) []byte {
|
|
||||||
return append(inflightPrefix, []byte(fmt.Sprintf("%s/%s/%d", sourcePort, sourceChannel, sequence))...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// InflightPacket is the in-flight packet record (replay protection — A-513).
|
|
||||||
type InflightPacket struct {
|
|
||||||
SourcePort string `json:"source_port" yaml:"source_port"`
|
|
||||||
SourceChannel string `json:"source_channel" yaml:"source_channel"`
|
|
||||||
Sequence uint64 `json:"sequence" yaml:"sequence"`
|
|
||||||
Denom string `json:"denom" yaml:"denom"`
|
|
||||||
Amount int64 `json:"amount" yaml:"amount"`
|
|
||||||
Sender string `json:"sender" yaml:"sender"` // source-chain sender reach-id
|
|
||||||
Receiver string `json:"receiver" yaml:"receiver"` // dest-chain receiver reach-id
|
|
||||||
L2Chain string `json:"l2_chain" yaml:"l2_chain"` // the L2 chain (EVM or Solana)
|
|
||||||
Refunded bool `json:"refunded" yaml:"refunded"` // timeout-refund exactly-once guard
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetInflight writes the in-flight packet record (OnRecvPacket).
|
|
||||||
func (k Keeper) SetInflight(ctx sdk.Context, p InflightPacket) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(p)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("bridge: marshal inflight %s/%s/%d: %v", p.SourcePort, p.SourceChannel, p.Sequence, err))
|
|
||||||
}
|
|
||||||
store.Set(inflightKey(p.SourcePort, p.SourceChannel, p.Sequence), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetInflight loads the in-flight packet record. Returns the record and
|
|
||||||
// true if found, or zero value + false if not. The absence of a record on
|
|
||||||
// OnAcknowledgementPacket is the replay signal (G-021).
|
|
||||||
func (k Keeper) GetInflight(ctx sdk.Context, sourcePort, sourceChannel string, sequence uint64) (InflightPacket, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(inflightKey(sourcePort, sourceChannel, sequence))
|
|
||||||
if bz == nil {
|
|
||||||
return InflightPacket{}, false
|
|
||||||
}
|
|
||||||
var p InflightPacket
|
|
||||||
if err := json.Unmarshal(bz, &p); err != nil {
|
|
||||||
return InflightPacket{}, false
|
|
||||||
}
|
|
||||||
return p, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// DeleteInflight deletes the in-flight packet record (OnAcknowledgementPacket
|
|
||||||
// — first ack; the deletion is the replay-protection signal).
|
|
||||||
func (k Keeper) DeleteInflight(ctx sdk.Context, sourcePort, sourceChannel string, sequence uint64) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
store.Delete(inflightKey(sourcePort, sourceChannel, sequence))
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Solana guardian sig set (wormhole-adapter — D-059) -----------------------
|
|
||||||
//
|
|
||||||
// The Solana branch verifies a wormhole guardian sig set (a 2-of-N quorum,
|
|
||||||
// N = the wormhole guardian set). The set is read from state (not
|
|
||||||
// hardcoded — D-054 uses a frozen stub set in simtest; live rotation is
|
|
||||||
// deferred). The set is stored as a JSON array of guardian reach-ids.
|
|
||||||
|
|
||||||
var guardianSetKey = []byte("solana/guardian-set")
|
|
||||||
|
|
||||||
// GuardianSet is the wormhole guardian sig set for the Solana branch.
|
|
||||||
type GuardianSet struct {
|
|
||||||
Guardians []string `json:"guardians" yaml:"guardians"` // guardian reach-ids
|
|
||||||
Threshold int `json:"threshold" yaml:"threshold"` // 2-of-N quorum
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetGuardianSet loads the current Solana guardian sig set from state.
|
|
||||||
func (k Keeper) GetGuardianSet(ctx sdk.Context) (GuardianSet, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(guardianSetKey)
|
|
||||||
if bz == nil {
|
|
||||||
return GuardianSet{}, false
|
|
||||||
}
|
|
||||||
var gs GuardianSet
|
|
||||||
if err := json.Unmarshal(bz, &gs); err != nil {
|
|
||||||
return GuardianSet{}, false
|
|
||||||
}
|
|
||||||
return gs, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetGuardianSet persists the Solana guardian sig set (simtest uses a frozen
|
|
||||||
// stub set; live rotation deferred per D-054).
|
|
||||||
func (k Keeper) SetGuardianSet(ctx sdk.Context, gs GuardianSet) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(gs)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("bridge: marshal guardian set: %v", err))
|
|
||||||
}
|
|
||||||
store.Set(guardianSetKey, bz)
|
|
||||||
}
|
|
||||||
@@ -1,164 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bridge/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// msg_server.go implements the bridge module's MsgServer (G-023 ownership
|
|
||||||
// split: cosmos-engineer scaffolds the file structure; backend-engineer
|
|
||||||
// implements the handler logic bodies). The MsgServer wraps the Keeper +
|
|
||||||
// the expected-keeper shims (already on the Keeper).
|
|
||||||
//
|
|
||||||
// Each method returns a (*Response, error). Handler state-machine ordering
|
|
||||||
// is enforced: ValidateBasic → keeper authz → state mutation →
|
|
||||||
// ctx.EventManager().EmitEvent.
|
|
||||||
|
|
||||||
// msgServer is the concrete MsgServer implementation wrapping the Keeper.
|
|
||||||
type msgServer struct {
|
|
||||||
Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewMsgServerImpl returns the bridge MsgServer for the provided Keeper.
|
|
||||||
func NewMsgServerImpl(k Keeper) types.MsgServer {
|
|
||||||
return &msgServer{Keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
var _ types.MsgServer = msgServer{}
|
|
||||||
|
|
||||||
// unwrapCtx extracts the sdk.Context from the interface-typed ctx (the
|
|
||||||
// MsgServer interface takes interface{} to avoid coupling types/ to
|
|
||||||
// sdk.Context; the keeper layer unwraps it).
|
|
||||||
func unwrapCtx(ctx interface{}) sdk.Context {
|
|
||||||
if c, ok := ctx.(sdk.Context); ok {
|
|
||||||
return c
|
|
||||||
}
|
|
||||||
panic(fmt.Sprintf("bridge: expected sdk.Context, got %T", ctx))
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- AttestBridgeRoute (Pending → Attested) -----------------------------------
|
|
||||||
//
|
|
||||||
// A Watcher 6-of-9 quorum (vision §7, REQ-004) must attest the route. The
|
|
||||||
// handler consults the WatcherKeeper expected-keeper shim (by-ID-string on
|
|
||||||
// the watcher-quorum-id). State-machine ordering:
|
|
||||||
// ValidateBasic → load route (authz: must be Pending) → WatcherKeeper
|
|
||||||
// quorum check → state mutation (status=Attested, set watcher-quorum-id)
|
|
||||||
// → emit event.
|
|
||||||
|
|
||||||
// AttestBridgeRoute transitions a bridge route Pending → Attested.
|
|
||||||
func (s msgServer) AttestBridgeRoute(ctx interface{}, msg *types.MsgAttestBridgeRoute) (*types.MsgAttestBridgeRouteResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Stateful: load route; must exist and be Pending.
|
|
||||||
r, ok := s.Keeper.GetBridgeRoute(sdkCtx, msg.BridgeID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bridge: route %q not found", msg.BridgeID)
|
|
||||||
}
|
|
||||||
if r.Status != types.BridgePending {
|
|
||||||
return nil, fmt.Errorf("bridge: route %q status %q, must be Pending to attest", msg.BridgeID, r.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Keeper authz: Watcher quorum check via expected-keeper shim.
|
|
||||||
if s.Keeper.watcherKeeper == nil {
|
|
||||||
return nil, fmt.Errorf("bridge: watcher keeper shim not wired")
|
|
||||||
}
|
|
||||||
// The payload is the bridge-id (the route attestation payload); a real
|
|
||||||
// watcher quorum signs a canonical payload. For simtest the shim
|
|
||||||
// returns true/false on the quorum-id.
|
|
||||||
if !s.Keeper.watcherKeeper.IsQuorumSigned(msg.WatcherQuorumID, []byte(msg.BridgeID)) {
|
|
||||||
return nil, fmt.Errorf("bridge: watcher quorum %q did not reach threshold on route %q", msg.WatcherQuorumID, msg.BridgeID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// State mutation: status=Attested, record the watcher-quorum-id.
|
|
||||||
r.Status = types.BridgeAttested
|
|
||||||
r.WatcherQuorumID = msg.WatcherQuorumID
|
|
||||||
s.Keeper.SetBridgeRoute(sdkCtx, r)
|
|
||||||
|
|
||||||
// Emit event.
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bridge.attest",
|
|
||||||
sdk.NewAttribute("bridge_id", msg.BridgeID),
|
|
||||||
sdk.NewAttribute("watcher_quorum_id", msg.WatcherQuorumID),
|
|
||||||
sdk.NewAttribute("status", string(types.BridgeAttested)),
|
|
||||||
))
|
|
||||||
return &types.MsgAttestBridgeRouteResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- ActivateBridge (Attested → Active) --------------------------------------
|
|
||||||
//
|
|
||||||
// The route must already be Attested. State-machine ordering:
|
|
||||||
// ValidateBasic → load route (authz: must be Attested) → state mutation
|
|
||||||
// (status=Active) → emit event.
|
|
||||||
|
|
||||||
// ActivateBridge transitions a bridge route Attested → Active.
|
|
||||||
func (s msgServer) ActivateBridge(ctx interface{}, msg *types.MsgActivateBridge) (*types.MsgActivateBridgeResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
r, ok := s.Keeper.GetBridgeRoute(sdkCtx, msg.BridgeID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bridge: route %q not found", msg.BridgeID)
|
|
||||||
}
|
|
||||||
if r.Status != types.BridgeAttested {
|
|
||||||
return nil, fmt.Errorf("bridge: route %q status %q, must be Attested to activate", msg.BridgeID, r.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
r.Status = types.BridgeActive
|
|
||||||
s.Keeper.SetBridgeRoute(sdkCtx, r)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bridge.activate",
|
|
||||||
sdk.NewAttribute("bridge_id", msg.BridgeID),
|
|
||||||
sdk.NewAttribute("status", string(types.BridgeActive)),
|
|
||||||
))
|
|
||||||
return &types.MsgActivateBridgeResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- CloseBridge (Active → Closed) -------------------------------------------
|
|
||||||
//
|
|
||||||
// Retire the route. State-machine ordering:
|
|
||||||
// ValidateBasic → load route (authz: must be Active) → state mutation
|
|
||||||
// (status=Closed) → emit event.
|
|
||||||
|
|
||||||
// CloseBridge transitions a bridge route Active → Closed.
|
|
||||||
func (s msgServer) CloseBridge(ctx interface{}, msg *types.MsgCloseBridge) (*types.MsgCloseBridgeResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
r, ok := s.Keeper.GetBridgeRoute(sdkCtx, msg.BridgeID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("bridge: route %q not found", msg.BridgeID)
|
|
||||||
}
|
|
||||||
if r.Status != types.BridgeActive {
|
|
||||||
return nil, fmt.Errorf("bridge: route %q status %q, must be Active to close", msg.BridgeID, r.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
r.Status = types.BridgeClosed
|
|
||||||
s.Keeper.SetBridgeRoute(sdkCtx, r)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"bridge.close",
|
|
||||||
sdk.NewAttribute("bridge_id", msg.BridgeID),
|
|
||||||
sdk.NewAttribute("status", string(types.BridgeClosed)),
|
|
||||||
))
|
|
||||||
return &types.MsgCloseBridgeResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertion: msgServer implements types.MsgServer.
|
|
||||||
var _ types.MsgServer = (*msgServer)(nil)
|
|
||||||
|
|
||||||
// Ensure the context import is used (unwrapCtx uses context indirectly via
|
|
||||||
// sdk.Context; this no-op reference keeps the import stable if handlers are
|
|
||||||
// later refactored to use context.Context directly).
|
|
||||||
var _ = context.Background
|
|
||||||
@@ -1,676 +0,0 @@
|
|||||||
package keeper_test
|
|
||||||
|
|
||||||
// msg_server_simtest_test.go is the x/bridge keeper simtest (P1-06-01).
|
|
||||||
//
|
|
||||||
// D-054: simtest-grade — in-memory sdk.Context + dbm in-memory store, no
|
|
||||||
// real IBC light clients. The simtest wires the expected-keeper shims
|
|
||||||
// (WatcherKeeper + BreadKeeper) to in-test stubs (G-003 test exemption:
|
|
||||||
// the test imports x/bridge/keeper + defines stub keepers that satisfy the
|
|
||||||
// interfaces; no production struct imports across x/<module>/types).
|
|
||||||
//
|
|
||||||
// Coverage (A-513, G-021):
|
|
||||||
// - OnRecvPacket: mints wrapped Bread (assert BreadKeeper.MintWrappedBread
|
|
||||||
// called); ICS-20 v1 denom trace parse; Solana guardian sig set (2-of-N
|
|
||||||
// stub).
|
|
||||||
// - OnAcknowledgementPacket: deletes the in-flight record (first ack) and
|
|
||||||
// rejects the second (REPLAY PROTECTION — G-021, A-513 CVE-class pitfall).
|
|
||||||
// - OnTimeoutPacket: refunds the escrow exactly once (second timeout is a
|
|
||||||
// no-op — the Refunded flag guards).
|
|
||||||
// - BridgeStatus lifecycle: Pending → Attested (MsgAttestBridgeRoute) →
|
|
||||||
// Active (MsgActivateBridge) → Closed (MsgCloseBridge).
|
|
||||||
// - Solana stub guardian sig set (2-of-N).
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"cosmossdk.io/log"
|
|
||||||
"cosmossdk.io/store"
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
cmtproto "github.com/cometbft/cometbft/proto/tendermint/types"
|
|
||||||
dbm "github.com/cosmos/cosmos-db"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
codectypes "github.com/cosmos/cosmos-sdk/codec/types"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
channeltypes "github.com/cosmos/ibc-go/v8/modules/core/04-channel/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bridge/keeper"
|
|
||||||
bridgetypes "github.com/oy/openyield/x/bridge/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// --- Stub expected-keepers (G-003 test exemption) ----------------------------
|
|
||||||
|
|
||||||
// stubWatcherKeeper satisfies bridgetypes.WatcherKeeper for the simtest. The
|
|
||||||
// IsQuorumSigned returns true for the configured quorum-id (the simtest
|
|
||||||
// stubs the Watcher 6-of-9 quorum + the Solana guardian 2-of-N quorum).
|
|
||||||
type stubWatcherKeeper struct {
|
|
||||||
// signedQuorums maps quorum-id → true if the quorum reached threshold.
|
|
||||||
signedQuorums map[string]bool
|
|
||||||
// solanaCalls tracks IsQuorumSigned invocations for the Solana branch.
|
|
||||||
solanaCalls int
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *stubWatcherKeeper) IsQuorumSigned(quorumID string, payload []byte) bool {
|
|
||||||
if quorumID == "solana-guardians" {
|
|
||||||
s.solanaCalls++
|
|
||||||
}
|
|
||||||
return s.signedQuorums[quorumID]
|
|
||||||
}
|
|
||||||
|
|
||||||
// stubBreadKeeper satisfies bridgetypes.BreadKeeper for the simtest. It
|
|
||||||
// records mint/release calls for assertion.
|
|
||||||
type stubBreadKeeper struct {
|
|
||||||
mints []mintCall
|
|
||||||
releases []releaseCall
|
|
||||||
}
|
|
||||||
|
|
||||||
type mintCall struct {
|
|
||||||
denom string
|
|
||||||
amount int64
|
|
||||||
reachID string
|
|
||||||
}
|
|
||||||
|
|
||||||
type releaseCall struct {
|
|
||||||
denom string
|
|
||||||
amount int64
|
|
||||||
reachID string
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *stubBreadKeeper) MintWrappedBread(ctx interface{}, denom string, amount int64, holderReach string) error {
|
|
||||||
s.mints = append(s.mints, mintCall{denom, amount, holderReach})
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *stubBreadKeeper) ReleaseWrappedBread(ctx interface{}, denom string, amount int64, holderReach string) error {
|
|
||||||
s.releases = append(s.releases, releaseCall{denom, amount, holderReach})
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Simtest context helper --------------------------------------------------
|
|
||||||
|
|
||||||
// newSimtestContext constructs an in-memory sdk.Context with a KVStore mounted
|
|
||||||
// at the bridge store key. D-054: in-memory, no real IBC light clients.
|
|
||||||
func newSimtestContext(t *testing.T) (sdk.Context, *stubWatcherKeeper, *stubBreadKeeper, keeper.Keeper) {
|
|
||||||
t.Helper()
|
|
||||||
db := dbm.NewMemDB()
|
|
||||||
cdc := newTestCodec()
|
|
||||||
storeKey := storetypes.NewKVStoreKey(bridgetypes.StoreKey)
|
|
||||||
cms := store.NewCommitMultiStore(db, log.NewNopLogger(), nil)
|
|
||||||
cms.MountStoreWithDB(storeKey, storetypes.StoreTypeDB, nil)
|
|
||||||
if err := cms.LoadLatestVersion(); err != nil {
|
|
||||||
t.Fatalf("load latest version: %v", err)
|
|
||||||
}
|
|
||||||
ctx := sdk.NewContext(cms, cmtproto.Header{}, false, log.NewNopLogger())
|
|
||||||
|
|
||||||
wk := &stubWatcherKeeper{signedQuorums: map[string]bool{}}
|
|
||||||
bk := &stubBreadKeeper{}
|
|
||||||
k := keeper.NewKeeper(cdc, storeKey, wk, bk)
|
|
||||||
return ctx, wk, bk, k
|
|
||||||
}
|
|
||||||
|
|
||||||
// newTestCodec constructs a minimal codec for the simtest (the keeper uses
|
|
||||||
// JSON marshaling, so a bare proto codec suffices).
|
|
||||||
func newTestCodec() codec.Codec {
|
|
||||||
registry := codectypes.NewInterfaceRegistry()
|
|
||||||
return codec.NewProtoCodec(registry)
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- ICS-20 v1 packet helpers ------------------------------------------------
|
|
||||||
|
|
||||||
// ics20PacketData returns the ICS-20 v1 packet payload (matches
|
|
||||||
// keeper.ICS20PacketData).
|
|
||||||
func ics20PacketData(denom, amount, sender, receiver string) []byte {
|
|
||||||
bz, _ := json.Marshal(map[string]string{
|
|
||||||
"denom": denom,
|
|
||||||
"amount": amount,
|
|
||||||
"sender": sender,
|
|
||||||
"receiver": receiver,
|
|
||||||
})
|
|
||||||
return bz
|
|
||||||
}
|
|
||||||
|
|
||||||
// newPacket constructs a real channeltypes.Packet for the simtest.
|
|
||||||
func newPacket(sourcePort, sourceChannel string, sequence uint64, data []byte) channeltypes.Packet {
|
|
||||||
return channeltypes.Packet{
|
|
||||||
SourcePort: sourcePort,
|
|
||||||
SourceChannel: sourceChannel,
|
|
||||||
Sequence: sequence,
|
|
||||||
Data: data,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- OnRecvPacket: mint wrapped Bread + denom trace + Solana ----------------
|
|
||||||
|
|
||||||
// TestOnRecvPacketMintsWrappedBread asserts OnRecvPacket mints wrapped Bread
|
|
||||||
// for a valid ICS-20 v1 packet (EVM chain).
|
|
||||||
func TestOnRecvPacketMintsWrappedBread(t *testing.T) {
|
|
||||||
ctx, _, bk, k := newSimtestContext(t)
|
|
||||||
im := keeper.NewIBCModule(k)
|
|
||||||
|
|
||||||
packet := newPacket("transfer.Polygon", "channel-0", 1, ics20PacketData(
|
|
||||||
"transfer/channel-0/uatom", "1000", "sender-reach", "receiver-reach"))
|
|
||||||
|
|
||||||
ack := im.OnRecvPacket(ctx, packet, sdk.AccAddress([]byte("relayer")))
|
|
||||||
if !ack.Success() {
|
|
||||||
t.Fatalf("OnRecvPacket should succeed; got error ack")
|
|
||||||
}
|
|
||||||
if len(bk.mints) != 1 {
|
|
||||||
t.Fatalf("expected 1 mint call, got %d", len(bk.mints))
|
|
||||||
}
|
|
||||||
if bk.mints[0].denom != "transfer/channel-0/uatom" {
|
|
||||||
t.Errorf("mint denom = %q, want transfer/channel-0/uatom", bk.mints[0].denom)
|
|
||||||
}
|
|
||||||
if bk.mints[0].amount != 1000 {
|
|
||||||
t.Errorf("mint amount = %d, want 1000", bk.mints[0].amount)
|
|
||||||
}
|
|
||||||
if bk.mints[0].reachID != "receiver-reach" {
|
|
||||||
t.Errorf("mint reach = %q, want receiver-reach", bk.mints[0].reachID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// In-flight record written.
|
|
||||||
if _, ok := k.GetInflight(ctx, packet.SourcePort, packet.SourceChannel, packet.Sequence); !ok {
|
|
||||||
t.Error("in-flight record not written after OnRecvPacket")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOnRecvPacketRejectsBadDenomTrace asserts OnRecvPacket rejects a packet
|
|
||||||
// whose denom trace lacks the `transfer/channel-N/` hop prefix.
|
|
||||||
func TestOnRecvPacketRejectsBadDenomTrace(t *testing.T) {
|
|
||||||
ctx, _, bk, k := newSimtestContext(t)
|
|
||||||
im := keeper.NewIBCModule(k)
|
|
||||||
|
|
||||||
packet := newPacket("transfer.Polygon", "channel-0", 1, ics20PacketData(
|
|
||||||
"uatom", "1000", "sender", "receiver")) // no hop prefix
|
|
||||||
|
|
||||||
ack := im.OnRecvPacket(ctx, packet, sdk.AccAddress{})
|
|
||||||
if ack.Success() {
|
|
||||||
t.Error("OnRecvPacket should fail on bad denom trace")
|
|
||||||
}
|
|
||||||
if len(bk.mints) != 0 {
|
|
||||||
t.Errorf("no mint should happen on bad denom trace; got %d", len(bk.mints))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOnRecvPacketRejectsBadICS20 asserts a malformed ICS-20 payload is rejected.
|
|
||||||
func TestOnRecvPacketRejectsBadICS20(t *testing.T) {
|
|
||||||
ctx, _, bk, k := newSimtestContext(t)
|
|
||||||
im := keeper.NewIBCModule(k)
|
|
||||||
packet := newPacket("transfer.Polygon", "channel-0", 1, []byte("not-json"))
|
|
||||||
ack := im.OnRecvPacket(ctx, packet, sdk.AccAddress{})
|
|
||||||
if ack.Success() {
|
|
||||||
t.Error("OnRecvPacket should fail on malformed ICS-20")
|
|
||||||
}
|
|
||||||
if len(bk.mints) != 0 {
|
|
||||||
t.Errorf("no mint on bad ICS-20; got %d", len(bk.mints))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOnRecvPacketSolanaGuardianSigSet asserts the Solana branch verifies the
|
|
||||||
// wormhole guardian sig set (2-of-N stub) from state before minting.
|
|
||||||
func TestOnRecvPacketSolanaGuardianSigSet(t *testing.T) {
|
|
||||||
ctx, wk, bk, k := newSimtestContext(t)
|
|
||||||
im := keeper.NewIBCModule(k)
|
|
||||||
|
|
||||||
// Configure the frozen stub guardian set (D-054 — frozen in simtest).
|
|
||||||
k.SetGuardianSet(ctx, keeper.GuardianSet{
|
|
||||||
Guardians: []string{"guardian-1", "guardian-2", "guardian-3"},
|
|
||||||
Threshold: 2,
|
|
||||||
})
|
|
||||||
wk.signedQuorums["solana-guardians"] = true
|
|
||||||
|
|
||||||
packet := newPacket("transfer.Solana", "channel-1", 1, ics20PacketData(
|
|
||||||
"transfer/channel-1/wsol", "500", "sol-sender", "sol-receiver"))
|
|
||||||
|
|
||||||
ack := im.OnRecvPacket(ctx, packet, sdk.AccAddress{})
|
|
||||||
if !ack.Success() {
|
|
||||||
t.Fatalf("OnRecvPacket Solana should succeed with guardian quorum; got error")
|
|
||||||
}
|
|
||||||
if len(bk.mints) != 1 {
|
|
||||||
t.Fatalf("expected 1 mint for Solana, got %d", len(bk.mints))
|
|
||||||
}
|
|
||||||
if bk.mints[0].denom != "transfer/channel-1/wsol" {
|
|
||||||
t.Errorf("mint denom = %q", bk.mints[0].denom)
|
|
||||||
}
|
|
||||||
if wk.solanaCalls != 1 {
|
|
||||||
t.Errorf("expected 1 Solana guardian sig check, got %d", wk.solanaCalls)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOnRecvPacketSolanaRejectsNoGuardianSet asserts the Solana branch rejects
|
|
||||||
// when the guardian set is not configured.
|
|
||||||
func TestOnRecvPacketSolanaRejectsNoGuardianSet(t *testing.T) {
|
|
||||||
ctx, _, bk, k := newSimtestContext(t)
|
|
||||||
im := keeper.NewIBCModule(k)
|
|
||||||
// No guardian set configured.
|
|
||||||
|
|
||||||
packet := newPacket("transfer.Solana", "channel-1", 1, ics20PacketData(
|
|
||||||
"transfer/channel-1/wsol", "500", "sender", "receiver"))
|
|
||||||
|
|
||||||
ack := im.OnRecvPacket(ctx, packet, sdk.AccAddress{})
|
|
||||||
if ack.Success() {
|
|
||||||
t.Error("OnRecvPacket Solana should fail without guardian set")
|
|
||||||
}
|
|
||||||
if len(bk.mints) != 0 {
|
|
||||||
t.Errorf("no mint should happen; got %d", len(bk.mints))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOnRecvPacketSolanaRejectsNoQuorum asserts the Solana branch rejects when
|
|
||||||
// the guardian sig set did not reach the 2-of-N quorum.
|
|
||||||
func TestOnRecvPacketSolanaRejectsNoQuorum(t *testing.T) {
|
|
||||||
ctx, wk, bk, k := newSimtestContext(t)
|
|
||||||
im := keeper.NewIBCModule(k)
|
|
||||||
|
|
||||||
k.SetGuardianSet(ctx, keeper.GuardianSet{
|
|
||||||
Guardians: []string{"guardian-1", "guardian-2", "guardian-3"},
|
|
||||||
Threshold: 2,
|
|
||||||
})
|
|
||||||
wk.signedQuorums["solana-guardians"] = false // quorum NOT reached
|
|
||||||
|
|
||||||
packet := newPacket("transfer.Solana", "channel-1", 1, ics20PacketData(
|
|
||||||
"transfer/channel-1/wsol", "500", "sender", "receiver"))
|
|
||||||
ack := im.OnRecvPacket(ctx, packet, sdk.AccAddress{})
|
|
||||||
if ack.Success() {
|
|
||||||
t.Error("OnRecvPacket Solana should fail without quorum")
|
|
||||||
}
|
|
||||||
if len(bk.mints) != 0 {
|
|
||||||
t.Errorf("no mint on Solana quorum failure; got %d", len(bk.mints))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOnRecvPacketRejectsZeroAmount asserts a zero/negative amount is rejected.
|
|
||||||
func TestOnRecvPacketRejectsZeroAmount(t *testing.T) {
|
|
||||||
ctx, _, bk, k := newSimtestContext(t)
|
|
||||||
im := keeper.NewIBCModule(k)
|
|
||||||
packet := newPacket("transfer.Polygon", "channel-0", 1, ics20PacketData(
|
|
||||||
"transfer/channel-0/uatom", "0", "sender", "receiver"))
|
|
||||||
ack := im.OnRecvPacket(ctx, packet, sdk.AccAddress{})
|
|
||||||
if ack.Success() {
|
|
||||||
t.Error("OnRecvPacket should reject zero amount")
|
|
||||||
}
|
|
||||||
if len(bk.mints) != 0 {
|
|
||||||
t.Errorf("no mint on zero amount; got %d", len(bk.mints))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- OnAcknowledgementPacket: delete-on-first-ack + ERROR-on-second (G-021) --
|
|
||||||
|
|
||||||
// TestOnAckPacketDeletesInflightRecord asserts OnAcknowledgementPacket deletes
|
|
||||||
// the in-flight record on the first ack (replay protection mirroring ibc-go).
|
|
||||||
func TestOnAckPacketDeletesInflightRecord(t *testing.T) {
|
|
||||||
ctx, _, _, k := newSimtestContext(t)
|
|
||||||
im := keeper.NewIBCModule(k)
|
|
||||||
|
|
||||||
k.SetInflight(ctx, keeper.InflightPacket{
|
|
||||||
SourcePort: "transfer.Polygon", SourceChannel: "channel-0",
|
|
||||||
Sequence: 7, Denom: "transfer/channel-0/uatom", Amount: 1000,
|
|
||||||
Sender: "s", Receiver: "r",
|
|
||||||
})
|
|
||||||
packet := newPacket("transfer.Polygon", "channel-0", 7, ics20PacketData(
|
|
||||||
"transfer/channel-0/uatom", "1000", "s", "r"))
|
|
||||||
|
|
||||||
if err := im.OnAcknowledgementPacket(ctx, packet, []byte(`{}`), sdk.AccAddress{}); err != nil {
|
|
||||||
t.Fatalf("first ack should succeed, got: %v", err)
|
|
||||||
}
|
|
||||||
if _, ok := k.GetInflight(ctx, packet.SourcePort, packet.SourceChannel, packet.Sequence); ok {
|
|
||||||
t.Error("in-flight record should be deleted after first ack")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOnAckPacketRejectsSecondAck asserts the SECOND OnAcknowledgementPacket
|
|
||||||
// returns ERROR (G-021 — NOT a silent no-op; the A-513 CVE-class replay pitfall
|
|
||||||
// is closed by failing loudly).
|
|
||||||
func TestOnAckPacketRejectsSecondAck(t *testing.T) {
|
|
||||||
ctx, _, _, k := newSimtestContext(t)
|
|
||||||
im := keeper.NewIBCModule(k)
|
|
||||||
|
|
||||||
k.SetInflight(ctx, keeper.InflightPacket{
|
|
||||||
SourcePort: "transfer.Polygon", SourceChannel: "channel-0", Sequence: 9,
|
|
||||||
})
|
|
||||||
packet := newPacket("transfer.Polygon", "channel-0", 9, ics20PacketData(
|
|
||||||
"transfer/channel-0/uatom", "1000", "s", "r"))
|
|
||||||
_ = im.OnAcknowledgementPacket(ctx, packet, []byte(`{}`), sdk.AccAddress{})
|
|
||||||
|
|
||||||
// Second ack: record is gone → ERROR (G-021).
|
|
||||||
err := im.OnAcknowledgementPacket(ctx, packet, []byte(`{}`), sdk.AccAddress{})
|
|
||||||
if err == nil {
|
|
||||||
t.Fatal("G-021: second OnAcknowledgementPacket must return ERROR, not nil (A-513 replay pitfall)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOnAckPacketNoInflightRecordReturnsError asserts an ack with no prior
|
|
||||||
// in-flight record returns ERROR (the replay signal — G-021).
|
|
||||||
func TestOnAckPacketNoInflightRecordReturnsError(t *testing.T) {
|
|
||||||
ctx, _, _, k := newSimtestContext(t)
|
|
||||||
im := keeper.NewIBCModule(k)
|
|
||||||
|
|
||||||
packet := newPacket("transfer.Polygon", "channel-0", 42, ics20PacketData(
|
|
||||||
"transfer/channel-0/uatom", "1000", "s", "r"))
|
|
||||||
err := im.OnAcknowledgementPacket(ctx, packet, []byte(`{}`), sdk.AccAddress{})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("ack with no in-flight record should return ERROR (G-021 replay signal)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- OnTimeoutPacket: refund exactly once ------------------------------------
|
|
||||||
|
|
||||||
// TestOnTimeoutPacketRefundsOnce asserts OnTimeoutPacket refunds the
|
|
||||||
// source-chain escrow via the BreadKeeper shim exactly once.
|
|
||||||
func TestOnTimeoutPacketRefundsOnce(t *testing.T) {
|
|
||||||
ctx, _, bk, k := newSimtestContext(t)
|
|
||||||
im := keeper.NewIBCModule(k)
|
|
||||||
|
|
||||||
k.SetInflight(ctx, keeper.InflightPacket{
|
|
||||||
SourcePort: "transfer.Polygon", SourceChannel: "channel-0",
|
|
||||||
Sequence: 3, Denom: "transfer/channel-0/uatom", Amount: 750,
|
|
||||||
Sender: "timeout-sender", Receiver: "r", Refunded: false,
|
|
||||||
})
|
|
||||||
packet := newPacket("transfer.Polygon", "channel-0", 3, ics20PacketData(
|
|
||||||
"transfer/channel-0/uatom", "750", "timeout-sender", "r"))
|
|
||||||
|
|
||||||
if err := im.OnTimeoutPacket(ctx, packet, sdk.AccAddress{}); err != nil {
|
|
||||||
t.Fatalf("first timeout should succeed: %v", err)
|
|
||||||
}
|
|
||||||
if len(bk.releases) != 1 {
|
|
||||||
t.Fatalf("expected 1 release on first timeout, got %d", len(bk.releases))
|
|
||||||
}
|
|
||||||
if bk.releases[0].amount != 750 {
|
|
||||||
t.Errorf("release amount = %d, want 750", bk.releases[0].amount)
|
|
||||||
}
|
|
||||||
if bk.releases[0].reachID != "timeout-sender" {
|
|
||||||
t.Errorf("release reach = %q, want timeout-sender", bk.releases[0].reachID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Second timeout: no-op (Refunded flag guards exactly-once).
|
|
||||||
if err := im.OnTimeoutPacket(ctx, packet, sdk.AccAddress{}); err != nil {
|
|
||||||
t.Fatalf("second timeout should be a no-op (nil), got: %v", err)
|
|
||||||
}
|
|
||||||
if len(bk.releases) != 1 {
|
|
||||||
t.Errorf("second timeout should NOT refund again; got %d releases total", len(bk.releases))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestOnTimeoutPacketNoInflightRecordIsNoop asserts a timeout with no
|
|
||||||
// in-flight record is a benign no-op (not an error).
|
|
||||||
func TestOnTimeoutPacketNoInflightRecordIsNoop(t *testing.T) {
|
|
||||||
ctx, _, bk, k := newSimtestContext(t)
|
|
||||||
im := keeper.NewIBCModule(k)
|
|
||||||
|
|
||||||
packet := newPacket("transfer.Polygon", "channel-0", 99, ics20PacketData(
|
|
||||||
"transfer/channel-0/uatom", "1000", "s", "r"))
|
|
||||||
err := im.OnTimeoutPacket(ctx, packet, sdk.AccAddress{})
|
|
||||||
if err != nil {
|
|
||||||
t.Errorf("timeout with no in-flight record should be a no-op (nil); got %v", err)
|
|
||||||
}
|
|
||||||
if len(bk.releases) != 0 {
|
|
||||||
t.Errorf("no release should happen; got %d", len(bk.releases))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- BridgeStatus lifecycle (MsgServer) --------------------------------------
|
|
||||||
|
|
||||||
// TestBridgeStatusLifecycle asserts the full BridgeStatus lifecycle:
|
|
||||||
// Pending → Attested → Active → Closed.
|
|
||||||
func TestBridgeStatusLifecycle(t *testing.T) {
|
|
||||||
ctx, wk, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
|
|
||||||
k.SetBridgeRoute(ctx, bridgetypes.BridgeRoute{
|
|
||||||
BridgeID: "bridge-1", L2Chain: "Polygon", Status: bridgetypes.BridgePending,
|
|
||||||
})
|
|
||||||
wk.signedQuorums["quorum-1"] = true
|
|
||||||
|
|
||||||
// Pending → Attested.
|
|
||||||
if _, err := srv.AttestBridgeRoute(ctx, &bridgetypes.MsgAttestBridgeRoute{
|
|
||||||
BridgeID: "bridge-1", WatcherQuorumID: "quorum-1", Signer: "watcher-reach",
|
|
||||||
}); err != nil {
|
|
||||||
t.Fatalf("AttestBridgeRoute: %v", err)
|
|
||||||
}
|
|
||||||
r, _ := k.GetBridgeRoute(ctx, "bridge-1")
|
|
||||||
if r.Status != bridgetypes.BridgeAttested {
|
|
||||||
t.Errorf("after attest, status = %q, want Attested", r.Status)
|
|
||||||
}
|
|
||||||
if r.WatcherQuorumID != "quorum-1" {
|
|
||||||
t.Errorf("watcher quorum id = %q, want quorum-1", r.WatcherQuorumID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Attested → Active.
|
|
||||||
if _, err := srv.ActivateBridge(ctx, &bridgetypes.MsgActivateBridge{
|
|
||||||
BridgeID: "bridge-1", Signer: "watcher-reach",
|
|
||||||
}); err != nil {
|
|
||||||
t.Fatalf("ActivateBridge: %v", err)
|
|
||||||
}
|
|
||||||
r, _ = k.GetBridgeRoute(ctx, "bridge-1")
|
|
||||||
if r.Status != bridgetypes.BridgeActive {
|
|
||||||
t.Errorf("after activate, status = %q, want Active", r.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Active → Closed.
|
|
||||||
if _, err := srv.CloseBridge(ctx, &bridgetypes.MsgCloseBridge{
|
|
||||||
BridgeID: "bridge-1", Signer: "watcher-reach",
|
|
||||||
}); err != nil {
|
|
||||||
t.Fatalf("CloseBridge: %v", err)
|
|
||||||
}
|
|
||||||
r, _ = k.GetBridgeRoute(ctx, "bridge-1")
|
|
||||||
if r.Status != bridgetypes.BridgeClosed {
|
|
||||||
t.Errorf("after close, status = %q, want Closed", r.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestAttestBridgeRouteRejectsBadStatus asserts AttestBridgeRoute rejects a
|
|
||||||
// route that is not Pending.
|
|
||||||
func TestAttestBridgeRouteRejectsBadStatus(t *testing.T) {
|
|
||||||
ctx, wk, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
wk.signedQuorums["quorum-1"] = true
|
|
||||||
|
|
||||||
k.SetBridgeRoute(ctx, bridgetypes.BridgeRoute{
|
|
||||||
BridgeID: "bridge-2", L2Chain: "Base", Status: bridgetypes.BridgeActive,
|
|
||||||
})
|
|
||||||
_, err := srv.AttestBridgeRoute(ctx, &bridgetypes.MsgAttestBridgeRoute{
|
|
||||||
BridgeID: "bridge-2", WatcherQuorumID: "quorum-1", Signer: "watcher-reach",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("AttestBridgeRoute should reject an Active route (must be Pending)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestAttestBridgeRouteRejectsNoQuorum asserts AttestBridgeRoute rejects when
|
|
||||||
// the Watcher quorum did not reach threshold.
|
|
||||||
func TestAttestBridgeRouteRejectsNoQuorum(t *testing.T) {
|
|
||||||
ctx, wk, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
wk.signedQuorums["quorum-1"] = false
|
|
||||||
|
|
||||||
k.SetBridgeRoute(ctx, bridgetypes.BridgeRoute{
|
|
||||||
BridgeID: "bridge-3", L2Chain: "Polygon", Status: bridgetypes.BridgePending,
|
|
||||||
})
|
|
||||||
_, err := srv.AttestBridgeRoute(ctx, &bridgetypes.MsgAttestBridgeRoute{
|
|
||||||
BridgeID: "bridge-3", WatcherQuorumID: "quorum-1", Signer: "watcher-reach",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("AttestBridgeRoute should reject when Watcher quorum not signed")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestAttestBridgeRouteRejectsNotFound asserts AttestBridgeRoute rejects a
|
|
||||||
// missing route.
|
|
||||||
func TestAttestBridgeRouteRejectsNotFound(t *testing.T) {
|
|
||||||
ctx, wk, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
wk.signedQuorums["quorum-1"] = true
|
|
||||||
|
|
||||||
_, err := srv.AttestBridgeRoute(ctx, &bridgetypes.MsgAttestBridgeRoute{
|
|
||||||
BridgeID: "missing", WatcherQuorumID: "quorum-1", Signer: "watcher-reach",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("AttestBridgeRoute should reject a missing route")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestActivateBridgeRejectsBadStatus asserts ActivateBridge rejects a route
|
|
||||||
// that is not Attested.
