Skip to content

chore(ci)(deps): bump actions/setup-node from 4 to 6 - #8

Merged
mmacedoeu merged 3 commits into
mainfrom
dependabot/github_actions/actions/setup-node-6
Feb 25, 2026
Merged

chore(ci)(deps): bump actions/setup-node from 4 to 6#8
mmacedoeu merged 3 commits into
mainfrom
dependabot/github_actions/actions/setup-node-6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Feb 24, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/setup-node from 4 to 6.

Release notes

Sourced from actions/setup-node's releases.

v6.0.0

What's Changed

Breaking Changes

Dependency Upgrades

Full Changelog: actions/setup-node@v5...v6.0.0

v5.0.0

What's Changed

Breaking Changes

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless. To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

New Contributors

Full Changelog: actions/setup-node@v4...v5.0.0

v4.4.0

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(ci)(deps): bump actions/setup-node from 4 to 6
6cb4120 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Feb 24, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@mmacedoeu
mmacedoeu merged commit c294e9d into main Feb 25, 2026
7 of 8 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/actions/setup-node-6 branch February 25, 2026 01:49
mmacedoeu added a commit that referenced this pull request Jun 16, 2026
@mmacedoeu
Round 1 of adversarial review: fix 20 issues across 4 RFCs
7888188 
0855p-c (Domain Coordinator):
- R1-DC-1 (CRITICAL): peer_id_to_platform_admin reverse mapping is impossible
  (BLAKE3 is one-way). Fixed: iterate admin list and compute expected peer_id
  for each. Updated code snippet with explicit warning.
- R1-DC-2 (HIGH): New admin designation event undefined. New group admin
  becomes DomainCoordinator automatically on PlatformEvent::AdminTransfer
  (no separate DOT-level designation event needed).
- R1-DC-3 (MEDIUM): PlatformLoss envelope referenced but type not defined.
  Added full PlatformLossEnvelope struct in new section 5a.
- R1-DC-4 (MEDIUM): Suspect -> Handover deadlock risk. Forced
  Suspect -> Handover -> Inactive at 3x heartbeat timeout regardless of
  connection state. Reconnection must re-claim via new BIND.
- R1-DC-5 (MEDIUM): F1 (cross-platform consensus) severity bumped MEDIUM -> HIGH
  (mission fragmentation = mission-level failure).
- R1-DC-6 (LOW): PlatformEvent::AdminTransfer source clarified (platform itself).

0851p-a (Network Bootstrap):
- R1-NB-1 (LOW): sender_id (request) vs requester_id (response) naming
  inconsistent. Renamed both to requester_id.
- R1-NB-2 (HIGH): sender_signature payload omitted max_peers and
  requester_pubkey (mutable after signing). Added both to signed payload.
- R1-NB-3 (LOW): entry_hash formula included undefined SeedListAuthorityId.
  Clarified: it's the authority's public key, implicit in verification flow.
- R1-NB-4 (LOW): Default seed list table missing signed_at_epoch column. Added.
- R1-NB-5 (LOW): MAX_PEER_LIST = 256 referenced but not defined. Added
  Appendix D with all constants.

0850p-c (Transport Group Binding):
- R1-TGB-1 (MEDIUM): ReBinding -> Bound transition misleading. Fixed: per-group
  clarity added to transitions table; REBIND affects two groups (old ReBinding
  -> UnboundQuarantined; new Unbound -> Bound).
- R1-TGB-2 (LOW): GroupBinding.binding_hash field list not specified. Added.
- R1-TGB-3 (LOW): BindAck.ack_hash field list not specified. Added.
- R1-TGB-4 (MEDIUM): bind_nonce entropy requirement not specified. Added
  CSPRNG + 128 bits entropy. Added witness rule #8 (nonce freshness check).
- R1-TGB-5 (MEDIUM): BindEnvelope.platform validation against actual platform
  not explicit. Added explicit enforcement rule.
- R1-TGB-6 (MEDIUM): RebindEnvelope.new_coordinator_id eligibility not
  validated. Added 4 explicit checks.
- R1-TGB-7 (LOW): SlashVote type cross-ref to 0855p-b implicit. Added.

