01a02f83 - Local e2e journey stages 1-11 including recovery - #237
Draft
TaprootFreakAI wants to merge 39 commits into
Draft
01a02f83 - Local e2e journey stages 1-11 including recovery#237TaprootFreakAI wants to merge 39 commits into
TaprootFreakAI wants to merge 39 commits into
Conversation
PUBLISHER_KEY has no default; cargo test shares a process and collides Legacy vs V1 stack claims. The wrapper matches the CI env and filter.
Public repo: keep the wrapper comment generic.
Collaborator
Author
|
EN: DE: |
Collaborator
Author
|
EN: DE: DetailsPass 1 (HEAD 7d26181): quality found 1 — an internal hostname in the new script comment. Pass 2 (HEAD e9c06bd): quality + logic complete, 0 findings on both review dimensions after that comment was dropped. Open comments: one status note from 2026-08-22 06:54 UTC that the cross-vendor gate was not authenticated — obsolete; that gate has now completed at e9c06bd. No review threads, no inline comments. Mergeability: mergeable=MERGEABLE, mergeStateStatus=CLEAN. Both commits verified=true. Draft CI jobs on this repo skip by design (label |
TaprootFreakAI
marked this pull request as ready for review
August 22, 2026 07:21
TaprootFreakAI
marked this pull request as draft
August 22, 2026 07:25
A-to-Z journey aborted on AbortError during mint because proving saturates the node and GET /v1/jobs times out. Poll until the job wait budget instead of dying on a single aborted fetch.
TaprootFreakAI
changed the title
A second Entrust with the same bundle returned wrong_phase, which the API edge maps to HTTP 500. Treat the identical bytes as accepted without consuming the challenge, and let the local journey continue when ownership pull already works.
Rerunning the A-to-Z journey against a node that already holds Alice signed the genesis spend key while the kernel had advanced send_counter. Load current_pubkey and send_counter after entrust.
The persistent local stack keeps NfLog and account state. A second stage-2 mint then fails as a republish of an existing nullifier. If the expected balance is already there, skip the mint.
Skip on any non-zero holding, not only the genesis amount. A later send leaves a remainder; minting again republishes a spent nullifier.
Rerunning mint/send/receive on a stack that already finished those stages republishes a nullifier. Skip when Alice or Bob already hold the expected balances, matching the existing stage-2 mint skip.
TaprootFreak
changed the title
Stage 6 needs the Alice→Bob send spend pubkey. After an idempotent skip of stages 3/4 that value is not in-process; look up a completed inscription for Alice's latest used spend key instead.
Honor ZKCOINS_VERIFY_ATTESTATION when the kernel is a native binary rather than a compose service. Derive USD/EUR asset ids in stages 10 and 11 so they can run without mint jobs from the same process.
Pull listed the process-local private-record index only, so a restarted kernel returned zero records while v1_decrypt_index and v1_self_delivery_index still held the catalog. Load both tables into that index at boot. The local-e2e driver recovers Alice's change coin from the durable self-delivery catalog, treats any post-mint USD balance as an already-sent skip, and walks send_counter past spend keys already present on the NfLog.
Compose still uses the 0.0.0.0:4242 constant. A native kernel that shares the host with an ingress on 4242 sets ZKCOINS_HTTP_ADDR.
Operational bundles are process-local. After a kernel restart, stage 10 and stage 11 must Entrust before IssueViewGrant or attest, matching stages 2–5.
Stage 9 already proved matching balances on the second node. A follow-up send using the cloned head republishes a nullifier already on the canonical NfLog (account send_counter lags the chain). Skip that send.
TaprootFreak
changed the title
Stage 8 reconstructs Bob's SEND_AMOUNT on the second node after entrust. The --list line no longer marks it as TODO.
TaprootFreak
changed the title
Header, --help, journey.sh comments, and the local-e2e README still called 2b-11 TODO skeletons. They now pass on a live stack. Default run remains stages 1-2. Known gaps keep the send_counter lag and the process-local operational bundle.
GetAccountState success used to skip §4.5 replay, so a send_counter that still names a current_pubkey on the NfLog never advanced. Recovery now replays those heads and replaces a strictly older engine account under the write gate.
Inscriptions publish Pk || R || R'. Recovery classified only R_create against the log, so a member that stored R' was discarded as a double-spend loser and a stale account head never advanced.