|
|
||||||
func TestActivateBridgeRejectsBadStatus(t *testing.T) {
|
|
||||||
ctx, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
|
|
||||||
k.SetBridgeRoute(ctx, bridgetypes.BridgeRoute{
|
|
||||||
BridgeID: "bridge-4", L2Chain: "Polygon", Status: bridgetypes.BridgePending,
|
|
||||||
})
|
|
||||||
_, err := srv.ActivateBridge(ctx, &bridgetypes.MsgActivateBridge{
|
|
||||||
BridgeID: "bridge-4", Signer: "watcher-reach",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("ActivateBridge should reject a Pending route (must be Attested)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestCloseBridgeRejectsBadStatus asserts CloseBridge rejects a route that is
|
|
||||||
// not Active.
|
|
||||||
func TestCloseBridgeRejectsBadStatus(t *testing.T) {
|
|
||||||
ctx, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
|
|
||||||
k.SetBridgeRoute(ctx, bridgetypes.BridgeRoute{
|
|
||||||
BridgeID: "bridge-5", L2Chain: "Polygon", Status: bridgetypes.BridgeAttested,
|
|
||||||
})
|
|
||||||
_, err := srv.CloseBridge(ctx, &bridgetypes.MsgCloseBridge{
|
|
||||||
BridgeID: "bridge-5", Signer: "watcher-reach",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("CloseBridge should reject an Attested route (must be Active)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- ValidateBasic (Msg types) -----------------------------------------------
|
|
||||||
|
|
||||||
func TestMsgAttestBridgeRouteValidateBasic(t *testing.T) {
|
|
||||||
cases := []struct {
|
|
||||||
name string
|
|
||||||
msg bridgetypes.MsgAttestBridgeRoute
|
|
||||||
ok bool
|
|
||||||
}{
|
|
||||||
{"valid", bridgetypes.MsgAttestBridgeRoute{"b1", "q1", "s"}, true},
|
|
||||||
{"empty bridge-id", bridgetypes.MsgAttestBridgeRoute{"", "q1", "s"}, false},
|
|
||||||
{"empty quorum-id", bridgetypes.MsgAttestBridgeRoute{"b1", "", "s"}, false},
|
|
||||||
{"empty signer", bridgetypes.MsgAttestBridgeRoute{"b1", "q1", ""}, false},
|
|
||||||
}
|
|
||||||
for _, c := range cases {
|
|
||||||
err := c.msg.ValidateBasic()
|
|
||||||
if c.ok && err != nil {
|
|
||||||
t.Errorf("%s: expected ok, got %v", c.name, err)
|
|
||||||
}
|
|
||||||
if !c.ok && err == nil {
|
|
||||||
t.Errorf("%s: expected error, got nil", c.name)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestMsgActivateBridgeValidateBasic(t *testing.T) {
|
|
||||||
if err := (&bridgetypes.MsgActivateBridge{BridgeID: "b1", Signer: "s"}).ValidateBasic(); err != nil {
|
|
||||||
t.Errorf("valid: %v", err)
|
|
||||||
}
|
|
||||||
if err := (&bridgetypes.MsgActivateBridge{BridgeID: "", Signer: "s"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty bridge-id should fail")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestMsgCloseBridgeValidateBasic(t *testing.T) {
|
|
||||||
if err := (&bridgetypes.MsgCloseBridge{BridgeID: "b1", Signer: "s"}).ValidateBasic(); err != nil {
|
|
||||||
t.Errorf("valid: %v", err)
|
|
||||||
}
|
|
||||||
if err := (&bridgetypes.MsgCloseBridge{BridgeID: "b1", Signer: ""}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty signer should fail")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestMsgGetSigners asserts GetSigners returns the signer reach-id as bytes.
|
|
||||||
func TestMsgGetSigners(t *testing.T) {
|
|
||||||
m := &bridgetypes.MsgAttestBridgeRoute{Signer: "watcher-reach"}
|
|
||||||
addrs := m.GetSigners()
|
|
||||||
if len(addrs) != 1 {
|
|
||||||
t.Fatalf("expected 1 signer, got %d", len(addrs))
|
|
||||||
}
|
|
||||||
if string(addrs[0]) != "watcher-reach" {
|
|
||||||
t.Errorf("signer = %q, want watcher-reach", string(addrs[0]))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Denom trace parser ------------------------------------------------------
|
|
||||||
|
|
||||||
func TestParseDenomTrace(t *testing.T) {
|
|
||||||
cases := []struct {
|
|
||||||
denom string
|
|
||||||
wantPrefix string
|
|
||||||
wantBase string
|
|
||||||
}{
|
|
||||||
{"transfer/channel-0/uatom", "transfer/channel-0", "uatom"},
|
|
||||||
{"transfer/channel-1/wsol", "transfer/channel-1", "wsol"},
|
|
||||||
{"uatom", "", "uatom"},
|
|
||||||
{"", "", ""},
|
|
||||||
}
|
|
||||||
for _, c := range cases {
|
|
||||||
p, b := keeper.ParseDenomTrace(c.denom)
|
|
||||||
if p != c.wantPrefix || b != c.wantBase {
|
|
||||||
t.Errorf("ParseDenomTrace(%q) = (%q,%q), want (%q,%q)", c.denom, p, b, c.wantPrefix, c.wantBase)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestValidateDenomTrace(t *testing.T) {
|
|
||||||
if err := keeper.ValidateDenomTrace("transfer/channel-0/uatom"); err != nil {
|
|
||||||
t.Errorf("valid denom trace: %v", err)
|
|
||||||
}
|
|
||||||
if err := keeper.ValidateDenomTrace("uatom"); err == nil {
|
|
||||||
t.Error("bare denom (no hop prefix) should fail")
|
|
||||||
}
|
|
||||||
if err := keeper.ValidateDenomTrace(""); err == nil {
|
|
||||||
t.Error("empty denom should fail")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Keeper store helpers ----------------------------------------------------
|
|
||||||
|
|
||||||
func TestSetGetBridgeRoute(t *testing.T) {
|
|
||||||
ctx, _, _, k := newSimtestContext(t)
|
|
||||||
r := bridgetypes.BridgeRoute{BridgeID: "b9", L2Chain: "Polygon", Status: bridgetypes.BridgePending}
|
|
||||||
k.SetBridgeRoute(ctx, r)
|
|
||||||
got, ok := k.GetBridgeRoute(ctx, "b9")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("GetBridgeRoute: not found")
|
|
||||||
}
|
|
||||||
if got.L2Chain != "Polygon" {
|
|
||||||
t.Errorf("L2Chain = %q", got.L2Chain)
|
|
||||||
}
|
|
||||||
if _, ok := k.GetBridgeRoute(ctx, "missing"); ok {
|
|
||||||
t.Error("GetBridgeRoute should return false for missing route")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestAllBridgeRoutes(t *testing.T) {
|
|
||||||
ctx, _, _, k := newSimtestContext(t)
|
|
||||||
k.SetBridgeRoute(ctx, bridgetypes.BridgeRoute{BridgeID: "b1", Status: bridgetypes.BridgePending})
|
|
||||||
k.SetBridgeRoute(ctx, bridgetypes.BridgeRoute{BridgeID: "b2", Status: bridgetypes.BridgeActive})
|
|
||||||
all := k.AllBridgeRoutes(ctx)
|
|
||||||
if len(all) != 2 {
|
|
||||||
t.Errorf("expected 2 routes, got %d", len(all))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestGuardianSetStore(t *testing.T) {
|
|
||||||
ctx, _, _, k := newSimtestContext(t)
|
|
||||||
gs := keeper.GuardianSet{
|
|
||||||
Guardians: []string{"g1", "g2", "g3"}, Threshold: 2,
|
|
||||||
}
|
|
||||||
k.SetGuardianSet(ctx, gs)
|
|
||||||
got, ok := k.GetGuardianSet(ctx)
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("GetGuardianSet: not found")
|
|
||||||
}
|
|
||||||
if got.Threshold != 2 {
|
|
||||||
t.Errorf("threshold = %d, want 2", got.Threshold)
|
|
||||||
}
|
|
||||||
if len(got.Guardians) != 3 {
|
|
||||||
t.Errorf("guardians = %d, want 3", len(got.Guardians))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,94 +0,0 @@
|
|||||||
package bridge
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/types/module"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/bridge/keeper"
|
|
||||||
"github.com/oy/openyield/x/bridge/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// module.go holds the bridge module's AppModule + RegisterServices (P1-03-01).
|
|
||||||
//
|
|
||||||
// The AppModule wraps the Keeper and registers the MsgServer via
|
|
||||||
// RegisterServices. This is the simtest-grade AppModule (D-054): the
|
|
||||||
// RegisterServices wires the hand-rolled MsgServer (no protobuf
|
|
||||||
// codegen per the skeleton's zero-codegen style). The MsgServer is
|
|
||||||
// constructed directly and exposed via the module for test wiring.
|
|
||||||
//
|
|
||||||
// The IBCModule (porttypes.IBCModule) is constructed separately by the app
|
|
||||||
// wiring (NewIBCModule wraps the Keeper); the AppModule does not register
|
|
||||||
// the IBC port binding here (that is app-wiring territory, deferred — the
|
|
||||||
// simtest wires the IBCModule directly).
|
|
||||||
|
|
||||||
// ConsensusVersion is the bridge module's consensus version (AppModule).
|
|
||||||
const ConsensusVersion = 1
|
|
||||||
|
|
||||||
// AppModule is the bridge application module (simtest-grade — D-054).
|
|
||||||
type AppModule struct {
|
|
||||||
keeper keeper.Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewAppModule constructs a new bridge AppModule.
|
|
||||||
func NewAppModule(cdc codec.Codec, storeKey storetypes.StoreKey, wk types.WatcherKeeper, bk types.BreadKeeper) AppModule {
|
|
||||||
k := keeper.NewKeeper(cdc, storeKey, wk, bk)
|
|
||||||
return AppModule{keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewKeeper exposes the keeper for app wiring / IBC module construction.
|
|
||||||
func (am AppModule) NewKeeper() keeper.Keeper { return am.keeper }
|
|
||||||
|
|
||||||
// RegisterServices registers the bridge MsgServer. This is the simtest-grade
|
|
||||||
// wiring: the MsgServer is constructed from the keeper and exposed via the
|
|
||||||
// module's MsgServer method (tests use NewMsgServerImpl directly; the
|
|
||||||
// configurator path is not exercised in simtest per D-054).
|
|
||||||
func (am AppModule) RegisterServices(cfg module.Configurator) {
|
|
||||||
// The hand-rolled MsgServer does not use the protobuf ServiceDesc
|
|
||||||
// registration (no codegen). Tests wire the MsgServer directly via
|
|
||||||
// keeper.NewMsgServerImpl(am.keeper). This no-op reference keeps the
|
|
||||||
// Configurator import stable for future codegen-based wiring.
|
|
||||||
_ = cfg
|
|
||||||
}
|
|
||||||
|
|
||||||
// MsgServer returns the bridge MsgServer for this module's keeper.
|
|
||||||
func (am AppModule) MsgServer() types.MsgServer {
|
|
||||||
return keeper.NewMsgServerImpl(am.keeper)
|
|
||||||
}
|
|
||||||
|
|
||||||
// IBCModule returns the bridge IBCModule for this module's keeper.
|
|
||||||
func (am AppModule) IBCModule() keeper.IBCModule {
|
|
||||||
return keeper.NewIBCModule(am.keeper)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Name returns the module name.
|
|
||||||
func (AppModule) Name() string { return types.ModuleName }
|
|
||||||
|
|
||||||
// ConsensusVersion implements AppModule.ConsensusVersion.
|
|
||||||
func (AppModule) ConsensusVersion() uint64 { return ConsensusVersion }
|
|
||||||
|
|
||||||
// InitGenesis performs genesis initialization for the bridge module.
|
|
||||||
func (am AppModule) InitGenesis(ctx sdk.Context, cdc codec.JSONCodec, data json.RawMessage) {
|
|
||||||
var gs types.GenesisState
|
|
||||||
cdc.MustUnmarshalJSON(data, &gs)
|
|
||||||
for _, r := range gs.Routes {
|
|
||||||
am.keeper.SetBridgeRoute(ctx, r)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ExportGenesis returns the exported genesis state as raw bytes.
|
|
||||||
func (am AppModule) ExportGenesis(ctx sdk.Context, cdc codec.JSONCodec) json.RawMessage {
|
|
||||||
routes := am.keeper.AllBridgeRoutes(ctx)
|
|
||||||
gs := types.GenesisState{Routes: routes}
|
|
||||||
return cdc.MustMarshalJSON(&gs)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertion: AppModule implements module.AppModule (simtest-grade
|
|
||||||
// — the RegisterServices signature matches the interface; the full
|
|
||||||
// AppModule interface is satisfied by the methods above + the
|
|
||||||
// appmodule.AppModule methods which are not exercised in simtest per D-054).
|
|
||||||
var _ module.HasName = AppModule{}
|
|
||||||
var _ module.HasConsensusVersion = AppModule{}
|
|
||||||
@@ -1,58 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
// expected_keepers.go holds the Go INTERFACES for the cross-module keepers
|
|
||||||
// x/bridge depends on (G-003 firewall — ibc-go expected-keepers convention).
|
|
||||||
//
|
|
||||||
// The bridge handler references x/watcher (Watcher quorum attestation on the
|
|
||||||
// Pending→Attested transition) and x/bread (mint/release wrapped Bread on
|
|
||||||
// IBC packet recv/timeout). Both dependencies are expressed as INTERFACES
|
|
||||||
// defined HERE (in x/bridge/types), NOT as struct imports of x/watcher/types
|
|
||||||
// or x/bread/types. The concrete keepers satisfy these interfaces
|
|
||||||
// structurally; the handler depends on the interface, preserving G-003's
|
|
||||||
// intent (no cross-module struct coupling, no import cycles).
|
|
||||||
//
|
|
||||||
// Test-only cross-package imports (the G-003 test exemption) remain exempt: a
|
|
||||||
// simtest may import both x/bridge/keeper and x/watcher/keeper (or x/bread)
|
|
||||||
// to wire the expected-keeper shim in a test setup.
|
|
||||||
|
|
||||||
// WatcherKeeper is the expected-keeper interface for x/watcher (G-003).
|
|
||||||
// The bridge handler calls it for:
|
|
||||||
// - the Pending→Attested transition: a Watcher 6-of-9 quorum must attest
|
|
||||||
// the route (vision §7, REQ-004). The handler consults the watcher
|
|
||||||
// quorum by ID-string; the interface method reports whether the quorum
|
|
||||||
// reached its threshold on the payload.
|
|
||||||
// - the Solana wormhole-adapter branch: the guardian sig set (a 2-of-N
|
|
||||||
// quorum, N = the wormhole guardian set) is verified via the same
|
|
||||||
// IsQuorumSigned interface.
|
|
||||||
//
|
|
||||||
// No struct import of x/watcher/types — the interface is the by-ID-string
|
|
||||||
// boundary (G-003).
|
|
||||||
type WatcherKeeper interface {
|
|
||||||
// IsQuorumSigned reports whether the named quorum (by-ID-string) reached
|
|
||||||
// its threshold signature count on the payload. Used for both the
|
|
||||||
// bridge-route Watcher attestation and the Solana guardian sig set.
|
|
||||||
IsQuorumSigned(quorumID string, payload []byte) bool
|
|
||||||
}
|
|
||||||
|
|
||||||
// BreadKeeper is the expected-keeper interface for x/bread (G-003).
|
|
||||||
// The bridge handler calls it for:
|
|
||||||
// - OnRecvPacket: mint wrapped Bread on the receiving chain when an ICS-20
|
|
||||||
// v1 packet arrives (mint by denom-string + amount).
|
|
||||||
// - OnTimeoutPacket: release (refund) the escrowed Bread exactly once
|
|
||||||
// when a packet times out (release by denom-string + amount).
|
|
||||||
//
|
|
||||||
// The wrapped Bread denom is a by-ID-string (the denom trace). No struct
|
|
||||||
// import of x/bread/types — the interface is the by-ID-string boundary
|
|
||||||
// (G-003).
|
|
||||||
type BreadKeeper interface {
|
|
||||||
// MintWrappedBread mints wrapped Bread on the receiving chain for an
|
|
||||||
// ICS-20 v1 packet recv. denom is the denom trace string; amount is the
|
|
||||||
// grain amount to mint; holderReach is the receiver reach-id.
|
|
||||||
MintWrappedBread(ctx interface{}, denom string, amount int64, holderReach string) error
|
|
||||||
|
|
||||||
// ReleaseWrappedBread releases (refunds) the escrowed Bread exactly once
|
|
||||||
// on a packet timeout. denom is the denom trace string; amount is the
|
|
||||||
// grain amount to release; holderReach is the sender reach-id (the
|
|
||||||
// source-chain escrow owner).
|
|
||||||
ReleaseWrappedBread(ctx interface{}, denom string, amount int64, holderReach string) error
|
|
||||||
}
|
|
||||||
@@ -1,198 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// msg_bridge.go holds the bridge module's Msg* types implementing sdk.Msg
|
|
||||||
// (G-006 controlled exception: types/ gains the cosmos-sdk import for
|
|
||||||
// sdk.Msg). Each Msg carries a ValidateBasic (stateless) and GetSigners.
|
|
||||||
//
|
|
||||||
// The three bridge Msg types drive the BridgeStatus lifecycle:
|
|
||||||
// - MsgAttestBridgeRoute: Pending → Attested (Watcher quorum-driven; the
|
|
||||||
// handler consults the WatcherKeeper expected-keeper shim with the
|
|
||||||
// watcher-quorum-id).
|
|
||||||
// - MsgActivateBridge: Attested → Active (route opens for transfers).
|
|
||||||
// - MsgCloseBridge: Active → Closed (route retired).
|
|
||||||
//
|
|
||||||
// All cross-module refs are by-ID-string (G-003): bridge-id is this route's
|
|
||||||
// ID; watcher-quorum-id references an x/watcher quorum by ID-string (no
|
|
||||||
// struct import). GetSigners returns the signer reach-ids encoded as
|
|
||||||
// sdk.AccAddress bytes.
|
|
||||||
|
|
||||||
// --- MsgAttestBridgeRoute -----------------------------------------------------
|
|
||||||
|
|
||||||
// MsgAttestBridgeRoute transitions a bridge route Pending → Attested. A
|
|
||||||
// Watcher 6-of-9 quorum (vision §7, REQ-004) must sign the payload; the
|
|
||||||
// handler consults the WatcherKeeper expected-keeper shim (by-ID-string on
|
|
||||||
// the watcher-quorum-id). ValidateBasic is stateless: non-empty bridge-id
|
|
||||||
// and watcher-quorum-id; the current status must be Pending (the only valid
|
|
||||||
// source state for the Attested transition target).
|
|
||||||
type MsgAttestBridgeRoute struct {
|
|
||||||
BridgeID string `json:"bridge_id" yaml:"bridge_id"`
|
|
||||||
WatcherQuorumID string `json:"watcher_quorum_id" yaml:"watcher_quorum_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"` // signer reach-id (by-ID-string)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message (sdk.Msg = proto.Message).
|
|
||||||
func (m *MsgAttestBridgeRoute) Reset() { *m = MsgAttestBridgeRoute{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgAttestBridgeRoute) String() string {
|
|
||||||
return fmt.Sprintf("MsgAttestBridgeRoute{BridgeID:%s WatcherQuorumID:%s Signer:%s}",
|
|
||||||
m.BridgeID, m.WatcherQuorumID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgAttestBridgeRoute) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty bridge-id, non-empty
|
|
||||||
// watcher-quorum-id, non-empty signer. The status transition target
|
|
||||||
// (Pending → Attested) is enforced at the handler (stateful — the handler
|
|
||||||
// loads the route and checks status == Pending).
|
|
||||||
func (m *MsgAttestBridgeRoute) ValidateBasic() error {
|
|
||||||
if m.BridgeID == "" {
|
|
||||||
return fmt.Errorf("bridge: empty bridge-id")
|
|
||||||
}
|
|
||||||
if m.WatcherQuorumID == "" {
|
|
||||||
return fmt.Errorf("bridge: empty watcher-quorum-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bridge: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes. The
|
|
||||||
// reach-id is the by-ID-string user identifier (G-003 — no banned
|
|
||||||
// financial-holder lexicon; use Holder/Reach).
|
|
||||||
func (m *MsgAttestBridgeRoute) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgActivateBridge --------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgActivateBridge transitions a bridge route Attested → Active. The route
|
|
||||||
// must already be Attested (Watcher quorum confirmed); the handler enforces
|
|
||||||
// the stateful source-status check. ValidateBasic is stateless: non-empty
|
|
||||||
// bridge-id and signer.
|
|
||||||
type MsgActivateBridge struct {
|
|
||||||
BridgeID string `json:"bridge_id" yaml:"bridge_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgActivateBridge) Reset() { *m = MsgActivateBridge{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgActivateBridge) String() string {
|
|
||||||
return fmt.Sprintf("MsgActivateBridge{BridgeID:%s Signer:%s}", m.BridgeID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgActivateBridge) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty bridge-id and signer.
|
|
||||||
func (m *MsgActivateBridge) ValidateBasic() error {
|
|
||||||
if m.BridgeID == "" {
|
|
||||||
return fmt.Errorf("bridge: empty bridge-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bridge: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgActivateBridge) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgCloseBridge -----------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgCloseBridge transitions a bridge route Active → Closed (retire the
|
|
||||||
// route). The handler enforces the stateful source-status check (status ==
|
|
||||||
// Active). ValidateBasic is stateless: non-empty bridge-id and signer.
|
|
||||||
type MsgCloseBridge struct {
|
|
||||||
BridgeID string `json:"bridge_id" yaml:"bridge_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgCloseBridge) Reset() { *m = MsgCloseBridge{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgCloseBridge) String() string {
|
|
||||||
return fmt.Sprintf("MsgCloseBridge{BridgeID:%s Signer:%s}", m.BridgeID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgCloseBridge) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty bridge-id and signer.
|
|
||||||
func (m *MsgCloseBridge) ValidateBasic() error {
|
|
||||||
if m.BridgeID == "" {
|
|
||||||
return fmt.Errorf("bridge: empty bridge-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("bridge: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgCloseBridge) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// MsgServer is the bridge module's message server interface (one method per
|
|
||||||
// Msg*). The keeper's msg_server.go implements this; module.go's
|
|
||||||
// RegisterServices wires the implementation. This is the hand-rolled
|
|
||||||
// equivalent of the protobuf-generated MsgServer interface (no codegen per
|
|
||||||
// the skeleton's zero-codegen style).
|
|
||||||
type MsgServer interface {
|
|
||||||
AttestBridgeRoute(ctx interface{}, msg *MsgAttestBridgeRoute) (*MsgAttestBridgeRouteResponse, error)
|
|
||||||
ActivateBridge(ctx interface{}, msg *MsgActivateBridge) (*MsgActivateBridgeResponse, error)
|
|
||||||
CloseBridge(ctx interface{}, msg *MsgCloseBridge) (*MsgCloseBridgeResponse, error)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Response types (hand-rolled equivalents of the protobuf-generated response
|
|
||||||
// wrappers; empty bodies — the response is the state mutation + event).
|
|
||||||
|
|
||||||
// MsgAttestBridgeRouteResponse is the response to MsgAttestBridgeRoute.
|
|
||||||
type MsgAttestBridgeRouteResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgAttestBridgeRouteResponse) Reset() { *m = MsgAttestBridgeRouteResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgAttestBridgeRouteResponse) String() string { return "MsgAttestBridgeRouteResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgAttestBridgeRouteResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgActivateBridgeResponse is the response to MsgActivateBridge.
|
|
||||||
type MsgActivateBridgeResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgActivateBridgeResponse) Reset() { *m = MsgActivateBridgeResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgActivateBridgeResponse) String() string { return "MsgActivateBridgeResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgActivateBridgeResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgCloseBridgeResponse is the response to MsgCloseBridge.
|
|
||||||
type MsgCloseBridgeResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgCloseBridgeResponse) Reset() { *m = MsgCloseBridgeResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgCloseBridgeResponse) String() string { return "MsgCloseBridgeResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgCloseBridgeResponse) ProtoMessage() {}
|
|
||||||
@@ -89,20 +89,6 @@ func DefaultGenesisState() *GenesisState {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Reset implements proto.Message (codec.JSONCodec.MustMarshalJSON /
|
|
||||||
// MustUnmarshalJSON require proto.Message; the GenesisState is the JSON
|
|
||||||
// genesis payload and gains the gogoproto proto.Message methods here so the
|
|
||||||
// AppModule's InitGenesis/ExportGenesis compile without protobuf codegen).
|
|
||||||
func (m *GenesisState) Reset() { *m = GenesisState{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *GenesisState) String() string {
|
|
||||||
return fmt.Sprintf("GenesisState{Routes:%d}", len(m.Routes))
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*GenesisState) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
||||||
// no-op): rejects duplicate bridge-ids and unknown statuses. Delegates to
|
// no-op): rejects duplicate bridge-ids and unknown statuses. Delegates to
|
||||||
// the data-engineer's genesis.go helpers (G-008).
|
// the data-engineer's genesis.go helpers (G-008).
|
||||||
|
|||||||
@@ -1,244 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/council/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// keeper.go holds the store-backed Keeper for the council module's
|
|
||||||
// Proposal-lifecycle runtime (P7-02-01, REQ-039, D-060).
|
|
||||||
//
|
|
||||||
// The Keeper wraps an sdk.KVStore via a storeKey. It holds the Proposal
|
|
||||||
// records (by proposal-id) and the Vote records (by vote-id). The v0.2
|
|
||||||
// skeleton had NO keeper (only types/); v0.5 (P7) promotes the council
|
|
||||||
// module to runtime by adding the store-backed Keeper + MsgServer.
|
|
||||||
//
|
|
||||||
// The Keeper also holds the three expected-keeper shims (WatcherKeeper
|
|
||||||
// for Veto authz; StandKeeper + GuildKeeper for proposal-target
|
|
||||||
// validation). The shims are interfaces (G-003 — no struct import of
|
|
||||||
// x/watcher/types, x/stand/types, or x/guild/types); the concrete
|
|
||||||
// keepers satisfy them structurally.
|
|
||||||
//
|
|
||||||
// State-machine ordering (vision §7, enforced in every handler):
|
|
||||||
// ValidateBasic → keeper authz → state mutation → ctx.EventManager().EmitEvent
|
|
||||||
|
|
||||||
// Keeper is the store-backed council Proposal-lifecycle keeper.
|
|
||||||
type Keeper struct {
|
|
||||||
cdc codec.Codec
|
|
||||||
storeKey storetypes.StoreKey
|
|
||||||
watcherKeeper types.WatcherKeeper
|
|
||||||
standKeeper types.StandKeeper
|
|
||||||
guildKeeper types.GuildKeeper
|
|
||||||
params types.Params
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewKeeper constructs a new store-backed council Proposal-lifecycle
|
|
||||||
// Keeper. The WatcherKeeper, StandKeeper, and GuildKeeper expected-keeper
|
|
||||||
// shims are injected (nil-able for partial tests; the handlers guard nil
|
|
||||||
// shims and skip the corresponding authz/validity check, still mutating
|
|
||||||
// state — the simtest wiring documents this). The Params default is set
|
|
||||||
// here; the simtest can override via SetParams.
|
|
||||||
func NewKeeper(cdc codec.Codec, storeKey storetypes.StoreKey, wk types.WatcherKeeper, sk types.StandKeeper, gk types.GuildKeeper) Keeper {
|
|
||||||
return Keeper{
|
|
||||||
cdc: cdc,
|
|
||||||
storeKey: storeKey,
|
|
||||||
watcherKeeper: wk,
|
|
||||||
standKeeper: sk,
|
|
||||||
guildKeeper: gk,
|
|
||||||
params: types.DefaultParams(),
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetWatcherKeeper sets the WatcherKeeper expected-keeper shim (for
|
|
||||||
// post-construction wiring, e.g., app wiring or test setup).
|
|
||||||
func (k *Keeper) SetWatcherKeeper(wk types.WatcherKeeper) { k.watcherKeeper = wk }
|
|
||||||
|
|
||||||
// SetStandKeeper sets the StandKeeper expected-keeper shim (for
|
|
||||||
// post-construction wiring).
|
|
||||||
func (k *Keeper) SetStandKeeper(sk types.StandKeeper) { k.standKeeper = sk }
|
|
||||||
|
|
||||||
// SetGuildKeeper sets the GuildKeeper expected-keeper shim (for
|
|
||||||
// post-construction wiring).
|
|
||||||
func (k *Keeper) SetGuildKeeper(gk types.GuildKeeper) { k.guildKeeper = gk }
|
|
||||||
|
|
||||||
// SetParams sets the council Params (the simtest overrides
|
|
||||||
// WatcherVetoQuorum for the quorum-Veto-fails test).
|
|
||||||
func (k *Keeper) SetParams(p types.Params) { k.params = p }
|
|
||||||
|
|
||||||
// GetParams returns the council Params.
|
|
||||||
func (k Keeper) GetParams() types.Params { return k.params }
|
|
||||||
|
|
||||||
// --- Proposal store --------------------------------------------------------
|
|
||||||
|
|
||||||
var proposalKeyPrefix = []byte("proposal/")
|
|
||||||
|
|
||||||
func proposalKey(proposalID string) []byte {
|
|
||||||
return append(proposalKeyPrefix, []byte(proposalID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetProposal loads a Proposal by proposal-id. Returns the Proposal and
|
|
||||||
// true if found, or zero value + false if not.
|
|
||||||
func (k Keeper) GetProposal(ctx sdk.Context, proposalID string) (types.Proposal, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(proposalKey(proposalID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.Proposal{}, false
|
|
||||||
}
|
|
||||||
var p types.Proposal
|
|
||||||
if err := json.Unmarshal(bz, &p); err != nil {
|
|
||||||
return types.Proposal{}, false
|
|
||||||
}
|
|
||||||
return p, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetProposal persists a Proposal by proposal-id.
|
|
||||||
func (k Keeper) SetProposal(ctx sdk.Context, p types.Proposal) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(p)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("council: marshal proposal %q: %v", p.ProposalID, err))
|
|
||||||
}
|
|
||||||
store.Set(proposalKey(p.ProposalID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllProposals returns all persisted Proposal records (iteration helper).
|
|
||||||
func (k Keeper) AllProposals(ctx sdk.Context) []types.Proposal {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(proposalKeyPrefix, prefixEnd(proposalKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.Proposal{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var p types.Proposal
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &p); err == nil {
|
|
||||||
out = append(out, p)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Vote store ------------------------------------------------------------
|
|
||||||
|
|
||||||
var voteKeyPrefix = []byte("vote/")
|
|
||||||
|
|
||||||
func voteKey(voteID string) []byte {
|
|
||||||
return append(voteKeyPrefix, []byte(voteID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetVote loads a Vote by vote-id. Returns the Vote and true if found,
|
|
||||||
// or zero value + false if not.
|
|
||||||
func (k Keeper) GetVote(ctx sdk.Context, voteID string) (types.Vote, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(voteKey(voteID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.Vote{}, false
|
|
||||||
}
|
|
||||||
var v types.Vote
|
|
||||||
if err := json.Unmarshal(bz, &v); err != nil {
|
|
||||||
return types.Vote{}, false
|
|
||||||
}
|
|
||||||
return v, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetVote persists a Vote by vote-id.
|
|
||||||
func (k Keeper) SetVote(ctx sdk.Context, v types.Vote) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(v)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("council: marshal vote %q: %v", v.VoteID, err))
|
|
||||||
}
|
|
||||||
store.Set(voteKey(v.VoteID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllVotes returns all persisted Vote records (iteration helper).
|
|
||||||
func (k Keeper) AllVotes(ctx sdk.Context) []types.Vote {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(voteKeyPrefix, prefixEnd(voteKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.Vote{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var v types.Vote
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &v); err == nil {
|
|
||||||
out = append(out, v)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// VotesForProposal returns all persisted Vote records for a given
|
|
||||||
// proposal-id (iteration + filter helper; used by the TallyProposal
|
|
||||||
// handler to compute the tally).
|
|
||||||
func (k Keeper) VotesForProposal(ctx sdk.Context, proposalID string) []types.Vote {
|
|
||||||
all := k.AllVotes(ctx)
|
|
||||||
out := []types.Vote{}
|
|
||||||
for _, v := range all {
|
|
||||||
if v.ProposalID == proposalID {
|
|
||||||
out = append(out, v)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Council store (for SubmitProposal target validation) ------------------
|
|
||||||
|
|
||||||
var councilKeyPrefix = []byte("council/")
|
|
||||||
|
|
||||||
func councilKey(councilID string) []byte {
|
|
||||||
return append(councilKeyPrefix, []byte(councilID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetCouncil loads a Council by council-id from the runtime store.
|
|
||||||
// Returns the Council and true if found, or zero value + false if not.
|
|
||||||
// The Council store is the runtime home for the v0.2 skeleton Council
|
|
||||||
// struct (the v0.2 skeleton had Council only in genesis; v0.5 promotes
|
|
||||||
// it to the runtime store so the SubmitProposal handler can validate the
|
|
||||||
// proposal-target against the Council's stand-id-ref / guild-id-ref).
|
|
||||||
func (k Keeper) GetCouncil(ctx sdk.Context, councilID string) (types.Council, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(councilKey(councilID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.Council{}, false
|
|
||||||
}
|
|
||||||
var c types.Council
|
|
||||||
if err := json.Unmarshal(bz, &c); err != nil {
|
|
||||||
return types.Council{}, false
|
|
||||||
}
|
|
||||||
return c, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetCouncil persists a Council by council-id (runtime store home for the
|
|
||||||
// v0.2 skeleton Council struct; the simtest seeds a Council for the
|
|
||||||
// SubmitProposal target validation).
|
|
||||||
func (k Keeper) SetCouncil(ctx sdk.Context, c types.Council) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(c)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("council: marshal council %q: %v", c.CouncilID, err))
|
|
||||||
}
|
|
||||||
store.Set(councilKey(c.CouncilID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// prefixEnd returns the key that sorts immediately after all keys sharing
|
|
||||||
// the given prefix (the standard prefix-iteration end key: increment the
|
|
||||||
// last byte, drop overflow). Used for store.Iterator(start, prefixEnd(start))
|
|
||||||
// prefix scans.
|
|
||||||
func prefixEnd(prefix []byte) []byte {
|
|
||||||
if len(prefix) == 0 {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
end := make([]byte, len(prefix))
|
|
||||||
copy(end, prefix)
|
|
||||||
for i := len(end) - 1; i >= 0; i-- {
|
|
||||||
end[i]++
|
|
||||||
if end[i] != 0 {
|
|
||||||
return end
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// All bytes were 0xFF; return nil (iterate to end of store).
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@@ -1,384 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/council/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// msg_server.go implements the council module's Proposal-lifecycle MsgServer
|
|
||||||
// (P7-02-01, REQ-039, D-060; G-023 ownership split: cosmos-engineer
|
|
||||||
// scaffolds the file structure + method signatures; backend-engineer
|
|
||||||
// implements the handler logic bodies). The MsgServer wraps the Keeper +
|
|
||||||
// the WatcherKeeper, StandKeeper, and GuildKeeper expected-keeper shims
|
|
||||||
// (already on the Keeper).
|
|
||||||
//
|
|
||||||
// Each method returns a (*Response, error). Handler state-machine ordering
|
|
||||||
// is enforced: ValidateBasic → keeper authz → state mutation →
|
|
||||||
// ctx.EventManager().EmitEvent.
|
|
||||||
//
|
|
||||||
// Lifecycle (REQ-039, D-060, vision §13):
|
|
||||||
// - SubmitProposal → creates a Proposal status=Pending (ValidateBasic
|
|
||||||
// already rejected MissionLockAmendment-Rejected
|
|
||||||
// per D-064 — the handler never sees that kind).
|
|
||||||
// - Vote → records a VoteOption; Veto requires Watcher authz
|
|
||||||
// via the WatcherKeeper shim (single-Veto-no-block;
|
|
||||||
// the Veto quorum check is at TALLY, not at VOTE).
|
|
||||||
// Vote on a non-Active proposal REJECTED. Vote after
|
|
||||||
// the voting-deadline REJECTED.
|
|
||||||
// - TallyProposal → closes the voting deadline, computes the tally,
|
|
||||||
// transitions Succeeded/Failed. Veto semantics: a
|
|
||||||
// single Veto does NOT block (anti-greed, vision
|
|
||||||
// §19); the proposal transitions to Failed only if
|
|
||||||
// NoWithVeto >= WatcherVetoQuorum (default 6,
|
|
||||||
// D-065/A-574). The v0.2 TallyResult.NoWithVeto
|
|
||||||
// field (zero-locked in v0.2) is now POPULATED by
|
|
||||||
// Watcher Vetos.
|
|
||||||
//
|
|
||||||
// Proposal EXECUTION (auto-executing a passed proposal) is NOT in v0.5 —
|
|
||||||
// the handler records the tally result but does NOT auto-execute (a
|
|
||||||
// v0.6+ concern; the Executed status exists in the enum but the handler
|
|
||||||
// does not transition to it).
|
|
||||||
//
|
|
||||||
// Nil-shim behavior (simtest wiring): a nil WatcherKeeper shim skips the
|
|
||||||
// Veto authz (the handler still records the Veto — the simtest documents
|
|
||||||
// the wiring contract). A nil StandKeeper / GuildKeeper shim skips the
|
|
||||||
// proposal-target validation (the handler still creates the Proposal — the
|
|
||||||
// simtest documents the wiring contract).
|
|
||||||
|
|
||||||
// msgServer is the concrete MsgServer implementation wrapping the Keeper.
|
|
||||||
type msgServer struct {
|
|
||||||
Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewMsgServerImpl returns the council MsgServer for the provided Keeper.
|
|
||||||
func NewMsgServerImpl(k Keeper) types.MsgServer {
|
|
||||||
return &msgServer{Keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
var _ types.MsgServer = msgServer{}
|
|
||||||
|
|
||||||
// unwrapCtx extracts the sdk.Context from the interface-typed ctx.
|
|
||||||
func unwrapCtx(ctx interface{}) sdk.Context {
|
|
||||||
if c, ok := ctx.(sdk.Context); ok {
|
|
||||||
return c
|
|
||||||
}
|
|
||||||
panic(fmt.Sprintf("council: expected sdk.Context, got %T", ctx))
|
|
||||||
}
|
|
||||||
|
|
||||||
// nowUnix returns the current block time as unix seconds from the ctx.
|
|
||||||
func nowUnix(ctx sdk.Context) int64 {
|
|
||||||
return ctx.BlockTime().Unix()
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- SubmitProposal (creates Proposal status=Pending) ----------------------
|
|
||||||
|
|
||||||
// SubmitProposal creates a Proposal (status=Pending). The handler
|
|
||||||
// enforces:
|
|
||||||
// 1. ValidateBasic (stateless — MissionLockAmendment-Rejected is
|
|
||||||
// REJECTED here per D-064/A-572; the message never reaches this
|
|
||||||
// handler with that kind).
|
|
||||||
// 2. Idempotency: proposal-id must not already exist.
|
|
||||||
// 3. The Council must exist in the runtime store.
|
|
||||||
// 4. Proposal-target validation via the StandKeeper / GuildKeeper shim:
|
|
||||||
// a Stand-kind Proposal requires the Council's stand-id-ref to
|
|
||||||
// reference a real Stand; a Guild-kind Proposal requires the
|
|
||||||
// Council's guild-id-ref to reference a real Guild. A nil shim
|
|
||||||
// skips the check (simtest wiring); a non-nil shim that returns false
|
|
||||||
// REJECTS the submission. A Mesh-kind Proposal has no target ref.
|
|
||||||
//
|
|
||||||
// On success the Proposal is persisted with status=Pending and an event
|
|
||||||
// is emitted.
|
|
||||||
func (s msgServer) SubmitProposal(ctx interface{}, msg *types.MsgSubmitProposal) (*types.MsgSubmitProposalResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Idempotency: proposal-id must not already exist.
|
|
||||||
if _, ok := s.Keeper.GetProposal(sdkCtx, msg.ProposalID); ok {
|
|
||||||
return nil, fmt.Errorf("council: proposal %q already exists", msg.ProposalID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The Council must exist in the runtime store.
|
|
||||||
council, ok := s.Keeper.GetCouncil(sdkCtx, msg.CouncilID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("council: council %q not found", msg.CouncilID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Proposal-target validation via the StandKeeper / GuildKeeper shim.
|
|
||||||
// The kind must be consistent with the Council's kind (a Stand-kind
|
|
||||||
// Proposal targets a Stand Council; a Guild-kind Proposal targets a
|
|
||||||
// Guild Council; a Mesh-kind Proposal targets a Mesh Council). A nil
|
|
||||||
// shim skips the check (simtest wiring).