0855p-b v1.1 (Coordinator Lifecycle):
- R1-CL-1 (LOW): GenesisState missing failure transition (key revoke after
  Active). Added GenesisActive -> Inactive with slash reason 0x0009
  (genesis-compromise; 0x0001-0x0008 are taken).
- R1-CL-2 (LOW): GenesisWitness validation failure path not specified. Added
  timeout-based rollback GenesisSelfAttest -> GenesisDesignated after
  genesis_witness_timeout = 100 epochs.

20 issues found, 20 fixed, 0 remaining at end of Round 1.
Next: Round 2 to verify Round 1 fixes and find new issues.
mmacedoeu added a commit that referenced this pull request Jun 16, 2026
@mmacedoeu
Round 2 of adversarial review: fix 13 new issues across 4 RFCs
0034303 
0850p-c (Transport Group Binding):
- R2-TGB-1 (MEDIUM): Nonce-replay table structure (rule #8) not specified.
  Added full NonceReplayTable spec with BTreeMap + amortized eviction.
- R2-TGB-2 (MEDIUM): HEARTBEAT envelope name wrong (was DOT/1/HEARTBEAT;
  actual is CoordinatorHeartbeat per 0855p-b). Corrected.
- R2-TGB-3 (MEDIUM): Cross-platform REBIND old-group state not specified.
  Clarified: old group always goes to UnboundQuarantined regardless of
  same/different platform.
- R2-TGB-4 (MEDIUM): BIND signature didn't bind coordinator_pubkey to
  coordinator_id. Added witness rule #9: coordinator_id == BLAKE3(coordinator_pubkey).
- R2-TGB-6 (MEDIUM): PRE-EXISTING inconsistency: BIND has envelope_type
  b"DOT1" but BACK/UNBD/RBND didn't. Added envelope_type to BACK/UNBD/RBND
  structs to match canonical header spec.

0855p-c (Domain Coordinator):
- R2-DC-1 (MEDIUM): Implicit designator (first-DOT-sender) path had no
  timeout. Added 100-epoch timeout.
- R2-DC-3 (MEDIUM): Reconnection after forced Inactive risks split-brain
  with newly-elected DomainCoordinator. Added split-brain prevention +
  reconnect_epoch field on BindEnvelope.
- R2-DC-4 (MEDIUM): PlatformEvent enum referenced (6+ variants) but never
  defined. Added full enum with payloads.
- R2-DC-5 (LOW): IA-DC-7 conflated 'phone -> peer_id' with two-step mapping.
  Rewrote: platform-native -> participant_id (32 bytes) -> peer_id.

0851p-a (Network Bootstrap):
- R2-NB-1 (MEDIUM): authority_pubkey in entry_hash is implicit. Added
  detailed signing-context model.
- R2-NB-2 (LOW): HEARTBEAT_TIMEOUT not derived from HEARTBEAT_INTERVAL.
  Changed to 3 * BOOTSTRAP_NODE_HEARTBEAT_INTERVAL.

0855p-b v1.1 (Coordinator Lifecycle):
- R2-CL-1 (MEDIUM): GenesisAttest rollback validation rule (stale nonce
  rejection) not specified on receiver side. Added 4-point validation rule.
- R2-CL-2 (MEDIUM): Slash reason 0x0009 not in Slash Reason Codes table.
  Added row + reserved 0x000A-0xFFFF row.
- R2-CL-3 (LOW): genesis_witness_timeout not defined as constant. Added
  Constants section with GENESIS_WITNESS_TIMEOUT = 100.

