Implemented the next deposit-observation step without activating live deposits

2026-10-21 14:09:55 -04:00
parent 79abaa78f2
commit ee5dc35330
8 changed files with 395 additions and 24 deletions
@@ -19,7 +19,7 @@ The operator has authorized proceeding with implementation instead of the previo

 **Financial storage update:** [ADR 003](postgres-financial-storage.md) selects PostgreSQL and records the integrated asynchronous custody backend, restricted runtime/schema roles, deferred accounting constraints, explicit SQLite freeze/import, and full dump/restore rehearsal. SQLite remains an opt-in-compatible local sandbox default, not an automatic fallback. Real custody and production operating acceptance remain blocked.

-**Read-only Monero observer prototype:** [server/market/monero-observer.ts](../server/market/monero-observer.ts) defines a narrow mainnet wallet-RPC client for primary-address network check and bounded incoming-transfer scans. It requires an explicit protected config file and observer opt-in, uses authenticated requests with strict HTTPS/loopback-only HTTP, no redirects, bounded response/deadline, JSON-RPC request-ID validation and lossless JSON integer handling. The module exposes no subaddress creation, credit posting, transfer construction, relay, sweep or withdrawal operation and is not wired into application startup/routes. Fixture tests cover uint64 preservation, malformed/oversized responses, wrong RPC IDs and unsafe endpoint schemes. No wallet endpoint, credentials or funds were accessed. This is preparatory read-only plumbing, not live deposit crediting or an approved mainnet switch.
+**Read-only Monero observation groundwork:** [server/market/monero-observer.ts](../server/market/monero-observer.ts) defines a narrow mainnet wallet-RPC client for mainnet primary-address verification and bounded incoming-transfer scans. It requires explicit opt-in and a protected external config file, uses authenticated requests with strict HTTPS/literal-loopback-only HTTP, no redirects, bounded response/deadline, JSON-RPC request-ID validation and lossless JSON integer handling. Each observed transfer includes its validated destination address. It exposes no subaddress creation, credit posting, transfer construction, relay, sweep or withdrawal operation and is not wired into server startup/routes. [server/market/monero-observation-store.ts](../server/market/monero-observation-store.ts) persists scan manifests, exact incoming-transfer observations, cursor progress and append-only seen/changed/not-seen/reappeared events in PostgreSQL schema v2, restricted to a dedicated observer DB role separate from the custody API runtime. Confirmation growth updates a projection without emitting an event every poll. A missing output is only a review signal; no automatic journal posting, debit, reversal or customer credit exists. Schema v1→v2 is an explicit additive migration, not an HTTP-runtime migration. The 33-test PostgreSQL suite covers v1 upgrade preservation, least-privilege separation, scan replay/cursor fencing and reorg/reappearance observations. No wallet endpoint, credentials or funds were accessed. This is observation/audit groundwork, not a deposit-address allocator, live deposit processor, or approved mainnet switch. The application only calls read methods, but operators must still use a restricted view-only wallet RPC instance/account; the code cannot prove credential scope.

 Validation: TypeScript/Vite build and 144 offline tests passed in the serial native-RandomX test run; the initial parallel run encountered a peer-gossip timeout. Browser smoke verified a disposable wallet's signed test credit, withdrawal hold and cancellation restoring the exact balance, plus a 390px viewport without horizontal overflow. No real funds were used. Tests and remaining acceptance gates are below; this is not launch readiness.