|
|
||||||
switch msg.Kind {
|
|
||||||
case types.ProposalKindStand:
|
|
||||||
if council.Kind != types.CouncilStand {
|
|
||||||
return nil, fmt.Errorf("council: Stand-kind proposal targets a non-Stand council %q (kind %q)", msg.CouncilID, council.Kind)
|
|
||||||
}
|
|
||||||
if s.Keeper.standKeeper != nil {
|
|
||||||
if !s.Keeper.standKeeper.StandExists(council.StandIDRef) {
|
|
||||||
return nil, fmt.Errorf("council: stand %q does not exist (SubmitProposal rejected — stand-target validation)", council.StandIDRef)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
case types.ProposalKindGuild:
|
|
||||||
if council.Kind != types.CouncilGuild {
|
|
||||||
return nil, fmt.Errorf("council: Guild-kind proposal targets a non-Guild council %q (kind %q)", msg.CouncilID, council.Kind)
|
|
||||||
}
|
|
||||||
if s.Keeper.guildKeeper != nil {
|
|
||||||
if !s.Keeper.guildKeeper.GuildExists(council.GuildIDRef) {
|
|
||||||
return nil, fmt.Errorf("council: guild %q does not exist (SubmitProposal rejected — guild-target validation)", council.GuildIDRef)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
case types.ProposalKindMesh:
|
|
||||||
if council.Kind != types.CouncilMesh {
|
|
||||||
return nil, fmt.Errorf("council: Mesh-kind proposal targets a non-Mesh council %q (kind %q)", msg.CouncilID, council.Kind)
|
|
||||||
}
|
|
||||||
// Mesh Council has no target ref.
|
|
||||||
default:
|
|
||||||
// ProposalMissionLockAmendmentRejected never reaches here
|
|
||||||
// (ValidateBasic rejects it — D-064). The default is defence in
|
|
||||||
// depth.
|
|
||||||
return nil, fmt.Errorf("council: proposal kind %q not valid for submission (D-064 — MissionLockAmendment-Rejected rejected at ValidateBasic)", msg.Kind)
|
|
||||||
}
|
|
||||||
|
|
||||||
proposal := types.Proposal{
|
|
||||||
ProposalID: msg.ProposalID,
|
|
||||||
CouncilID: msg.CouncilID,
|
|
||||||
Kind: msg.Kind,
|
|
||||||
ProposerReach: msg.ProposerReach,
|
|
||||||
SubmitTime: msg.SubmitTime,
|
|
||||||
VotingDeadline: msg.VotingDeadline,
|
|
||||||
Status: types.ProposalStatusPending,
|
|
||||||
Tally: types.TallyResult{}, // zero-value: Yes=0, No=0, Abstain=0, NoWithVeto=0
|
|
||||||
}
|
|
||||||
s.Keeper.SetProposal(sdkCtx, proposal)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"council.proposal_submitted",
|
|
||||||
sdk.NewAttribute("proposal_id", msg.ProposalID),
|
|
||||||
sdk.NewAttribute("council_id", msg.CouncilID),
|
|
||||||
sdk.NewAttribute("kind", string(msg.Kind)),
|
|
||||||
sdk.NewAttribute("proposer_reach", msg.ProposerReach),
|
|
||||||
sdk.NewAttribute("status", string(types.ProposalStatusPending)),
|
|
||||||
))
|
|
||||||
return &types.MsgSubmitProposalResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Vote (records a VoteOption; Veto requires Watcher authz) --------------
|
|
||||||
|
|
||||||
// Vote records a Vote on a Proposal. The handler enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. Idempotency: vote-id must not already exist.
|
|
||||||
// 3. The Proposal must exist.
|
|
||||||
// 4. The Proposal must be Active (vote-on-non-Active REJECTED — the
|
|
||||||
// simtest transitions Pending → Active before voting).
|
|
||||||
// 5. The voting deadline must not have passed (vote-after-deadline
|
|
||||||
// REJECTED).
|
|
||||||
// 6. Veto authz via the WatcherKeeper shim: if Option == VoteOptionVeto,
|
|
||||||
// the voter-reach must be a Watcher (IsWatcher). A nil shim skips the
|
|
||||||
// authz (simtest wiring); a non-nil shim that returns false REJECTS
|
|
||||||
// the Veto (the Vote is NOT recorded). The Veto quorum check is at
|
|
||||||
// TALLY, not at VOTE — the single-Veto-no-block rule (anti-greed,
|
|
||||||
// vision §19) means a single Veto is recorded but does NOT block;
|
|
||||||
// the quorum (default 6 per D-065/A-574) must be met at tally to FAIL
|
|
||||||
// the proposal.
|
|
||||||
//
|
|
||||||
// On success the Vote is persisted, the Proposal's Tally is updated
|
|
||||||
// (Yes/No/Abstain/NoWithVeto counts incremented), and an event is emitted.
|
|
||||||
func (s msgServer) Vote(ctx interface{}, msg *types.MsgVote) (*types.MsgVoteResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Idempotency: vote-id must not already exist.
|
|
||||||
if _, ok := s.Keeper.GetVote(sdkCtx, msg.VoteID); ok {
|
|
||||||
return nil, fmt.Errorf("council: vote %q already exists", msg.VoteID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The Proposal must exist.
|
|
||||||
proposal, ok := s.Keeper.GetProposal(sdkCtx, msg.ProposalID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("council: proposal %q not found", msg.ProposalID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The Proposal must be Active (vote-on-non-Active REJECTED).
|
|
||||||
if proposal.Status != types.ProposalStatusActive {
|
|
||||||
return nil, fmt.Errorf("council: proposal %q status %q is not Active (vote rejected)", msg.ProposalID, proposal.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The voting deadline must not have passed (vote-after-deadline
|
|
||||||
// REJECTED). now = block time; if now >= VotingDeadline, the window
|
|
||||||
// is closed.
|
|
||||||
now := nowUnix(sdkCtx)
|
|
||||||
if now >= proposal.VotingDeadline {
|
|
||||||
return nil, fmt.Errorf("council: proposal %q voting deadline %d has passed (now %d) — vote rejected", msg.ProposalID, proposal.VotingDeadline, now)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Veto authz via the WatcherKeeper shim. If Option == VoteOptionVeto,
|
|
||||||
// the voter-reach must be a Watcher. A nil shim skips the authz
|
|
||||||
// (simtest wiring); a non-nil shim that returns false REJECTS the
|
|
||||||
// Veto (the Vote is NOT recorded). The Veto quorum check is at
|
|
||||||
// TALLY, not at VOTE.
|
|
||||||
if msg.Option == types.VoteOptionVeto && s.Keeper.watcherKeeper != nil {
|
|
||||||
if !s.Keeper.watcherKeeper.IsWatcher(msg.VoterReach) {
|
|
||||||
return nil, fmt.Errorf("council: voter %q is not a Watcher (Veto requires Watcher authz — D-065/A-574)", msg.VoterReach)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Record the Vote.
|
|
||||||
vote := types.Vote{
|
|
||||||
VoteID: msg.VoteID,
|
|
||||||
ProposalID: msg.ProposalID,
|
|
||||||
VoterReach: msg.VoterReach,
|
|
||||||
Option: msg.Option,
|
|
||||||
Timestamp: now,
|
|
||||||
}
|
|
||||||
s.Keeper.SetVote(sdkCtx, vote)
|
|
||||||
|
|
||||||
// Update the Proposal's running Tally.
|
|
||||||
switch msg.Option {
|
|
||||||
case types.VoteOptionYes:
|
|
||||||
proposal.Tally.Yes++
|
|
||||||
case types.VoteOptionNo:
|
|
||||||
proposal.Tally.No++
|
|
||||||
case types.VoteOptionAbstain:
|
|
||||||
proposal.Tally.Abstain++
|
|
||||||
case types.VoteOptionVeto:
|
|
||||||
// NoWithVeto is POPULATED by Watcher Vetos (D-060 — the v0.2
|
|
||||||
// zero-locked field is now populated; G-017 reconciles the v0.2
|
|
||||||
// regression: the DEFAULT tally has NoWithVeto=0, but a tally
|
|
||||||
// after a Watcher Veto quorum has NoWithVeto > 0).
|
|
||||||
proposal.Tally.NoWithVeto++
|
|
||||||
}
|
|
||||||
proposal.Tally.Total++
|
|
||||||
s.Keeper.SetProposal(sdkCtx, proposal)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"council.vote_cast",
|
|
||||||
sdk.NewAttribute("vote_id", msg.VoteID),
|
|
||||||
sdk.NewAttribute("proposal_id", msg.ProposalID),
|
|
||||||
sdk.NewAttribute("voter_reach", msg.VoterReach),
|
|
||||||
sdk.NewAttribute("option", string(msg.Option)),
|
|
||||||
))
|
|
||||||
return &types.MsgVoteResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- TallyProposal (close voting, compute tally, transition) ---------------
|
|
||||||
|
|
||||||
// TallyProposal tallies a Proposal: closes the voting deadline, computes
|
|
||||||
// the Yes/No/Abstain/Veto tally, and transitions the Proposal to Succeeded
|
|
||||||
// (Yes quorum met, Veto quorum NOT met) or Failed (No quorum OR Veto
|
|
||||||
// quorum met — D-065/A-574). The handler enforces:
|
|
||||||
// 1. ValidateBasic (stateless).
|
|
||||||
// 2. The Proposal must exist.
|
|
||||||
// 3. The voting deadline must have passed (tally-before-deadline
|
|
||||||
// REJECTED — the tally closes the window).
|
|
||||||
// 4. The Proposal must be Active (tally-on-non-Active REJECTED — a
|
|
||||||
// Pending proposal has not opened voting; a Succeeded/Failed/
|
|
||||||
// Executed proposal is already tallied).
|
|
||||||
//
|
|
||||||
// Veto semantics (D-065/A-574): a single Veto does NOT block (anti-greed,
|
|
||||||
// vision §19); the proposal transitions to Failed only if
|
|
||||||
// NoWithVeto >= WatcherVetoQuorum (default 6). The handler reads the
|
|
||||||
// WatcherVetoQuorum from the Params (the Keeper holds the Params); the
|
|
||||||
// simtest overrides the Params to test the quorum boundary.
|
|
||||||
//
|
|
||||||
// On success the Proposal's Tally is finalized (the running tally is
|
|
||||||
// already maintained by Vote; the handler recomputes from the Vote
|
|
||||||
// store for defence in depth), the Status transitions to Succeeded or
|
|
||||||
// Failed, and an event is emitted. No auto-execution (the Executed
|
|
||||||
// status exists in the enum but the handler does not transition to it —
|
|
||||||
// execution is v0.6+).
|
|
||||||
func (s msgServer) TallyProposal(ctx interface{}, msg *types.MsgTallyProposal) (*types.MsgTallyProposalResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// The Proposal must exist.
|
|
||||||
proposal, ok := s.Keeper.GetProposal(sdkCtx, msg.ProposalID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("council: proposal %q not found", msg.ProposalID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The Proposal must be Active (tally-on-non-Active REJECTED).
|
|
||||||
if proposal.Status != types.ProposalStatusActive {
|
|
||||||
return nil, fmt.Errorf("council: proposal %q status %q is not Active (tally rejected)", msg.ProposalID, proposal.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The voting deadline must have passed (tally-before-deadline
|
|
||||||
// REJECTED). now = block time; if now < VotingDeadline, the window
|
|
||||||
// is still open.
|
|
||||||
now := nowUnix(sdkCtx)
|
|
||||||
if now < proposal.VotingDeadline {
|
|
||||||
return nil, fmt.Errorf("council: proposal %q voting deadline %d not yet reached (now %d) — tally rejected", msg.ProposalID, proposal.VotingDeadline, now)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Recompute the tally from the Vote store (defence in depth — the
|
|
||||||
// running tally in proposal.Tally should already match, but the
|
|
||||||
// handler recomputes to guard against any drift).
|
|
||||||
votes := s.Keeper.VotesForProposal(sdkCtx, msg.ProposalID)
|
|
||||||
tally := types.TallyResult{}
|
|
||||||
for _, v := range votes {
|
|
||||||
switch v.Option {
|
|
||||||
case types.VoteOptionYes:
|
|
||||||
tally.Yes++
|
|
||||||
case types.VoteOptionNo:
|
|
||||||
tally.No++
|
|
||||||
case types.VoteOptionAbstain:
|
|
||||||
tally.Abstain++
|
|
||||||
case types.VoteOptionVeto:
|
|
||||||
tally.NoWithVeto++
|
|
||||||
}
|
|
||||||
tally.Total++
|
|
||||||
}
|
|
||||||
|
|
||||||
// Veto quorum check (D-065/A-574). The WatcherVetoQuorum is from the
|
|
||||||
// Params (default 6). A single Veto does NOT block (anti-greed,
|
|
||||||
// vision §19); the proposal transitions to Failed only if
|
|
||||||
// NoWithVeto >= WatcherVetoQuorum.
|
|
||||||
vetoQuorum := s.Keeper.GetParams().WatcherVetoQuorum
|
|
||||||
if vetoQuorum == 0 {
|
|
||||||
// Defence in depth: a zero quorum (e.g., from a zero-value Params
|
|
||||||
// not set via DefaultParams) would block on any Veto, violating
|
|
||||||
// the single-Veto-no-block rule. Fall back to the default (6).
|
|
||||||
vetoQuorum = types.WatcherVetoQuorumDefault
|
|
||||||
}
|
|
||||||
|
|
||||||
// Determine the outcome.
|
|
||||||
// - Veto quorum met → Failed (D-065/A-574).
|
|
||||||
// - Else: Yes > No (Abstain excluded) → Succeeded; else → Failed.
|
|
||||||
// A tie (Yes == No) → Failed (the proposal does not pass).
|
|
||||||
vetoQuorumMet := tally.NoWithVeto >= uint64(vetoQuorum)
|
|
||||||
var newStatus types.ProposalStatus
|
|
||||||
if vetoQuorumMet {
|
|
||||||
newStatus = types.ProposalStatusFailed
|
|
||||||
} else if tally.Yes > tally.No {
|
|
||||||
newStatus = types.ProposalStatusSucceeded
|
|
||||||
} else {
|
|
||||||
newStatus = types.ProposalStatusFailed
|
|
||||||
}
|
|
||||||
|
|
||||||
// Finalize the tally on the Proposal.
|
|
||||||
proposal.Tally = tally
|
|
||||||
proposal.Tally.QuorumMet = (tally.Yes + tally.No + tally.Abstain + tally.NoWithVeto) > 0
|
|
||||||
proposal.Status = newStatus
|
|
||||||
s.Keeper.SetProposal(sdkCtx, proposal)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"council.proposal_tallied",
|
|
||||||
sdk.NewAttribute("proposal_id", msg.ProposalID),
|
|
||||||
sdk.NewAttribute("yes", fmt.Sprintf("%d", tally.Yes)),
|
|
||||||
sdk.NewAttribute("no", fmt.Sprintf("%d", tally.No)),
|
|
||||||
sdk.NewAttribute("abstain", fmt.Sprintf("%d", tally.Abstain)),
|
|
||||||
sdk.NewAttribute("nowithveto", fmt.Sprintf("%d", tally.NoWithVeto)),
|
|
||||||
sdk.NewAttribute("total", fmt.Sprintf("%d", tally.Total)),
|
|
||||||
sdk.NewAttribute("veto_quorum", fmt.Sprintf("%d", vetoQuorum)),
|
|
||||||
sdk.NewAttribute("status", string(newStatus)),
|
|
||||||
))
|
|
||||||
return &types.MsgTallyProposalResponse{}, nil
|
|
||||||
}
|
|
||||||
@@ -1,966 +0,0 @@
|
|||||||
package keeper_test
|
|
||||||
|
|
||||||
// msg_server_simtest_test.go is the x/council keeper simtest (P7-04-01,
|
|
||||||
// REQ-039, D-060).
|
|
||||||
//
|
|
||||||
// D-054: simtest-grade — in-memory sdk.Context + dbm in-memory store, no
|
|
||||||
// real watcher/stand/guild keepers. The simtest wires the expected-keeper
|
|
||||||
// shims (WatcherKeeper, StandKeeper, GuildKeeper) to in-test stubs
|
|
||||||
// (G-003 test exemption: the test imports x/council/keeper + defines stub
|
|
||||||
// types that satisfy the interfaces; no production struct imports across
|
|
||||||
// x/<module>/types).
|
|
||||||
//
|
|
||||||
// Coverage (REQ-039 lifecycle Pending → Active → Vote → Tally →
|
|
||||||
// Succeeded/Failed):
|
|
||||||
// - Full success lifecycle: Submit (Pending) → Active → Vote (Yes) →
|
|
||||||
// Tally → Succeeded.
|
|
||||||
// - MissionLockAmendment-Rejected kind REJECTED at ValidateBasic
|
|
||||||
// (D-064/A-572 — the message never reaches the handler; the keeper
|
|
||||||
// Proposal store stays empty).
|
|
||||||
// - Veto semantics (D-065/A-574):
|
|
||||||
// - Single Veto does NOT block (anti-greed, vision §19): a single
|
|
||||||
// Veto + majority Yes → Succeeded.
|
|
||||||
// - Veto quorum (default 6) → Failed: 6 Vetos → Failed.
|
|
||||||
// - Quorum boundary: quorum-1 = 5 Vetos (below default 6) + majority
|
|
||||||
// Yes → Succeeded; quorum-6 = 6 Vetos → Failed.
|
|
||||||
// - Watcher authz for Veto: a non-Watcher casting Veto is REJECTED
|
|
||||||
// (the Vote is NOT recorded).
|
|
||||||
// - Vote-on-non-Active REJECTED (vote on a Pending proposal → error).
|
|
||||||
// - Vote-after-deadline REJECTED (now >= VotingDeadline → error).
|
|
||||||
// - Tally-before-deadline REJECTED (now < VotingDeadline → error).
|
|
||||||
// - Tally-on-non-Active REJECTED (tally on a Pending proposal → error).
|
|
||||||
// - Idempotency: duplicate proposal-id + duplicate vote-id → error.
|
|
||||||
// - NotFound: Vote/Tally on a missing proposal-id → error.
|
|
||||||
// - Proposal-target validation: Stand-kind Proposal on a non-Stand
|
|
||||||
// Council REJECTED; Guild-kind Proposal on a non-Guild Council
|
|
||||||
// REJECTED; Stand-kind Proposal with a non-existent stand-id-ref
|
|
||||||
// REJECTED (via the StandKeeper stub).
|
|
||||||
// - ValidateBasic: each Msg* ValidateBasic error path.
|
|
||||||
//
|
|
||||||
// Coverage target: ≥80% on x/council/keeper.
|
|
||||||
|
|
||||||
import (
|
|
||||||
"testing"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
"cosmossdk.io/log"
|
|
||||||
"cosmossdk.io/store"
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
cmtproto "github.com/cometbft/cometbft/proto/tendermint/types"
|
|
||||||
dbm "github.com/cosmos/cosmos-db"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
codectypes "github.com/cosmos/cosmos-sdk/codec/types"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/council/keeper"
|
|
||||||
"github.com/oy/openyield/x/council/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// --- Stub expected-keepers (G-003 test exemption) ---------------------------
|
|
||||||
|
|
||||||
// stubWatcherKeeper satisfies types.WatcherKeeper for the simtest. It
|
|
||||||
// records IsWatcher + CountWatchers calls for assertion and returns the
|
|
||||||
// configured watcher-set + per-reach-id watcher membership.
|
|
||||||
type stubWatcherKeeper struct {
|
|
||||||
isWatcher map[string]bool // reach-id → is-watcher
|
|
||||||
watcherCount int // total Watcher set size (default 9 per REQ-004)
|
|
||||||
calls []string // recorded IsWatcher reach-ids
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *stubWatcherKeeper) IsWatcher(reachID string) bool {
|
|
||||||
s.calls = append(s.calls, reachID)
|
|
||||||
if s.isWatcher != nil {
|
|
||||||
return s.isWatcher[reachID]
|
|
||||||
}
|
|
||||||
return true // default: all are Watchers (simtest wiring)
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *stubWatcherKeeper) CountWatchers() int {
|
|
||||||
if s.watcherCount == 0 {
|
|
||||||
return 9 // REQ-004: 9 Watchers
|
|
||||||
}
|
|
||||||
return s.watcherCount
|
|
||||||
}
|
|
||||||
|
|
||||||
// stubStandKeeper satisfies types.StandKeeper for the simtest. Returns
|
|
||||||
// the configured existence per stand-id (default: exists=true).
|
|
||||||
type stubStandKeeper struct {
|
|
||||||
exists map[string]bool
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *stubStandKeeper) StandExists(standID string) bool {
|
|
||||||
if s.exists != nil {
|
|
||||||
return s.exists[standID]
|
|
||||||
}
|
|
||||||
return true // default: exists (simtest wiring)
|
|
||||||
}
|
|
||||||
|
|
||||||
// stubGuildKeeper satisfies types.GuildKeeper for the simtest.
|
|
||||||
type stubGuildKeeper struct {
|
|
||||||
exists map[string]bool
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *stubGuildKeeper) GuildExists(guildID string) bool {
|
|
||||||
if s.exists != nil {
|
|
||||||
return s.exists[guildID]
|
|
||||||
}
|
|
||||||
return true // default: exists (simtest wiring)
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Simtest context helper --------------------------------------------------
|
|
||||||
|
|
||||||
// newSimtestContext constructs an in-memory sdk.Context with a KVStore
|
|
||||||
// mounted at the council store key. D-054: in-memory, no real
|
|
||||||
// watcher/stand/guild keepers. Returns the ctx, the stub WatcherKeeper,
|
|
||||||
// the stub StandKeeper, the stub GuildKeeper, and the Keeper.
|
|
||||||
func newSimtestContext(t *testing.T) (sdk.Context, *stubWatcherKeeper, *stubStandKeeper, *stubGuildKeeper, keeper.Keeper) {
|
|
||||||
t.Helper()
|
|
||||||
db := dbm.NewMemDB()
|
|
||||||
cdc := newTestCodec()
|
|
||||||
storeKey := storetypes.NewKVStoreKey(types.StoreKey)
|
|
||||||
cms := store.NewCommitMultiStore(db, log.NewNopLogger(), nil)
|
|
||||||
cms.MountStoreWithDB(storeKey, storetypes.StoreTypeDB, nil)
|
|
||||||
if err := cms.LoadLatestVersion(); err != nil {
|
|
||||||
t.Fatalf("load latest version: %v", err)
|
|
||||||
}
|
|
||||||
// Block time set to a fixed unix second so lifecycle timestamps are
|
|
||||||
// deterministic (now = 1000).
|
|
||||||
ctx := sdk.NewContext(cms, cmtproto.Header{Time: time.Unix(1000, 0)}, false, log.NewNopLogger())
|
|
||||||
|
|
||||||
wk := &stubWatcherKeeper{}
|
|
||||||
sk := &stubStandKeeper{}
|
|
||||||
gk := &stubGuildKeeper{}
|
|
||||||
k := keeper.NewKeeper(cdc, storeKey, wk, sk, gk)
|
|
||||||
return ctx, wk, sk, gk, k
|
|
||||||
}
|
|
||||||
|
|
||||||
// newTestCodec constructs a minimal codec for the simtest.
|
|
||||||
func newTestCodec() codec.Codec {
|
|
||||||
registry := codectypes.NewInterfaceRegistry()
|
|
||||||
return codec.NewProtoCodec(registry)
|
|
||||||
}
|
|
||||||
|
|
||||||
// hasEvent reports whether ctx emitted an event of the given type.
|
|
||||||
func hasEvent(ctx sdk.Context, eventType string) bool {
|
|
||||||
for _, ev := range ctx.EventManager().Events() {
|
|
||||||
if ev.Type == eventType {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
|
|
||||||
// eventAttr returns the value of an attribute on the last event of the
|
|
||||||
// given type, or "" if not found.
|
|
||||||
func eventAttr(ctx sdk.Context, eventType, attrKey string) string {
|
|
||||||
for _, ev := range ctx.EventManager().Events() {
|
|
||||||
if ev.Type == eventType {
|
|
||||||
for _, a := range ev.Attributes {
|
|
||||||
if string(a.Key) == attrKey {
|
|
||||||
return string(a.Value)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return ""
|
|
||||||
}
|
|
||||||
|
|
||||||
// seedCouncil seeds a Council into the runtime store for the SubmitProposal
|
|
||||||
// target validation. Returns the Council.
|
|
||||||
func seedCouncil(k keeper.Keeper, ctx sdk.Context, councilID string, kind types.CouncilKind, standRef, guildRef string) types.Council {
|
|
||||||
c := types.Council{
|
|
||||||
CouncilID: councilID,
|
|
||||||
Kind: kind,
|
|
||||||
StandIDRef: standRef,
|
|
||||||
GuildIDRef: guildRef,
|
|
||||||
Members: []types.CouncilMember{{ReachID: "reach:member-1", VoiceWeight: 1, JoinedAt: 0}},
|
|
||||||
VoiceThreshold: 1,
|
|
||||||
}
|
|
||||||
k.SetCouncil(ctx, c)
|
|
||||||
return c
|
|
||||||
}
|
|
||||||
|
|
||||||
// activateProposal transitions a Pending Proposal to Active (the simtest
|
|
||||||
// helper — the v0.5 keeper does not expose an Activate message; the
|
|
||||||
// handler creates Pending and the tally closes Active; the Pending →
|
|
||||||
// Active transition is the voting-window-open transition, which in a
|
|
||||||
// real chain would be triggered by the block height crossing the
|
|
||||||
// submit-time. For the simtest, the helper flips the status directly to
|
|
||||||
// enable voting).
|
|
||||||
func activateProposal(k keeper.Keeper, ctx sdk.Context, proposalID string) types.Proposal {
|
|
||||||
p, ok := k.GetProposal(ctx, proposalID)
|
|
||||||
if !ok {
|
|
||||||
panic("activateProposal: proposal not found: " + proposalID)
|
|
||||||
}
|
|
||||||
p.Status = types.ProposalStatusActive
|
|
||||||
k.SetProposal(ctx, p)
|
|
||||||
return p
|
|
||||||
}
|
|
||||||
|
|
||||||
// newSubmitMsg returns a valid MsgSubmitProposal for a Mesh Council.
|
|
||||||
func newSubmitMsg(proposalID, councilID string, kind types.ProposalKind, deadline int64) *types.MsgSubmitProposal {
|
|
||||||
return &types.MsgSubmitProposal{
|
|
||||||
ProposalID: proposalID,
|
|
||||||
CouncilID: councilID,
|
|
||||||
Kind: kind,
|
|
||||||
ProposerReach: "reach:prop",
|
|
||||||
SubmitTime: 500,
|
|
||||||
VotingDeadline: deadline,
|
|
||||||
Signer: "reach:prop",
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Full success lifecycle: Pending → Active → Vote → Tally → Succeeded -------
|
|
||||||
|
|
||||||
// TestProposalLifecycleFullSuccess asserts the full success lifecycle:
|
|
||||||
// Submit (Pending) → Active → Vote (Yes majority) → Tally → Succeeded.
|
|
||||||
func TestProposalLifecycleFullSuccess(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
|
|
||||||
// Submit → Pending.
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p1", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
p, ok := k.GetProposal(ctx, "p1")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("proposal not found after submit")
|
|
||||||
}
|
|
||||||
if p.Status != types.ProposalStatusPending {
|
|
||||||
t.Errorf("status = %q, want Pending", p.Status)
|
|
||||||
}
|
|
||||||
if p.Kind != types.ProposalKindMesh {
|
|
||||||
t.Errorf("kind = %q, want Mesh", p.Kind)
|
|
||||||
}
|
|
||||||
if !hasEvent(ctx, "council.proposal_submitted") {
|
|
||||||
t.Error("proposal_submitted event not emitted")
|
|
||||||
}
|
|
||||||
|
|
||||||
// Pending → Active (simtest helper).
|
|
||||||
activateProposal(k, ctx, "p1")
|
|
||||||
|
|
||||||
// Vote (3 Yes, 1 No → Yes majority → Succeeded on tally).
|
|
||||||
for i, voter := range []string{"reach:a", "reach:b", "reach:c"} {
|
|
||||||
if _, err := srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-yes-" + string(rune('A'+i)),
|
|
||||||
ProposalID: "p1", VoterReach: voter, Option: types.VoteOptionYes, Signer: voter,
|
|
||||||
}); err != nil {
|
|
||||||
t.Fatalf("Vote[%d]: %v", i, err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if _, err := srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-no-1", ProposalID: "p1", VoterReach: "reach:d", Option: types.VoteOptionNo, Signer: "reach:d",
|
|
||||||
}); err != nil {
|
|
||||||
t.Fatalf("Vote No: %v", err)
|
|
||||||
}
|
|
||||||
if !hasEvent(ctx, "council.vote_cast") {
|
|
||||||
t.Error("vote_cast event not emitted")
|
|
||||||
}
|
|
||||||
|
|
||||||
// Advance block time past the voting deadline (now=1000 < 2000; need
|
|
||||||
// now >= 2000 to tally). Re-create the ctx with a later block time.
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
|
|
||||||
// Tally → Succeeded (Yes=3 > No=1, no Vetos).
|
|
||||||
if _, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p1", Signer: "reach:tally"}); err != nil {
|
|
||||||
t.Fatalf("TallyProposal: %v", err)
|
|
||||||
}
|
|
||||||
p, _ = k.GetProposal(ctx, "p1")
|
|
||||||
if p.Status != types.ProposalStatusSucceeded {
|
|
||||||
t.Errorf("status = %q, want Succeeded (Yes=3 > No=1)", p.Status)
|
|
||||||
}
|
|
||||||
if p.Tally.Yes != 3 || p.Tally.No != 1 || p.Tally.Abstain != 0 || p.Tally.NoWithVeto != 0 || p.Tally.Total != 4 {
|
|
||||||
t.Errorf("tally = %+v, want Yes=3 No=1 Abstain=0 NoWithVeto=0 Total=4", p.Tally)
|
|
||||||
}
|
|
||||||
if !p.Tally.QuorumMet {
|
|
||||||
t.Error("QuorumMet should be true (Total > 0)")
|
|
||||||
}
|
|
||||||
if !hasEvent(ctx, "council.proposal_tallied") {
|
|
||||||
t.Error("proposal_tallied event not emitted")
|
|
||||||
}
|
|
||||||
if eventAttr(ctx, "council.proposal_tallied", "status") != string(types.ProposalStatusSucceeded) {
|
|
||||||
t.Errorf("tally event status = %q, want Succeeded", eventAttr(ctx, "council.proposal_tallied", "status"))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MissionLockAmendment-Rejected REJECTED at ValidateBasic (D-064) --------
|
|
||||||
|
|
||||||
// TestMissionLockAmendmentRejectedAtValidateBasic asserts the
|
|
||||||
// MissionLockAmendment-Rejected kind is REJECTED at ValidateBasic
|
|
||||||
// (D-064/A-572 — the message never reaches the handler; the keeper
|
|
||||||
// Proposal store stays empty).
|
|
||||||
func TestMissionLockAmendmentRejectedAtValidateBasic(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
|
|
||||||
msg := newSubmitMsg("p-mla", "cm", types.ProposalMissionLockAmendmentRejected, 2000)
|
|
||||||
_, err := srv.SubmitProposal(ctx, msg)
|
|
||||||
if err == nil {
|
|
||||||
t.Fatal("SubmitProposal with MissionLockAmendment-Rejected kind should be rejected at ValidateBasic (D-064)")
|
|
||||||
}
|
|
||||||
// The keeper Proposal store stays empty (the handler was never
|
|
||||||
// invoked with this kind — ValidateBasic rejected it).
|
|
||||||
if _, ok := k.GetProposal(ctx, "p-mla"); ok {
|
|
||||||
t.Error("Proposal store should be empty — the MissionLockAmendment-Rejected message never reaches the handler (D-064)")
|
|
||||||
}
|
|
||||||
if !hasEvent(ctx, "council.proposal_submitted") {
|
|
||||||
// no event emitted (the rejection is at ValidateBasic, before
|
|
||||||
// the handler emits any event) — this is correct.
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Veto semantics (D-065/A-574) --------------------------------------------
|
|
||||||
|
|
||||||
// TestVetoSingleDoesNotBlock asserts a single Veto does NOT block
|
|
||||||
// (anti-greed, vision §19, D-065): a single Veto + majority Yes →
|
|
||||||
// Succeeded. The Veto quorum (default 6) must be met to FAIL.
|
|
||||||
func TestVetoSingleDoesNotBlock(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-veto-1", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-veto-1")
|
|
||||||
|
|
||||||
// 3 Yes + 1 Veto → Yes majority, single Veto does NOT block → Succeeded.
|
|
||||||
for i, voter := range []string{"reach:a", "reach:b", "reach:c"} {
|
|
||||||
srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "vy" + string(rune('A'+i)), ProposalID: "p-veto-1", VoterReach: voter, Option: types.VoteOptionYes, Signer: voter,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
// 1 Veto (watcher-1 is a Watcher via the default stub).
|
|
||||||
srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "vv1", ProposalID: "p-veto-1", VoterReach: "reach:watcher-1", Option: types.VoteOptionVeto, Signer: "reach:watcher-1",
|
|
||||||
})
|
|
||||||
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
if _, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-veto-1", Signer: "reach:tally"}); err != nil {
|
|
||||||
t.Fatalf("TallyProposal: %v", err)
|
|
||||||
}
|
|
||||||
p, _ := k.GetProposal(ctx, "p-veto-1")
|
|
||||||
if p.Status != types.ProposalStatusSucceeded {
|
|
||||||
t.Errorf("status = %q, want Succeeded (single Veto does NOT block — D-065 anti-greed; Yes=3 > No=0)", p.Status)
|
|
||||||
}
|
|
||||||
if p.Tally.NoWithVeto != 1 {
|
|
||||||
t.Errorf("NoWithVeto = %d, want 1 (single Veto recorded but does NOT block)", p.Tally.NoWithVeto)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVetoQuorumBlocks asserts the Veto quorum (default 6) FAILS the
|
|
||||||
// proposal: 6 Vetos → Failed (D-065/A-574).
|
|
||||||
func TestVetoQuorumBlocks(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-veto-q", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-veto-q")
|
|
||||||
|
|
||||||
// 2 Yes + 6 Vetos → Veto quorum met → Failed.
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy1", ProposalID: "p-veto-q", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy2", ProposalID: "p-veto-q", VoterReach: "reach:b", Option: types.VoteOptionYes, Signer: "reach:b"})
|
|
||||||
for i := 0; i < 6; i++ {
|
|
||||||
voter := "reach:watcher-" + string(rune('A'+i))
|
|
||||||
srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "vv" + string(rune('A'+i)), ProposalID: "p-veto-q", VoterReach: voter, Option: types.VoteOptionVeto, Signer: voter,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
if _, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-veto-q", Signer: "reach:tally"}); err != nil {
|
|
||||||
t.Fatalf("TallyProposal: %v", err)
|
|
||||||
}
|
|
||||||
p, _ := k.GetProposal(ctx, "p-veto-q")
|
|
||||||
if p.Status != types.ProposalStatusFailed {
|
|
||||||
t.Errorf("status = %q, want Failed (Veto quorum met — 6 Vetos >= default 6 per D-065/A-574)", p.Status)
|
|
||||||
}
|
|
||||||
if p.Tally.NoWithVeto != 6 {
|
|
||||||
t.Errorf("NoWithVeto = %d, want 6 (quorum)", p.Tally.NoWithVeto)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVetoQuorumBoundary asserts the quorum boundary: 5 Vetos (below the
|
|
||||||
// default 6) + majority Yes → Succeeded; 6 Vetos → Failed.
|
|
||||||
func TestVetoQuorumBoundary(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-bnd", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-bnd")
|
|
||||||
|
|
||||||
// 3 Yes + 5 Vetos (below default quorum 6) → Succeeded.
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy1", ProposalID: "p-bnd", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy2", ProposalID: "p-bnd", VoterReach: "reach:b", Option: types.VoteOptionYes, Signer: "reach:b"})
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy3", ProposalID: "p-bnd", VoterReach: "reach:c", Option: types.VoteOptionYes, Signer: "reach:c"})
|
|
||||||
for i := 0; i < 5; i++ {
|
|
||||||
voter := "reach:watcher-" + string(rune('A'+i))
|
|
||||||
srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "vv" + string(rune('A'+i)), ProposalID: "p-bnd", VoterReach: voter, Option: types.VoteOptionVeto, Signer: voter,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
if _, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-bnd", Signer: "reach:tally"}); err != nil {
|
|
||||||
t.Fatalf("TallyProposal (5 Vetos, below quorum): %v", err)
|
|
||||||
}
|
|
||||||
p, _ := k.GetProposal(ctx, "p-bnd")
|
|
||||||
if p.Status != types.ProposalStatusSucceeded {
|
|
||||||
t.Errorf("status = %q, want Succeeded (5 Vetos < default quorum 6 — single-Veto-no-block quorum rule; Yes=3 > No=0)", p.Status)
|
|
||||||
}
|
|
||||||
if p.Tally.NoWithVeto != 5 {
|
|
||||||
t.Errorf("NoWithVeto = %d, want 5 (below quorum)", p.Tally.NoWithVeto)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVetoQuorumCustom asserts the WatcherVetoQuorum Params field is
|
|
||||||
// honored: setting the quorum to 3 makes 3 Vetos FAIL the proposal. The
|
|
||||||
// Params must be set BEFORE constructing the MsgServer (the server embeds
|
|
||||||
// the Keeper by value).
|
|
||||||
func TestVetoQuorumCustom(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
// Override the quorum to 3 BEFORE constructing the MsgServer.
|
|
||||||
k.SetParams(types.Params{WatcherVetoQuorum: 3})
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-cq", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-cq")
|
|
||||||
|
|
||||||
// 2 Yes + 3 Vetos → quorum 3 met → Failed.
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy1", ProposalID: "p-cq", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy2", ProposalID: "p-cq", VoterReach: "reach:b", Option: types.VoteOptionYes, Signer: "reach:b"})
|
|
||||||
for i := 0; i < 3; i++ {
|
|
||||||
voter := "reach:watcher-" + string(rune('A'+i))
|
|
||||||
srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "vv" + string(rune('A'+i)), ProposalID: "p-cq", VoterReach: voter, Option: types.VoteOptionVeto, Signer: voter,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
if _, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-cq", Signer: "reach:tally"}); err != nil {
|
|
||||||
t.Fatalf("TallyProposal: %v", err)
|
|
||||||
}
|
|
||||||
p, _ := k.GetProposal(ctx, "p-cq")
|
|
||||||
if p.Status != types.ProposalStatusFailed {
|
|
||||||
t.Errorf("status = %q, want Failed (custom quorum 3 met — 3 Vetos >= 3)", p.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Watcher authz for Veto --------------------------------------------------
|
|
||||||
|
|
||||||
// TestVetoNonWatcherRejected asserts a non-Watcher casting Veto is
|
|
||||||
// REJECTED at the handler (the Vote is NOT recorded). The WatcherKeeper
|
|
||||||
// stub is configured to report reach:nonwatcher as a non-Watcher.
|
|
||||||
func TestVetoNonWatcherRejected(t *testing.T) {
|
|
||||||
ctx, wk, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-nw", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-nw")
|
|
||||||
|
|
||||||
// Configure the stub: reach:nonwatcher is NOT a Watcher.
|
|
||||||
wk.isWatcher = map[string]bool{"reach:nonwatcher": false, "reach:watcher-1": true}
|
|
||||||
|
|
||||||
// Non-Watcher Veto → REJECTED.
|
|
||||||
_, err := srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-nw", ProposalID: "p-nw", VoterReach: "reach:nonwatcher", Option: types.VoteOptionVeto, Signer: "reach:nonwatcher",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Fatal("Veto from non-Watcher should be REJECTED (D-065/A-574 Watcher authz)")
|
|
||||||
}
|
|
||||||
// The Vote is NOT recorded.
|
|
||||||
if _, ok := k.GetVote(ctx, "v-nw"); ok {
|
|
||||||
t.Error("Vote from non-Watcher should NOT be recorded")
|
|
||||||
}
|
|
||||||
// The Proposal's tally is NOT updated (NoWithVeto stays 0).
|
|
||||||
p, _ := k.GetProposal(ctx, "p-nw")
|
|
||||||
if p.Tally.NoWithVeto != 0 {
|
|
||||||
t.Errorf("NoWithVeto = %d, want 0 (non-Watcher Veto rejected, not recorded)", p.Tally.NoWithVeto)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Watcher Veto → accepted.
|
|
||||||
if _, err := srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-w", ProposalID: "p-nw", VoterReach: "reach:watcher-1", Option: types.VoteOptionVeto, Signer: "reach:watcher-1",
|
|
||||||
}); err != nil {
|
|
||||||
t.Fatalf("Veto from Watcher should be accepted; got: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVetoNilWatcherKeeperPath exercises the nil-WatcherKeeper-shim path
|
|
||||||
// directly: construct a fresh Keeper with nil shims and assert a Veto is
|
|
||||||
// recorded (the nil guard skips the authz). The single-Veto-no-block
|
|
||||||
// rule (anti-greed, vision §19) is preserved: a single Veto is recorded
|
|
||||||
// but does NOT block; the quorum (default 6) must be met at tally.
|
|
||||||
func TestVetoNilWatcherKeeperPath(t *testing.T) {
|
|
||||||
db := dbm.NewMemDB()
|
|
||||||
storeKey := storetypes.NewKVStoreKey(types.StoreKey)
|
|
||||||
cms := store.NewCommitMultiStore(db, log.NewNopLogger(), nil)
|
|
||||||
cms.MountStoreWithDB(storeKey, storetypes.StoreTypeDB, nil)
|
|
||||||
if err := cms.LoadLatestVersion(); err != nil {
|
|
||||||
t.Fatalf("load latest version: %v", err)
|
|
||||||
}
|
|
||||||
ctx := sdk.NewContext(cms, cmtproto.Header{Time: time.Unix(1000, 0)}, false, log.NewNopLogger())
|
|
||||||
// nil WatcherKeeper, nil StandKeeper, nil GuildKeeper.
|
|
||||||
k := keeper.NewKeeper(nil, storeKey, nil, nil, nil)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-nil-wk", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-nil-wk")
|
|
||||||
|
|
||||||
// Veto from any reach-id — nil shim skips authz → accepted.
|
|
||||||
if _, err := srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-nil-wk", ProposalID: "p-nil-wk", VoterReach: "reach:nonwatcher", Option: types.VoteOptionVeto, Signer: "reach:nonwatcher",
|
|
||||||
}); err != nil {
|
|
||||||
t.Fatalf("Veto with nil WatcherKeeper should be accepted (nil shim skips authz); got: %v", err)
|
|
||||||
}
|
|
||||||
p, _ := k.GetProposal(ctx, "p-nil-wk")
|
|
||||||
if p.Tally.NoWithVeto != 1 {
|
|
||||||
t.Errorf("NoWithVeto = %d, want 1 (nil shim skips authz, Veto recorded)", p.Tally.NoWithVeto)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Vote-on-non-Active REJECTED ---------------------------------------------
|
|
||||||
|
|
||||||
// TestVoteRejectsNonActive asserts a Vote on a non-Active proposal is
|
|
||||||
// REJECTED. Covers Pending (not yet Active) and Succeeded (already
|
|
||||||
// tallied).
|
|
||||||
func TestVoteRejectsNonActive(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-na", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
// Proposal is Pending (not Active) → Vote rejected.
|
|
||||||
_, err := srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-na", ProposalID: "p-na", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Vote on Pending proposal should be rejected (vote-on-non-Active)")
|
|
||||||
}
|
|
||||||
|
|
||||||
// Active the proposal; tally it to Succeeded; then Vote should be
|
|
||||||
// rejected again.
|
|
||||||
activateProposal(k, ctx, "p-na")
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy1", ProposalID: "p-na", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-na", Signer: "reach:tally"})
|
|
||||||
_, err = srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-na-2", ProposalID: "p-na", VoterReach: "reach:b", Option: types.VoteOptionYes, Signer: "reach:b",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Vote on Succeeded proposal should be rejected (vote-on-non-Active)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Vote-after-deadline REJECTED --------------------------------------------
|
|
||||||
|
|
||||||
// TestVoteRejectsAfterDeadline asserts a Vote after the voting deadline
|
|
||||||
// is REJECTED (now >= VotingDeadline).
|
|
||||||
func TestVoteRejectsAfterDeadline(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
// Voting deadline = 1500; block time now = 1000 (< 1500).