13 issues fixed, 1 withdrawn (R2-DC-2 was based on a misread of
envelope_type consistency). 0 issues remaining at end of Round 2.
Next: Round 3 to verify Round 2 fixes and find new issues.
mmacedoeu added a commit that referenced this pull request Aug 3, 2026
@mmacedoeu
docs(mission): REV-3 fix Round 3 review of 0968a2
5afef43 
Round 3 review (background subagent, 2026-07-30) found 10 NEW findings
(3 MAJOR + 5 MINOR + 2 NIT). All MAJOR + most MINOR fixed.

**MAJOR fixes**:
- F1 (rotation_receipt_id implicit coverage): Live ChainAnchorSubmitter
  Scope item 3 now explicitly states it covers 0968a AC #5 (chain-side
  encoding of rotation_receipt_id field through to v010 ledger's
  rotation_receipt_id column). Added explicit AC #5 "Live
  ChainAnchorSubmitter writes rotation_receipt_id through to v010
  ledger (covers 0968a AC #5 chain-side encoding)".
- F2 (GovernanceSnapshot/Signer/Proof types missing from IMPL):
  Scope item 2 now states that the 3 verifier types per RFC-0955-R1
  lines 177-200 must be created in a new auth.rs module (alongside
  the existing age_secs/is_fresh). Added explicit AC #8
  "GovernanceSnapshot / GovernanceSigner / GovernanceProof types
  defined per RFC-0955-R1 lines 177-200".
- F3 (plan_batches purity/wiring): Scope item 4 reworded — plan_batches
  is a pure function (no chain-state arguments). Now specifies either
  extending run_once_strict to call is_finality_reached BEFORE
  plan_batches, OR introducing a new plan_batches_with_reorg_check
  function.

**MINOR fixes**:
- F4 (misleading reserved-band citation): "per error.rs:8-49 context"
  → "per RFC-0968 §13 line 2641; note error.rs:8-49 mentions a
  post-amendment-82 reserved band 0x3A..=0xFF not yet active".
- F5 (10 Scope items confusing wording): "The 10 Scope items (9
  Scope + 1 split...)" → "The 9 Scope items (reorg + DID-rotation
  finality combined into 1 Scope item covering both; the 1:1 AC mapping
  would have produced 10)".
- F6 (canonical_blobs.rs lines 34-49 tight block): "lines 34-49"
  → "lines 34, 41, 48".
- F7 (gossip ingress handler underspecified): Scope item 9 now
  specifies "Target the ingress handler only (the handle_one /
  validate_envelope call site); the 6 test fixtures at lines 813,
  1056, 1206, 1288, 1336, 1389, 1526 intentionally use
  anchor_tx_hash: None as test default and should remain unchanged."
- F8 (event_id shorthand for 4-tuple): AC #9 rewording: "Idempotency
  test (2 duplicate submits on (did, signal_kind, layer, last_event_id)
  4-tuple) passes".

**NIT pending**:
- F9 (future RFC-0968-A2 amendment 0x2D impact) — forward-looking
  concern, not blocking.
- F10 (background job scheduler interface) — caller responsibility,
  not owned by this mission. Documented in Out of scope if needed.

Mission 0968a2 now: 9 Scope items + 14 ACs (was 12). 9 Scope items
  cover all 9 ungrounded ACs from 0968a (1:1 + 1 explicit
  chain-encoding + 1 verifier types).
mmacedoeu added a commit that referenced this pull request Aug 3, 2026
@mmacedoeu
docs(mission): 0968a status refresh — 0968a2 landed, residual blocked
f8ac3a8 
Update Status header after 0968a2 implementation landed in commit
72bf19d. N9 (ReputationAnchorBatch governance fields drift)
resolved at the struct + digest + migration + test-vector level.
The 9 ungrounded 0968a ACs split cleanly into 3 categories:

- 5 (#1, #4, #5, #6, #7, #8) gated on chain-substrate selection RFC
- 1 (#9) gated on 0855p-b successor mission (gossip file ownership)
- 2 (#2, #3) achievable but need a live ChainAnchorSubmitter
  fixture (deferred until #1 lands)

