Implemented PostgreSQL v3 allocation-registry groundwork

2026-10-21 14:59:15 -04:00
parent ee5dc35330
commit e70199ecb0
6 changed files with 360 additions and 9 deletions
@@ -20,7 +20,7 @@ Status: active engineering plan; **not launch or payment authorization**. Update

 **Current design deliverable:** [custodial market design](custodial-market-design.md). Read the workstreams below with this update: pooled customer liabilities replace per-order incoming invoices and external sale payouts in the proposed architecture. Earlier trustless-first research gates are historical, not a prerequisite to investigating custody. Exact ledger, withdrawal, fee, custody/legal and host-attested NFT consensus rules still require approval and evidence; the existing mock domain cannot authorize real balance debits.

-**Read-only XMR groundwork:** a disabled-by-default Monero wallet-RPC observer client is implemented for mainnet address validation and bounded incoming scans; an explicit PostgreSQL v1→v2 migration adds durable scan cursors, exact observation records and append-only reorg/reappearance markers under a separate observer database role. Each record includes a validated destination address. The observer/store remain disconnected from startup/routes and cannot allocate deposit addresses, post credits, reverse balances or spend. Missing outputs create review evidence only. Offline fixtures cover strict RPC safety, scan retry idempotency and cursor fencing; the PostgreSQL suite passed 33/33, including upgrade and reorg-observation persistence. No live RPC, wallet credential or funds were used. Remaining deposit milestone: backed-up non-reusable subaddress allocation, binding each credited output to a registered beneficiary/address, authoritative chain inclusion and reorg policy, exact idempotent journal crediting plus audited reversal/hold handling, controlled stagenet rehearsal, and independent accounting/security review before real deposits.
+**Read-only XMR groundwork:** a disabled-by-default Monero wallet-RPC observer client is implemented for mainnet address validation and bounded incoming scans. Explicit PostgreSQL v1→v3 migrations add durable scan cursors, exact observation records, append-only reorg/reappearance markers, and a private beneficiary-bound subaddress-index registry. The registry can reserve a never-reused index before a future wallet RPC side effect, then register a validated mainnet subaddress once. It is not wired to startup/routes/UI/RPC; existing custody and observer roles cannot read or write it. The registry does not prove wallet-generation identity, solve RPC/database crash recovery, or determine unique output identity. Observation records include validated destination addresses. Missing outputs create review evidence only; neither observer nor registry can post credits, reverse balances or spend. Verification passed: Docker test-target build; **183/183** offline tests; **35/35** disposable PostgreSQL integration tests, including v1/v2 upgrades, cross-pool concurrent index reservation, replay, immutable registration, least-privilege isolation and zero journal postings. No live RPC, wallet credential or funds were used. Remaining deposit milestone: reconcile reserved allocations against the pinned wallet RPC and backed-up wallet generation; establish stable per-output identity and canonical inclusion/lock/reorg semantics; then design exact idempotent journal crediting plus audited reversal/hold handling, controlled stagenet rehearsal, and independent accounting/security review before any real deposits.

 ## 1A. MVP release boundary — proposed safe first production-hosted release