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-ad", "cm", types.ProposalKindMesh, 1500)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-ad")
|
|
||||||
// Advance block time past the deadline (now=1600 >= 1500).
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(1600, 0))
|
|
||||||
_, err := srv.Vote(ctx, &types.MsgVote{
|
|
||||||
VoteID: "v-ad", ProposalID: "p-ad", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Vote after voting deadline should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Tally-before-deadline REJECTED ------------------------------------------
|
|
||||||
|
|
||||||
// TestTallyRejectsBeforeDeadline asserts a Tally before the voting
|
|
||||||
// deadline is REJECTED (now < VotingDeadline).
|
|
||||||
func TestTallyRejectsBeforeDeadline(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
// Voting deadline = 5000; block time now = 1000 (< 5000).
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-bd", "cm", types.ProposalKindMesh, 5000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
activateProposal(k, ctx, "p-bd")
|
|
||||||
// now=1000 < VotingDeadline=5000 → tally rejected.
|
|
||||||
_, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-bd", Signer: "reach:tally"})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Tally before voting deadline should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Tally-on-non-Active REJECTED --------------------------------------------
|
|
||||||
|
|
||||||
// TestTallyRejectsNonActive asserts a Tally on a non-Active proposal is
|
|
||||||
// REJECTED (a Pending proposal has not opened voting; a Succeeded
|
|
||||||
// proposal is already tallied).
|
|
||||||
func TestTallyRejectsNonActive(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-tna", "cm", types.ProposalKindMesh, 1500)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal: %v", err)
|
|
||||||
}
|
|
||||||
// Proposal is Pending → tally rejected.
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
_, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-tna", Signer: "reach:tally"})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Tally on Pending proposal should be rejected (tally-on-non-Active)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Idempotency + NotFound --------------------------------------------------
|
|
||||||
|
|
||||||
// TestSubmitProposalRejectsDuplicate asserts a duplicate proposal-id is
|
|
||||||
// rejected.
|
|
||||||
func TestSubmitProposalRejectsDuplicate(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-dup", "cm", types.ProposalKindMesh, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal[1]: %v", err)
|
|
||||||
}
|
|
||||||
_, err := srv.SubmitProposal(ctx, newSubmitMsg("p-dup", "cm", types.ProposalKindMesh, 2000))
|
|
||||||
if err == nil {
|
|
||||||
t.Error("duplicate proposal-id should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestSubmitProposalRejectsUnknownCouncil asserts a Submit to a missing
|
|
||||||
// council-id is rejected.
|
|
||||||
func TestSubmitProposalRejectsUnknownCouncil(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
_, err := srv.SubmitProposal(ctx, newSubmitMsg("p-uc", "no-such-council", types.ProposalKindMesh, 2000))
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Submit to unknown council-id should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVoteRejectsDuplicate asserts a duplicate vote-id is rejected.
|
|
||||||
func TestVoteRejectsDuplicate(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
srv.SubmitProposal(ctx, newSubmitMsg("p-vd", "cm", types.ProposalKindMesh, 2000))
|
|
||||||
activateProposal(k, ctx, "p-vd")
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "v-dup", ProposalID: "p-vd", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
_, err := srv.Vote(ctx, &types.MsgVote{VoteID: "v-dup", ProposalID: "p-vd", VoterReach: "reach:b", Option: types.VoteOptionYes, Signer: "reach:b"})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("duplicate vote-id should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVoteRejectsUnknownProposal asserts a Vote on a missing proposal-id
|
|
||||||
// is rejected.
|
|
||||||
func TestVoteRejectsUnknownProposal(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
_, err := srv.Vote(ctx, &types.MsgVote{VoteID: "v-np", ProposalID: "no-such", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Vote on unknown proposal-id should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestTallyRejectsUnknownProposal asserts a Tally on a missing proposal-id
|
|
||||||
// is rejected.
|
|
||||||
func TestTallyRejectsUnknownProposal(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
_, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "no-such", Signer: "reach:tally"})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Tally on unknown proposal-id should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Proposal-target validation (Stand/Guild shims) -------------------------
|
|
||||||
|
|
||||||
// TestSubmitProposalStandTargetValidation asserts a Stand-kind Proposal
|
|
||||||
// targets a Stand Council whose stand-id-ref references a real Stand.
|
|
||||||
func TestSubmitProposalStandTargetValidation(t *testing.T) {
|
|
||||||
ctx, _, sk, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cs", types.CouncilStand, "stand-xyz", "")
|
|
||||||
|
|
||||||
// Stand exists (default stub) → accepted.
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-stand-ok", "cs", types.ProposalKindStand, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal Stand with valid stand-id-ref should be accepted; got: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Stand does NOT exist → rejected.
|
|
||||||
sk.exists = map[string]bool{"stand-xyz": false}
|
|
||||||
_, err := srv.SubmitProposal(ctx, newSubmitMsg("p-stand-bad", "cs", types.ProposalKindStand, 2000))
|
|
||||||
if err == nil {
|
|
||||||
t.Error("SubmitProposal Stand with non-existent stand-id-ref should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestSubmitProposalGuildTargetValidation asserts a Guild-kind Proposal
|
|
||||||
// targets a Guild Council whose guild-id-ref references a real Guild.
|
|
||||||
func TestSubmitProposalGuildTargetValidation(t *testing.T) {
|
|
||||||
ctx, _, _, gk, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cg", types.CouncilGuild, "", "guild-xyz")
|
|
||||||
|
|
||||||
// Guild exists (default stub) → accepted.
|
|
||||||
if _, err := srv.SubmitProposal(ctx, newSubmitMsg("p-guild-ok", "cg", types.ProposalKindGuild, 2000)); err != nil {
|
|
||||||
t.Fatalf("SubmitProposal Guild with valid guild-id-ref should be accepted; got: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Guild does NOT exist → rejected.
|
|
||||||
gk.exists = map[string]bool{"guild-xyz": false}
|
|
||||||
_, err := srv.SubmitProposal(ctx, newSubmitMsg("p-guild-bad", "cg", types.ProposalKindGuild, 2000))
|
|
||||||
if err == nil {
|
|
||||||
t.Error("SubmitProposal Guild with non-existent guild-id-ref should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestSubmitProposalKindMustMatchCouncil asserts the ProposalKind must
|
|
||||||
// match the CouncilKind (a Stand-kind Proposal on a Mesh Council is
|
|
||||||
// rejected; a Guild-kind Proposal on a Stand Council is rejected).
|
|
||||||
func TestSubmitProposalKindMustMatchCouncil(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
|
|
||||||
// Stand-kind Proposal on a Mesh Council → rejected.
|
|
||||||
_, err := srv.SubmitProposal(ctx, newSubmitMsg("p-stand-on-mesh", "cm", types.ProposalKindStand, 2000))
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Stand-kind Proposal on a Mesh Council should be rejected")
|
|
||||||
}
|
|
||||||
// Guild-kind Proposal on a Mesh Council → rejected.
|
|
||||||
_, err = srv.SubmitProposal(ctx, newSubmitMsg("p-guild-on-mesh", "cm", types.ProposalKindGuild, 2000))
|
|
||||||
if err == nil {
|
|
||||||
t.Error("Guild-kind Proposal on a Mesh Council should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Tally outcome: No majority → Failed ------------------------------------
|
|
||||||
|
|
||||||
// TestTallyNoMajorityFails asserts a tally with Yes <= No (no majority)
|
|
||||||
// transitions to Failed.
|
|
||||||
func TestTallyNoMajorityFails(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
srv.SubmitProposal(ctx, newSubmitMsg("p-nm", "cm", types.ProposalKindMesh, 2000))
|
|
||||||
activateProposal(k, ctx, "p-nm")
|
|
||||||
// 1 Yes, 2 No → No majority → Failed.
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy1", ProposalID: "p-nm", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vn1", ProposalID: "p-nm", VoterReach: "reach:b", Option: types.VoteOptionNo, Signer: "reach:b"})
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vn2", ProposalID: "p-nm", VoterReach: "reach:c", Option: types.VoteOptionNo, Signer: "reach:c"})
|
|
||||||
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
if _, err := srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-nm", Signer: "reach:tally"}); err != nil {
|
|
||||||
t.Fatalf("TallyProposal: %v", err)
|
|
||||||
}
|
|
||||||
p, _ := k.GetProposal(ctx, "p-nm")
|
|
||||||
if p.Status != types.ProposalStatusFailed {
|
|
||||||
t.Errorf("status = %q, want Failed (Yes=1 not > No=2 — no majority)", p.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestTallyTieFails asserts a tally tie (Yes == No) → Failed (the proposal
|
|
||||||
// does not pass on a tie).
|
|
||||||
func TestTallyTieFails(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
srv.SubmitProposal(ctx, newSubmitMsg("p-tie", "cm", types.ProposalKindMesh, 2000))
|
|
||||||
activateProposal(k, ctx, "p-tie")
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vy1", ProposalID: "p-tie", VoterReach: "reach:a", Option: types.VoteOptionYes, Signer: "reach:a"})
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "vn1", ProposalID: "p-tie", VoterReach: "reach:b", Option: types.VoteOptionNo, Signer: "reach:b"})
|
|
||||||
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-tie", Signer: "reach:tally"})
|
|
||||||
p, _ := k.GetProposal(ctx, "p-tie")
|
|
||||||
if p.Status != types.ProposalStatusFailed {
|
|
||||||
t.Errorf("status = %q, want Failed (tie Yes=No → does not pass)", p.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestTallyAbstainOnly asserts a tally with only Abstains → Failed (no
|
|
||||||
// Yes majority).
|
|
||||||
func TestTallyAbstainOnly(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
seedCouncil(k, ctx, "cm", types.CouncilMesh, "", "")
|
|
||||||
srv.SubmitProposal(ctx, newSubmitMsg("p-ab", "cm", types.ProposalKindMesh, 2000))
|
|
||||||
activateProposal(k, ctx, "p-ab")
|
|
||||||
srv.Vote(ctx, &types.MsgVote{VoteID: "va1", ProposalID: "p-ab", VoterReach: "reach:a", Option: types.VoteOptionAbstain, Signer: "reach:a"})
|
|
||||||
|
|
||||||
ctx = ctx.WithBlockTime(time.Unix(3000, 0))
|
|
||||||
srv.TallyProposal(ctx, &types.MsgTallyProposal{ProposalID: "p-ab", Signer: "reach:tally"})
|
|
||||||
p, _ := k.GetProposal(ctx, "p-ab")
|
|
||||||
if p.Status != types.ProposalStatusFailed {
|
|
||||||
t.Errorf("status = %q, want Failed (Abstain only — no Yes majority)", p.Status)
|
|
||||||
}
|
|
||||||
if p.Tally.Abstain != 1 || p.Tally.Yes != 0 || p.Tally.No != 0 {
|
|
||||||
t.Errorf("tally = %+v, want Abstain=1 only", p.Tally)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Keeper store helpers ----------------------------------------------------
|
|
||||||
|
|
||||||
// TestSetGetProposal asserts the Proposal store round-trips.
|
|
||||||
func TestSetGetProposal(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
p := types.Proposal{ProposalID: "p-rt", CouncilID: "cm", Kind: types.ProposalKindMesh, Status: types.ProposalStatusPending}
|
|
||||||
k.SetProposal(ctx, p)
|
|
||||||
got, ok := k.GetProposal(ctx, "p-rt")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("GetProposal: not found")
|
|
||||||
}
|
|
||||||
if got.Status != types.ProposalStatusPending {
|
|
||||||
t.Errorf("status = %q", got.Status)
|
|
||||||
}
|
|
||||||
if _, ok := k.GetProposal(ctx, "missing"); ok {
|
|
||||||
t.Error("GetProposal should return false for missing id")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestAllProposals asserts AllProposals iteration.
|
|
||||||
func TestAllProposals(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
k.SetProposal(ctx, types.Proposal{ProposalID: "p1", Status: types.ProposalStatusPending})
|
|
||||||
k.SetProposal(ctx, types.Proposal{ProposalID: "p2", Status: types.ProposalStatusActive})
|
|
||||||
if len(k.AllProposals(ctx)) != 2 {
|
|
||||||
t.Errorf("expected 2 proposals, got %d", len(k.AllProposals(ctx)))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestSetGetVote asserts the Vote store round-trips.
|
|
||||||
func TestSetGetVote(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
v := types.Vote{VoteID: "v-rt", ProposalID: "p", VoterReach: "reach:a", Option: types.VoteOptionYes}
|
|
||||||
k.SetVote(ctx, v)
|
|
||||||
got, ok := k.GetVote(ctx, "v-rt")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("GetVote: not found")
|
|
||||||
}
|
|
||||||
if got.Option != types.VoteOptionYes {
|
|
||||||
t.Errorf("option = %q", got.Option)
|
|
||||||
}
|
|
||||||
if _, ok := k.GetVote(ctx, "missing"); ok {
|
|
||||||
t.Error("GetVote should return false for missing id")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVotesForProposal asserts the VotesForProposal filter.
|
|
||||||
func TestVotesForProposal(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
k.SetVote(ctx, types.Vote{VoteID: "v1", ProposalID: "p1", Option: types.VoteOptionYes})
|
|
||||||
k.SetVote(ctx, types.Vote{VoteID: "v2", ProposalID: "p1", Option: types.VoteOptionNo})
|
|
||||||
k.SetVote(ctx, types.Vote{VoteID: "v3", ProposalID: "p2", Option: types.VoteOptionYes})
|
|
||||||
if len(k.VotesForProposal(ctx, "p1")) != 2 {
|
|
||||||
t.Errorf("VotesForProposal(p1) = %d, want 2", len(k.VotesForProposal(ctx, "p1")))
|
|
||||||
}
|
|
||||||
if len(k.VotesForProposal(ctx, "p2")) != 1 {
|
|
||||||
t.Errorf("VotesForProposal(p2) = %d, want 1", len(k.VotesForProposal(ctx, "p2")))
|
|
||||||
}
|
|
||||||
if len(k.VotesForProposal(ctx, "no-such")) != 0 {
|
|
||||||
t.Errorf("VotesForProposal(no-such) = %d, want 0", len(k.VotesForProposal(ctx, "no-such")))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestSetGetCouncil asserts the Council store round-trips.
|
|
||||||
func TestSetGetCouncil(t *testing.T) {
|
|
||||||
ctx, _, _, _, k := newSimtestContext(t)
|
|
||||||
c := types.Council{CouncilID: "cm", Kind: types.CouncilMesh}
|
|
||||||
k.SetCouncil(ctx, c)
|
|
||||||
got, ok := k.GetCouncil(ctx, "cm")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("GetCouncil: not found")
|
|
||||||
}
|
|
||||||
if got.Kind != types.CouncilMesh {
|
|
||||||
t.Errorf("kind = %q", got.Kind)
|
|
||||||
}
|
|
||||||
if _, ok := k.GetCouncil(ctx, "missing"); ok {
|
|
||||||
t.Error("GetCouncil should return false for missing id")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Params helper ----------------------------------------------------------
|
|
||||||
|
|
||||||
// TestKeeperGetSetParams asserts the Keeper holds + returns the Params.
|
|
||||||
func TestKeeperGetSetParams(t *testing.T) {
|
|
||||||
_, _, _, _, k := newSimtestContext(t)
|
|
||||||
if k.GetParams().WatcherVetoQuorum != types.WatcherVetoQuorumDefault {
|
|
||||||
t.Errorf("default WatcherVetoQuorum = %d, want %d", k.GetParams().WatcherVetoQuorum, types.WatcherVetoQuorumDefault)
|
|
||||||
}
|
|
||||||
k.SetParams(types.Params{WatcherVetoQuorum: 4})
|
|
||||||
if k.GetParams().WatcherVetoQuorum != 4 {
|
|
||||||
t.Errorf("WatcherVetoQuorum = %d, want 4", k.GetParams().WatcherVetoQuorum)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Expected-keeper stubs --------------------------------------------------
|
|
||||||
|
|
||||||
// TestStubWatcherKeeper asserts the stub records calls and returns
|
|
||||||
// configured results.
|
|
||||||
func TestStubWatcherKeeper(t *testing.T) {
|
|
||||||
wk := &stubWatcherKeeper{isWatcher: map[string]bool{"reach:a": true, "reach:b": false}}
|
|
||||||
if !wk.IsWatcher("reach:a") {
|
|
||||||
t.Error("reach:a should be a Watcher")
|
|
||||||
}
|
|
||||||
if wk.IsWatcher("reach:b") {
|
|
||||||
t.Error("reach:b should NOT be a Watcher")
|
|
||||||
}
|
|
||||||
if len(wk.calls) != 2 {
|
|
||||||
t.Errorf("calls = %d, want 2", len(wk.calls))
|
|
||||||
}
|
|
||||||
if wk.CountWatchers() != 9 {
|
|
||||||
t.Errorf("CountWatchers = %d, want 9 (REQ-004)", wk.CountWatchers())
|
|
||||||
}
|
|
||||||
wk2 := &stubWatcherKeeper{watcherCount: 7}
|
|
||||||
if wk2.CountWatchers() != 7 {
|
|
||||||
t.Errorf("CountWatchers = %d, want 7", wk2.CountWatchers())
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- G-003 import-invariant (test exemption documentation) -------------------
|
|
||||||
|
|
||||||
// TestG003NoWatcherOrStandOrGuildTypesImport asserts the council
|
|
||||||
// production files do NOT import x/watcher/types, x/stand/types, or
|
|
||||||
// x/guild/types by struct (G-003 — the WatcherKeeper, StandKeeper, and
|
|
||||||
// GuildKeeper interfaces are the only coupling; no struct import). This
|
|
||||||
// is a tested invariant. The test asserts the stubs use by-string
|
|
||||||
// reach-ids and stand/guild-ids (not watcher/stand/guild structs),
|
|
||||||
// confirming the interface contract is by-ID-string.
|
|
||||||
func TestG003NoWatcherOrStandOrGuildTypesImport(t *testing.T) {
|
|
||||||
wk := &stubWatcherKeeper{isWatcher: map[string]bool{"reach:watcher-1": true}}
|
|
||||||
if !wk.IsWatcher("reach:watcher-1") {
|
|
||||||
t.Error("stub IsWatcher by-ID-string should return true")
|
|
||||||
}
|
|
||||||
if len(wk.calls) != 1 {
|
|
||||||
t.Errorf("expected 1 watcher call recorded, got %d", len(wk.calls))
|
|
||||||
}
|
|
||||||
sk := &stubStandKeeper{}
|
|
||||||
if !sk.StandExists("stand-1") {
|
|
||||||
t.Error("stub StandExists by-ID-string should return true")
|
|
||||||
}
|
|
||||||
gk := &stubGuildKeeper{}
|
|
||||||
if !gk.GuildExists("guild-1") {
|
|
||||||
t.Error("stub GuildExists by-ID-string should return true")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,101 +0,0 @@
|
|||||||
package council
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/types/module"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/council/keeper"
|
|
||||||
"github.com/oy/openyield/x/council/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// module.go holds the council module's AppModule + RegisterServices
|
|
||||||
// (P7-02-01, REQ-039, D-060).
|
|
||||||
//
|
|
||||||
// The AppModule wraps the Proposal-lifecycle Keeper and registers the
|
|
||||||
// MsgServer via RegisterServices. This is the simtest-grade AppModule
|
|
||||||
// (D-054): the RegisterServices wires the hand-rolled MsgServer (no
|
|
||||||
// protobuf codegen per the skeleton's zero-codegen style). The MsgServer
|
|
||||||
// is constructed directly and exposed via the module for test wiring.
|
|
||||||
//
|
|
||||||
// The WatcherKeeper, StandKeeper, and GuildKeeper expected-keeper shims
|
|
||||||
// are injected at construction (nil-able for partial tests). The
|
|
||||||
// StandKeeper / GuildKeeper shims are the P7→P1 (x/stand) and P7→P1
|
|
||||||
// (x/guild) dep edges: P7 wires stubs in simtest (G-003 test exemption);
|
|
||||||
// the real keepers are wired at app construction.
|
|
||||||
|
|
||||||
// ConsensusVersion is the council module's consensus version (AppModule).
|
|
||||||
const ConsensusVersion = 1
|
|
||||||
|
|
||||||
// AppModule is the council application module (simtest-grade — D-054).
|
|
||||||
type AppModule struct {
|
|
||||||
keeper keeper.Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewAppModule constructs a new council AppModule. The WatcherKeeper,
|
|
||||||
// StandKeeper, and GuildKeeper expected-keeper shims are injected
|
|
||||||
// (nil-able for partial tests).
|
|
||||||
func NewAppModule(cdc codec.Codec, storeKey storetypes.StoreKey, wk types.WatcherKeeper, sk types.StandKeeper, gk types.GuildKeeper) AppModule {
|
|
||||||
k := keeper.NewKeeper(cdc, storeKey, wk, sk, gk)
|
|
||||||
return AppModule{keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
// RegisterServices registers the council MsgServer. Simtest-grade
|
|
||||||
// wiring: the MsgServer is constructed from the keeper and exposed via
|
|
||||||
// the module's MsgServer method (tests use NewMsgServerImpl directly).
|
|
||||||
func (am AppModule) RegisterServices(cfg module.Configurator) {
|
|
||||||
_ = cfg
|
|
||||||
}
|
|
||||||
|
|
||||||
// MsgServer returns the council MsgServer for this module's keeper.
|
|
||||||
func (am AppModule) MsgServer() types.MsgServer {
|
|
||||||
return keeper.NewMsgServerImpl(am.keeper)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Name returns the module name.
|
|
||||||
func (AppModule) Name() string { return types.ModuleName }
|
|
||||||
|
|
||||||
// ConsensusVersion implements AppModule.ConsensusVersion.
|
|
||||||
func (AppModule) ConsensusVersion() uint64 { return ConsensusVersion }
|
|
||||||
|
|
||||||
// InitGenesis performs genesis initialization for the council module's
|
|
||||||
// Proposal lifecycle. (The v0.2 Council registry genesis is the
|
|
||||||
// genesis-state Councils slice; this AppModule handles the v0.5 Proposal
|
|
||||||
// + Vote store.)
|
|
||||||
func (am AppModule) InitGenesis(ctx sdk.Context, cdc codec.JSONCodec, data json.RawMessage) {
|
|
||||||
var gs types.GenesisState
|
|
||||||
cdc.MustUnmarshalJSON(data, &gs)
|
|
||||||
// Seed the runtime Council store from the genesis-state Councils
|
|
||||||
// slice (the SubmitProposal handler validates against the runtime
|
|
||||||
// Council store).
|
|
||||||
for _, c := range gs.Councils {
|
|
||||||
am.keeper.SetCouncil(ctx, c)
|
|
||||||
}
|
|
||||||
for _, p := range gs.Proposals {
|
|
||||||
am.keeper.SetProposal(ctx, p)
|
|
||||||
}
|
|
||||||
for _, v := range gs.Votes {
|
|
||||||
am.keeper.SetVote(ctx, v)
|
|
||||||
}
|
|
||||||
am.keeper.SetParams(gs.Params)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ExportGenesis returns the exported genesis state as raw bytes.
|
|
||||||
func (am AppModule) ExportGenesis(ctx sdk.Context, cdc codec.JSONCodec) json.RawMessage {
|
|
||||||
gs := types.DefaultGenesisState()
|
|
||||||
for _, p := range am.keeper.AllProposals(ctx) {
|
|
||||||
gs.Proposals = append(gs.Proposals, p)
|
|
||||||
}
|
|
||||||
for _, v := range am.keeper.AllVotes(ctx) {
|
|
||||||
gs.Votes = append(gs.Votes, v)
|
|
||||||
}
|
|
||||||
gs.Params = am.keeper.GetParams()
|
|
||||||
return cdc.MustMarshalJSON(gs)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions: AppModule implements the module interface stubs.
|
|
||||||
var _ module.HasName = AppModule{}
|
|
||||||
var _ module.HasConsensusVersion = AppModule{}
|
|
||||||
@@ -1,106 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
// expected_keepers.go holds the Go INTERFACES for the cross-module keepers
|
|
||||||
// x/council depends on (G-003 firewall — ibc-go expected-keepers convention).
|
|
||||||
//
|
|
||||||
// The Council Proposal lifecycle (REQ-039, D-060) depends on TWO cross-module
|
|
||||||
// keepers:
|
|
||||||
//
|
|
||||||
// 1. x/watcher (WatcherKeeper) — the Veto authz for the Vote handler. The
|
|
||||||
// VoteOption.Veto is the Watcher-only block signal (anti-greed, vision
|
|
||||||
// §19). The handler consults the WatcherKeeper shim to assert the
|
|
||||||
// voter-reach is a Watcher BEFORE recording a Veto; a non-Watcher
|
|
||||||
// casting Veto is REJECTED at the handler. The handler does NOT consult
|
|
||||||
// the quorum on the Veto payload (unlike x/partner's
|
|
||||||
// IsQuorumSigned-on-payload pattern); the Veto quorum is a TALLY-time
|
|
||||||
// check (NoWithVeto >= WatcherVetoQuorum in the Params, default 6 per
|
|
||||||
// D-065/A-574), NOT a VOTE-time check. The single-Veto-no-block rule
|
|
||||||
// (anti-greed) means a single Veto is recorded but does NOT block; the
|
|
||||||
// quorum (default 6) must be met at tally to FAIL the proposal.
|
|
||||||
//
|
|
||||||
// 2. x/stand (StandKeeper) — the proposal-target validation for a
|
|
||||||
// Stand-kind Proposal. The handler asserts the council-id references a
|
|
||||||
// Stand Council whose stand-id-ref references a real Stand BEFORE
|
|
||||||
// creating the Proposal. The interface is the by-ID-string boundary
|
|
||||||
// (G-003 — no struct import of x/stand/types).
|
|
||||||
//
|
|
||||||
// 3. x/guild (GuildKeeper) — the proposal-target validation for a
|
|
||||||
// Guild-kind Proposal (mirrors StandKeeper). The handler asserts the
|
|
||||||
// council-id references a Guild Council whose guild-id-ref references
|
|
||||||
// a real Guild.
|
|
||||||
//
|
|
||||||
// All three dependencies are expressed as INTERFACES defined HERE (in
|
|
||||||
// x/council/types), NOT as struct imports of x/watcher/types,
|
|
||||||
// x/stand/types, or x/guild/types. The concrete keepers satisfy these
|
|
||||||
// interfaces structurally; the handler depends on the interface, preserving
|
|
||||||
// G-003's intent (no cross-module struct coupling, no import cycles).
|
|
||||||
//
|
|
||||||
// Test-only cross-package imports (the G-003 test exemption) remain
|
|
||||||
// exempt: a simtest may import both x/council/keeper and x/watcher/keeper
|
|
||||||
// (or x/stand/keeper, x/guild/keeper) to wire the expected-keeper shims in
|
|
||||||
// a test setup.
|
|
||||||
|
|
||||||
// WatcherKeeper is the expected-keeper interface for x/watcher (G-003).
|
|
||||||
// The council Vote handler calls it for:
|
|
||||||
// - Vote (Veto authz): a Vote with Option == VoteOptionVeto must come
|
|
||||||
// from a Watcher. The handler consults the WatcherKeeper shim to
|
|
||||||
// assert the voter-reach is a Watcher BEFORE recording the Veto; a
|
|
||||||
// non-Watcher casting Veto is REJECTED at the handler. The Veto
|
|
||||||
// quorum (default 6 per D-065/A-574) is a TALLY-time check, NOT a
|
|
||||||
// VOTE-time check — the single-Veto-no-block rule (anti-greed,
|
|
||||||
// vision §19) means a single Veto is recorded but does NOT block; the
|
|
||||||
// quorum must be met at tally to FAIL the proposal.
|
|
||||||
//
|
|
||||||
// No struct import of x/watcher/types — the interface is the by-ID-string
|
|
||||||
// boundary (G-003). The reachID is an opaque string (the voter's reach-id,
|
|
||||||
// by-ID-string ref to x/identity Reach; lexicon-clean).
|
|
||||||
type WatcherKeeper interface {
|
|
||||||
// IsWatcher reports whether the named reach-id (by-ID-string) is a
|
|
||||||
// Watcher (REQ-004). Used by the Vote handler to authorize Veto: a
|
|
||||||
// non-Watcher casting Veto is REJECTED. A nil shim skips the authz
|
|
||||||
// (simtest wiring); a non-nil shim that returns false REJECTS.
|
|
||||||
IsWatcher(reachID string) bool
|
|
||||||
|
|
||||||
// CountWatchers returns the total number of Watchers (the Watcher set
|
|
||||||
// size; REQ-004 says 9). Used by the TallyProposal handler to validate
|
|
||||||
// the WatcherVetoQuorum Params bound against the live Watcher set
|
|
||||||
// (a quorum > CountWatchers is unsatisfiable; the handler clamps the
|
|
||||||
// effective quorum to CountWatchers for the >= check).
|
|
||||||
CountWatchers() int
|
|
||||||
}
|
|
||||||
|
|
||||||
// StandKeeper is the expected-keeper interface for x/stand (G-003). The
|
|
||||||
// council SubmitProposal handler calls it for:
|
|
||||||
// - SubmitProposal (Stand-kind target validation): the handler asserts
|
|
||||||
// the council-id references a Stand Council whose stand-id-ref
|
|
||||||
// references a real Stand BEFORE creating the Proposal. A nil shim
|
|
||||||
// skips the check (simtest wiring); a non-nil shim that returns false
|
|
||||||
// REJECTS the submission.
|
|
||||||
//
|
|
||||||
// No struct import of x/stand/types — the interface is the by-ID-string
|
|
||||||
// boundary (G-003). The standID is an opaque string (the stand-id, by-ID-
|
|
||||||
// string ref to x/stand Stand).
|
|
||||||
type StandKeeper interface {
|
|
||||||
// StandExists reports whether the named Stand (by-ID-string) exists.
|
|
||||||
// Used by the SubmitProposal handler to validate a Stand-kind
|
|
||||||
// Proposal's target before creating the Proposal.
|
|
||||||
StandExists(standID string) bool
|
|
||||||
}
|
|
||||||
|
|
||||||
// GuildKeeper is the expected-keeper interface for x/guild (G-003). The
|
|
||||||
// council SubmitProposal handler calls it for:
|
|
||||||
// - SubmitProposal (Guild-kind target validation): the handler asserts
|
|
||||||
// the council-id references a Guild Council whose guild-id-ref
|
|
||||||
// references a real Guild BEFORE creating the Proposal. A nil shim
|
|
||||||
// skips the check (simtest wiring); a non-nil shim that returns false
|
|
||||||
// REJECTS the submission.
|
|
||||||
//
|
|
||||||
// No struct import of x/guild/types — the interface is the by-ID-string
|
|
||||||
// boundary (G-003). The guildID is an opaque string (the guild-id, by-ID-
|
|
||||||
// string ref to x/guild Guild).
|
|
||||||
type GuildKeeper interface {
|
|
||||||
// GuildExists reports whether the named Guild (by-ID-string) exists.
|
|
||||||
// Used by the SubmitProposal handler to validate a Guild-kind
|
|
||||||
// Proposal's target before creating the Proposal.
|
|
||||||
GuildExists(guildID string) bool
|
|
||||||
}
|
|
||||||
@@ -100,74 +100,6 @@ func knownSignalKind(s SignalKind) bool {
|
|||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
|
|
||||||
// ValidateProposals asserts proposal-ids are present and unique, each
|
|
||||||
// proposal's council-id references an existing Council (referential
|
|
||||||
// integrity), each proposal's kind is a known ProposalKind, and each
|
|
||||||
// proposal's status is a known ProposalStatus (D-060, P7 genesis
|
|
||||||
// validation). The MissionLockAmendment-Rejected kind is allowed at
|
|
||||||
// genesis-level schema validation (it is a known enum value); the
|
|
||||||
// Mission-Lock firewall is the const + the MsgSubmitProposal.ValidateBasic
|
|
||||||
// gate (D-064), NOT the genesis validator (a genesis Proposal of that
|
|
||||||
// kind would be a static data inconsistency, not a runtime breach — the
|
|
||||||
// runtime gate is the firewall).
|
|
||||||
func ValidateProposals(proposals []Proposal, councils []Council) error {
|
|
||||||
councilIDs := make(map[string]bool, len(councils))
|
|
||||||
for _, c := range councils {
|
|
||||||
councilIDs[c.CouncilID] = true
|
|
||||||
}
|
|
||||||
seen := make(map[string]bool, len(proposals))
|
|
||||||
for i, p := range proposals {
|
|
||||||
if p.ProposalID == "" {
|
|
||||||
return fmt.Errorf("proposal [%d]: empty proposal-id", i)
|
|
||||||
}
|
|
||||||
if seen[p.ProposalID] {
|
|
||||||
return fmt.Errorf("proposal: duplicate proposal-id %q", p.ProposalID)
|
|
||||||
}
|
|
||||||
seen[p.ProposalID] = true
|
|
||||||
if !councilIDs[p.CouncilID] {
|
|
||||||
return fmt.Errorf("proposal %q: council-id %q does not reference an existing council", p.ProposalID, p.CouncilID)
|
|
||||||
}
|
|
||||||
if !knownProposalKind(p.Kind) {
|
|
||||||
return fmt.Errorf("proposal %q: unknown kind %q", p.ProposalID, p.Kind)
|
|
||||||
}
|
|
||||||
if !knownProposalStatus(p.Status) {
|
|
||||||
return fmt.Errorf("proposal %q: unknown status %q", p.ProposalID, p.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ValidateVotes asserts vote-ids are present and unique, each vote's
|
|
||||||
// proposal-id references an existing Proposal (referential integrity),
|
|
||||||
// and each vote's option is a known VoteOption (D-060, P7 genesis
|
|
||||||
// validation). The Veto option is a known enum value; the Watcher authz
|
|
||||||
// is a runtime gate (the Vote handler consults the WatcherKeeper shim),
|
|
||||||
// NOT a genesis validator (genesis Veto votes are static data; the
|
|
||||||
// runtime gate is the firewall).
|
|
||||||
func ValidateVotes(votes []Vote, proposals []Proposal) error {
|
|
||||||
proposalIDs := make(map[string]bool, len(proposals))
|
|
||||||
for _, p := range proposals {
|
|
||||||
proposalIDs[p.ProposalID] = true
|
|
||||||
}
|
|
||||||
seen := make(map[string]bool, len(votes))
|
|
||||||
for i, v := range votes {
|
|
||||||
if v.VoteID == "" {
|
|
||||||
return fmt.Errorf("vote [%d]: empty vote-id", i)
|
|
||||||
}
|
|
||||||
if seen[v.VoteID] {
|
|
||||||
return fmt.Errorf("vote: duplicate vote-id %q", v.VoteID)
|
|
||||||
}
|
|
||||||
seen[v.VoteID] = true
|
|
||||||
if !proposalIDs[v.ProposalID] {
|
|
||||||
return fmt.Errorf("vote %q: proposal-id %q does not reference an existing proposal", v.VoteID, v.ProposalID)
|
|
||||||
}
|
|
||||||
if !knownVoteOption(v.Option) {
|
|
||||||
return fmt.Errorf("vote %q: unknown option %q", v.VoteID, v.Option)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// MissionLockCheck asserts the Mission-Lock invariant on a slice of
|
// MissionLockCheck asserts the Mission-Lock invariant on a slice of
|
||||||
// Councils (vision §19, REQ-011). Because MissionLockAmendable is a compile-
|
// Councils (vision §19, REQ-011). Because MissionLockAmendable is a compile-
|
||||||
// time const bool == false, this check always passes — it exists as the
|
// time const bool == false, this check always passes — it exists as the
|
||||||
|
|||||||
@@ -1,260 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// msg.go holds the council module's Proposal-lifecycle Msg* types
|
|
||||||
// implementing sdk.Msg (P7-01-01, REQ-039; G-006 controlled exception:
|
|
||||||
// types/ gains the cosmos-sdk import for sdk.Msg — D-055; the
|
|
||||||
// invariant/lexicon tests in *_test.go stay stdlib-only per G-024,
|
|
||||||
// isolated from this msg.go file). Each Msg carries a ValidateBasic
|
|
||||||
// (stateless) and GetSigners.
|
|
||||||
//
|
|
||||||
// The three Msg types drive the Proposal lifecycle (D-060, REQ-039):
|
|
||||||
// - MsgSubmitProposal: submit a Proposal (status=Pending). ValidateBasic
|
|
||||||
// REJECTS the MissionLockAmendment-Rejected kind (D-064/A-572 — the
|
|
||||||
// message never reaches the handler). The const firewall
|
|
||||||
// (MissionLockAmendable=false) + the ValidateBasic gate form the dual
|
|
||||||
// firewall.
|
|
||||||
// - MsgVote: cast a Vote (VoteOption) on a Proposal. Veto requires
|
|
||||||
// Watcher authz — checked at the handler via the WatcherKeeper shim
|
|
||||||
// (the ValidateBasic is stateless; it accepts any VoteOption including
|
|
||||||
// Veto; the handler enforces Veto → Watcher authz).
|
|
||||||
// - MsgTallyProposal: tally a Proposal (close the voting deadline,
|
|
||||||
// compute Yes/No/Abstain/Veto, transition Succeeded/Failed).
|
|
||||||
//
|
|
||||||
// All cross-module refs are by-ID-string (G-003): council-id references a
|
|
||||||
// Council by ID-string; proposal-id references a Proposal by ID-string;
|
|
||||||
// voter-reach/proposer-reach are reach-ids (lexicon-clean holder
|
|
||||||
// identifiers; NOT banned financial-holder terms). GetSigners returns
|
|
||||||
// the signer reach-ids encoded as sdk.AccAddress bytes.
|
|
||||||
|
|
||||||
// --- MsgSubmitProposal ------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgSubmitProposal submits a Proposal to a Council (status=Pending).