Path B closure recommended (per BLUEPRINT §1152-1158 user-initiated
deferral rule). Mission substantively complete at the commit
boundary; residual work is separate chain-substrate + gossip
coordination effort.
mmacedoeu added a commit that referenced this pull request Aug 3, 2026
@mmacedoeu
fix(zk): CASM loud-fail gate + optional hash pin (R3 #8)
e7c79b9
mmacedoeu added a commit that referenced this pull request Aug 7, 2026
@mmacedoeu
docs(missions): 0968a2 R7 mission-text refresh — IMPL/RFC alignment +…
6104a57 
… AC grounding

R7 review findings closed:

MAJOR (governance type collision): mandate path (a) — new anchor-specific types in same module — verified against current IMPL at crates/octo-reputation/src/{auth.rs:399-603, anchor.rs:174-208, anchor.rs:233+}; existing auth.rs::GovernanceSnapshot (L21-25) + GovernanceProof (L113+) preserved unchanged as RFC-0968 authorization envelopes (slash/suspension flows); new AnchorGovernanceSnapshot/AnchorGovernanceSigner/AnchorGovernanceProof/AnchorSignature types + 5 unit tests cover the anchor binding schema.

NIT (duplicate sentence): file no longer contains duplicate (prior edits removed it).

AC grounding updates — 7 ACs flipped to [x]:

- AC #2 governance fields (72bf19d + 48cf997 + b0660c3)
- AC #3 batch_size: u32 (same)
- AC #4 chain_block_height: Option<u64> (same)
- AC #5 AnchorLeaf::digest field order (b0660c3)
- AC #6 v012 migration (file shipped)
- AC #12 anchor-specific verifier types (72bf19d)
- AC #1 StakeBelowMinimum 0x2D verification (013a567)

10 ACs deferred per [[deferred-vs-unspecified]] named-owner rule to chain-substrate selection RFC + 0855p-b successor: #7/#8 live ChainAnchorSubmitter + rotation_receipt_id wire-through, #9/#10 reorg + DID-rotation finality handlers, #11 governance signature verification runtime hook (meets_quorum helper landed), #13 per-deployment config plumbing, #14/#15 idempotency + failure isolation tests, #16 gossip cross-reference, #17 canonical test vector re-pinning.

Version History v0.2 added; mission text no longer contradicts IMPL state.

63 insertions, 78 deletions.
mmacedoeu added a commit that referenced this pull request Aug 12, 2026
@mmacedoeu
docs: round-1 multi-round adversarial review fixes
ba2a571 
Apply fixes from Round 1 multi-round adversarial review of 5 session
commits (b355cb5 RFC-0871 promotion, 9465c5f CLAUDE principles,
99de280 6 refactor missions, a539330 7 RFC v1.1-v2.0 amendments,
63088a3 RFC-0871 planned stage) + uncommitted RFC-0871 working tree.

RFC-0871 (specialized node protocol envelope) — actual Draft promotion:
- Status header updated (PLANNED → Draft 2026-08-08); expected review
  rounds rephrased per [[dual-mode-auth-batch-accepted]] R28-R64 baseline.
- §Dependencies stripped of (Accepted)/(Final) status tags per RFC
  Referencing rule; RFC-0008 added with Planned-status assumption note.
- §Motivation line refs replaced with symbol/section refs (no-line-refs).
- §Algorithms signing preimage domain-separated:
  blake3::derive_key("OCTO_NODEENVELOPE_V1_SIGNATURE",
    envelope_id || from_did_wire || payload)
  per collision-fragility concern; Clock injection requirement added.
- §Adversary Analysis A1-A7 expanded with "Threat actor" + "What they
  gain" rows matching the v0.2 Version History claim.
- §Test Vectors TV1-8 hardened: concrete bytes via test fixtures
  (no truncated `b3ea1f...` placeholder), MockLedgerSigner rename for
  test-only contract, TV8 byte-exact via hand-computed reference +
  property test.
- §Implementation Phases: mission pointers per phase (TBD-at-promotion
  for new missions, real pointers for 0009-a, 0870-b, 0957-ext-*).
- §Future Work: Owner + Schedule columns per [[deferred-vs-unspecified]].
- §Version History v0.2 entry corrected + credits a539330 amendments +
  99de280 missions; §Notes retired (was Planned-era placeholder).

