WikiDeck/wikideck
3
0
Fork 1
Code Issues 8 Pull Requests Actions Packages Projects 2 Releases Wiki Activity

Implemented the next deposit-observation step without activating live deposits

Browse Source
This commit is contained in:
eric
2026-10-21 14:09:55 -04:00
parent 79abaa78f2
commit ee5dc35330
8 changed files with 395 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/production-plan.md
+1 -1
View File
@@ -20,7 +20,7 @@ Status: active engineering plan; **not launch or payment authorization**. Update
**Current design deliverable:** [custodial market design](custodial-market-design.md). Read the workstreams below with this update: pooled customer liabilities replace per-order incoming invoices and external sale payouts in the proposed architecture. Earlier trustless-first research gates are historical, not a prerequisite to investigating custody. Exact ledger, withdrawal, fee, custody/legal and host-attested NFT consensus rules still require approval and evidence; the existing mock domain cannot authorize real balance debits.
**Read-only XMR groundwork:** a disabled-by-default Monero wallet-RPC observer client is implemented for mainnet address verification and bounded incoming-transfer scans, with protected config-file loading, transport limits and lossless uint64 parsing. It is deliberately not started by the server and cannot create addresses, post credits or spend funds. It has offline fixture coverage only. No actual RPC endpoint, wallet credential, address allocation or deposit was configured. Remaining deposit milestone: backed-up non-reusable subaddress allocation, durable output observation/inclusion/reorg history, exact idempotent ledger credit rules, controlled testnet/stagenet rehearsal, and independent accounting/security review before any real deposit can be accepted.
**Read-only XMR groundwork:** a disabled-by-default Monero wallet-RPC observer client is implemented for mainnet address validation and bounded incoming scans; an explicit PostgreSQL v1→v2 migration adds durable scan cursors, exact observation records and append-only reorg/reappearance markers under a separate observer database role. Each record includes a validated destination address. The observer/store remain disconnected from startup/routes and cannot allocate deposit addresses, post credits, reverse balances or spend. Missing outputs create review evidence only. Offline fixtures cover strict RPC safety, scan retry idempotency and cursor fencing; the PostgreSQL suite passed 33/33, including upgrade and reorg-observation persistence. No live RPC, wallet credential or funds were used. Remaining deposit milestone: backed-up non-reusable subaddress allocation, binding each credited output to a registered beneficiary/address, authoritative chain inclusion and reorg policy, exact idempotent journal crediting plus audited reversal/hold handling, controlled stagenet rehearsal, and independent accounting/security review before real deposits.
## 1A. MVP release boundary — proposed safe first production-hosted release