|
|
||||||
// ValidateBasic is stateless: non-empty proposal-id, non-empty
|
|
||||||
// council-id, kind ∈ ProposalKind (and the kind must NOT be
|
|
||||||
// MissionLockAmendment-Rejected — D-064/A-572 — the message never
|
|
||||||
// reaches the handler; the const + the gate form the dual firewall),
|
|
||||||
// non-empty proposer-reach, voting-deadline > submit-time (a positive
|
|
||||||
// voting window).
|
|
||||||
type MsgSubmitProposal struct {
|
|
||||||
ProposalID string `json:"proposal_id" yaml:"proposal_id"`
|
|
||||||
CouncilID string `json:"council_id" yaml:"council_id"`
|
|
||||||
Kind ProposalKind `json:"kind" yaml:"kind"`
|
|
||||||
ProposerReach string `json:"proposer_reach" yaml:"proposer_reach"`
|
|
||||||
SubmitTime int64 `json:"submit_time" yaml:"submit_time"`
|
|
||||||
VotingDeadline int64 `json:"voting_deadline" yaml:"voting_deadline"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message (sdk.Msg = proto.Message).
|
|
||||||
func (m *MsgSubmitProposal) Reset() { *m = MsgSubmitProposal{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgSubmitProposal) String() string {
|
|
||||||
return fmt.Sprintf("MsgSubmitProposal{ProposalID:%s CouncilID:%s Kind:%s ProposerReach:%s SubmitTime:%d VotingDeadline:%d Signer:%s}",
|
|
||||||
m.ProposalID, m.CouncilID, m.Kind, m.ProposerReach, m.SubmitTime, m.VotingDeadline, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgSubmitProposal) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation. Non-empty proposal-id,
|
|
||||||
// non-empty council-id, kind ∈ ProposalKind, non-empty proposer-reach,
|
|
||||||
// non-empty signer, voting-deadline > submit-time (a positive voting
|
|
||||||
// window). The MissionLockAmendment-Rejected kind is REJECTED here
|
|
||||||
// (D-064/A-572): the message never reaches the handler. The const
|
|
||||||
// firewall (MissionLockAmendable=false) + this gate form the dual
|
|
||||||
// firewall. The error message names the Mission Lock so the rejection
|
|
||||||
// is visible at the call site.
|
|
||||||
func (m *MsgSubmitProposal) ValidateBasic() error {
|
|
||||||
if m.ProposalID == "" {
|
|
||||||
return fmt.Errorf("council: empty proposal-id")
|
|
||||||
}
|
|
||||||
if m.CouncilID == "" {
|
|
||||||
return fmt.Errorf("council: empty council-id")
|
|
||||||
}
|
|
||||||
if !knownProposalKind(m.Kind) {
|
|
||||||
return fmt.Errorf("council: unknown proposal kind %q", m.Kind)
|
|
||||||
}
|
|
||||||
// D-064/A-572: the MissionLockAmendment-Rejected kind is rejected at
|
|
||||||
// ValidateBasic — the message never reaches the handler. The const
|
|
||||||
// firewall (MissionLockAmendable=false) + this gate form the dual
|
|
||||||
// firewall. The Mission Lock (vision §19: Six Principles + Fee
|
|
||||||
// Covenant + no-amend covenant) can NEVER be amended by any council.
|
|
||||||
if m.Kind == ProposalMissionLockAmendmentRejected {
|
|
||||||
return fmt.Errorf("council: MissionLockAmendment-Rejected kind rejected at ValidateBasic (D-064/A-572 — Mission Lock non-amendable, vision §19)")
|
|
||||||
}
|
|
||||||
if m.ProposerReach == "" {
|
|
||||||
return fmt.Errorf("council: empty proposer-reach")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("council: empty signer")
|
|
||||||
}
|
|
||||||
if m.VotingDeadline <= m.SubmitTime {
|
|
||||||
return fmt.Errorf("council: voting-deadline %d must be after submit-time %d", m.VotingDeadline, m.SubmitTime)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgSubmitProposal) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgVote ---------------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgVote casts a Vote on a Proposal. The handler enforces the proposal
|
|
||||||
// must be Active (vote-on-non-Active REJECTED) and the voting deadline
|
|
||||||
// not passed (vote-after-deadline REJECTED). Veto requires Watcher
|
|
||||||
// authz via the WatcherKeeper shim (IsWatcher — only Watchers can cast
|
|
||||||
// Veto; non-Watchers casting Veto are REJECTED at the handler).
|
|
||||||
// ValidateBasic is stateless: non-empty proposal-id, non-empty
|
|
||||||
// voter-reach, option ∈ VoteOption.
|
|
||||||
type MsgVote struct {
|
|
||||||
VoteID string `json:"vote_id" yaml:"vote_id"`
|
|
||||||
ProposalID string `json:"proposal_id" yaml:"proposal_id"`
|
|
||||||
VoterReach string `json:"voter_reach" yaml:"voter_reach"`
|
|
||||||
Option VoteOption `json:"option" yaml:"option"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgVote) Reset() { *m = MsgVote{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgVote) String() string {
|
|
||||||
return fmt.Sprintf("MsgVote{VoteID:%s ProposalID:%s VoterReach:%s Option:%s Signer:%s}",
|
|
||||||
m.VoteID, m.ProposalID, m.VoterReach, m.Option, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgVote) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty vote-id,
|
|
||||||
// non-empty proposal-id, non-empty voter-reach, option ∈ VoteOption,
|
|
||||||
// non-empty signer. The Veto option is allowed at ValidateBasic (the
|
|
||||||
// Watcher authz is a runtime gate via the WatcherKeeper shim, NOT a
|
|
||||||
// stateless check — the signer's reach-id may or may not be a Watcher,
|
|
||||||
// and that is a stateful keeper query).
|
|
||||||
func (m *MsgVote) ValidateBasic() error {
|
|
||||||
if m.VoteID == "" {
|
|
||||||
return fmt.Errorf("council: empty vote-id")
|
|
||||||
}
|
|
||||||
if m.ProposalID == "" {
|
|
||||||
return fmt.Errorf("council: empty proposal-id")
|
|
||||||
}
|
|
||||||
if m.VoterReach == "" {
|
|
||||||
return fmt.Errorf("council: empty voter-reach")
|
|
||||||
}
|
|
||||||
if !knownVoteOption(m.Option) {
|
|
||||||
return fmt.Errorf("council: unknown vote option %q", m.Option)
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("council: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgVote) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgTallyProposal ------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgTallyProposal tallies a Proposal: closes the voting deadline,
|
|
||||||
// computes the Yes/No/Abstain/Veto tally, and transitions the Proposal
|
|
||||||
// to Succeeded (Yes quorum met, Veto quorum NOT met) or Failed (No
|
|
||||||
// quorum OR Veto quorum met — D-065). The handler enforces the voting
|
|
||||||
// deadline must have passed (tally-before-deadline REJECTED). ValidateBasic
|
|
||||||
// is stateless: non-empty proposal-id.
|
|
||||||
type MsgTallyProposal struct {
|
|
||||||
ProposalID string `json:"proposal_id" yaml:"proposal_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgTallyProposal) Reset() { *m = MsgTallyProposal{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgTallyProposal) String() string {
|
|
||||||
return fmt.Sprintf("MsgTallyProposal{ProposalID:%s Signer:%s}", m.ProposalID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgTallyProposal) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty proposal-id,
|
|
||||||
// non-empty signer.
|
|
||||||
func (m *MsgTallyProposal) ValidateBasic() error {
|
|
||||||
if m.ProposalID == "" {
|
|
||||||
return fmt.Errorf("council: empty proposal-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("council: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgTallyProposal) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgServer interface + Response types -----------------------------------
|
|
||||||
|
|
||||||
// MsgServer is the council module's message server interface (one method
|
|
||||||
// per Msg*). The keeper's msg_server.go implements this; module.go's
|
|
||||||
// RegisterServices wires the implementation. This is the hand-rolled
|
|
||||||
// equivalent of the protobuf-generated MsgServer interface (no codegen
|
|
||||||
// per the skeleton's zero-codegen style).
|
|
||||||
type MsgServer interface {
|
|
||||||
SubmitProposal(ctx interface{}, msg *MsgSubmitProposal) (*MsgSubmitProposalResponse, error)
|
|
||||||
Vote(ctx interface{}, msg *MsgVote) (*MsgVoteResponse, error)
|
|
||||||
TallyProposal(ctx interface{}, msg *MsgTallyProposal) (*MsgTallyProposalResponse, error)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Response types (hand-rolled equivalents of the protobuf-generated
|
|
||||||
// response wrappers; empty bodies — the response is the state mutation +
|
|
||||||
// event).
|
|
||||||
|
|
||||||
// MsgSubmitProposalResponse is the response to MsgSubmitProposal.
|
|
||||||
type MsgSubmitProposalResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgSubmitProposalResponse) Reset() { *m = MsgSubmitProposalResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgSubmitProposalResponse) String() string { return "MsgSubmitProposalResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgSubmitProposalResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgVoteResponse is the response to MsgVote.
|
|
||||||
type MsgVoteResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgVoteResponse) Reset() { *m = MsgVoteResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgVoteResponse) String() string { return "MsgVoteResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgVoteResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgTallyProposalResponse is the response to MsgTallyProposal.
|
|
||||||
type MsgTallyProposalResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgTallyProposalResponse) Reset() { *m = MsgTallyProposalResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgTallyProposalResponse) String() string { return "MsgTallyProposalResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgTallyProposalResponse) ProtoMessage() {}
|
|
||||||
+12
-285
@@ -28,36 +28,6 @@ const (
|
|||||||
// four Freeholder signals (vision §9.1 / REQ-005) plus Capital (REQ-011
|
// four Freeholder signals (vision §9.1 / REQ-005) plus Capital (REQ-011
|
||||||
// multi-source Voice). Cross-ref v0.1 x/standing FreeholderSignals.
|
// multi-source Voice). Cross-ref v0.1 x/standing FreeholderSignals.
|
||||||
SignalKindCount = 4
|
SignalKindCount = 4
|
||||||
|
|
||||||
// ProposalKindCount is the locked count of ProposalKind enum values
|
|
||||||
// (D-060, AUDIT §193 P1-1). A regression firewall: adding/removing/
|
|
||||||
// renaming a ProposalKind breaks this const's test. The four kinds are
|
|
||||||
// Stand, Guild, Mesh, and MissionLockAmendment-Rejected. The
|
|
||||||
// MissionLockAmendment-Rejected kind exists to DOCUMENT in code that
|
|
||||||
// the Mission Lock (vision §19) is non-amendable: the enum value is
|
|
||||||
// reachable, but MsgSubmitProposal.ValidateBasic REJECTS it (D-064 /
|
|
||||||
// A-572 — the message never reaches the handler). The const + the
|
|
||||||
// ValidateBasic gate form the dual firewall (D-064).
|
|
||||||
ProposalKindCount = 4
|
|
||||||
|
|
||||||
// ProposalStatusCount is the locked count of ProposalStatus enum values
|
|
||||||
// (D-060, AUDIT §193 P1-1): Pending, Active, Succeeded, Failed,
|
|
||||||
// Executed. A regression firewall.
|
|
||||||
ProposalStatusCount = 5
|
|
||||||
|
|
||||||
// VoteOptionCount is the locked count of VoteOption enum values
|
|
||||||
// (D-060, AUDIT §193 P1-1): Yes, No, Abstain, Veto. Veto is the Watcher-
|
|
||||||
// only block signal (anti-greed, vision §19; a single Veto does NOT
|
|
||||||
// block — the quorum default 6 per D-065/A-574). A regression firewall.
|
|
||||||
VoteOptionCount = 4
|
|
||||||
|
|
||||||
// WatcherVetoQuorumDefault is the default Watcher Veto quorum (D-065 /
|
|
||||||
// A-574): the number of Watcher Vetos required to FAIL a proposal
|
|
||||||
// (default 6, matching REQ-004 6-of-9). Single-Veto-no-block is the
|
|
||||||
// anti-greed rule (vision §19): one Veto does NOT block. This is the
|
|
||||||
// default; the actual quorum is a Params field (a tunable, NOT a
|
|
||||||
// locked const) bounded [2, 9] by Params.Validate() (G-020).
|
|
||||||
WatcherVetoQuorumDefault = 6
|
|
||||||
)
|
)
|
||||||
|
|
||||||
// CouncilKind enumerates the three governance councils (vision §13, REQ-011):
|
// CouncilKind enumerates the three governance councils (vision §13, REQ-011):
|
||||||
@@ -174,264 +144,30 @@ type TallyResult struct {
|
|||||||
QuorumMet bool `json:"quorum_met" yaml:"quorum_met"`
|
QuorumMet bool `json:"quorum_met" yaml:"quorum_met"`
|
||||||
}
|
}
|
||||||
|
|
||||||
// Params for the council module. v0.2 had no tunables (skeleton). v0.5 (P7,
|
// Params for the council module (skeleton — no tunables in v0.2).
|
||||||
// D-065/A-574) adds WatcherVetoQuorum — the number of Watcher Vetos required
|
type Params struct{}
|
||||||
// to FAIL a proposal (default 6, matching REQ-004 6-of-9). Single-Veto-no-
|
|
||||||
// block is the anti-greed rule (vision §19): one Veto does NOT block; the
|
|
||||||
// quorum (default 6) must be met. The quorum is a tunable bounded [2, 9] by
|
|
||||||
// Params.Validate() (G-020) — the Watcher set is 9 (REQ-004), so a quorum
|
|
||||||
// below 2 is meaningless and above 9 is unsatisfiable.
|
|
||||||
type Params struct {
|
|
||||||
WatcherVetoQuorum uint32 `json:"watcher_veto_quorum" yaml:"watcher_veto_quorum"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// DefaultParams returns the default council Params — WatcherVetoQuorum =
|
func DefaultParams() Params { return Params{} }
|
||||||
// WatcherVetoQuorumDefault (6, D-065/A-574).
|
|
||||||
func DefaultParams() Params {
|
|
||||||
return Params{WatcherVetoQuorum: WatcherVetoQuorumDefault}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Validate asserts the Params are well-formed (G-020). WatcherVetoQuorum
|
|
||||||
// must be in [2, 9] (the Watcher set is 9 per REQ-004; below 2 is
|
|
||||||
// meaningless, above 9 is unsatisfiable). The v0.5 simtest exercises the
|
|
||||||
// bounds.
|
|
||||||
func (p Params) Validate() error {
|
|
||||||
if p.WatcherVetoQuorum < 2 {
|
|
||||||
return fmt.Errorf("council: WatcherVetoQuorum %d below min 2 (G-020)", p.WatcherVetoQuorum)
|
|
||||||
}
|
|
||||||
if p.WatcherVetoQuorum > 9 {
|
|
||||||
return fmt.Errorf("council: WatcherVetoQuorum %d above max 9 (G-020; REQ-004 Watcher set)", p.WatcherVetoQuorum)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProposalKind enumerates the four proposal kinds a Council can take up
|
|
||||||
// (D-060, AUDIT §193 P1-1). Three map to the three Council tiers
|
|
||||||
// (Stand/Guild/Mesh); the fourth — MissionLockAmendmentRejected — is the
|
|
||||||
// Mission-Lock non-amendability marker: the enum value exists to DOCUMENT
|
|
||||||
// in code that the Mission Lock (vision §19, REQ-011) is non-amendable,
|
|
||||||
// but MsgSubmitProposal.ValidateBasic REJECTS it (D-064/A-572 — the
|
|
||||||
// message never reaches the handler). The locked const + the
|
|
||||||
// ValidateBasic gate form the dual firewall (D-064).
|
|
||||||
//
|
|
||||||
// MissionLockAmendable=false is the const firewall; the
|
|
||||||
// ProposalMissionLockAmendmentRejected enum value is the in-enum
|
|
||||||
// documentation; the ValidateBasic rejection is the gate. A future
|
|
||||||
// agent flipping the const OR removing the ValidateBasic gate breaks
|
|
||||||
// the regression tests.
|
|
||||||
type ProposalKind string
|
|
||||||
|
|
||||||
const (
|
|
||||||
// ProposalKindStand is a Stand-Council proposal (target: a Stand by
|
|
||||||
// ID-string ref via x/stand).
|
|
||||||
ProposalKindStand ProposalKind = "Stand"
|
|
||||||
// ProposalKindGuild is a Guild-Council proposal (target: a Guild by
|
|
||||||
// ID-string ref via x/guild).
|
|
||||||
ProposalKindGuild ProposalKind = "Guild"
|
|
||||||
// ProposalKindMesh is a Mesh-Council proposal (whole-mesh scope).
|
|
||||||
ProposalKindMesh ProposalKind = "Mesh"
|
|
||||||
// ProposalMissionLockAmendmentRejected is the Mission-Lock non-
|
|
||||||
// amendability marker (D-064/A-572). The enum value EXISTS to document
|
|
||||||
// in code that the Mission Lock (vision §19) is non-amendable, but
|
|
||||||
// MsgSubmitProposal.ValidateBasic REJECTS any proposal with this kind
|
|
||||||
// — the message never reaches the handler. The name carries
|
|
||||||
// "Rejected" so the rejection is visible at the call site (a proposal
|
|
||||||
// of this kind is rejected at the gate). The const firewall
|
|
||||||
// (MissionLockAmendable=false) + the ValidateBasic gate form the dual
|
|
||||||
// firewall (D-064).
|
|
||||||
ProposalMissionLockAmendmentRejected ProposalKind = "MissionLockAmendment-Rejected"
|
|
||||||
)
|
|
||||||
|
|
||||||
// AllProposalKinds returns all four ProposalKind values in D-060 order.
|
|
||||||
// Locked-const test asserts exactly 4 entries (the regression firewall).
|
|
||||||
func AllProposalKinds() []ProposalKind {
|
|
||||||
return []ProposalKind{
|
|
||||||
ProposalKindStand,
|
|
||||||
ProposalKindGuild,
|
|
||||||
ProposalKindMesh,
|
|
||||||
ProposalMissionLockAmendmentRejected,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// knownProposalKind reports whether k is one of the four ProposalKind
|
|
||||||
// values (used by genesis + ValidateBasic).
|
|
||||||
func knownProposalKind(k ProposalKind) bool {
|
|
||||||
for _, kk := range AllProposalKinds() {
|
|
||||||
if k == kk {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProposalStatus enumerates the five states a Proposal transitions through
|
|
||||||
// (D-060, AUDIT §193 P1-1). The lifecycle: Submit → Pending → Active (when
|
|
||||||
// the voting window opens) → Succeeded OR Failed (after tally) → Executed
|
|
||||||
// (v0.6+; v0.5 records the tally but does NOT auto-execute — D-060
|
|
||||||
// scope). Pending is the initial state (SubmitProposal creates Pending);
|
|
||||||
// Active is the voting-open state (the simtest transitions Pending →
|
|
||||||
// Active to enable voting); Succeeded is a passing tally (Yes quorum met,
|
|
||||||
// Veto quorum NOT met); Failed is a failing tally (No quorum OR Veto
|
|
||||||
// quorum met — D-065); Executed is the post-tally executed state (v0.6+).
|
|
||||||
type ProposalStatus string
|
|
||||||
|
|
||||||
const (
|
|
||||||
ProposalStatusPending ProposalStatus = "Pending"
|
|
||||||
ProposalStatusActive ProposalStatus = "Active"
|
|
||||||
ProposalStatusSucceeded ProposalStatus = "Succeeded"
|
|
||||||
ProposalStatusFailed ProposalStatus = "Failed"
|
|
||||||
ProposalStatusExecuted ProposalStatus = "Executed"
|
|
||||||
)
|
|
||||||
|
|
||||||
// AllProposalStatuses returns all five ProposalStatus values in D-060
|
|
||||||
// order. Locked-const test asserts exactly 5 entries (the regression
|
|
||||||
// firewall).
|
|
||||||
func AllProposalStatuses() []ProposalStatus {
|
|
||||||
return []ProposalStatus{
|
|
||||||
ProposalStatusPending,
|
|
||||||
ProposalStatusActive,
|
|
||||||
ProposalStatusSucceeded,
|
|
||||||
ProposalStatusFailed,
|
|
||||||
ProposalStatusExecuted,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// knownProposalStatus reports whether s is one of the five ProposalStatus
|
|
||||||
// values.
|
|
||||||
func knownProposalStatus(s ProposalStatus) bool {
|
|
||||||
for _, ss := range AllProposalStatuses() {
|
|
||||||
if s == ss {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
|
|
||||||
// VoteOption enumerates the four vote options on a Proposal (D-060, AUDIT
|
|
||||||
// §193 P1-1). Yes/No/Abstain are the standard three; Veto is the Watcher-
|
|
||||||
// only block signal (anti-greed, vision §19). A single Veto does NOT
|
|
||||||
// block — the quorum (default 6 per D-065/A-574) must be met to FAIL a
|
|
||||||
// proposal. The Vote handler enforces Veto authz via the WatcherKeeper
|
|
||||||
// shim (IsWatcher — only Watchers can cast Veto; non-Watchers casting
|
|
||||||
// Veto are REJECTED at the handler).
|
|
||||||
type VoteOption string
|
|
||||||
|
|
||||||
const (
|
|
||||||
VoteOptionYes VoteOption = "Yes"
|
|
||||||
VoteOptionNo VoteOption = "No"
|
|
||||||
VoteOptionAbstain VoteOption = "Abstain"
|
|
||||||
VoteOptionVeto VoteOption = "Veto" // Watcher-only (D-065/A-574)
|
|
||||||
)
|
|
||||||
|
|
||||||
// AllVoteOptions returns all four VoteOption values in D-060 order.
|
|
||||||
// Locked-const test asserts exactly 4 entries (the regression firewall).
|
|
||||||
func AllVoteOptions() []VoteOption {
|
|
||||||
return []VoteOption{
|
|
||||||
VoteOptionYes,
|
|
||||||
VoteOptionNo,
|
|
||||||
VoteOptionAbstain,
|
|
||||||
VoteOptionVeto,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// knownVoteOption reports whether o is one of the four VoteOption values.
|
|
||||||
func knownVoteOption(o VoteOption) bool {
|
|
||||||
for _, oo := range AllVoteOptions() {
|
|
||||||
if o == oo {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
|
|
||||||
// Proposal is a Council governance proposal (D-060, REQ-039). It is the
|
|
||||||
// runtime promotion of the v0.2 skeleton: the v0.2 Voice struct held a
|
|
||||||
// tally snapshot; v0.5 adds the Proposal lifecycle (Submit → Vote →
|
|
||||||
// Tally → Succeeded/Failed). Fields:
|
|
||||||
// - proposal-id: this proposal's ID (unique within a Council).
|
|
||||||
// - council-id: the Council by ID-string (G-003 by-ID-string ref).
|
|
||||||
// - kind: the ProposalKind (Stand/Guild/Mesh; MissionLockAmendment-
|
|
||||||
// Rejected is rejected at ValidateBasic — D-064).
|
|
||||||
// - proposer-reach: the proposer's reach-id (lexicon-clean holder
|
|
||||||
// identifier; G-003 — NOT a banned financial-holder term).
|
|
||||||
// - submit-time: unix seconds at SubmitProposal.
|
|
||||||
// - voting-deadline: unix seconds after which TallyProposal can close.
|
|
||||||
// - status: the ProposalStatus (Pending → Active → Succeeded/Failed →
|
|
||||||
// Executed).
|
|
||||||
// - tally: the running TallyResult (Yes/No/Abstain/Veto counts; the
|
|
||||||
// v0.2 NoWithVeto field — zero-locked in v0.2 — is now POPULATED by
|
|
||||||
// Watcher Vetos per D-060; G-017 reconciles the v0.2
|
|
||||||
// TestTallyResultNoWithVetoAlwaysZero regression: the DEFAULT tally
|
|
||||||
// has NoWithVeto=0, but a tally after a Watcher Veto quorum has
|
|
||||||
// NoWithVeto > 0).
|
|
||||||
type Proposal struct {
|
|
||||||
ProposalID string `json:"proposal_id" yaml:"proposal_id"`
|
|
||||||
CouncilID string `json:"council_id" yaml:"council_id"`
|
|
||||||
Kind ProposalKind `json:"kind" yaml:"kind"`
|
|
||||||
ProposerReach string `json:"proposer_reach" yaml:"proposer_reach"`
|
|
||||||
SubmitTime int64 `json:"submit_time" yaml:"submit_time"`
|
|
||||||
VotingDeadline int64 `json:"voting_deadline" yaml:"voting_deadline"`
|
|
||||||
Status ProposalStatus `json:"status" yaml:"status"`
|
|
||||||
Tally TallyResult `json:"tally" yaml:"tally"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Vote is a single Voice cast on a Proposal (D-060, REQ-039). The v0.2
|
|
||||||
// Voice struct held a SignalKind-based tally; v0.5 adds the per-Vote
|
|
||||||
// VoteOption (Yes/No/Abstain/Veto). The Vote is the per-voter record;
|
|
||||||
// the Proposal's Tally is the aggregate. Fields:
|
|
||||||
// - vote-id: this vote's ID (unique within a Proposal).
|
|
||||||
// - proposal-id: the Proposal by ID-string (G-003).
|
|
||||||
// - voter-reach: the voter's reach-id (lexicon-clean holder identifier).
|
|
||||||
// - option: the VoteOption (Yes/No/Abstain/Veto; Veto is Watcher-only).
|
|
||||||
// - timestamp: the cast time (unix seconds).
|
|
||||||
type Vote struct {
|
|
||||||
VoteID string `json:"vote_id" yaml:"vote_id"`
|
|
||||||
ProposalID string `json:"proposal_id" yaml:"proposal_id"`
|
|
||||||
VoterReach string `json:"voter_reach" yaml:"voter_reach"`
|
|
||||||
Option VoteOption `json:"option" yaml:"option"`
|
|
||||||
Timestamp int64 `json:"timestamp" yaml:"timestamp"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// GenesisState defines the council module genesis state (REQ-011).
|
// GenesisState defines the council module genesis state (REQ-011).
|
||||||
// Councils is the top-level set of three Council kinds; Voices is the
|
// Councils is the top-level set of three Council kinds; Voices is the
|
||||||
// Voice-tally set. Proposals + Votes are the v0.5 (P7, D-060) runtime
|
// Voice-tally set. ValidateGenesis enforces council-id uniqueness,
|
||||||
// promotion: the proposal lifecycle store. ValidateGenesis enforces
|
// voice-id uniqueness, and the Mission-Lock check (the const firewall echo).
|
||||||
// council-id uniqueness, voice-id uniqueness, proposal-id uniqueness,
|
// The data-engineer's genesis.go holds the schema helpers (G-008).
|
||||||
// vote-id uniqueness, and the Mission-Lock check (the const firewall
|
|
||||||
// echo). The data-engineer's genesis.go holds the schema helpers (G-008).
|
|
||||||
type GenesisState struct {
|
type GenesisState struct {
|
||||||
Councils []Council `json:"councils" yaml:"councils"`
|
Councils []Council `json:"councils" yaml:"councils"`
|
||||||
Voices []Voice `json:"voices" yaml:"voices"`
|
Voices []Voice `json:"voices" yaml:"voices"`
|
||||||
Proposals []Proposal `json:"proposals" yaml:"proposals"`
|
Params Params `json:"params" yaml:"params"`
|
||||||
Votes []Vote `json:"votes" yaml:"votes"`
|
|
||||||
Params Params `json:"params" yaml:"params"`
|
|
||||||
}
|
}
|
||||||
|
|
||||||
func DefaultGenesisState() *GenesisState {
|
func DefaultGenesisState() *GenesisState {
|
||||||
return &GenesisState{
|
return &GenesisState{
|
||||||
Councils: []Council{},
|
Councils: []Council{},
|
||||||
Voices: []Voice{},
|
Voices: []Voice{},
|
||||||
Proposals: []Proposal{},
|
Params: DefaultParams(),
|
||||||
Votes: []Vote{},
|
|
||||||
Params: DefaultParams(),
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Reset implements proto.Message (codec.JSONCodec.MustMarshalJSON /
|
|
||||||
// MustUnmarshalJSON require proto.Message — G-006 controlled exception:
|
|
||||||
// the codec requires the proto.Message interface; the lexicon tests in
|
|
||||||
// *_test.go stay stdlib-only per G-024, isolated from this types.go file).
|
|
||||||
func (m *GenesisState) Reset() { *m = GenesisState{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *GenesisState) String() string {
|
|
||||||
return fmt.Sprintf("GenesisState{Councils:%d Voices:%d Proposals:%d Votes:%d}",
|
|
||||||
len(m.Councils), len(m.Voices), len(m.Proposals), len(m.Votes))
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*GenesisState) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
||||||
// no-op): rejects duplicate council-ids and duplicate voice-ids, and runs
|
// no-op): rejects duplicate council-ids and duplicate voice-ids, and runs
|
||||||
// the Mission-Lock check. Delegates to the data-engineer's genesis.go
|
// the Mission-Lock check. Delegates to the data-engineer's genesis.go
|
||||||
@@ -447,14 +183,5 @@ func ValidateGenesis(bz json.RawMessage) error {
|
|||||||
if err := ValidateVoices(gs.Voices, gs.Councils); err != nil {
|
if err := ValidateVoices(gs.Voices, gs.Councils); err != nil {
|
||||||
return fmt.Errorf("council: %w", err)
|
return fmt.Errorf("council: %w", err)
|
||||||
}
|
}
|
||||||
if err := ValidateProposals(gs.Proposals, gs.Councils); err != nil {
|
|
||||||
return fmt.Errorf("council: %w", err)
|
|
||||||
}
|
|
||||||
if err := ValidateVotes(gs.Votes, gs.Proposals); err != nil {
|
|
||||||
return fmt.Errorf("council: %w", err)
|
|
||||||
}
|
|
||||||
if err := gs.Params.Validate(); err != nil {
|
|
||||||
return fmt.Errorf("council: %w", err)
|
|
||||||
}
|
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|||||||
+11
-526
@@ -109,58 +109,6 @@ func TestSignalKindCountLockedConst(t *testing.T) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// TestSignalKindShapeIntentional (REQ-031, AUDIT §193 P1-2) is a regression
|
|
||||||
// GUARD that documents and locks the 4-source SignalKind shape. It is NOT a
|
|
||||||
// shape change — the existing TestSignalKindCountLockedConst already locks
|
|
||||||
// the count. This test adds the INTENT documentation so a future agent who
|
|
||||||
// changes SignalKindCount from 4 to 5 (e.g., to "restore" the spec's 5-source
|
|
||||||
// VoiceSource list) must also update this test, surfacing the AUDIT rationale
|
|
||||||
// for review.
|
|
||||||
//
|
|
||||||
// AUDIT §193 P1-2 rationale (why SignalKind is 4 sources, NOT the spec's 5):
|
|
||||||
//
|
|
||||||
// The v0.2 P3-01-01 deliverable specified VoiceSource with 5 sources
|
|
||||||
// (Stash/Standing/Vouch/Freeholder/Guild). The implementation uses
|
|
||||||
// SignalKind with 4 sources (Stash/Standing/Vouch/Capital). The 4-source
|
|
||||||
// shape is a defensible design refinement:
|
|
||||||
// - Freeholder is an ELIGIBILITY property (upstream in x/standing), not
|
|
||||||
// a voice signal. A Freeholder-eligible Reach is a precondition for
|
|
||||||
// voting, not a signal that feeds a vote's weight.
|
|
||||||
// - Guild is a COUNCIL TIER (one of the three councils is the Guild
|
|
||||||
// Council), not a voice signal. Including Guild as a signal kind
|
|
||||||
// would conflate the council tier with the signal source.
|
|
||||||
// - Capital is committed-capital (vision §9.1, one of the four
|
|
||||||
// Freeholder signals per REQ-005), which the spec's VoiceSource list
|
|
||||||
// omitted. Adding Capital corrects the spec to match vision §9.1's
|
|
||||||
// four-signal definition (REQ-005: "Four Freeholder signals locked").
|
|
||||||
//
|
|
||||||
// The 4-source shape matches REQ-005 exactly. The spec deliverable text
|
|
||||||
// was wrong, not the implementation. v0.4 (D-050) DOCUMENTS this and
|
|
||||||
// locks the 4-source shape; changing it to 5 is a locked-const change
|
|
||||||
// rejected by the D-001 refinement-only filter and deferred to a future
|
|
||||||
// milestone that re-litigates REQ-005's signal definition.
|
|
||||||
//
|
|
||||||
// See .ciagent/oy/ARCHITECTURE.md §"Council Voice/Council Interface —
|
|
||||||
// Lifecycle Type Divergence Decisions (v0.4, REQ-031)" for the full rationale.
|
|
||||||
func TestSignalKindShapeIntentional(t *testing.T) {
|
|
||||||
// LOCKED: 4 sources. Changing this to 5 requires updating this test's
|
|
||||||
// intent block AND re-litigating REQ-005's four-signal definition.
|
|
||||||
const expectedSignalCount = 4
|
|
||||||
if types.SignalKindCount != expectedSignalCount {
|
|
||||||
t.Fatalf("SignalKindCount = %d, want %d (REQ-031 intent guard: the 4-source shape is intentional per AUDIT §193 P1-2; see ARCHITECTURE.md v0.4 divergence section before changing this)", types.SignalKindCount, expectedSignalCount)
|
|
||||||
}
|
|
||||||
want := []types.SignalKind{types.SignalStash, types.SignalStanding, types.SignalVouch, types.SignalCapital}
|
|
||||||
all := types.AllSignalKinds()
|
|
||||||
if len(all) != len(want) {
|
|
||||||
t.Fatalf("AllSignalKinds() len = %d, want %d", len(all), len(want))
|
|
||||||
}
|
|
||||||
for i, s := range all {
|
|
||||||
if s != want[i] {
|
|
||||||
t.Errorf("AllSignalKinds()[%d] = %q, want %q (REQ-031 intent guard: the 4-source shape {Stash, Standing, Vouch, Capital} is intentional per AUDIT §193 P1-2; Freeholder and Guild are NOT signal kinds)", i, s, want[i])
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestAllSignalKindsNames asserts the 4 signal names (Stash, Standing,
|
// TestAllSignalKindsNames asserts the 4 signal names (Stash, Standing,
|
||||||
// Vouch, Capital) cross-ref v0.1 x/standing FreeholderSignals (StashMaturity,
|
// Vouch, Capital) cross-ref v0.1 x/standing FreeholderSignals (StashMaturity,
|
||||||
// MultiDomainStanding, CommunityEndorsement, CommittedCapital).
|
// MultiDomainStanding, CommunityEndorsement, CommittedCapital).
|
||||||
@@ -201,26 +149,20 @@ func TestSignalKindValues(t *testing.T) {
|
|||||||
|
|
||||||
// TestTallyResultStructShape asserts TallyResult mirrors x/gov shape (A-204):
|
// TestTallyResultStructShape asserts TallyResult mirrors x/gov shape (A-204):
|
||||||
// fields yes, no, abstain, nowithveto, total, quorum_met. The no-with-veto
|
// fields yes, no, abstain, nowithveto, total, quorum_met. The no-with-veto
|
||||||
// field is kept for x/gov parity; v0.2 locked it to 0 (no veto option —
|
// field is kept for x/gov parity but always 0 (OY has no veto option —
|
||||||
// anti-greed, vision §19). v0.5 P7 (D-060) POPULATES NoWithVeto with Watcher
|
// anti-greed, vision §19). The test asserts the field names via JSON tags
|
||||||
// Vetos (the VoteOption enum adds Veto as the Watcher-only block signal).
|
// and that NoWithVeto is zero by default.
|
||||||
// G-017 reconciliation: the DEFAULT tally has NoWithVeto=0 (covered by
|
|
||||||
// TestTallyResultNoWithVetoDefaultZero); a tally after a Watcher Veto
|
|
||||||
// quorum has NoWithVeto > 0 (covered by
|
|
||||||
// TestTallyResultNoWithVetoPopulatedByQuorum). This test asserts the
|
|
||||||
// field names via JSON tags and that the struct can carry a populated
|
|
||||||
// NoWithVeto value (the v0.5 shape).
|
|
||||||
func TestTallyResultStructShape(t *testing.T) {
|
func TestTallyResultStructShape(t *testing.T) {
|
||||||
tr := types.TallyResult{
|
tr := types.TallyResult{
|
||||||
Yes: 10,
|
Yes: 10,
|
||||||
No: 3,
|
No: 3,
|
||||||
Abstain: 1,
|
Abstain: 1,
|
||||||
NoWithVeto: 2, // POPULATED by Watcher Vetos (D-060 — no longer always 0; G-017 reconciliation)
|
NoWithVeto: 0, // always 0 — no veto option
|
||||||
Total: 16,
|
Total: 14,
|
||||||
QuorumMet: true,
|
QuorumMet: true,
|
||||||
}
|
}
|
||||||
if tr.Yes != 10 || tr.No != 3 || tr.Abstain != 1 || tr.NoWithVeto != 2 ||
|
if tr.Yes != 10 || tr.No != 3 || tr.Abstain != 1 || tr.NoWithVeto != 0 ||
|
||||||
tr.Total != 16 || tr.QuorumMet != true {
|
tr.Total != 14 || tr.QuorumMet != true {
|
||||||
t.Error("TallyResult fields not set correctly")
|
t.Error("TallyResult fields not set correctly")
|
||||||
}
|
}
|
||||||
// x/gov field-name parity: marshal and check JSON tags.
|
// x/gov field-name parity: marshal and check JSON tags.
|
||||||
@@ -236,70 +178,12 @@ func TestTallyResultStructShape(t *testing.T) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// TestTallyResultNoWithVetoDefaultZero asserts the DEFAULT TallyResult
|
// TestTallyResultNoWithVetoAlwaysZero asserts the default TallyResult has
|
||||||
// has NoWithVeto == 0 (the anti-greed invariant — no veto option in the
|
// NoWithVeto == 0 (the anti-greed invariant — no veto option in OY).
|
||||||
// default zero-value tally).
|
func TestTallyResultNoWithVetoAlwaysZero(t *testing.T) {
|
||||||
//
|
|
||||||
// G-017 RECONCILIATION (CRITICAL): the v0.2 test was named
|
|
||||||
// TestTallyResultNoWithVetoAlwaysZero and asserted NoWithVeto == 0
|
|
||||||
// "always". v0.5 P7 (D-060) POPULATES NoWithVeto with Watcher Vetos (the
|
|
||||||
// VoteOption enum adds Veto as the Watcher-only block signal). The v0.2
|
|
||||||
// test's "always" assertion would contradict D-060. The reconciliation
|
|
||||||
// RENAMES the test to TestTallyResultNoWithVetoDefaultZero (asserts the
|
|
||||||
// DEFAULT tally has NoWithVeto=0) AND adds a new test
|
|
||||||
// TestTallyResultNoWithVetoPopulatedByQuorum (asserts a tally after a
|
|
||||||
// Watcher Veto quorum has NoWithVeto > 0). The regression is preserved
|
|
||||||
// (renamed + re-scoped, NOT deleted — the v0.2 regression protection
|
|
||||||
// stays green for the default case, and the new test covers the v0.5
|
|
||||||
// populated case).
|
|
||||||
func TestTallyResultNoWithVetoDefaultZero(t *testing.T) {
|
|
||||||
var tr types.TallyResult
|
var tr types.TallyResult
|
||||||
if tr.NoWithVeto != 0 {
|
if tr.NoWithVeto != 0 {
|
||||||
t.Errorf("default TallyResult.NoWithVeto = %d, expected 0 (no veto option in default tally — anti-greed)", tr.NoWithVeto)
|
t.Errorf("default TallyResult.NoWithVeto = %d, expected 0 (no veto option — anti-greed)", tr.NoWithVeto)
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestTallyResultNoWithVetoPopulatedByQuorum asserts a tally AFTER a
|
|
||||||
// Watcher Veto quorum has NoWithVeto > 0 (D-060 — the v0.2 zero-locked
|
|
||||||
// field is now POPULATED by Watcher Vetos). This is the G-017
|
|
||||||
// reconciliation's NEW test: it covers the v0.5 populated case that the
|
|
||||||
// v0.2 TestTallyResultNoWithVetoAlwaysZero test did not cover (the v0.2
|
|
||||||
// test asserted "always 0", which is no longer true post-D-060). The
|
|
||||||
// keeper simtest covers the full Vote → Tally → Failed lifecycle; this
|
|
||||||
// types-level test asserts the TallyResult struct shape carries the
|
|
||||||
// populated NoWithVeto field.
|
|
||||||
func TestTallyResultNoWithVetoPopulatedByQuorum(t *testing.T) {
|
|
||||||
// A tally after 6 Watcher Vetos (the default quorum, D-065/A-574).