RFC-0969 v1.2 (dual pipeline authorization) — half-applied rename + dispatch
table contradiction resolved:
- AuthenticatedIdentity → AuthenticatedRequest sweep across §Algorithms
  body, §Test Vectors TV1/TV2/TV3/TV4/TV5 (rewritten to use new struct
  shape), §Determinism Requirements text, §Summary debug redaction list.
- §Algorithms §authenticate() rewritten: routing_decision computed from
  header count alone (no AND-gate identity linkage, which is unreachable
  under new dispatch semantics); BothSchemesUnsupported rejects at
  dispatch step; NoAuth pass-through.
- §Test Vectors TV3-5 rewritten per new dispatch semantics (TV3 both
  schemes = reject; TV5 identity-mismatch becomes capability-only invalid).

6 new missions (0009-a, 0010-d, 0870-b, 0957-ext-macaroon, 0957-ext-zk,
0969-a) — RFC ref + line ref hygiene:
- Stripped (Accepted vN.N) / vN.N from all RFC-NNNN cross-refs.
- Replaced line refs (e.g. crates/octo-wallet/src/identity.rs:71) with
  symbol/section refs.
- Mission 0009-a phantom `0850p-h-wallet-ledger.md` pointer clarified:
  substrate is documented in RFC-0850 §F2; mission file will be filed
  when production APDU work starts (not yet a phantom per
  [[no-phantom-mission-pointers]]).
- Missions 0010-d, 0870-b, 0969-a: "RFC-0871 (Planned)" → RFC-0871
  (current Draft per today's promotion).
- Mission 0870-b: "8 existing payloads" → "7 wire payloads" + "RFC-0870
  §NodeEnvelope Adoption" anchor consistency.

7 RFC v1.1-v2.0 amendments (0957-a1, 0957, 0965, 0870, 0009, 0010, 0969):
- Stripped (Accepted vN.N) / (Planned) / (Draft) from cross-refs in
  Version History entries and prose.
- Cross-ref anchor consistency: RFC-0871 §Wallet as Specialized Node →
  §Wallet Node Lifecycle across 0969, 0870, 0957, 0965.
- RFC-0870 v2.0 §NodeEnvelope Adoption: "Eight existing payload types"
  → "Seven existing payload types" aligned with 0870-b mission count;
  "RFC-0863 v1.7" → "RFC-0863" (strip version).
- RFC-0009 v1.1 Version History: "RFC-0871 (Planned)" → RFC-0871;
  line ref `crates/octo-wallet/src/hsm.rs:33` removed.
- RFC-0957 Dependency graph: (Draft)/(Planned) parentheticals rewritten
  to dependency status meta-annotations only.
- RFC-0957-a1 v1.2 Version History: "RFC-0871 (Planned)" → RFC-0871;
  "RFC-0957 v1.0" → "pre-A1 RFC-0957" (neutral ref).

docs/research/2026-08-08-specialized-node-protocol-research.md:
- §Methodology added (was missing per audit lens).
- §Problem Statement table: stripped (Accepted) from 4 RFC refs; "TBD
  future nodes" → "Beyond RFC-0871 scope: governance, oracle, identity
  federation (each = future RFC per Layer C per-RFC model)".
- §Findings 5 W3C DIDComm: "cross-reference DIDComm in Future Work"
  → concrete "future RFC-0XXX on DIDComm URI bridge" with Owner TBD +
  Schedule post-v2.0.
- §References external sources: added URLs + section anchors per item.
- §CipherOcto substrate surveyed: stripped bare (L697-711) line ref.

docs/use-cases/wallet-as-specialized-node.md:
- §Motivation: stripped two bare file:line refs.
- §Success Metrics: "RFC-NNNN §Conformance" → "RFC-0871 §Conformance".
- §Related RFCs: "RFC-NNNN (PLANNED: ...)" → "RFC-0871 (currently
  Draft per promotion 2026-08-08)".
- §Non-Goals: "companion use case" → "docs/use-cases/paid-query-market.md
  (to be filed at RFC-0871 §Implementation Phase 5 promotion)".