A missing output_ref blob was failing §4.5 fold even though v1_self_delivery_index / v1_decrypt_index already held the coin.
FetchFailed on one coin blob aborted the whole subject, including an already-accepted SDR chain. Missing blobs are discarded; fold continues with coins already in the durable index.
Stage 10 used docker compose exec node, which fails on the native kernel stack. Prefer ZKCOINS_VERIFY_ATTESTATION or the release binary before the compose fallback.
Contributor
|
Native verifier for stage 10: prefer ZKCOINS_VERIFY_ATTESTATION or target/release/verify_attestation before docker compose exec node. Re-verified stages 10–11 PASS on the native m5me stack. Draft remains draft. |
…lled Blossom 404 no longer drops an SDR whose ZBE is still in v1_delivery_outbox. A live send_counter that matches the reconstructed head but whose current_pubkey is already on the NfLog is a spent head, not a recovered one.
Contributor
|
Recovery: blossom 404 falls back to durable outbox ZBE; a live send_counter matching the reconstructed head is not treated as already-installed when current_pubkey is already on the NfLog. Draft remains draft. |
Unit tests for v1_publisher_env_from_env: unclaimed and legacy stack claims, missing/empty/whitespace env, invalid and zero fee/reveal, and into_config mapping. Connect/publish stay integration-only.
TaprootFreak
changed the title
Roundtrip against the canonical serializer, empty proof, truncated prefix/payload, trailing bytes, and non-canonical digest limbs.
lookup_account_owner length/missing, publish/drain without a network pin, GetInfo identity/engine mismatch, and DeclineFeeLess without identity. Drain asserts the full pin-detail string.
Truncated prefix, depth above MAX_OUTPUT_MERKLE_DEPTH, length mismatch, non-canonical sibling digest, and a depth-1 roundtrip.
fetch_blob_from_holders must fail closed before any HTTP when the holder list is empty.
Fail-closed details for missing zkdt/zkepk, empty list, skipped short tags, last-wins zkdt, and exact 64-hex-char errors.
parse_inclusion_proof_wire must fail closed when a depth-0 wire is longer than the expected 5-byte prefix.
Reject v1 trailing cap_total/terms_salt, v2 missing fields, name-hash overflow, and last-wins zkepk; pin exact IncomingError::Verification strings on the existing mismatch and unknown-version cases.
Cover v1 trailing fields, v2 missing cap/salt, unknown issuance version, overlong name, and mint snapshots with no output coins. Each reject leaves token provenance unwritten.
Pin CreatingNullifierNotCompleted on a loser R, RecipientMismatch on a foreign subject, and CoinProofCorrupt when canonical identifier disagrees with fold_coin_id.
Reject a creating nullifier whose NfLog position is not covered by size_final, and wrap a truncated inclusion-proof wire as OutputInclusion.
Reject a 38-byte depth-1 proof (expected 37) and pin the non-canonical sibling limb error to the exact Verification string.
Require exact IncomingError::Verification text for truncated prefix, depth above the maximum, and depth-1 length mismatch.
Pin the remaining HolderOutcome Display arms so a lying holder is named as fetch_error and a verified body reports body_len.
Pin IncomingError Display so an empty holder list and every failed holder attempt stay named in the error string.
Pin IncomingError Display so a missing scan tag and a detect_tag mismatch both name their fields in the error string.
Pin Nip59, SealAuthorMismatch, Payload, AckDestination, AckSend, and Relay Display so each named cause stays in the error string.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
EN:
All named A-to-Z stages 1-11 are fail-closed on a live stack. Default journey.sh still runs only 1-2. Recovery now replays a servable account head whose current_pubkey is already on the NfLog and replaces a strictly older engine account under the write gate.
DE:
Alle benannten A-to-Z-Stufen 1-11 sind fail-closed auf einem Live-Stack. Default-journey.sh bleibt 1-2. Recovery spielt einen servable Account-Head nach, dessen current_pubkey schon auf dem NfLog liegt, und ersetzt einen strikt älteren Engine-Account unter dem Write-Gate.
Details
Stage 8 recovery is no longer listed as TODO. README and --help no longer call 2b-11 TODO skeletons.
already_recovered_subjectsno longer skips a GetAccountState hit whose current spend key is a first-occurrence winner.StateEngine::replace_accountinstalls a strictly newer reconstructed head. Draft archive; not a landing candidate.