|
|
||||||
tr := types.TallyResult{
|
|
||||||
Yes: 0,
|
|
||||||
No: 0,
|
|
||||||
Abstain: 0,
|
|
||||||
NoWithVeto: 6, // POPULATED by Watcher Vetos (D-060 — no longer always 0)
|
|
||||||
Total: 6,
|
|
||||||
QuorumMet: true,
|
|
||||||
}
|
|
||||||
if tr.NoWithVeto == 0 {
|
|
||||||
t.Errorf("TallyResult.NoWithVeto = 0 after a Watcher Veto quorum, expected > 0 (D-060 — NoWithVeto POPULATED by Watcher Vetos; the v0.2 zero-locked field is now populated)")
|
|
||||||
}
|
|
||||||
if tr.NoWithVeto != 6 {
|
|
||||||
t.Errorf("TallyResult.NoWithVeto = %d, expected 6 (quorum)", tr.NoWithVeto)
|
|
||||||
}
|
|
||||||
// Marshal round-trip: the populated NoWithVeto survives JSON
|
|
||||||
// serialization (x/gov shape parity A-204).
|
|
||||||
bz, err := json.Marshal(tr)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("marshal: %v", err)
|
|
||||||
}
|
|
||||||
js := string(bz)
|
|
||||||
if !strings.Contains(js, `"nowithveto":6`) {
|
|
||||||
t.Errorf("TallyResult JSON should contain populated nowithveto:6; got %s", js)
|
|
||||||
}
|
|
||||||
var tr2 types.TallyResult
|
|
||||||
if err := json.Unmarshal(bz, &tr2); err != nil {
|
|
||||||
t.Fatalf("unmarshal: %v", err)
|
|
||||||
}
|
|
||||||
if tr2.NoWithVeto != 6 {
|
|
||||||
t.Errorf("round-trip NoWithVeto = %d, expected 6", tr2.NoWithVeto)
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -475,7 +359,6 @@ func TestValidateGenesisAcceptsClean(t *testing.T) {
|
|||||||
{VoiceID: "v1", CouncilID: "cm", SignalKind: types.SignalStash},
|
{VoiceID: "v1", CouncilID: "cm", SignalKind: types.SignalStash},
|
||||||
{VoiceID: "v2", CouncilID: "cs", SignalKind: types.SignalCapital},
|
{VoiceID: "v2", CouncilID: "cs", SignalKind: types.SignalCapital},
|
||||||
},
|
},
|
||||||
Params: types.DefaultParams(),
|
|
||||||
}
|
}
|
||||||
bz, _ := json.Marshal(gs)
|
bz, _ := json.Marshal(gs)
|
||||||
if err := types.ValidateGenesis(bz); err != nil {
|
if err := types.ValidateGenesis(bz); err != nil {
|
||||||
@@ -556,404 +439,6 @@ func TestDefaultParams(t *testing.T) {
|
|||||||
_ = types.DefaultParams() // no panics
|
_ = types.DefaultParams() // no panics
|
||||||
}
|
}
|
||||||
|
|
||||||
// --- New v0.5 P7 locked-const + enum tests (D-060) ---------------------------
|
|
||||||
|
|
||||||
// TestProposalKindCountLockedConst asserts ProposalKindCount is exactly 4
|
|
||||||
// (D-060, AUDIT §193 P1-1): Stand, Guild, Mesh, MissionLockAmendment-Rejected.
|
|
||||||
func TestProposalKindCountLockedConst(t *testing.T) {
|
|
||||||
if types.ProposalKindCount != 4 {
|
|
||||||
t.Errorf("ProposalKindCount = %d, expected 4 (D-060 LOCKED — AUDIT §193 P1-1)", types.ProposalKindCount)
|
|
||||||
}
|
|
||||||
all := types.AllProposalKinds()
|
|
||||||
if len(all) != 4 {
|
|
||||||
t.Errorf("AllProposalKinds() len = %d, expected 4", len(all))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestAllProposalKindsNames asserts the 4 D-060 names in order with no
|
|
||||||
// extras, no dups, no renames. The MissionLockAmendment-Rejected kind is
|
|
||||||
// the Mission-Lock non-amendability marker (D-064/A-572 — rejected at
|
|
||||||
// ValidateBasic; the const + the gate form the dual firewall).
|
|
||||||
func TestAllProposalKindsNames(t *testing.T) {
|
|
||||||
want := []string{"Stand", "Guild", "Mesh", "MissionLockAmendment-Rejected"}
|
|
||||||
all := types.AllProposalKinds()
|
|
||||||
if len(all) != len(want) {
|
|
||||||
t.Fatalf("len = %d, want %d", len(all), len(want))
|
|
||||||
}
|
|
||||||
seen := map[string]bool{}
|
|
||||||
for i, k := range all {
|
|
||||||
if string(k) != want[i] {
|
|
||||||
t.Errorf("AllProposalKinds()[%d] = %q, want %q", i, k, want[i])
|
|
||||||
}
|
|
||||||
if seen[string(k)] {
|
|
||||||
t.Errorf("duplicate ProposalKind %q", k)
|
|
||||||
}
|
|
||||||
seen[string(k)] = true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestProposalKindValues asserts each named const matches its
|
|
||||||
// AllProposalKinds entry.
|
|
||||||
func TestProposalKindValues(t *testing.T) {
|
|
||||||
if types.ProposalKindStand != "Stand" {
|
|
||||||
t.Errorf("ProposalKindStand = %q", types.ProposalKindStand)
|
|
||||||
}
|
|
||||||
if types.ProposalKindGuild != "Guild" {
|
|
||||||
t.Errorf("ProposalKindGuild = %q", types.ProposalKindGuild)
|
|
||||||
}
|
|
||||||
if types.ProposalKindMesh != "Mesh" {
|
|
||||||
t.Errorf("ProposalKindMesh = %q", types.ProposalKindMesh)
|
|
||||||
}
|
|
||||||
if types.ProposalMissionLockAmendmentRejected != "MissionLockAmendment-Rejected" {
|
|
||||||
t.Errorf("ProposalMissionLockAmendmentRejected = %q", types.ProposalMissionLockAmendmentRejected)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestProposalStatusCountLockedConst asserts ProposalStatusCount is
|
|
||||||
// exactly 5 (D-060): Pending, Active, Succeeded, Failed, Executed.
|
|
||||||
func TestProposalStatusCountLockedConst(t *testing.T) {
|
|
||||||
if types.ProposalStatusCount != 5 {
|
|
||||||
t.Errorf("ProposalStatusCount = %d, expected 5 (D-060 LOCKED)", types.ProposalStatusCount)
|
|
||||||
}
|
|
||||||
all := types.AllProposalStatuses()
|
|
||||||
if len(all) != 5 {
|
|
||||||
t.Errorf("AllProposalStatuses() len = %d, expected 5", len(all))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestAllProposalStatusesNames asserts the 5 D-060 names in order.
|
|
||||||
func TestAllProposalStatusesNames(t *testing.T) {
|
|
||||||
want := []string{"Pending", "Active", "Succeeded", "Failed", "Executed"}
|
|
||||||
all := types.AllProposalStatuses()
|
|
||||||
if len(all) != len(want) {
|
|
||||||
t.Fatalf("len = %d, want %d", len(all), len(want))
|
|
||||||
}
|
|
||||||
for i, s := range all {
|
|
||||||
if string(s) != want[i] {
|
|
||||||
t.Errorf("AllProposalStatuses()[%d] = %q, want %q", i, s, want[i])
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVoteOptionCountLockedConst asserts VoteOptionCount is exactly 4
|
|
||||||
// (D-060): Yes, No, Abstain, Veto (Veto is Watcher-only).
|
|
||||||
func TestVoteOptionCountLockedConst(t *testing.T) {
|
|
||||||
if types.VoteOptionCount != 4 {
|
|
||||||
t.Errorf("VoteOptionCount = %d, expected 4 (D-060 LOCKED — AUDIT §193 P1-1)", types.VoteOptionCount)
|
|
||||||
}
|
|
||||||
all := types.AllVoteOptions()
|
|
||||||
if len(all) != 4 {
|
|
||||||
t.Errorf("AllVoteOptions() len = %d, expected 4", len(all))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestAllVoteOptionsNames asserts the 4 D-060 names in order. Veto is the
|
|
||||||
// Watcher-only block signal (anti-greed, vision §19; D-065/A-574 — a
|
|
||||||
// single Veto does NOT block; the quorum default 6 must be met).
|
|
||||||
func TestAllVoteOptionsNames(t *testing.T) {
|
|
||||||
want := []string{"Yes", "No", "Abstain", "Veto"}
|
|
||||||
all := types.AllVoteOptions()
|
|
||||||
if len(all) != len(want) {
|
|
||||||
t.Fatalf("len = %d, want %d", len(all), len(want))
|
|
||||||
}
|
|
||||||
for i, o := range all {
|
|
||||||
if string(o) != want[i] {
|
|
||||||
t.Errorf("AllVoteOptions()[%d] = %q, want %q", i, o, want[i])
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVoteOptionValues asserts each named const matches its AllVoteOptions
|
|
||||||
// entry.
|
|
||||||
func TestVoteOptionValues(t *testing.T) {
|
|
||||||
if types.VoteOptionYes != "Yes" {
|
|
||||||
t.Errorf("VoteOptionYes = %q", types.VoteOptionYes)
|
|
||||||
}
|
|
||||||
if types.VoteOptionNo != "No" {
|
|
||||||
t.Errorf("VoteOptionNo = %q", types.VoteOptionNo)
|
|
||||||
}
|
|
||||||
if types.VoteOptionAbstain != "Abstain" {
|
|
||||||
t.Errorf("VoteOptionAbstain = %q", types.VoteOptionAbstain)
|
|
||||||
}
|
|
||||||
if types.VoteOptionVeto != "Veto" {
|
|
||||||
t.Errorf("VoteOptionVeto = %q", types.VoteOptionVeto)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestProposalStructFields asserts Proposal carries all required fields
|
|
||||||
// (D-060). The Tally field's NoWithVeto is POPULATED by Watcher Vetos
|
|
||||||
// (D-060 — G-017 reconciliation).
|
|
||||||
func TestProposalStructFields(t *testing.T) {
|
|
||||||
p := types.Proposal{
|
|
||||||
ProposalID: "p1",
|
|
||||||
CouncilID: "cm",
|
|
||||||
Kind: types.ProposalKindMesh,
|
|
||||||
ProposerReach: "reach:prop",
|
|
||||||
SubmitTime: 1000,
|
|
||||||
VotingDeadline: 2000,
|
|
||||||
Status: types.ProposalStatusPending,
|
|
||||||
Tally: types.TallyResult{Yes: 1, No: 0, Abstain: 0, NoWithVeto: 0, Total: 1, QuorumMet: true},
|
|
||||||
}
|
|
||||||
if p.ProposalID != "p1" || p.CouncilID != "cm" || p.Kind != types.ProposalKindMesh ||
|
|
||||||
p.ProposerReach != "reach:prop" || p.SubmitTime != 1000 || p.VotingDeadline != 2000 ||
|
|
||||||
p.Status != types.ProposalStatusPending || p.Tally.Yes != 1 || p.Tally.Total != 1 ||
|
|
||||||
p.Tally.QuorumMet != true {
|
|
||||||
t.Error("Proposal fields not set correctly")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestVoteStructFields asserts Vote carries all required fields (D-060).
|
|
||||||
func TestVoteStructFields(t *testing.T) {
|
|
||||||
v := types.Vote{
|
|
||||||
VoteID: "v1",
|
|
||||||
ProposalID: "p1",
|
|
||||||
VoterReach: "reach:voter",
|
|
||||||
Option: types.VoteOptionVeto,
|
|
||||||
Timestamp: 1500,
|
|
||||||
}
|
|
||||||
if v.VoteID != "v1" || v.ProposalID != "p1" || v.VoterReach != "reach:voter" ||
|
|
||||||
v.Option != types.VoteOptionVeto || v.Timestamp != 1500 {
|
|
||||||
t.Error("Vote fields not set correctly")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestWatcherVetoQuorumDefault asserts the default WatcherVetoQuorum is 6
|
|
||||||
// (D-065/A-574 — matching REQ-004 6-of-9).
|
|
||||||
func TestWatcherVetoQuorumDefault(t *testing.T) {
|
|
||||||
if types.WatcherVetoQuorumDefault != 6 {
|
|
||||||
t.Errorf("WatcherVetoQuorumDefault = %d, expected 6 (D-065/A-574)", types.WatcherVetoQuorumDefault)
|
|
||||||
}
|
|
||||||
p := types.DefaultParams()
|
|
||||||
if p.WatcherVetoQuorum != 6 {
|
|
||||||
t.Errorf("DefaultParams().WatcherVetoQuorum = %d, expected 6 (D-065/A-574)", p.WatcherVetoQuorum)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestParamsValidateBounds asserts Params.Validate() bounds WatcherVetoQuorum
|
|
||||||
// to [2, 9] (G-020 — the Watcher set is 9 per REQ-004; below 2 is
|
|
||||||
// meaningless, above 9 is unsatisfiable).
|
|
||||||
func TestParamsValidateBounds(t *testing.T) {
|
|
||||||
// Below min (2) → rejected.
|
|
||||||
if err := (types.Params{WatcherVetoQuorum: 1}).Validate(); err == nil {
|
|
||||||
t.Error("WatcherVetoQuorum=1 should be rejected (G-020 min 2)")
|
|
||||||
}
|
|
||||||
if err := (types.Params{WatcherVetoQuorum: 0}).Validate(); err == nil {
|
|
||||||
t.Error("WatcherVetoQuorum=0 should be rejected (G-020 min 2)")
|
|
||||||
}
|
|
||||||
// Above max (9) → rejected.
|
|
||||||
if err := (types.Params{WatcherVetoQuorum: 10}).Validate(); err == nil {
|
|
||||||
t.Error("WatcherVetoQuorum=10 should be rejected (G-020 max 9)")
|
|
||||||
}
|
|
||||||
// Bounds [2, 9] → accepted.
|
|
||||||
for q := uint32(2); q <= 9; q++ {
|
|
||||||
if err := (types.Params{WatcherVetoQuorum: q}).Validate(); err != nil {
|
|
||||||
t.Errorf("WatcherVetoQuorum=%d should be accepted (G-020 bounds [2,9]), got: %v", q, err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestMsgSubmitProposalValidateBasicRejectsMissionLockAmendment asserts
|
|
||||||
// the MissionLockAmendment-Rejected kind is REJECTED at ValidateBasic
|
|
||||||
// (D-064/A-572 — the message never reaches the handler; the const +
|
|
||||||
// ValidateBasic dual firewall). The keeper Proposal store stays empty
|
|
||||||
// (the handler is never invoked with this kind).
|
|
||||||
func TestMsgSubmitProposalValidateBasicRejectsMissionLockAmendment(t *testing.T) {
|
|
||||||
msg := &types.MsgSubmitProposal{
|
|
||||||
ProposalID: "p1",
|
|
||||||
CouncilID: "cm",
|
|
||||||
Kind: types.ProposalMissionLockAmendmentRejected,
|
|
||||||
ProposerReach: "reach:prop",
|
|
||||||
SubmitTime: 1000,
|
|
||||||
VotingDeadline: 2000,
|
|
||||||
Signer: "reach:prop",
|
|
||||||
}
|
|
||||||
err := msg.ValidateBasic()
|
|
||||||
if err == nil {
|
|
||||||
t.Fatal("MsgSubmitProposal with MissionLockAmendment-Rejected kind should be rejected at ValidateBasic (D-064/A-572)")
|
|
||||||
}
|
|
||||||
if !strings.Contains(err.Error(), "MissionLockAmendment") {
|
|
||||||
t.Errorf("error should reference the Mission Lock; got: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestMsgSubmitProposalValidateBasicAcceptsValid asserts the valid kinds
|
|
||||||
// (Stand, Guild, Mesh) pass ValidateBasic.
|
|
||||||
func TestMsgSubmitProposalValidateBasicAcceptsValid(t *testing.T) {
|
|
||||||
for _, kind := range []types.ProposalKind{types.ProposalKindStand, types.ProposalKindGuild, types.ProposalKindMesh} {
|
|
||||||
msg := &types.MsgSubmitProposal{
|
|
||||||
ProposalID: "p1",
|
|
||||||
CouncilID: "cm",
|
|
||||||
Kind: kind,
|
|
||||||
ProposerReach: "reach:prop",
|
|
||||||
SubmitTime: 1000,
|
|
||||||
VotingDeadline: 2000,
|
|
||||||
Signer: "reach:prop",
|
|
||||||
}
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
t.Errorf("kind %q should pass ValidateBasic; got: %v", kind, err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestMsgSubmitProposalValidateBasicErrorPaths asserts the other
|
|
||||||
// ValidateBasic error paths (empty fields, bad deadline).
|
|
||||||
func TestMsgSubmitProposalValidateBasicErrorPaths(t *testing.T) {
|
|
||||||
// empty proposal-id
|
|
||||||
if err := (&types.MsgSubmitProposal{CouncilID: "cm", Kind: types.ProposalKindMesh, ProposerReach: "r", VotingDeadline: 2, SubmitTime: 1, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty proposal-id should be rejected")
|
|
||||||
}
|
|
||||||
// empty council-id
|
|
||||||
if err := (&types.MsgSubmitProposal{ProposalID: "p", Kind: types.ProposalKindMesh, ProposerReach: "r", VotingDeadline: 2, SubmitTime: 1, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty council-id should be rejected")
|
|
||||||
}
|
|
||||||
// unknown kind
|
|
||||||
if err := (&types.MsgSubmitProposal{ProposalID: "p", CouncilID: "cm", Kind: types.ProposalKind("Bogus"), ProposerReach: "r", VotingDeadline: 2, SubmitTime: 1, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("unknown kind should be rejected")
|
|
||||||
}
|
|
||||||
// empty proposer-reach
|
|
||||||
if err := (&types.MsgSubmitProposal{ProposalID: "p", CouncilID: "cm", Kind: types.ProposalKindMesh, VotingDeadline: 2, SubmitTime: 1, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty proposer-reach should be rejected")
|
|
||||||
}
|
|
||||||
// empty signer
|
|
||||||
if err := (&types.MsgSubmitProposal{ProposalID: "p", CouncilID: "cm", Kind: types.ProposalKindMesh, ProposerReach: "r", VotingDeadline: 2, SubmitTime: 1}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty signer should be rejected")
|
|
||||||
}
|
|
||||||
// voting-deadline <= submit-time
|
|
||||||
if err := (&types.MsgSubmitProposal{ProposalID: "p", CouncilID: "cm", Kind: types.ProposalKindMesh, ProposerReach: "r", VotingDeadline: 1, SubmitTime: 2, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("voting-deadline <= submit-time should be rejected")
|
|
||||||
}
|
|
||||||
if err := (&types.MsgSubmitProposal{ProposalID: "p", CouncilID: "cm", Kind: types.ProposalKindMesh, ProposerReach: "r", VotingDeadline: 1, SubmitTime: 1, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("voting-deadline == submit-time should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestMsgVoteValidateBasic asserts MsgVote ValidateBasic error paths.
|
|
||||||
func TestMsgVoteValidateBasic(t *testing.T) {
|
|
||||||
// valid
|
|
||||||
if err := (&types.MsgVote{VoteID: "v", ProposalID: "p", VoterReach: "r", Option: types.VoteOptionYes, Signer: "r"}).ValidateBasic(); err != nil {
|
|
||||||
t.Errorf("valid MsgVote should pass; got: %v", err)
|
|
||||||
}
|
|
||||||
// Veto is allowed at ValidateBasic (Watcher authz is a runtime gate).
|
|
||||||
if err := (&types.MsgVote{VoteID: "v", ProposalID: "p", VoterReach: "r", Option: types.VoteOptionVeto, Signer: "r"}).ValidateBasic(); err != nil {
|
|
||||||
t.Errorf("MsgVote with Veto should pass ValidateBasic (Watcher authz is a runtime gate); got: %v", err)
|
|
||||||
}
|
|
||||||
// empty vote-id
|
|
||||||
if err := (&types.MsgVote{ProposalID: "p", VoterReach: "r", Option: types.VoteOptionYes, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty vote-id should be rejected")
|
|
||||||
}
|
|
||||||
// empty proposal-id
|
|
||||||
if err := (&types.MsgVote{VoteID: "v", VoterReach: "r", Option: types.VoteOptionYes, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty proposal-id should be rejected")
|
|
||||||
}
|
|
||||||
// empty voter-reach
|
|
||||||
if err := (&types.MsgVote{VoteID: "v", ProposalID: "p", Option: types.VoteOptionYes, Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty voter-reach should be rejected")
|
|
||||||
}
|
|
||||||
// unknown option
|
|
||||||
if err := (&types.MsgVote{VoteID: "v", ProposalID: "p", VoterReach: "r", Option: types.VoteOption("Bogus"), Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("unknown option should be rejected")
|
|
||||||
}
|
|
||||||
// empty signer
|
|
||||||
if err := (&types.MsgVote{VoteID: "v", ProposalID: "p", VoterReach: "r", Option: types.VoteOptionYes}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty signer should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestMsgTallyProposalValidateBasic asserts MsgTallyProposal ValidateBasic.
|
|
||||||
func TestMsgTallyProposalValidateBasic(t *testing.T) {
|
|
||||||
// valid
|
|
||||||
if err := (&types.MsgTallyProposal{ProposalID: "p", Signer: "r"}).ValidateBasic(); err != nil {
|
|
||||||
t.Errorf("valid MsgTallyProposal should pass; got: %v", err)
|
|
||||||
}
|
|
||||||
// empty proposal-id
|
|
||||||
if err := (&types.MsgTallyProposal{Signer: "r"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty proposal-id should be rejected")
|
|
||||||
}
|
|
||||||
// empty signer
|
|
||||||
if err := (&types.MsgTallyProposal{ProposalID: "p"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty signer should be rejected")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisRejectsDupProposalIDs asserts A-212: duplicate
|
|
||||||
// proposal-ids are rejected (P7 genesis validation).
|
|
||||||
func TestValidateGenesisRejectsDupProposalIDs(t *testing.T) {
|
|
||||||
gs := types.GenesisState{
|
|
||||||
Councils: []types.Council{{CouncilID: "c1", Kind: types.CouncilMesh}},
|
|
||||||
Proposals: []types.Proposal{
|
|
||||||
{ProposalID: "p1", CouncilID: "c1", Kind: types.ProposalKindMesh, Status: types.ProposalStatusPending},
|
|
||||||
{ProposalID: "p1", CouncilID: "c1", Kind: types.ProposalKindMesh, Status: types.ProposalStatusActive},
|
|
||||||
},
|
|
||||||
Params: types.DefaultParams(),
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := types.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject duplicate proposal-ids")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisRejectsProposalWithUnknownCouncil asserts referential
|
|
||||||
// integrity: a Proposal whose council-id does not reference an existing
|
|
||||||
// Council is rejected (P7 genesis validation).
|
|
||||||
func TestValidateGenesisRejectsProposalWithUnknownCouncil(t *testing.T) {
|
|
||||||
gs := types.GenesisState{
|
|
||||||
Councils: []types.Council{{CouncilID: "c1", Kind: types.CouncilMesh}},
|
|
||||||
Proposals: []types.Proposal{{ProposalID: "p1", CouncilID: "no-such", Kind: types.ProposalKindMesh, Status: types.ProposalStatusPending}},
|
|
||||||
Params: types.DefaultParams(),
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := types.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject Proposal with unknown council-id")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisRejectsProposalWithUnknownKind asserts an unknown
|
|
||||||
// ProposalKind is rejected at genesis.
|
|
||||||
func TestValidateGenesisRejectsProposalWithUnknownKind(t *testing.T) {
|
|
||||||
gs := types.GenesisState{
|
|
||||||
Councils: []types.Council{{CouncilID: "c1", Kind: types.CouncilMesh}},
|
|
||||||
Proposals: []types.Proposal{{ProposalID: "p1", CouncilID: "c1", Kind: types.ProposalKind("Bogus"), Status: types.ProposalStatusPending}},
|
|
||||||
Params: types.DefaultParams(),
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := types.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject Proposal with unknown kind")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisRejectsBadParams asserts a Params with an out-of-
|
|
||||||
// bounds WatcherVetoQuorum is rejected (G-020).
|
|
||||||
func TestValidateGenesisRejectsBadParams(t *testing.T) {
|
|
||||||
gs := types.GenesisState{
|
|
||||||
Councils: []types.Council{{CouncilID: "c1", Kind: types.CouncilMesh}},
|
|
||||||
Params: types.Params{WatcherVetoQuorum: 0}, // below min 2
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := types.ValidateGenesis(bz); err == nil {
|
|
||||||
t.Error("ValidateGenesis should reject Params with WatcherVetoQuorum=0 (G-020)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestValidateGenesisAcceptsProposalAndVotes asserts a clean genesis with
|
|
||||||
// Proposals + Votes validates.
|
|
||||||
func TestValidateGenesisAcceptsProposalAndVotes(t *testing.T) {
|
|
||||||
gs := types.GenesisState{
|
|
||||||
Councils: []types.Council{{CouncilID: "cm", Kind: types.CouncilMesh}},
|
|
||||||
Proposals: []types.Proposal{
|
|
||||||
{ProposalID: "p1", CouncilID: "cm", Kind: types.ProposalKindMesh, Status: types.ProposalStatusActive},
|
|
||||||
},
|
|
||||||
Votes: []types.Vote{
|
|
||||||
{VoteID: "v1", ProposalID: "p1", Option: types.VoteOptionYes},
|
|
||||||
{VoteID: "v2", ProposalID: "p1", Option: types.VoteOptionVeto},
|
|
||||||
},
|
|
||||||
Params: types.DefaultParams(),
|
|
||||||
}
|
|
||||||
bz, _ := json.Marshal(gs)
|
|
||||||
if err := types.ValidateGenesis(bz); err != nil {
|
|
||||||
t.Errorf("ValidateGenesis should accept clean proposal+vote genesis, got: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Lexicon assertion (REQ-012) -------------------------------------------------
|
// --- Lexicon assertion (REQ-012) -------------------------------------------------
|
||||||
|
|
||||||
// TestLexiconNoBannedTermsInCouncilPackage scans every non-test .go file in
|
// TestLexiconNoBannedTermsInCouncilPackage scans every non-test .go file in
|
||||||
|
|||||||
@@ -1,165 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/exit/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// keeper.go holds the store-backed Keeper for the exit module (P1-05-01).
|
|
||||||
//
|
|
||||||
// The Keeper wraps an sdk.KVStore via a storeKey. It holds the ExitRoute
|
|
||||||
// records (by route-id) and the DEXSwap records (by swap-id). The Keeper
|
|
||||||
// also holds the expected-keeper shim (BridgeKeeper for cross-chain exits).
|
|
||||||
// The shim is an interface (G-003 — no struct import of x/bridge/types);
|
|
||||||
// the concrete x/bridge keeper satisfies it structurally.
|
|
||||||
//
|
|
||||||
// The Fee Covenant clamp (x/feecovenant/types.Clamp) is invoked on
|
|
||||||
// exit-fee-bps at runtime per the v0.5 interface extension. The clamp
|
|
||||||
// ensures the exit fee is within [FeeFloorBps=1, FeeCeilingBps=10] (§18
|
|
||||||
// Mission-Lock Fee Covenant — auto-decline-only, never auto-increase).
|
|
||||||
//
|
|
||||||
// State-machine ordering (vision §7, enforced in every handler):
|
|
||||||
// ValidateBasic → keeper authz → state mutation → ctx.EventManager().EmitEvent
|
|
||||||
|
|
||||||
// Keeper is the store-backed exit keeper.
|
|
||||||
type Keeper struct {
|
|
||||||
cdc codec.Codec
|
|
||||||
storeKey storetypes.StoreKey
|
|
||||||
bridgeKeeper types.BridgeKeeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewKeeper constructs a new store-backed exit Keeper. The BridgeKeeper
|
|
||||||
// expected-keeper shim is injected (nil-able for partial tests; the
|
|
||||||
// ExecuteDEXSwap handler guards a nil shim for same-chain exits).
|
|
||||||
func NewKeeper(cdc codec.Codec, storeKey storetypes.StoreKey, bk types.BridgeKeeper) Keeper {
|
|
||||||
return Keeper{
|
|
||||||
cdc: cdc,
|
|
||||||
storeKey: storeKey,
|
|
||||||
bridgeKeeper: bk,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetBridgeKeeper sets the BridgeKeeper expected-keeper shim (for
|
|
||||||
// post-construction wiring, e.g., app wiring or test setup).
|
|
||||||
func (k *Keeper) SetBridgeKeeper(bk types.BridgeKeeper) { k.bridgeKeeper = bk }
|
|
||||||
|
|
||||||
// --- ExitRoute store ----------------------------------------------------------
|
|
||||||
|
|
||||||
var routeKeyPrefix = []byte("route/")
|
|
||||||
|
|
||||||
func routeKey(routeID string) []byte {
|
|
||||||
return append(routeKeyPrefix, []byte(routeID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetExitRoute loads an ExitRoute by route-id. Returns the route and true
|
|
||||||
// if found, or zero value + false if not.
|
|
||||||
func (k Keeper) GetExitRoute(ctx sdk.Context, routeID string) (types.ExitRoute, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(routeKey(routeID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.ExitRoute{}, false
|
|
||||||
}
|
|
||||||
var r types.ExitRoute
|
|
||||||
if err := json.Unmarshal(bz, &r); err != nil {
|
|
||||||
return types.ExitRoute{}, false
|
|
||||||
}
|
|
||||||
return r, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetExitRoute persists an ExitRoute by route-id.
|
|
||||||
func (k Keeper) SetExitRoute(ctx sdk.Context, r types.ExitRoute) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(r)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("exit: marshal route %q: %v", r.RouteID, err))
|
|
||||||
}
|
|
||||||
store.Set(routeKey(r.RouteID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllExitRoutes returns all persisted ExitRoute records (iteration helper).
|
|
||||||
func (k Keeper) AllExitRoutes(ctx sdk.Context) []types.ExitRoute {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(routeKeyPrefix, prefixEnd(routeKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.ExitRoute{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var r types.ExitRoute
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &r); err == nil {
|
|
||||||
out = append(out, r)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- DEXSwap store ------------------------------------------------------------
|
|
||||||
|
|
||||||
var swapKeyPrefix = []byte("swap/")
|
|
||||||
|
|
||||||
func swapKey(swapID string) []byte {
|
|
||||||
return append(swapKeyPrefix, []byte(swapID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetDEXSwap loads a DEXSwap by swap-id. Returns the swap and true if found.
|
|
||||||
func (k Keeper) GetDEXSwap(ctx sdk.Context, swapID string) (types.DEXSwap, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(swapKey(swapID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.DEXSwap{}, false
|
|
||||||
}
|
|
||||||
var s types.DEXSwap
|
|
||||||
if err := json.Unmarshal(bz, &s); err != nil {
|
|
||||||
return types.DEXSwap{}, false
|
|
||||||
}
|
|
||||||
return s, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetDEXSwap persists a DEXSwap by swap-id.
|
|
||||||
func (k Keeper) SetDEXSwap(ctx sdk.Context, s types.DEXSwap) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(s)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("exit: marshal swap %q: %v", s.SwapID, err))
|
|
||||||
}
|
|
||||||
store.Set(swapKey(s.SwapID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllDEXSwaps returns all persisted DEXSwap records (iteration helper).
|
|
||||||
func (k Keeper) AllDEXSwaps(ctx sdk.Context) []types.DEXSwap {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(swapKeyPrefix, prefixEnd(swapKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.DEXSwap{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var s types.DEXSwap
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &s); err == nil {
|
|
||||||
out = append(out, s)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// prefixEnd returns the key that sorts immediately after all keys sharing the
|
|
||||||
// given prefix (the standard prefix-iteration end key: increment the last
|
|
||||||
// byte, drop overflow). Used for store.Iterator(start, prefixEnd(start))
|
|
||||||
// prefix scans.
|
|
||||||
func prefixEnd(prefix []byte) []byte {
|
|
||||||
if len(prefix) == 0 {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
end := make([]byte, len(prefix))
|
|
||||||
copy(end, prefix)
|
|
||||||
for i := len(end) - 1; i >= 0; i-- {
|
|
||||||
end[i]++
|
|
||||||
if end[i] != 0 {
|
|
||||||
return end
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// All bytes were 0xFF; return nil (iterate to end of store).
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@@ -1,262 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/exit/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// msg_server.go implements the exit module's MsgServer (G-023 ownership
|
|
||||||
// split: cosmos-engineer scaffolds the file structure; backend-engineer
|
|
||||||
// implements the handler logic bodies). The MsgServer wraps the Keeper +
|
|
||||||
// the BridgeKeeper expected-keeper shim (already on the Keeper).
|
|
||||||
//
|
|
||||||
// Each method returns a (*Response, error). Handler state-machine ordering
|
|
||||||
// is enforced: ValidateBasic → keeper authz → state mutation →
|
|
||||||
// ctx.EventManager().EmitEvent.
|
|
||||||
//
|
|
||||||
// Fee Covenant clamp (§18, REQ-012): the exit fee (exit-fee-bps) is clamped
|
|
||||||
// to [FeeFloorBps=1, FeeCeilingBps=10] at runtime. The clamp is the runtime
|
|
||||||
// echo of the locked Fee Covenant consts (x/feecovenant/types.Clamp —
|
|
||||||
// cross-documented per the G-003 lexicon-safe-consts pattern used by
|
|
||||||
// D-028/REQ-030; the consts are NOT imported across x/<module>/types per
|
|
||||||
// G-003, they are re-declared locally with a cross-reference comment to the
|
|
||||||
// source of truth). A clamp event is emitted for simtest assertion (the
|
|
||||||
// clamp is a stateless transform; the event documents the clamp for audit).
|
|
||||||
|
|
||||||
// Fee Covenant consts (§18, LOCKED — cross-documented from
|
|
||||||
// x/feecovenant/types). These are the Mission-Lock Fee Covenant bounds:
|
|
||||||
// the exit fee can never exceed FeeCeilingBps (0.1pct) or fall below
|
|
||||||
// FeeFloorBps (0.01pct). Auto-decline-only, never auto-increase. G-003:
|
|
||||||
// the consts are re-declared locally (not imported across x/<module>/types)
|
|
||||||
// with a cross-reference to the source of truth in x/feecovenant/types.go.
|
|
||||||
// A regression test in x/feecovenant/types/types_test.go asserts the source
|
|
||||||
// consts stay at 10/1; the cross-reference comment keeps these in lockstep.
|
|
||||||
const (
|
|
||||||
exitFeeCeilingBps = 10 // 0.1pct (ceiling, LOCKED — matches FeeCeilingBps)
|
|
||||||
exitFeeFloorBps = 1 // 0.01pct (floor, LOCKED — matches FeeFloorBps)
|
|
||||||
)
|
|
||||||
|
|
||||||
// clampExitFee clamps the exit fee to the Fee Covenant bounds [1, 10] bps.
|
|
||||||
// This is the runtime echo of x/feecovenant/types.Clamp (cross-documented;
|
|
||||||
// the clamp logic is identical to the source). G-003: the clamp is local
|
|
||||||
// (no import of x/feecovenant/types).
|
|
||||||
func clampExitFee(feeBps uint32) uint32 {
|
|
||||||
if feeBps > exitFeeCeilingBps {
|
|
||||||
return exitFeeCeilingBps
|
|
||||||
}
|
|
||||||
if feeBps < exitFeeFloorBps {
|
|
||||||
return exitFeeFloorBps
|
|
||||||
}
|
|
||||||
return feeBps
|
|
||||||
}
|
|
||||||
|
|
||||||
// msgServer is the concrete MsgServer implementation wrapping the Keeper.
|
|
||||||
type msgServer struct {
|
|
||||||
Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewMsgServerImpl returns the exit MsgServer for the provided Keeper.
|
|
||||||
func NewMsgServerImpl(k Keeper) types.MsgServer {
|
|
||||||
return &msgServer{Keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
var _ types.MsgServer = msgServer{}
|
|
||||||
|
|
||||||
// unwrapCtx extracts the sdk.Context from the interface-typed ctx.
|
|
||||||
func unwrapCtx(ctx interface{}) sdk.Context {
|
|
||||||
if c, ok := ctx.(sdk.Context); ok {
|
|
||||||
return c
|
|
||||||
}
|
|
||||||
panic(fmt.Sprintf("exit: expected sdk.Context, got %T", ctx))
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- SubmitExitRoute (creates ExitRoute status=Proposed) ----------------------
|
|
||||||
//
|
|
||||||
// State-machine ordering:
|
|
||||||
// ValidateBasic → state mutation (create route, status=Proposed) → emit event.
|
|
||||||
|
|
||||||
// SubmitExitRoute creates an ExitRoute with status=Proposed.
|
|
||||||
func (s msgServer) SubmitExitRoute(ctx interface{}, msg *types.MsgSubmitExitRoute) (*types.MsgSubmitExitRouteResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Idempotency: route-id must not already exist.
|
|
||||||
if _, ok := s.Keeper.GetExitRoute(sdkCtx, msg.RouteID); ok {
|
|
||||||
return nil, fmt.Errorf("exit: route %q already exists", msg.RouteID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// State mutation: create route status=Proposed.
|
|
||||||
r := types.ExitRoute{
|
|
||||||
RouteID: msg.RouteID,
|
|
||||||
BridgeRouteID: "", // set later for cross-chain exits (optional)
|
|
||||||
Status: types.ExitProposed,
|
|
||||||
}
|
|
||||||
s.Keeper.SetExitRoute(sdkCtx, r)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"exit.submit_route",
|
|
||||||
sdk.NewAttribute("route_id", msg.RouteID),
|
|
||||||
sdk.NewAttribute("holder_reach_id", msg.HolderReachID),
|
|
||||||
sdk.NewAttribute("status", string(types.ExitProposed)),
|
|
||||||
))
|
|
||||||
return &types.MsgSubmitExitRouteResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- ExecuteDEXSwap (Proposed → InProgress → Settled/Failed) ------------------
|
|
||||||
//
|
|
||||||
// Transitions an exit route Proposed → InProgress → Settled (success) or
|
|
||||||
// Failed (slippage/timeout). Cross-chain exits invoke the BridgeKeeper
|
|
||||||
// expected-keeper shim by ID-string on the route's bridge-route-id (G-003).
|
|
||||||
// The Fee Covenant clamp (§18) is invoked on exit-fee-bps at runtime.
|
|
||||||
//
|
|
||||||
// State-machine ordering:
|
|
||||||
// ValidateBasic → load route (authz: must be Proposed or InProgress) →
|
|
||||||
// cross-chain hop via BridgeKeeper shim (if bridge-route-id set) →
|
|
||||||
// Fee Covenant clamp on exit-fee-bps → state mutation (status transition)
|
|
||||||
// → emit event (incl. clamp event).
|
|
||||||
|
|
||||||
// ExecuteDEXSwap executes the pre-computed venue-hops for an exit route.
|
|
||||||
func (s msgServer) ExecuteDEXSwap(ctx interface{}, msg *types.MsgExecuteDEXSwap) (*types.MsgExecuteDEXSwapResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
// Stateful: load route; must be Proposed or InProgress.
|
|
||||||
r, ok := s.Keeper.GetExitRoute(sdkCtx, msg.RouteID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("exit: route %q not found", msg.RouteID)
|
|
||||||
}
|
|
||||||
if r.Status != types.ExitProposed && r.Status != types.ExitInProgress {
|
|
||||||
// Replay rejection: a duplicate ExecuteDEXSwap on a Settled route
|
|
||||||
// is a no-op error (the route is terminal).
|
|
||||||
return nil, fmt.Errorf("exit: route %q status %q, must be Proposed or InProgress", msg.RouteID, r.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Proposed → InProgress (first hop).
|
|
||||||
if r.Status == types.ExitProposed {
|
|
||||||
r.Status = types.ExitInProgress
|
|
||||||
s.Keeper.SetExitRoute(sdkCtx, r)
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"exit.in_progress",
|
|
||||||
sdk.NewAttribute("route_id", msg.RouteID),
|
|
||||||
sdk.NewAttribute("status", string(types.ExitInProgress)),
|
|
||||||
))
|
|
||||||
}
|
|
||||||
|
|
||||||
// Cross-chain exit: invoke the BridgeKeeper shim by ID-string (G-003).
|
|
||||||
if r.BridgeRouteID != "" {
|
|
||||||
if s.Keeper.bridgeKeeper == nil {
|
|
||||||
// Cross-chain exit but shim not wired: fail the route.
|
|
||||||
r.Status = types.ExitFailed
|
|
||||||
s.Keeper.SetExitRoute(sdkCtx, r)
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"exit.failed",
|
|
||||||
sdk.NewAttribute("route_id", msg.RouteID),
|
|
||||||
sdk.NewAttribute("reason", "bridge keeper shim not wired"),
|
|
||||||
))
|
|
||||||
return &types.MsgExecuteDEXSwapResponse{}, nil
|
|
||||||
}
|
|
||||||
status, _, err := s.Keeper.bridgeKeeper.GetBridgeRoute(r.BridgeRouteID)
|
|
||||||
if err != nil || status != "Active" {
|
|
||||||
// Bridge route not active: fail the exit (slippage/timeout).
|
|
||||||
r.Status = types.ExitFailed
|
|
||||||
s.Keeper.SetExitRoute(sdkCtx, r)
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"exit.failed",
|
|
||||||
sdk.NewAttribute("route_id", msg.RouteID),
|
|
||||||
sdk.NewAttribute("bridge_route_id", r.BridgeRouteID),
|
|
||||||
sdk.NewAttribute("bridge_status", status),
|
|
||||||
))
|
|
||||||
return &types.MsgExecuteDEXSwapResponse{}, nil
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Fee Covenant clamp (§18): clamp exit-fee-bps to [1, 10] at runtime.
|
|
||||||
// The clamp is the runtime echo of the locked Fee Covenant consts. The
|
|
||||||
// simtest passes a fee via the venue string encoding (simtest
|
|
||||||
// convention: "venue:feeBps"); the handler clamps and emits a clamp
|
|
||||||
// event for simtest assertion.
|
|
||||||
exitFeeBps := uint32(parseFeeBps(msg.Venue))
|
|
||||||
clampedFee := clampExitFee(exitFeeBps)
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"exit.fee_covenant_clamp",
|
|
||||||
sdk.NewAttribute("route_id", msg.RouteID),
|
|
||||||
sdk.NewAttribute("fee_bps_requested", fmt.Sprintf("%d", exitFeeBps)),
|
|
||||||
sdk.NewAttribute("fee_bps_clamped", fmt.Sprintf("%d", clampedFee)),
|
|
||||||
))
|
|
||||||
|
|
||||||
// InProgress → Settled (success). Produce a DEXSwap record.
|
|
||||||
r.Status = types.ExitSettled
|
|
||||||
s.Keeper.SetExitRoute(sdkCtx, r)
|
|
||||||
swap := types.DEXSwap{
|
|
||||||
SwapID: fmt.Sprintf("%s-swap", msg.RouteID),
|
|
||||||
Venue: msg.Venue,
|
|
||||||
Status: types.ExitSettled,
|
|
||||||
}
|
|
||||||
s.Keeper.SetDEXSwap(sdkCtx, swap)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"exit.settled",
|
|
||||||
sdk.NewAttribute("route_id", msg.RouteID),
|
|
||||||
sdk.NewAttribute("status", string(types.ExitSettled)),
|
|
||||||
sdk.NewAttribute("venue", msg.Venue),
|
|
||||||
))
|
|
||||||
return &types.MsgExecuteDEXSwapResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- RefundExit (Failed → Refunded) ------------------------------------------
|
|
||||||
//
|
|
||||||
// State-machine ordering:
|
|
||||||
// ValidateBasic → load route (authz: must be Failed) → state mutation
|
|
||||||
// (status=Refunded) → emit event.
|
|
||||||
|
|
||||||
// RefundExit transitions a Failed exit to Refunded.
|
|
||||||
func (s msgServer) RefundExit(ctx interface{}, msg *types.MsgRefundExit) (*types.MsgRefundExitResponse, error) {
|
|
||||||
if err := msg.ValidateBasic(); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
|
|
||||||
r, ok := s.Keeper.GetExitRoute(sdkCtx, msg.RouteID)
|
|
||||||
if !ok {
|
|
||||||
return nil, fmt.Errorf("exit: route %q not found", msg.RouteID)
|
|
||||||
}
|
|
||||||
if r.Status != types.ExitFailed {
|
|
||||||
return nil, fmt.Errorf("exit: route %q status %q, must be Failed to refund", msg.RouteID, r.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
r.Status = types.ExitRefunded
|
|
||||||
s.Keeper.SetExitRoute(sdkCtx, r)
|
|
||||||
|
|
||||||
sdkCtx.EventManager().EmitEvent(sdk.NewEvent(
|
|
||||||
"exit.refunded",
|
|
||||||
sdk.NewAttribute("route_id", msg.RouteID),
|
|
||||||
sdk.NewAttribute("status", string(types.ExitRefunded)),
|
|
||||||
))
|
|
||||||
return &types.MsgRefundExitResponse{}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// parseFeeBps extracts the fee-bps from the venue string (simtest convention:
|
|
||||||
// "venue:feeBps"). Returns 0 if no fee encoded (the clamp floors at
|
|
||||||
// FeeFloorBps=1).
|
|
||||||
func parseFeeBps(venue string) int {
|
|
||||||
// The simtest encodes the fee in the venue string as "venue:feeBps" for
|
|
||||||
// the clamp assertion. A real handler reads the fee from the route
|
|
||||||
// params; the simtest uses the venue encoding for simplicity (D-054).
|
|
||||||
for i := len(venue) - 1; i >= 0; i-- {
|
|
||||||
if venue[i] == ':' {
|
|
||||||
var fee int
|
|
||||||
if _, err := fmt.Sscanf(venue[i+1:], "%d", &fee); err == nil {
|
|
||||||
return fee
|
|
||||||
}
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
@@ -1,515 +0,0 @@
|
|||||||
package keeper_test
|
|
||||||
|
|
||||||
// msg_server_simtest_test.go is the x/exit keeper simtest (P1-06-01).
|
|
||||||
//
|
|
||||||
// D-054: simtest-grade — in-memory sdk.Context + dbm in-memory store, no
|
|
||||||
// real IBC light clients. The simtest wires the expected-keeper shim
|
|
||||||
// (BridgeKeeper) to an in-test stub (G-003 test exemption: the test imports
|
|
||||||
// x/exit/keeper + defines a stub BridgeKeeper that satisfies the interface;
|
|
||||||
// no production struct imports across x/<module>/types).
|
|
||||||
//
|
|
||||||
// Coverage (A-513, G-021):
|
|
||||||
// - ExitStatus lifecycle: Proposed → InProgress → Settled; Failed → Refunded.
|
|
||||||
// - Cross-chain exit via BridgeKeeper shim (G-003 test exemption — wired to
|
|
||||||
// a stub that returns Active status; the simtest asserts the shim is called).
|
|
||||||
// - Fee Covenant clamp event (exit-fee-bps clamped to [1, 10] bps).
|
|
||||||
// - Replay rejection (duplicate MsgExecuteDEXSwap on a Settled route is an
|
|
||||||
// error — the route is terminal).
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"cosmossdk.io/log"
|
|
||||||
"cosmossdk.io/store"
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
cmtproto "github.com/cometbft/cometbft/proto/tendermint/types"
|
|
||||||
dbm "github.com/cosmos/cosmos-db"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
codectypes "github.com/cosmos/cosmos-sdk/codec/types"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/exit/keeper"
|
|
||||||
exittypes "github.com/oy/openyield/x/exit/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// --- Stub expected-keeper (G-003 test exemption) -----------------------------
|
|
||||||
|
|
||||||
// stubBridgeKeeper satisfies exittypes.BridgeKeeper for the simtest. It
|
|
||||||
// records GetBridgeRoute calls and returns the configured status/bridge-type.
|
|
||||||
type stubBridgeKeeper struct {
|
|
||||||
// routes maps bridge-id → (status, bridgeType).
|
|
||||||
routes map[string]stubBridgeRoute
|
|
||||||
calls int
|
|
||||||
}
|
|
||||||
|
|
||||||
type stubBridgeRoute struct {
|
|
||||||
status string
|
|
||||||
bridgeType string
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *stubBridgeKeeper) GetBridgeRoute(routeID string) (status string, bridgeType string, err error) {
|
|
||||||
s.calls++
|
|
||||||
r, ok := s.routes[routeID]
|
|
||||||
if !ok {
|
|
||||||
return "", "", nil // not found: status "" → handler fails the exit
|
|
||||||
}
|
|
||||||
return r.status, r.bridgeType, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Simtest context helper --------------------------------------------------
|
|
||||||
|
|
||||||
// newSimtestContext constructs an in-memory sdk.Context with a KVStore mounted
|
|
||||||
// at the exit store key. D-054: in-memory, no real IBC light clients.
|
|
||||||
func newSimtestContext(t *testing.T) (sdk.Context, *stubBridgeKeeper, keeper.Keeper) {
|
|
||||||
t.Helper()
|
|
||||||
db := dbm.NewMemDB()
|
|
||||||
cdc := newTestCodec()
|
|
||||||
storeKey := storetypes.NewKVStoreKey(exittypes.StoreKey)
|
|
||||||
cms := store.NewCommitMultiStore(db, log.NewNopLogger(), nil)
|
|
||||||
cms.MountStoreWithDB(storeKey, storetypes.StoreTypeDB, nil)
|
|
||||||
if err := cms.LoadLatestVersion(); err != nil {
|
|
||||||
t.Fatalf("load latest version: %v", err)
|
|
||||||
}
|
|
||||||
ctx := sdk.NewContext(cms, cmtproto.Header{}, false, log.NewNopLogger())
|
|
||||||
|
|
||||||
bk := &stubBridgeKeeper{routes: map[string]stubBridgeRoute{}}
|
|
||||||
k := keeper.NewKeeper(cdc, storeKey, bk)
|
|
||||||
return ctx, bk, k
|
|
||||||
}
|
|
||||||
|
|
||||||
// newTestCodec constructs a minimal codec for the simtest.
|
|
||||||
func newTestCodec() codec.Codec {
|
|
||||||
registry := codectypes.NewInterfaceRegistry()
|
|
||||||
return codec.NewProtoCodec(registry)
|
|
||||||
}
|
|
||||||
|
|
||||||
// hasEvent reports whether ctx emitted an event of the given type.
|
|
||||||
func hasEvent(ctx sdk.Context, eventType string) bool {
|
|
||||||
for _, ev := range ctx.EventManager().Events() {
|
|
||||||
if ev.Type == eventType {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
|
|
||||||
// eventAttr returns the value of an attribute on the last event of the given
|
|
||||||
// type, or "" if not found.
|
|
||||||
func eventAttr(ctx sdk.Context, eventType, attrKey string) string {
|
|
||||||
for _, ev := range ctx.EventManager().Events() {
|
|
||||||
if ev.Type == eventType {
|
|
||||||
for _, a := range ev.Attributes {
|
|
||||||
if string(a.Key) == attrKey {
|
|
||||||
return string(a.Value)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return ""
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- ExitStatus lifecycle: Proposed → InProgress → Settled -------------------
|
|
||||||
|
|
||||||
// TestExitStatusLifecycleProposedToSettled asserts the full success lifecycle:
|
|
||||||
// SubmitExitRoute (Proposed) → ExecuteDEXSwap (InProgress → Settled). The
|
|
||||||
// DEXSwap record is produced. The Fee Covenant clamp event is emitted.
|
|
||||||
func TestExitStatusLifecycleProposedToSettled(t *testing.T) {
|
|
||||||
ctx, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
|
|
||||||
// SubmitExitRoute → Proposed.
|
|
||||||
if _, err := srv.SubmitExitRoute(ctx, &exittypes.MsgSubmitExitRoute{
|
|
||||||
RouteID: "route-1", HolderReachID: "holder-1",
|
|
||||||
SourceAsset: "ubread", DestAsset: "uatom", Amount: 500, Signer: "holder-1",
|
|
||||||
}); err != nil {
|
|
||||||
t.Fatalf("SubmitExitRoute: %v", err)
|
|
||||||
}
|
|
||||||
r, ok := k.GetExitRoute(ctx, "route-1")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("route not found after submit")
|
|
||||||
}
|
|
||||||
if r.Status != exittypes.ExitProposed {
|
|
||||||
t.Errorf("status = %q, want Proposed", r.Status)
|
|
||||||
}
|
|
||||||
if !hasEvent(ctx, "exit.submit_route") {
|
|
||||||
t.Error("submit_route event not emitted")
|
|
||||||
}
|
|
||||||
|
|
||||||
// ExecuteDEXSwap → InProgress → Settled (same-chain exit, no bridge-route-id).
|
|
||||||
if _, err := srv.ExecuteDEXSwap(ctx, &exittypes.MsgExecuteDEXSwap{
|
|
||||||
RouteID: "route-1", Venue: "uniswap-v3:5", Signer: "holder-1",
|
|
||||||
}); err != nil {
|
|
||||||
t.Fatalf("ExecuteDEXSwap: %v", err)
|
|
||||||
}
|
|
||||||
r, _ = k.GetExitRoute(ctx, "route-1")
|
|
||||||
if r.Status != exittypes.ExitSettled {
|
|
||||||
t.Errorf("status = %q, want Settled", r.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
// DEXSwap record produced.
|
|
||||||
swap, ok := k.GetDEXSwap(ctx, "route-1-swap")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("DEXSwap record not produced")
|
|
||||||
}
|
|
||||||
if swap.Status != exittypes.ExitSettled {
|
|
||||||
t.Errorf("swap status = %q, want Settled", swap.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Fee Covenant clamp event emitted (5 bps → within [1,10], no clamp).
|
|
||||||
if !hasEvent(ctx, "exit.fee_covenant_clamp") {
|
|
||||||
t.Error("fee_covenant_clamp event not emitted")
|
|
||||||
}
|
|
||||||
if !hasEvent(ctx, "exit.settled") {
|
|
||||||
t.Error("settled event not emitted")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestFeeCovenantClampHighFee asserts a fee above the ceiling (10 bps) is
|
|
||||||
// clamped to the ceiling (10 bps) — the Fee Covenant auto-decline-only rule.
|
|
||||||
func TestFeeCovenantClampHighFee(t *testing.T) {
|
|
||||||
ctx, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
|
|
||||||
srv.SubmitExitRoute(ctx, &exittypes.MsgSubmitExitRoute{
|
|
||||||
RouteID: "route-clamp-hi", HolderReachID: "h",
|
|
||||||
SourceAsset: "ubread", DestAsset: "uatom", Amount: 100, Signer: "h",
|
|
||||||
})
|
|
||||||
srv.ExecuteDEXSwap(ctx, &exittypes.MsgExecuteDEXSwap{
|
|
||||||
RouteID: "route-clamp-hi", Venue: "venue:99", Signer: "h", // 99 bps → clamped to 10
|
|
||||||
})
|
|
||||||
|
|
||||||
clamped := eventAttr(ctx, "exit.fee_covenant_clamp", "fee_bps_clamped")
|
|
||||||
if clamped != "10" {
|
|
||||||
t.Errorf("fee should be clamped to 10 (ceiling); got %q", clamped)
|
|
||||||
}
|
|
||||||
requested := eventAttr(ctx, "exit.fee_covenant_clamp", "fee_bps_requested")
|
|
||||||
if requested != "99" {
|
|
||||||
t.Errorf("fee requested = %q, want 99", requested)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestFeeCovenantClampLowFee asserts a fee below the floor (1 bps) is clamped
|
|
||||||
// up to the floor (1 bps) — the Fee Covenant never-below-floor rule.
|
|
||||||
func TestFeeCovenantClampLowFee(t *testing.T) {
|
|
||||||
ctx, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
|
|
||||||
srv.SubmitExitRoute(ctx, &exittypes.MsgSubmitExitRoute{
|
|
||||||
RouteID: "route-clamp-lo", HolderReachID: "h",
|
|
||||||
SourceAsset: "ubread", DestAsset: "uatom", Amount: 100, Signer: "h",
|
|
||||||
})
|
|
||||||
srv.ExecuteDEXSwap(ctx, &exittypes.MsgExecuteDEXSwap{
|
|
||||||
RouteID: "route-clamp-lo", Venue: "venue:0", Signer: "h", // 0 bps → clamped to 1
|
|
||||||
})
|
|
||||||
|
|
||||||
clamped := eventAttr(ctx, "exit.fee_covenant_clamp", "fee_bps_clamped")
|
|
||||||
if clamped != "1" {
|
|
||||||
t.Errorf("fee should be clamped to 1 (floor); got %q", clamped)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestFeeCovenantClampInBand asserts a fee within [1, 10] bps is unchanged.
|
|
||||||
func TestFeeCovenantClampInBand(t *testing.T) {
|
|
||||||
ctx, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
|
|
||||||
srv.SubmitExitRoute(ctx, &exittypes.MsgSubmitExitRoute{
|
|
||||||
RouteID: "route-band", HolderReachID: "h",
|
|
||||||
SourceAsset: "ubread", DestAsset: "uatom", Amount: 100, Signer: "h",
|
|
||||||
})
|
|
||||||
srv.ExecuteDEXSwap(ctx, &exittypes.MsgExecuteDEXSwap{
|
|
||||||
RouteID: "route-band", Venue: "venue:5", Signer: "h", // 5 bps → in-band, unchanged
|
|
||||||
})
|
|
||||||
|
|
||||||
clamped := eventAttr(ctx, "exit.fee_covenant_clamp", "fee_bps_clamped")
|
|
||||||
if clamped != "5" {
|
|
||||||
t.Errorf("fee in-band should be unchanged at 5; got %q", clamped)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- ExitStatus lifecycle: Failed → Refunded ---------------------------------
|
|
||||||
|
|
||||||
// TestExitStatusLifecycleFailedToRefunded asserts the failure/refund path:
|
|
||||||
// SubmitExitRoute (Proposed) → cross-chain ExecuteDEXSwap with a non-Active
|
|
||||||
// bridge route → Failed → RefundExit → Refunded.
|
|
||||||
func TestExitStatusLifecycleFailedToRefunded(t *testing.T) {
|
|
||||||
ctx, bk, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
|
|
||||||
// Submit a cross-chain exit route (with a bridge-route-id).
|
|
||||||
srv.SubmitExitRoute(ctx, &exittypes.MsgSubmitExitRoute{
|
|
||||||
RouteID: "route-fail", HolderReachID: "h",
|
|
||||||
SourceAsset: "ubread", DestAsset: "uatom", Amount: 200, Signer: "h",
|
|
||||||
})
|
|
||||||
// Set the bridge-route-id on the route (simtest sets it directly; the real
|
|
||||||
// handler sets it at submit time from the route params).
|
|
||||||
r, _ := k.GetExitRoute(ctx, "route-fail")
|
|
||||||
r.BridgeRouteID = "bridge-fail-1"
|
|
||||||
k.SetExitRoute(ctx, r)
|
|
||||||
|
|
||||||
// Stub bridge returns a non-Active status (Closed) → exit fails.
|
|
||||||
bk.routes["bridge-fail-1"] = stubBridgeRoute{status: "Closed", bridgeType: "evm-ibc"}
|
|
||||||
|
|
||||||
srv.ExecuteDEXSwap(ctx, &exittypes.MsgExecuteDEXSwap{
|
|
||||||
RouteID: "route-fail", Venue: "venue:3", Signer: "h",
|
|
||||||
})
|
|
||||||
r, _ = k.GetExitRoute(ctx, "route-fail")
|
|
||||||
if r.Status != exittypes.ExitFailed {
|
|
||||||
t.Errorf("status = %q, want Failed", r.Status)
|
|
||||||
}
|
|
||||||
if !hasEvent(ctx, "exit.failed") {
|
|
||||||
t.Error("failed event not emitted")
|
|
||||||
}
|
|
||||||
|
|
||||||
// RefundExit → Refunded.
|
|
||||||
if _, err := srv.RefundExit(ctx, &exittypes.MsgRefundExit{
|
|
||||||
RouteID: "route-fail", Signer: "h",
|
|
||||||
}); err != nil {
|
|
||||||
t.Fatalf("RefundExit: %v", err)
|
|
||||||
}
|
|
||||||
r, _ = k.GetExitRoute(ctx, "route-fail")
|
|
||||||
if r.Status != exittypes.ExitRefunded {
|
|
||||||
t.Errorf("status = %q, want Refunded", r.Status)
|
|
||||||
}
|
|
||||||
if !hasEvent(ctx, "exit.refunded") {
|
|
||||||
t.Error("refunded event not emitted")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestCrossChainExitActiveBridge asserts a cross-chain exit with an Active
|
|
||||||
// bridge route succeeds (Settled), invoking the BridgeKeeper shim.
|
|
||||||
func TestCrossChainExitActiveBridge(t *testing.T) {
|
|
||||||
ctx, bk, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
|
|
||||||
srv.SubmitExitRoute(ctx, &exittypes.MsgSubmitExitRoute{
|
|
||||||
RouteID: "route-xchain", HolderReachID: "h",
|
|
||||||
SourceAsset: "ubread", DestAsset: "uatom", Amount: 300, Signer: "h",
|
|
||||||
})
|
|
||||||
r, _ := k.GetExitRoute(ctx, "route-xchain")
|
|
||||||
r.BridgeRouteID = "bridge-active-1"
|
|
||||||
k.SetExitRoute(ctx, r)
|
|
||||||
bk.routes["bridge-active-1"] = stubBridgeRoute{status: "Active", bridgeType: "evm-ibc"}
|
|
||||||
|
|
||||||
srv.ExecuteDEXSwap(ctx, &exittypes.MsgExecuteDEXSwap{
|
|
||||||
RouteID: "route-xchain", Venue: "venue:5", Signer: "h",
|
|
||||||
})
|
|
||||||
r, _ = k.GetExitRoute(ctx, "route-xchain")
|
|
||||||
if r.Status != exittypes.ExitSettled {
|
|
||||||
t.Errorf("cross-chain exit with Active bridge should Settle; got %q", r.Status)
|
|
||||||
}
|
|
||||||
if bk.calls == 0 {
|
|
||||||
t.Error("BridgeKeeper.GetBridgeRoute was not called (G-003 shim not invoked)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Replay rejection --------------------------------------------------------
|
|
||||||
|
|
||||||
// TestReplayRejectedOnSettledRoute asserts a duplicate ExecuteDEXSwap on a
|
|
||||||
// Settled route returns an error (the route is terminal — replay rejection).
|
|
||||||
func TestReplayRejectedOnSettledRoute(t *testing.T) {
|
|
||||||
ctx, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
|
|
||||||
srv.SubmitExitRoute(ctx, &exittypes.MsgSubmitExitRoute{
|
|
||||||
RouteID: "route-replay", HolderReachID: "h",
|
|
||||||
SourceAsset: "ubread", DestAsset: "uatom", Amount: 100, Signer: "h",
|
|
||||||
})
|
|
||||||
srv.ExecuteDEXSwap(ctx, &exittypes.MsgExecuteDEXSwap{
|
|
||||||
RouteID: "route-replay", Venue: "venue:5", Signer: "h",
|
|
||||||
})
|
|
||||||
// Second ExecuteDEXSwap on Settled route → error (replay rejection).
|
|
||||||
_, err := srv.ExecuteDEXSwap(ctx, &exittypes.MsgExecuteDEXSwap{
|
|
||||||
RouteID: "route-replay", Venue: "venue:5", Signer: "h",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("duplicate ExecuteDEXSwap on Settled route should return error (replay rejection)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// TestRefundExitRejectsNonFailed asserts RefundExit rejects a route that is
|
|
||||||
// not Failed.
|
|
||||||
func TestRefundExitRejectsNonFailed(t *testing.T) {
|
|
||||||
ctx, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
|
|
||||||
srv.SubmitExitRoute(ctx, &exittypes.MsgSubmitExitRoute{
|
|
||||||
RouteID: "route-refund-bad", HolderReachID: "h",
|
|
||||||
SourceAsset: "ubread", DestAsset: "uatom", Amount: 100, Signer: "h",
|
|
||||||
})
|
|
||||||
_, err := srv.RefundExit(ctx, &exittypes.MsgRefundExit{
|
|
||||||
RouteID: "route-refund-bad", Signer: "h",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("RefundExit should reject a Proposed route (must be Failed)")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- SubmitExitRoute validation ----------------------------------------------
|
|
||||||
|
|
||||||
func TestSubmitExitRouteRejectsDuplicate(t *testing.T) {
|
|
||||||
ctx, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
srv.SubmitExitRoute(ctx, &exittypes.MsgSubmitExitRoute{
|
|
||||||
RouteID: "dup", HolderReachID: "h", SourceAsset: "a", DestAsset: "b", Amount: 1, Signer: "h",
|
|
||||||
})
|
|
||||||
_, err := srv.SubmitExitRoute(ctx, &exittypes.MsgSubmitExitRoute{
|
|
||||||
RouteID: "dup", HolderReachID: "h", SourceAsset: "a", DestAsset: "b", Amount: 1, Signer: "h",
|
|
||||||
})
|
|
||||||
if err == nil {
|
|
||||||
t.Error("SubmitExitRoute should reject a duplicate route-id")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- ValidateBasic (Msg types) -----------------------------------------------
|
|
||||||
|
|
||||||
func TestMsgSubmitExitRouteValidateBasic(t *testing.T) {
|
|
||||||
cases := []struct {
|
|
||||||
name string
|
|
||||||
msg exittypes.MsgSubmitExitRoute
|
|
||||||
ok bool
|
|
||||||
}{
|
|
||||||
{"valid", exittypes.MsgSubmitExitRoute{"r1", "h", "a", "b", 100, "s"}, true},
|
|
||||||
{"empty holder", exittypes.MsgSubmitExitRoute{"r1", "", "a", "b", 100, "s"}, false},
|
|
||||||
{"empty source", exittypes.MsgSubmitExitRoute{"r1", "h", "", "b", 100, "s"}, false},
|
|
||||||
{"empty dest", exittypes.MsgSubmitExitRoute{"r1", "h", "a", "", 100, "s"}, false},
|
|
||||||
{"zero amount", exittypes.MsgSubmitExitRoute{"r1", "h", "a", "b", 0, "s"}, false},
|
|
||||||
{"neg amount", exittypes.MsgSubmitExitRoute{"r1", "h", "a", "b", -1, "s"}, false},
|
|
||||||
{"empty signer", exittypes.MsgSubmitExitRoute{"r1", "h", "a", "b", 100, ""}, false},
|
|
||||||
}
|
|
||||||
for _, c := range cases {
|
|
||||||
err := c.msg.ValidateBasic()
|
|
||||||
if c.ok && err != nil {
|
|
||||||
t.Errorf("%s: expected ok, got %v", c.name, err)
|
|
||||||
}
|
|
||||||
if !c.ok && err == nil {
|
|
||||||
t.Errorf("%s: expected error, got nil", c.name)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestMsgExecuteDEXSwapValidateBasic(t *testing.T) {
|
|
||||||
if err := (&exittypes.MsgExecuteDEXSwap{RouteID: "r1", Signer: "s"}).ValidateBasic(); err != nil {
|
|
||||||
t.Errorf("valid: %v", err)
|
|
||||||
}
|
|
||||||
if err := (&exittypes.MsgExecuteDEXSwap{RouteID: "", Signer: "s"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty route-id should fail")
|
|
||||||
}
|
|
||||||
if err := (&exittypes.MsgExecuteDEXSwap{RouteID: "r1", Signer: ""}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty signer should fail")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestMsgRefundExitValidateBasic(t *testing.T) {
|
|
||||||
if err := (&exittypes.MsgRefundExit{RouteID: "r1", Signer: "s"}).ValidateBasic(); err != nil {
|
|
||||||
t.Errorf("valid: %v", err)
|
|
||||||
}
|
|
||||||
if err := (&exittypes.MsgRefundExit{RouteID: "", Signer: "s"}).ValidateBasic(); err == nil {
|
|
||||||
t.Error("empty route-id should fail")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestExitMsgGetSigners(t *testing.T) {
|
|
||||||
m := &exittypes.MsgSubmitExitRoute{Signer: "holder-reach"}
|
|
||||||
addrs := m.GetSigners()
|
|
||||||
if len(addrs) != 1 || string(addrs[0]) != "holder-reach" {
|
|
||||||
t.Errorf("GetSigners = %v, want [holder-reach]", addrs)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Keeper store helpers ----------------------------------------------------
|
|
||||||
|
|
||||||
func TestSetGetExitRoute(t *testing.T) {
|
|
||||||
ctx, _, k := newSimtestContext(t)
|
|
||||||
r := exittypes.ExitRoute{RouteID: "r9", Status: exittypes.ExitProposed}
|
|
||||||
k.SetExitRoute(ctx, r)
|
|
||||||
got, ok := k.GetExitRoute(ctx, "r9")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("GetExitRoute: not found")
|
|
||||||
}
|
|
||||||
if got.Status != exittypes.ExitProposed {
|
|
||||||
t.Errorf("status = %q", got.Status)
|
|
||||||
}
|
|
||||||
if _, ok := k.GetExitRoute(ctx, "missing"); ok {
|
|
||||||
t.Error("GetExitRoute should return false for missing route")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestSetGetDEXSwap(t *testing.T) {
|
|
||||||
ctx, _, k := newSimtestContext(t)
|
|
||||||
s := exittypes.DEXSwap{SwapID: "s9", Venue: "oy-dex", Status: exittypes.ExitSettled}
|
|
||||||
k.SetDEXSwap(ctx, s)
|
|
||||||
got, ok := k.GetDEXSwap(ctx, "s9")
|
|
||||||
if !ok {
|
|
||||||
t.Fatal("GetDEXSwap: not found")
|
|
||||||
}
|
|
||||||
if got.Venue != "oy-dex" {
|
|
||||||
t.Errorf("venue = %q", got.Venue)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestAllExitRoutesAndSwaps(t *testing.T) {
|
|
||||||
ctx, _, k := newSimtestContext(t)
|
|
||||||
k.SetExitRoute(ctx, exittypes.ExitRoute{RouteID: "r1", Status: exittypes.ExitProposed})
|
|
||||||
k.SetExitRoute(ctx, exittypes.ExitRoute{RouteID: "r2", Status: exittypes.ExitSettled})
|
|
||||||
k.SetDEXSwap(ctx, exittypes.DEXSwap{SwapID: "s1", Venue: "v"})
|
|
||||||
if len(k.AllExitRoutes(ctx)) != 2 {
|
|
||||||
t.Errorf("expected 2 routes")
|
|
||||||
}
|
|
||||||
if len(k.AllDEXSwaps(ctx)) != 1 {
|
|
||||||
t.Errorf("expected 1 swap")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Cross-chain exit: nil shim handling -------------------------------------
|
|
||||||
|
|
||||||
// TestCrossChainExitNilBridgeShimFails asserts a cross-chain exit with a nil
|
|
||||||
// BridgeKeeper shim fails the route (not a panic).
|
|
||||||
func TestCrossChainExitNilBridgeShimFails(t *testing.T) {
|
|
||||||
ctx, _, k := newSimtestContext(t)
|
|
||||||
srv := keeper.NewMsgServerImpl(k)
|
|
||||||
// Clear the bridge shim to simulate unwired.
|
|
||||||
k.SetBridgeKeeper(nil)
|
|
||||||
|
|
||||||
srv.SubmitExitRoute(ctx, &exittypes.MsgSubmitExitRoute{
|
|
||||||
RouteID: "route-noshim", HolderReachID: "h",
|
|
||||||
SourceAsset: "ubread", DestAsset: "uatom", Amount: 100, Signer: "h",
|
|
||||||
})
|
|
||||||
r, _ := k.GetExitRoute(ctx, "route-noshim")
|
|
||||||
r.BridgeRouteID = "bridge-x"
|
|
||||||
k.SetExitRoute(ctx, r)
|
|
||||||
|
|
||||||
_, err := srv.ExecuteDEXSwap(ctx, &exittypes.MsgExecuteDEXSwap{
|
|
||||||
RouteID: "route-noshim", Venue: "venue:5", Signer: "h",
|
|
||||||
})
|
|
||||||
if err != nil {
|
|
||||||
t.Errorf("ExecuteDEXSwap with nil shim should not return error (route fails to Failed); got %v", err)
|
|
||||||
}
|
|
||||||
r, _ = k.GetExitRoute(ctx, "route-noshim")
|
|
||||||
if r.Status != exittypes.ExitFailed {
|
|
||||||
t.Errorf("cross-chain exit with nil shim should fail; got %q", r.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- JSON marshal/unmarshal for the InflightPacket (bridge) sanity -----------
|
|
||||||
|
|
||||||
// TestInflightPacketJSON asserts the InflightPacket JSON round-trips (the
|
|
||||||
// keeper uses json.Marshal/Unmarshal).
|
|
||||||
func TestInflightPacketJSON(t *testing.T) {
|
|
||||||
p := struct {
|
|
||||||
SourcePort string
|
|
||||||
Amount int64
|
|
||||||
}{"transfer", 100}
|
|
||||||
bz, _ := json.Marshal(p)
|
|
||||||
var got struct {
|
|
||||||
SourcePort string
|
|
||||||
Amount int64
|
|
||||||
}
|
|
||||||
if err := json.Unmarshal(bz, &got); err != nil {
|
|
||||||
t.Fatalf("unmarshal: %v", err)
|
|
||||||
}
|
|
||||||
if got.SourcePort != "transfer" || got.Amount != 100 {
|
|
||||||
t.Errorf("round-trip mismatch: %+v", got)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,77 +0,0 @@
|
|||||||
package exit
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/types/module"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/exit/keeper"
|
|
||||||
"github.com/oy/openyield/x/exit/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// module.go holds the exit module's AppModule + RegisterServices (P1-05-01).
|
|
||||||
//
|
|
||||||
// The AppModule wraps the Keeper and registers the MsgServer via
|
|
||||||
// RegisterServices. This is the simtest-grade AppModule (D-054): the
|
|
||||||
// RegisterServices wires the hand-rolled MsgServer (no protobuf codegen per
|
|
||||||
// the skeleton's zero-codegen style). The MsgServer is constructed directly
|
|
||||||
// and exposed via the module for test wiring.
|
|
||||||
|
|
||||||
// ConsensusVersion is the exit module's consensus version (AppModule).
|
|
||||||
const ConsensusVersion = 1
|
|
||||||
|
|
||||||
// AppModule is the exit application module (simtest-grade — D-054).
|
|
||||||
type AppModule struct {
|
|
||||||
keeper keeper.Keeper
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewAppModule constructs a new exit AppModule.
|
|
||||||
func NewAppModule(cdc codec.Codec, storeKey storetypes.StoreKey, bk types.BridgeKeeper) AppModule {
|
|
||||||
k := keeper.NewKeeper(cdc, storeKey, bk)
|
|
||||||
return AppModule{keeper: k}
|
|
||||||
}
|
|
||||||
|
|
||||||
// RegisterServices registers the exit MsgServer. Simtest-grade wiring: the
|
|
||||||
// MsgServer is constructed from the keeper and exposed via the module's
|
|
||||||
// MsgServer method (tests use NewMsgServerImpl directly).
|
|
||||||
func (am AppModule) RegisterServices(cfg module.Configurator) {
|
|
||||||
_ = cfg
|
|
||||||
}
|
|
||||||
|
|
||||||
// MsgServer returns the exit MsgServer for this module's keeper.
|
|
||||||
func (am AppModule) MsgServer() types.MsgServer {
|
|
||||||
return keeper.NewMsgServerImpl(am.keeper)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Name returns the module name.
|
|
||||||
func (AppModule) Name() string { return types.ModuleName }
|
|
||||||
|
|
||||||
// ConsensusVersion implements AppModule.ConsensusVersion.
|
|
||||||
func (AppModule) ConsensusVersion() uint64 { return ConsensusVersion }
|
|
||||||
|
|
||||||
// InitGenesis performs genesis initialization for the exit module.
|
|
||||||
func (am AppModule) InitGenesis(ctx sdk.Context, cdc codec.JSONCodec, data json.RawMessage) {
|
|
||||||
var gs types.GenesisState
|
|
||||||
cdc.MustUnmarshalJSON(data, &gs)
|
|
||||||
for _, r := range gs.Routes {
|
|
||||||
am.keeper.SetExitRoute(ctx, r)
|
|
||||||
}
|
|
||||||
for _, s := range gs.Swaps {
|
|
||||||
am.keeper.SetDEXSwap(ctx, s)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ExportGenesis returns the exported genesis state as raw bytes.
|
|
||||||
func (am AppModule) ExportGenesis(ctx sdk.Context, cdc codec.JSONCodec) json.RawMessage {
|
|
||||||
routes := am.keeper.AllExitRoutes(ctx)
|
|
||||||
swaps := am.keeper.AllDEXSwaps(ctx)
|
|
||||||
gs := types.GenesisState{Routes: routes, Swaps: swaps}
|
|
||||||
return cdc.MustMarshalJSON(&gs)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertions: AppModule implements the module interface stubs.
|
|
||||||
var _ module.HasName = AppModule{}
|
|
||||||
var _ module.HasConsensusVersion = AppModule{}
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
// expected_keepers.go holds the Go INTERFACE for the cross-module keeper
|
|
||||||
// x/exit depends on (G-003 firewall — ibc-go expected-keepers convention).
|
|
||||||
//
|
|
||||||
// x/exit's ExecuteDEXSwap handler drives cross-chain exits via the
|
|
||||||
// x/bridge keeper (by-ID-string on the bridge-route-id). The dependency is
|
|
||||||
// expressed as an INTERFACE defined HERE (in x/exit/types), NOT as a struct
|
|
||||||
// import of x/bridge/types. The x/bridge keeper satisfies this interface
|
|
||||||
// structurally; the handler depends on the interface, preserving G-003's
|
|
||||||
// intent (no cross-module struct coupling, no import cycles).
|
|
||||||
//
|
|
||||||
// Test-only cross-package imports (the G-003 test exemption) remain exempt:
|
|
||||||
// a simtest may import both x/exit/keeper and x/bridge/keeper to wire the
|
|
||||||
// BridgeKeeper shim in a test setup.
|
|
||||||
|
|
||||||
// BridgeKeeper is the expected-keeper interface for x/bridge (G-003). The
|
|
||||||
// exit handler calls it for cross-chain exits: the ExecuteDEXSwap handler
|
|
||||||
// invokes GetBridgeRoute with the bridge-route-id (by-ID-string) to query
|
|
||||||
// the bridge route's status and type before driving the cross-chain hop.
|
|
||||||
//
|
|
||||||
// The bridge-route-id is a by-ID-string at the type level (G-003) and stays
|
|
||||||
// a by-ID-string at the runtime level (this interface takes a string, not a
|
|
||||||
// x/bridge.BridgeRoute struct). No struct import of x/bridge/types.
|
|
||||||
type BridgeKeeper interface {
|
|
||||||
// GetBridgeRoute returns the bridge route's status, bridge type, and
|
|
||||||
// error for the named route (by-ID-string). The exit handler uses the
|
|
||||||
// status to decide whether the cross-chain hop can proceed (the bridge
|
|
||||||
// route must be Active). The bridge type is an opaque string (e.g.
|
|
||||||
// "evm-ibc", "solana-wormhole") used for handler dispatch.
|
|
||||||
GetBridgeRoute(routeID string) (status string, bridgeType string, err error)
|
|
||||||
}
|
|
||||||
@@ -1,207 +0,0 @@
|
|||||||
package types
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// msg_exit.go holds the exit module's Msg* types implementing sdk.Msg
|
|
||||||
// (G-006 controlled exception: types/ gains the cosmos-sdk import for
|
|
||||||
// sdk.Msg). Each Msg carries a ValidateBasic (stateless) and GetSigners.
|
|
||||||
//
|
|
||||||
// The three exit Msg types drive the ExitStatus lifecycle:
|
|
||||||
// - MsgSubmitExitRoute: creates an ExitRoute status=Proposed.
|
|
||||||
// - MsgExecuteDEXSwap: transitions Proposed → InProgress → Settled/Failed;
|
|
||||||
// cross-chain exits invoke the BridgeKeeper expected-keeper shim (by
|
|
||||||
// ID-string on the bridge-route-id).
|
|
||||||
// - MsgRefundExit: Failed → Refunded.
|
|
||||||
//
|
|
||||||
// All cross-module refs are by-ID-string (G-003): route-id is this route's
|
|
||||||
// ID; bridge-route-id references an x/bridge BridgeRoute by ID-string (no
|
|
||||||
// struct import). GetSigners returns the signer reach-ids encoded as
|
|
||||||
// sdk.AccAddress bytes. The holder-reach-id is the by-ID-string user
|
|
||||||
// identifier (G-003 — no banned financial-holder lexicon; use Holder/Reach).
|
|
||||||
|
|
||||||
// --- MsgSubmitExitRoute -------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgSubmitExitRoute proposes an ExitRoute (status=Proposed). ValidateBasic
|
|
||||||
// is stateless: non-empty holder-reach-id, non-empty source/dest-asset,
|
|
||||||
// amount > 0.
|
|
||||||
type MsgSubmitExitRoute struct {
|
|
||||||
RouteID string `json:"route_id" yaml:"route_id"`
|
|
||||||
HolderReachID string `json:"holder_reach_id" yaml:"holder_reach_id"`
|
|
||||||
SourceAsset string `json:"source_asset" yaml:"source_asset"`
|
|
||||||
DestAsset string `json:"dest_asset" yaml:"dest_asset"`
|
|
||||||
Amount int64 `json:"amount" yaml:"amount"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message (sdk.Msg = proto.Message).
|
|
||||||
func (m *MsgSubmitExitRoute) Reset() { *m = MsgSubmitExitRoute{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgSubmitExitRoute) String() string {
|
|
||||||
return fmt.Sprintf("MsgSubmitExitRoute{RouteID:%s HolderReachID:%s SourceAsset:%s DestAsset:%s Amount:%d Signer:%s}",
|
|
||||||
m.RouteID, m.HolderReachID, m.SourceAsset, m.DestAsset, m.Amount, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgSubmitExitRoute) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty holder-reach-id,
|
|
||||||
// non-empty source/dest-asset, amount > 0, non-empty signer.
|
|
||||||
func (m *MsgSubmitExitRoute) ValidateBasic() error {
|
|
||||||
if m.HolderReachID == "" {
|
|
||||||
return fmt.Errorf("exit: empty holder-reach-id")
|
|
||||||
}
|
|
||||||
if m.SourceAsset == "" {
|
|
||||||
return fmt.Errorf("exit: empty source-asset")
|
|
||||||
}
|
|
||||||
if m.DestAsset == "" {
|
|
||||||
return fmt.Errorf("exit: empty dest-asset")
|
|
||||||
}
|
|
||||||
if m.Amount <= 0 {
|
|
||||||
return fmt.Errorf("exit: amount must be > 0")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("exit: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgSubmitExitRoute) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgExecuteDEXSwap --------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgExecuteDEXSwap executes the pre-computed venue-hops for an exit route.
|
|
||||||
// ValidateBasic is stateless: non-empty route-id, non-empty signer. The
|
|
||||||
// route status must be InProgress or Proposed (the handler enforces the
|
|
||||||
// stateful transition: Proposed → InProgress → Settled/Failed). Cross-chain
|
|
||||||
// exits invoke the BridgeKeeper expected-keeper shim by ID-string on the
|
|
||||||
// route's bridge-route-id (G-003).
|
|
||||||
type MsgExecuteDEXSwap struct {
|
|
||||||
RouteID string `json:"route_id" yaml:"route_id"`
|
|
||||||
Venue string `json:"venue" yaml:"venue"` // opaque DEX venue (A-308)
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgExecuteDEXSwap) Reset() { *m = MsgExecuteDEXSwap{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgExecuteDEXSwap) String() string {
|
|
||||||
return fmt.Sprintf("MsgExecuteDEXSwap{RouteID:%s Venue:%s Signer:%s}", m.RouteID, m.Venue, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgExecuteDEXSwap) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty route-id, non-empty
|
|
||||||
// signer. The venue is an opaque string (A-308 — not a locked enum); an
|
|
||||||
// empty venue is permitted (the handler may default it). The route status
|
|
||||||
// check (InProgress or Proposed) is stateful — the handler loads the route.
|
|
||||||
func (m *MsgExecuteDEXSwap) ValidateBasic() error {
|
|
||||||
if m.RouteID == "" {
|
|
||||||
return fmt.Errorf("exit: empty route-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("exit: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgExecuteDEXSwap) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- MsgRefundExit ------------------------------------------------------------
|
|
||||||
|
|
||||||
// MsgRefundExit refunds a Failed exit (Failed → Refunded). ValidateBasic is
|
|
||||||
// stateless: non-empty route-id, non-empty signer. The handler enforces the
|
|
||||||
// stateful source-status check (status == Failed).
|
|
||||||
type MsgRefundExit struct {
|
|
||||||
RouteID string `json:"route_id" yaml:"route_id"`
|
|
||||||
Signer string `json:"signer" yaml:"signer"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgRefundExit) Reset() { *m = MsgRefundExit{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgRefundExit) String() string {
|
|
||||||
return fmt.Sprintf("MsgRefundExit{RouteID:%s Signer:%s}", m.RouteID, m.Signer)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgRefundExit) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateBasic is the stateless validation: non-empty route-id and signer.
|
|
||||||
func (m *MsgRefundExit) ValidateBasic() error {
|
|
||||||
if m.RouteID == "" {
|
|
||||||
return fmt.Errorf("exit: empty route-id")
|
|
||||||
}
|
|
||||||
if m.Signer == "" {
|
|
||||||
return fmt.Errorf("exit: empty signer")
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetSigners returns the signer's reach-id as sdk.AccAddress bytes.
|
|
||||||
func (m *MsgRefundExit) GetSigners() []sdk.AccAddress {
|
|
||||||
return []sdk.AccAddress{[]byte(m.Signer)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// MsgServer is the exit module's message server interface (one method per
|
|
||||||
// Msg*). The keeper's msg_server.go implements this; module.go's
|
|
||||||
// RegisterServices wires the implementation. This is the hand-rolled
|
|
||||||
// equivalent of the protobuf-generated MsgServer interface (no codegen per
|
|
||||||
// the skeleton's zero-codegen style).
|
|
||||||
type MsgServer interface {
|
|
||||||
SubmitExitRoute(ctx interface{}, msg *MsgSubmitExitRoute) (*MsgSubmitExitRouteResponse, error)
|
|
||||||
ExecuteDEXSwap(ctx interface{}, msg *MsgExecuteDEXSwap) (*MsgExecuteDEXSwapResponse, error)
|
|
||||||
RefundExit(ctx interface{}, msg *MsgRefundExit) (*MsgRefundExitResponse, error)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Response types (hand-rolled equivalents of the protobuf-generated response
|
|
||||||
// wrappers; empty bodies — the response is the state mutation + event).
|
|
||||||
|
|
||||||
// MsgSubmitExitRouteResponse is the response to MsgSubmitExitRoute.
|
|
||||||
type MsgSubmitExitRouteResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgSubmitExitRouteResponse) Reset() { *m = MsgSubmitExitRouteResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgSubmitExitRouteResponse) String() string { return "MsgSubmitExitRouteResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgSubmitExitRouteResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgExecuteDEXSwapResponse is the response to MsgExecuteDEXSwap.
|
|
||||||
type MsgExecuteDEXSwapResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgExecuteDEXSwapResponse) Reset() { *m = MsgExecuteDEXSwapResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgExecuteDEXSwapResponse) String() string { return "MsgExecuteDEXSwapResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgExecuteDEXSwapResponse) ProtoMessage() {}
|
|
||||||
|
|
||||||
// MsgRefundExitResponse is the response to MsgRefundExit.
|
|
||||||
type MsgRefundExitResponse struct{}
|
|
||||||
|
|
||||||
// Reset implements proto.Message.
|
|
||||||
func (m *MsgRefundExitResponse) Reset() { *m = MsgRefundExitResponse{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *MsgRefundExitResponse) String() string { return "MsgRefundExitResponse{}" }
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*MsgRefundExitResponse) ProtoMessage() {}
|
|
||||||
@@ -104,20 +104,6 @@ func DefaultGenesisState() *GenesisState {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Reset implements proto.Message (codec.JSONCodec.MustMarshalJSON /
|
|
||||||
// MustUnmarshalJSON require proto.Message; the GenesisState is the JSON
|
|
||||||
// genesis payload and gains the gogoproto proto.Message methods here so the
|
|
||||||
// AppModule's InitGenesis/ExportGenesis compile without protobuf codegen).
|
|
||||||
func (m *GenesisState) Reset() { *m = GenesisState{} }
|
|
||||||
|
|
||||||
// String implements proto.Message.
|
|
||||||
func (m *GenesisState) String() string {
|
|
||||||
return fmt.Sprintf("GenesisState{Routes:%d Swaps:%d}", len(m.Routes), len(m.Swaps))
|
|
||||||
}
|
|
||||||
|
|
||||||
// ProtoMessage implements proto.Message.
|
|
||||||
func (*GenesisState) ProtoMessage() {}
|
|
||||||
|
|
||||||
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
// ValidateGenesis performs ID-uniqueness checks (A-212 upgrade from v0.1
|
||||||
// no-op): rejects duplicate route-ids and swap-ids. Delegates to the
|
// no-op): rejects duplicate route-ids and swap-ids. Delegates to the
|
||||||
// data-engineer's genesis.go helpers (G-008).
|
// data-engineer's genesis.go helpers (G-008).
|
||||||
|
|||||||
@@ -1,168 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
// custody_state.go holds the custody asset records (assetID → custody entry
|
|
||||||
// + sig ref + key version) for the x/hub custody runtime (P4-02-01,
|
|
||||||
// REQ-036). data-engineer territory (P4 phase-specific — removed after P4
|
|
||||||
// per PERSONAS.md).
|
|
||||||
//
|
|
||||||
// D-054: in-memory test store ONLY — the SDK in-memory store (dbm NewMemDB)
|
|
||||||
// is the substrate; NO real database, NO migration (simtest grade). The
|
|
||||||
// custody state is the closest thing to a data store in v0.5; there is NO
|
|
||||||
// real database (the SDK store is the substrate). data-engineer's role is
|
|
||||||
// narrow: ensure the custody state shape (assetID → custody entry + sig ref
|
|
||||||
// + key version) is consistent with the CustodyKeyring interface and
|
|
||||||
// supports rotation (D-058).
|
|
||||||
//
|
|
||||||
// State shape (consistent with CustodyKeyring interface, D-058):
|
|
||||||
// - assetID → CustodyEntry (assetID, holder-reach-id, partner-id, sig-ref,
|
|
||||||
// key-version, custody-status)
|
|
||||||
// - sig-ref is the opaque reference to the signature produced by
|
|
||||||
// CustodyKeyring.Sign on the custody-receive payload (stored so a
|
|
||||||
// later CustodyReleaseAsset can verify the release is authorized by
|
|
||||||
// the same key version that received the asset — rotation safety).
|
|
||||||
// - key-version is the CustodyKeyring active key version at the time of
|
|
||||||
// custody-receive (recorded so a post-rotation release can detect the
|
|
||||||
// key has rotated — the handler may require re-attestation).
|
|
||||||
//
|
|
||||||
// The custody state is store-backed (wraps an sdk.KVStore via a storeKey on
|
|
||||||
// the Keeper). The custody entry is JSON-marshaled (same pattern as
|
|
||||||
// x/partner/keeper/keeper.go AnchorCredential store — simtest-grade, no
|
|
||||||
// protobuf codegen).
|
|
||||||
//
|
|
||||||
// Lexicon note (REQ-012, A-542): "custody", "asset", "holder", "reach-id",
|
|
||||||
// "sig-ref", "key-version", "receive", "release" are all lexicon-clean.
|
|
||||||
// The inbound/outbound custody names follow A-542 (the banned storage
|
|
||||||
// terms are NOT used; CustodyReceiveAsset / CustodyReleaseAsset are the
|
|
||||||
// safe vision vocabulary). "holder"/"reach-id" (NOT the banned holder
|
|
||||||
// lexicon term).
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// CustodyEntry is the per-assetID custody record. Stored in the hub
|
|
||||||
// custody store keyed by assetID. The sig-ref + key-version support
|
|
||||||
// rotation safety (D-058): a post-rotation release can detect the key
|
|
||||||
// has rotated and require re-attestation.
|
|
||||||
type CustodyEntry struct {
|
|
||||||
// AssetID is the opaque asset identifier (the custody key is assetID).
|
|
||||||
// Opaque so the hub does not import any asset-denom module (G-003).
|
|
||||||
AssetID string `json:"asset_id" yaml:"asset_id"`
|
|
||||||
|
|
||||||
// HolderReachID is the lexicon-clean holder identifier (NOT the banned
|
|
||||||
// holder-lexicon term; use Holder/Reach per REQ-012). The reach-id that
|
|
||||||
// asset; the CustodyReleaseAsset handler asserts the signer is this
|
|
||||||
// holder or an authorized Window grantee.
|
|
||||||
HolderReachID string `json:"holder_reach_id" yaml:"holder_reach_id"`
|
|
||||||
|
|
||||||
// PartnerID is the operator-partner-id (by-ID-string ref to an
|
|
||||||
// x/partner Anchor Partner — G-003). The Anchor operator that
|
|
||||||
// custody-received the asset.
|
|
||||||
PartnerID string `json:"partner_id" yaml:"partner_id"`
|
|
||||||
|
|
||||||
// SigRef is the opaque reference to the signature produced by
|
|
||||||
// CustodyKeyring.Sign on the custody-receive payload. Stored so a
|
|
||||||
// later CustodyReleaseAsset can verify the release is authorized by
|
|
||||||
// the same key version that received the asset (rotation safety —
|
|
||||||
// D-058).
|
|
||||||
SigRef []byte `json:"sig_ref" yaml:"sig_ref"`
|
|
||||||
|
|
||||||
// KeyVersion is the CustodyKeyring active key version at the time of
|
|
||||||
// custody-receive (recorded so a post-rotation release can detect the
|
|
||||||
// key has rotated — the handler may require re-attestation).
|
|
||||||
KeyVersion uint64 `json:"key_version" yaml:"key_version"`
|
|
||||||
|
|
||||||
// Status is the custody lifecycle state (Held or Released).
|
|
||||||
CustodyStatus CustodyStatus `json:"custody_status" yaml:"custody_status"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// CustodyStatus enumerates the custody entry lifecycle states (REQ-036).
|
|
||||||
// Held is the active state (asset is in custody); Released is the terminal
|
|
||||||
// state (asset has been released to the holder or an authorized grantee).
|
|
||||||
// The custody lifecycle is receive → hold → release (A-544
|
|
||||||
// compliance-before-custody: the handler checks compliance BEFORE the
|
|
||||||
// custody debit on release).
|
|
||||||
type CustodyStatus string
|
|
||||||
|
|
||||||
const (
|
|
||||||
// CustodyHeld is the active state: the asset is in custody.
|
|
||||||
CustodyHeld CustodyStatus = "Held"
|
|
||||||
|
|
||||||
// CustodyReleased is the terminal state: the asset has been released.
|
|
||||||
CustodyReleased CustodyStatus = "Released"
|
|
||||||
)
|
|
||||||
|
|
||||||
// custodyStore is the store-backed custody state (wraps an sdk.KVStore via
|
|
||||||
// a storeKey on the Keeper). The Keeper owns the storeKey; this struct is
|
|
||||||
// the helper that reads/writes the custody entries.
|
|
||||||
type custodyStore struct {
|
|
||||||
storeKey storetypes.StoreKey
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Custody store key helpers ------------------------------------------------
|
|
||||||
|
|
||||||
var custodyKeyPrefix = []byte("custody/")
|
|
||||||
|
|
||||||
func custodyKey(assetID string) []byte {
|
|
||||||
return append(custodyKeyPrefix, []byte(assetID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// custodyPrefixEnd returns the key that sorts immediately after all keys
|
|
||||||
// sharing the custody key prefix (the standard prefix-iteration end key).
|
|
||||||
func custodyPrefixEnd() []byte {
|
|
||||||
return prefixEnd(custodyKeyPrefix)
|
|
||||||
}
|
|
||||||
|
|
||||||
// getCustodyEntry loads a CustodyEntry by assetID. Returns the entry and
|
|
||||||
// true if found, or zero value + false if not.
|
|
||||||
func (cs custodyStore) getCustodyEntry(ctx sdk.Context, assetID string) (CustodyEntry, bool) {
|
|
||||||
store := ctx.KVStore(cs.storeKey)
|
|
||||||
bz := store.Get(custodyKey(assetID))
|
|
||||||
if bz == nil {
|
|
||||||
return CustodyEntry{}, false
|
|
||||||
}
|
|
||||||
var e CustodyEntry
|
|
||||||
if err := json.Unmarshal(bz, &e); err != nil {
|
|
||||||
return CustodyEntry{}, false
|
|
||||||
}
|
|
||||||
return e, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// setCustodyEntry persists a CustodyEntry by assetID.
|
|
||||||
func (cs custodyStore) setCustodyEntry(ctx sdk.Context, e CustodyEntry) {
|
|
||||||
store := ctx.KVStore(cs.storeKey)
|
|
||||||
bz, err := json.Marshal(e)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("hub: marshal custody entry %q: %v", e.AssetID, err))
|
|
||||||
}
|
|
||||||
store.Set(custodyKey(e.AssetID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// deleteCustodyEntry removes a CustodyEntry by assetID (used on full release
|
|
||||||
// if the entry is not retained; the simtest retains Released entries for
|
|
||||||
// audit — delete is provided for completeness but the handler uses
|
|
||||||
// setCustodyEntry with CustodyReleased to retain the audit trail).
|
|
||||||
func (cs custodyStore) deleteCustodyEntry(ctx sdk.Context, assetID string) {
|
|
||||||
store := ctx.KVStore(cs.storeKey)
|
|
||||||
store.Delete(custodyKey(assetID))
|
|
||||||
}
|
|
||||||
|
|
||||||
// allCustodyEntries returns all persisted CustodyEntry records (iteration
|
|
||||||
// helper, unordered).
|
|
||||||
func (cs custodyStore) allCustodyEntries(ctx sdk.Context) []CustodyEntry {
|
|
||||||
store := ctx.KVStore(cs.storeKey)
|
|
||||||
iterator := store.Iterator(custodyKeyPrefix, custodyPrefixEnd())
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []CustodyEntry{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var e CustodyEntry
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &e); err == nil {
|
|
||||||
out = append(out, e)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
@@ -1,263 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
// keeper.go holds the store-backed Keeper for the hub module's custody/
|
|
||||||
// lending/compliance runtime (P4-04-01, REQ-036).
|
|
||||||
//
|
|
||||||
// The Keeper wraps an sdk.KVStore via a storeKey. It holds:
|
|
||||||
// - the custody asset records (custody_state.go — assetID → CustodyEntry);
|
|
||||||
// - the registered custody services (service-id → CustodyService);
|
|
||||||
// - the lending primitive records (loan-id → LendingPrimitive);
|
|
||||||
// - the compliance attestation records (partner-id → attestation-ref, the
|
|
||||||
// store the ComplianceKeeper shim's IsCompliant reads — A-544).
|
|
||||||
//
|
|
||||||
// The Keeper also holds the two expected-keeper shims (PartnerKeeper for
|
|
||||||
// IsAnchorOnboarded on RegisterCustodyService; ComplianceKeeper for
|
|
||||||
// IsCompliant on CustodyReleaseAsset — A-544 compliance-before-custody).
|
|
||||||
// The shims are interfaces (G-003 — no struct import of x/partner/types);
|
|
||||||
// the concrete partner keeper satisfies them structurally.
|
|
||||||
//
|
|
||||||
// The Keeper holds the CustodyKeyring (D-058) — the custody key-share
|
|
||||||
// abstraction. v0.5 ships the in-memory test-only memKeyring impl
|
|
||||||
// (keyring_mem.go); real MPC/HSM backing is deferred (Year 3+). The
|
|
||||||
// handler consults the keyring per operation (no cross-block caching —
|
|
||||||
// D-058: a cached pubkey breaks rotation).
|
|
||||||
//
|
|
||||||
// State-machine ordering (vision §7, enforced in every handler):
|
|
||||||
// ValidateBasic → keeper authz → state mutation → ctx.EventManager().EmitEvent
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
storetypes "cosmossdk.io/store/types"
|
|
||||||
"github.com/cosmos/cosmos-sdk/codec"
|
|
||||||
sdk "github.com/cosmos/cosmos-sdk/types"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/hub/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Keeper is the store-backed hub custody/lending/compliance keeper.
|
|
||||||
type Keeper struct {
|
|
||||||
cdc codec.Codec
|
|
||||||
storeKey storetypes.StoreKey
|
|
||||||
partnerKeeper types.PartnerKeeper
|
|
||||||
keyring types.CustodyKeyring
|
|
||||||
custody custodyStore
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewKeeper constructs a new store-backed hub Keeper. The PartnerKeeper
|
|
||||||
// expected-keeper shim is injected (nil-able for partial tests; the
|
|
||||||
// RegisterCustodyService handler guards a nil shim and skips the
|
|
||||||
// IsAnchorOnboarded check, still mutating state — the simtest wiring
|
|
||||||
// documents this). The CustodyKeyring is injected (D-058 — the memKeyring
|
|
||||||
// for simtest; real MPC/HSM for production, deferred).
|
|
||||||
//
|
|
||||||
// The ComplianceKeeper shim is satisfied by the Keeper ITSELF (the
|
|
||||||
// IsCompliant method reads the attestation store the
|
|
||||||
// RecordComplianceAttestation handler populates — A-544); the
|
|
||||||
// CustodyReleaseAsset handler passes the keeper as the ComplianceKeeper.
|
|
||||||
// This is the by-ID-string boundary (G-003): the hub keeper satisfies
|
|
||||||
// ComplianceKeeper structurally (same package; no cross-module struct
|
|
||||||
// import).
|
|
||||||
func NewKeeper(cdc codec.Codec, storeKey storetypes.StoreKey, pk types.PartnerKeeper, kr types.CustodyKeyring) Keeper {
|
|
||||||
return Keeper{
|
|
||||||
cdc: cdc,
|
|
||||||
storeKey: storeKey,
|
|
||||||
partnerKeeper: pk,
|
|
||||||
keyring: kr,
|
|
||||||
custody: custodyStore{storeKey: storeKey},
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetPartnerKeeper sets the PartnerKeeper expected-keeper shim (for
|
|
||||||
// post-construction wiring, e.g., app wiring or test setup).
|
|
||||||
func (k *Keeper) SetPartnerKeeper(pk types.PartnerKeeper) { k.partnerKeeper = pk }
|
|
||||||
|
|
||||||
// SetKeyring sets the CustodyKeyring (for post-construction wiring).
|
|
||||||
func (k *Keeper) SetKeyring(kr types.CustodyKeyring) { k.keyring = kr }
|
|
||||||
|
|
||||||
// Compile-time assertion: Keeper satisfies types.ComplianceKeeper (the
|
|
||||||
// CustodyReleaseAsset handler passes the keeper as the ComplianceKeeper
|
|
||||||
// shim — A-544 compliance-before-custody; the IsCompliant method reads the
|
|
||||||
// attestation store the RecordComplianceAttestation handler populates).
|
|
||||||
var _ types.ComplianceKeeper = (*Keeper)(nil)
|
|
||||||
|
|
||||||
// --- Custody service store ---------------------------------------------------
|
|
||||||
|
|
||||||
var custodyServiceKeyPrefix = []byte("svc/custody/")
|
|
||||||
|
|
||||||
func custodyServiceKey(serviceID string) []byte {
|
|
||||||
return append(custodyServiceKeyPrefix, []byte(serviceID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetCustodyService loads a registered custody service by service-id.
|
|
||||||
// Returns the service and true if found, or zero value + false if not.
|
|
||||||
func (k Keeper) GetCustodyService(ctx sdk.Context, serviceID string) (types.CustodyService, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(custodyServiceKey(serviceID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.CustodyService{}, false
|
|
||||||
}
|
|
||||||
var s types.CustodyService
|
|
||||||
if err := json.Unmarshal(bz, &s); err != nil {
|
|
||||||
return types.CustodyService{}, false
|
|
||||||
}
|
|
||||||
return s, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetCustodyService persists a registered custody service by service-id.
|
|
||||||
func (k Keeper) SetCustodyService(ctx sdk.Context, s types.CustodyService) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(s)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("hub: marshal custody service %q: %v", s.CustodyID, err))
|
|
||||||
}
|
|
||||||
store.Set(custodyServiceKey(s.CustodyID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllCustodyServices returns all registered custody services.
|
|
||||||
func (k Keeper) AllCustodyServices(ctx sdk.Context) []types.CustodyService {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(custodyServiceKeyPrefix, prefixEnd(custodyServiceKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.CustodyService{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var s types.CustodyService
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &s); err == nil {
|
|
||||||
out = append(out, s)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Lending primitive store -------------------------------------------------
|
|
||||||
|
|
||||||
var lendingKeyPrefix = []byte("lending/")
|
|
||||||
|
|
||||||
func lendingKey(loanID string) []byte {
|
|
||||||
return append(lendingKeyPrefix, []byte(loanID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetLendingPrimitive loads a recorded lending primitive by loan-id.
|
|
||||||
func (k Keeper) GetLendingPrimitive(ctx sdk.Context, loanID string) (types.LendingPrimitive, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(lendingKey(loanID))
|
|
||||||
if bz == nil {
|
|
||||||
return types.LendingPrimitive{}, false
|
|
||||||
}
|
|
||||||
var l types.LendingPrimitive
|
|
||||||
if err := json.Unmarshal(bz, &l); err != nil {
|
|
||||||
return types.LendingPrimitive{}, false
|
|
||||||
}
|
|
||||||
return l, true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetLendingPrimitive persists a recorded lending primitive by loan-id.
|
|
||||||
func (k Keeper) SetLendingPrimitive(ctx sdk.Context, l types.LendingPrimitive) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz, err := json.Marshal(l)
|
|
||||||
if err != nil {
|
|
||||||
panic(fmt.Sprintf("hub: marshal lending primitive %q: %v", l.LoanID, err))
|
|
||||||
}
|
|
||||||
store.Set(lendingKey(l.LoanID), bz)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllLendingPrimitives returns all recorded lending primitives.
|
|
||||||
func (k Keeper) AllLendingPrimitives(ctx sdk.Context) []types.LendingPrimitive {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
iterator := store.Iterator(lendingKeyPrefix, prefixEnd(lendingKeyPrefix))
|
|
||||||
defer iterator.Close()
|
|
||||||
out := []types.LendingPrimitive{}
|
|
||||||
for ; iterator.Valid(); iterator.Next() {
|
|
||||||
var l types.LendingPrimitive
|
|
||||||
if err := json.Unmarshal(iterator.Value(), &l); err == nil {
|
|
||||||
out = append(out, l)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Custody entry exported accessors (for simtest + handler helpers) --------
|
|
||||||
|
|
||||||
// GetCustodyEntry loads a CustodyEntry by assetID. Returns the entry and
|
|
||||||
// true if found, or zero value + false if not. Exported for simtest
|
|
||||||
// assertion (the custody store's getCustodyEntry is lowercase; this is the
|
|
||||||
// exported wrapper on the Keeper).
|
|
||||||
func (k Keeper) GetCustodyEntry(ctx sdk.Context, assetID string) (CustodyEntry, bool) {
|
|
||||||
return k.custody.getCustodyEntry(ctx, assetID)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AllCustodyEntries returns all persisted CustodyEntry records (iteration
|
|
||||||
// helper, unordered). Exported for simtest assertion.
|
|
||||||
func (k Keeper) AllCustodyEntries(ctx sdk.Context) []CustodyEntry {
|
|
||||||
return k.custody.allCustodyEntries(ctx)
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Compliance attestation store --------------------------------------------
|
|
||||||
|
|
||||||
// The compliance attestation store is keyed by partner-id. The value is
|
|
||||||
// the latest attestation-ref (the RecordComplianceAttestation handler
|
|
||||||
// overwrites prior attestations for the same partner-id; the IsCompliant
|
|
||||||
// method reads this store). A-544 compliance-before-custody: the
|
|
||||||
// CustodyReleaseAsset handler consults IsCompliant(partnerID) via the
|
|
||||||
// ComplianceKeeper shim (the Keeper satisfies it) BEFORE the custody debit.
|
|
||||||
|
|
||||||
var complianceKeyPrefix = []byte("compliance/")
|
|
||||||
|
|
||||||
func complianceKey(partnerID string) []byte {
|
|
||||||
return append(complianceKeyPrefix, []byte(partnerID)...)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetComplianceAttestation loads the latest attestation-ref for a partner.
|
|
||||||
// Returns the attestation-ref and true if found, or "" + false if not.
|
|
||||||
func (k Keeper) GetComplianceAttestation(ctx sdk.Context, partnerID string) (string, bool) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
bz := store.Get(complianceKey(partnerID))
|
|
||||||
if bz == nil {
|
|
||||||
return "", false
|
|
||||||
}
|
|
||||||
return string(bz), true
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetComplianceAttestation persists the latest attestation-ref for a partner.
|
|
||||||
func (k Keeper) SetComplianceAttestation(ctx sdk.Context, partnerID, attestationRef string) {
|
|
||||||
store := ctx.KVStore(k.storeKey)
|
|
||||||
store.Set(complianceKey(partnerID), []byte(attestationRef))
|
|
||||||
}
|
|
||||||
|
|
||||||
// IsCompliant reports whether the named partner has a valid compliance
|
|
||||||
// attestation on record (i.e., a MsgRecordComplianceAttestation has been
|
|
||||||
// recorded against it). The CustodyReleaseAsset handler consults this
|
|
||||||
// BEFORE the custody debit (A-544 compliance-before-custody); a
|
|
||||||
// non-compliant partner REJECTS the release (the asset stays in custody).
|
|
||||||
//
|
|
||||||
// Implements types.ComplianceKeeper (the Keeper satisfies the
|
|
||||||
// ComplianceKeeper shim structurally — A-544; the handler passes the
|
|
||||||
// keeper as the ComplianceKeeper to itself).
|
|
||||||
func (k Keeper) IsCompliant(ctx interface{}, partnerID string) bool {
|
|
||||||
sdkCtx := unwrapCtx(ctx)
|
|
||||||
_, ok := k.GetComplianceAttestation(sdkCtx, partnerID)
|
|
||||||
return ok
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- prefixEnd helper --------------------------------------------------------
|
|
||||||
|
|
||||||
// prefixEnd returns the key that sorts immediately after all keys sharing
|
|
||||||
// the given prefix (the standard prefix-iteration end key: increment the
|
|
||||||
// last byte, drop overflow). Used for store.Iterator(start, prefixEnd(start))
|
|
||||||
// prefix scans. Mirrors x/partner/keeper/keeper.go.
|
|
||||||
func prefixEnd(prefix []byte) []byte {
|
|
||||||
if len(prefix) == 0 {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
end := make([]byte, len(prefix))
|
|
||||||
copy(end, prefix)
|
|
||||||
for i := len(end) - 1; i >= 0; i-- {
|
|
||||||
end[i]++
|
|
||||||
if end[i] != 0 {
|
|
||||||
return end
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// All bytes were 0xFF; return nil (iterate to end of store).
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@@ -1,217 +0,0 @@
|
|||||||
package keeper
|
|
||||||
|
|
||||||
// keyring_mem.go holds the in-memory test-only memKeyring impl of the
|
|
||||||
// CustodyKeyring interface (D-058, P4-02-01). data-engineer territory (P4
|
|
||||||
// phase-specific — removed after P4 per PERSONAS.md).
|
|
||||||
//
|
|
||||||
// D-054: simtest-grade — NO real MPC, NO real HSM, NO real hardware. The
|
|
||||||
// memKeyring signs with a throwaway ed25519 key per assetID (generated
|
|
||||||
// in-process; the seed is not persisted). Real MPC/HSM backing is deferred
|
|
||||||
// (operational, Year 3+). This impl exists so the x/hub custody handlers
|
|
||||||
// can be exercised end-to-end in simtest without a custody vendor.
|
|
||||||
//
|
|
||||||
// Rotation: Rotate(assetID) swaps the keymap entry for assetID with a fresh
|
|
||||||
// ed25519 keypair and bumps the version (monotonic uint64). A subsequent
|
|
||||||
// Status reports the new active key version; a subsequent Sign uses the new
|
|
||||||
// key (D-058: no cross-block caching — the handler consults Status/Sign per
|
|
||||||
// operation, so rotation is observed immediately). The previous key is
|
|
||||||
// retained as a Rotated entry so Derive can still return the historical
|
|
||||||
// pubkey for verification of prior signatures.
|
|
||||||
//
|
|
||||||
// Revocation: Revoke(assetID) marks the active key Revoked (terminal).
|
|
||||||
// Subsequent Sign/Derive against the assetID return ErrKeyringRevoked/
|
|
||||||
// ErrKeyringInactive. The key material is wiped (defensive — simtest grade).
|
|
||||||
//
|
|
||||||
// Thread safety: the simtest is single-threaded per-block (SDK store
|
|
||||||
// semantics); the memKeyring uses a mutex so concurrent test paths are
|
|
||||||
// safe (mirrors x/partner/types/types.go Keeper stub pattern).
|
|
||||||
//
|
|
||||||
// Lexicon note (REQ-012): "memKeyring", "Sign", "Derive", "rotation",
|
|
||||||
// "revocation", "ed25519" are all lexicon-clean. No banned terms.
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"crypto/ed25519"
|
|
||||||
"crypto/rand"
|
|
||||||
"fmt"
|
|
||||||
"sync"
|
|
||||||
|
|
||||||
"github.com/oy/openyield/x/hub/types"
|
|
||||||
)
|
|
||||||
|
|
||||||
// memKeyring is the in-memory test-only CustodyKeyring impl (D-058).
|
|
||||||
// NOT for production use — real MPC/HSM backing is deferred (Year 3+).
|
|
||||||
type memKeyring struct {
|
|
||||||
mu sync.Mutex
|
|
||||||
keys map[string]*keyEntry // assetID → active key entry
|
|
||||||
}
|
|
||||||
|
|
||||||
// keyEntry is the per-assetID key record. The active key is the one used
|
|
||||||
// for Sign/Derive; the rotated keys are retained for historical Derive
|
|
||||||
// (verification of prior signatures).
|
|
||||||
type keyEntry struct {
|
|
||||||
priv ed25519.PrivateKey
|
|
||||||
pub ed25519.PublicKey
|
|
||||||
status types.KeyringStatus
|
|
||||||
version uint64
|
|
||||||
rotated []*keyEntry // historical (Rotated) entries, newest-first
|
|
||||||
}
|
|
||||||
|
|
||||||
// NewMemKeyring returns a fresh empty in-memory CustodyKeyring (D-058).
|
|
||||||
// Keys are generated lazily on the first Register/Sign/Derive for an
|
|
||||||
// assetID (or explicitly via Register).
|
|
||||||
func NewMemKeyring() types.CustodyKeyring {
|
|
||||||
return &memKeyring{keys: make(map[string]*keyEntry)}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Register ensures an active key exists for assetID. If one already exists
|
|
||||||
// and is Active, this is a no-op (returns the existing version). If the
|
|
||||||
// assetID is unknown, a fresh ed25519 keypair is generated (version 1).
|
|
||||||
// Register is a convenience for test setup; the handler does not require
|
|
||||||
// explicit registration (Sign/Derive auto-register on first use).
|
|
||||||
func (m *memKeyring) Register(ctx context.Context, assetID string) (types.PubKey, uint64, error) {
|
|
||||||
m.mu.Lock()
|
|
||||||
defer m.mu.Unlock()
|
|
||||||
if e, ok := m.keys[assetID]; ok && e.status == types.KeyringActive {
|
|
||||||
return types.PubKey(e.pub), e.version, nil
|
|
||||||
}
|
|
||||||
e, err := newActiveEntry(1)
|
|
||||||
if err != nil {
|
|
||||||
return nil, 0, err
|
|
||||||
}
|
|
||||||
m.keys[assetID] = e
|
|
||||||
return types.PubKey(e.pub), e.version, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Sign produces an ed25519 signature over payload with the active key for
|
|
||||||
// assetID. Auto-registers on first use (lazy key generation). Returns
|
|
||||||
// ErrKeyringInactive if the key is Rotated or Revoked.
|
|
||||||
func (m *memKeyring) Sign(ctx context.Context, assetID string, payload []byte) ([]byte, error) {
|
|
||||||
m.mu.Lock()
|
|
||||||
defer m.mu.Unlock()
|
|
||||||
e, ok := m.keys[assetID]
|
|
||||||
if !ok {
|
|
||||||
// Lazy auto-register on first Sign.
|
|
||||||
ne, err := newActiveEntry(1)
|
|
||||||
if err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
m.keys[assetID] = ne
|
|
||||||
e = ne
|
|
||||||
}
|
|
||||||
if e.status != types.KeyringActive {
|
|
||||||
return nil, types.ErrKeyringInactive
|
|
||||||
}
|
|
||||||
return ed25519.Sign(e.priv, payload), nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Derive returns the active public key for assetID. Auto-registers on first
|
|
||||||
// use. Returns ErrKeyringRevoked if the key is Revoked; returns the
|
|
||||||
// historical pubkey if the key is Rotated (for verification of prior
|
|
||||||
// signatures).
|
|
||||||
func (m *memKeyring) Derive(ctx context.Context, assetID string) (types.PubKey, error) {
|
|
||||||
m.mu.Lock()
|
|
||||||
defer m.mu.Unlock()
|
|
||||||
e, ok := m.keys[assetID]
|
|
||||||
if !ok {
|
|
||||||
// Lazy auto-register on first Derive.
|
|
||||||
ne, err := newActiveEntry(1)
|
|
||||||
if err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
m.keys[assetID] = ne
|
|
||||||
e = ne
|
|
||||||
}
|
|
||||||
if e.status == types.KeyringRevoked {
|
|
||||||
return nil, types.ErrKeyringRevoked
|
|
||||||
}
|
|
||||||
// Active or Rotated: return the pubkey (Rotated returns the historical
|
|
||||||
// pubkey of that entry — the entry's own pubkey, not the new active).
|
|
||||||
return types.PubKey(e.pub), nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Status reports the active key's status + version for assetID. Returns
|
|
||||||
// ErrKeyringUnknownAsset if the assetID is not registered (Status does NOT
|
|
||||||
// auto-register — the handler consults Status before Sign to enforce
|
|
||||||
// rotation safety; auto-register on Status would mask a missing-asset bug).
|
|
||||||
func (m *memKeyring) Status(ctx context.Context, assetID string) (types.KeyringStatus, uint64, error) {
|
|
||||||
m.mu.Lock()
|
|
||||||
defer m.mu.Unlock()
|
|
||||||
e, ok := m.keys[assetID]
|
|
||||||
if !ok {
|
|
||||||
return "", 0, types.ErrKeyringUnknownAsset
|
|
||||||
}
|
|
||||||
return e.status, e.version, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Rotate swaps the active key for assetID with a fresh ed25519 keypair and
|
|
||||||
// bumps the version (monotonic). The previous key is retained as a Rotated
|
|
||||||
// entry (newest-first in e.rotated). A subsequent Sign uses the new key;
|
|
||||||
// Derive against the Rotated entry returns the historical pubkey. Returns
|
|
||||||
// the new version. This is the test-only rotation helper (D-058); the
|
|
||||||
// simtest exercises rotation via this method.
|
|
||||||
func (m *memKeyring) Rotate(assetID string) (uint64, error) {
|
|
||||||
m.mu.Lock()
|
|
||||||
defer m.mu.Unlock()
|
|
||||||
e, ok := m.keys[assetID]
|
|
||||||
if !ok {
|
|
||||||
// Auto-register on Rotate (convenience for test setup).
|
|
||||||
ne, err := newActiveEntry(1)
|
|
||||||
if err != nil {
|
|
||||||
return 0, err
|
|
||||||
}
|
|
||||||
m.keys[assetID] = ne
|
|
||||||
return ne.version, nil
|
|
||||||
}
|
|
||||||
if e.status == types.KeyringRevoked {
|
|
||||||
return 0, types.ErrKeyringRevoked
|
|
||||||
}
|
|
||||||
// Promote current active to Rotated, generate a new active.
|
|
||||||
newVersion := e.version + 1
|
|
||||||
ne, err := newActiveEntry(newVersion)
|
|
||||||
if err != nil {
|
|
||||||
return 0, err
|
|
||||||
}
|
|
||||||
old := e
|
|
||||||
old.status = types.KeyringRotated
|
|
||||||
ne.rotated = append([]*keyEntry{old}, e.rotated...)
|
|
||||||
m.keys[assetID] = ne
|
|
||||||
return newVersion, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Revoke marks the active key for assetID as Revoked (terminal). Subsequent
|
|
||||||
// Sign/Derive against the assetID return ErrKeyringInactive/ErrKeyringRevoked.
|
|
||||||
// The key material is wiped (defensive — simtest grade). Returns
|
|
||||||
// ErrKeyringUnknownAsset if the assetID is not registered.
|
|
||||||
func (m *memKeyring) Revoke(assetID string) error {
|
|
||||||
m.mu.Lock()
|
|
||||||
defer m.mu.Unlock()
|
|
||||||
e, ok := m.keys[assetID]
|
|
||||||
if !ok {
|
|
||||||
return types.ErrKeyringUnknownAsset
|
|
||||||
}
|
|
||||||
e.status = types.KeyringRevoked
|
|
||||||
// Defensive: wipe the private key material (simtest grade — a real
|
|
||||||
// impl would zeroize the HSM key slot).
|
|
||||||
wipe := make(ed25519.PrivateKey, ed25519.PrivateKeySize)
|
|
||||||
e.priv = wipe
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// newActiveEntry generates a fresh ed25519 keypair with the given version
|
|
||||||
// and status=Active.
|
|
||||||
func newActiveEntry(version uint64) (*keyEntry, error) {
|
|
||||||
pub, priv, err := ed25519.GenerateKey(rand.Reader)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("memKeyring: generate ed25519 key: %w", err)
|
|
||||||
}
|
|
||||||
return &keyEntry{
|
|
||||||
priv: priv,
|
|
||||||
pub: pub,
|
|
||||||
status: types.KeyringActive,
|
|
||||||
version: version,
|
|
||||||
}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Compile-time assertion: memKeyring implements types.CustodyKeyring.
|
|
||||||
var _ types.CustodyKeyring = (*memKeyring)(nil)
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user