CLAUDE.md (Architectural Principles delta):
- Layer A scope: added "+ semantic policies".
- Layer B scope: added "+ wallet-core" (matches §Crate dependency
  rationale example comment "Layer B years-stable" label).
- Layer D scope: added "(BLE/USB/TCP/QUIC/HID/...)" examples.
- Layer E scope: "Capability variants + user extensions" (precise term).
- Layer direction: added per-arrow explanation + "Why this works"
  rationale paragraph (10-year migration survival).
- §Core engineering principles: added missing #8 "Composition over
  inheritance" (canonical 14 → list 13; §Extension over enumeration is
  separate sub-heading, not counted as list item); added reminder about
  section refs not line refs for principle references.
- §Crate dependency rationale example: parenthetical "(years-stable
  maps to ...)" added for label clarity.

Round-2 adversarial review pending.
mmacedoeu added a commit that referenced this pull request Aug 12, 2026
@mmacedoeu
docs(rfc-0862): resolve v1.3 inline comment drift — DidDocument + Ver…
18d9fab 
…ificationMethod refs

Inline ref fixes (cross-RFC version-pin drift after RFC-0010 v1.4/v1.5 amendments landed):

- §Breaking Changes #1: 'DidDocument uses RFC-0010 v1.3 + v1.4 amendment' → 'v1.3 substrate + v1.5 amendment (rich 7-field + VerificationMethod)'. v1.4 = typed ChainId; v1.5 = rich DidDocument — the v1.3 inline used 'v1.4' as placeholder for the originally-planned future amendment.
- §Dependencies: 'RFC-0010 v1.4 amendment (PENDING)' → 'RFC-0010 v1.4 + v1.5 amendments (both FILED 2026-08-11; v1.4 = typed ChainId, v1.5 = rich DidDocument)'.
- §Specification §Substrate types: DidDocument inline comment block rephrased — DidDocument was INTRODUCED by v1.3 storage extension (lib.rs + in_memory_did_registry + registry modules); v1.5 EXTENDED to rich 7-field shape. Pre-v1.3 octo-ident had only lib.rs + test_helpers.rs (corrected from stale 'v1.4 amendment per R12 H8' attribution).
- §Specification VerificationMethod code comment: 'v1.4 amendment' → 'v1.5 amendment'.
- §Acceptance Criteria #8: 'RFC-0010 v1.4 amendment FILED' → 'RFC-0010 v1.4 + v1.5 amendments FILED' (clarifies scope of both amendments that shipped substrate required by §Specification DidDocument field shape referenced inline).
- §Out-of-scope Cross-shard drain: 'tracked for v1.4 amendment' → 'tracked for future amendment' (v1.4 §Out of scope kept single-shard limit; cross-shard atomicity deferred).
- §Future Work Partition recovery: 'RFC-0862 v1.4 amendment will reference this AC' → 'v1.4 §Out of scope deferred the concrete snapshot-recovery schema (only WAL replay landed); full snapshot+replay AC remains a follow-on amendment'.

All RFC-0862 v1.3 inline version-pins now consistent with the actual landed RFC-0010 v1.3/v1.4/v1.5 amendment history. Per RFC Reference Conventions, intra-file version-history refs retain version precision; cross-RFC refs updated to match the now-landed amendments.
mmacedoeu added a commit that referenced this pull request Aug 21, 2026
@mmacedoeu
feat(0862-c4): dqa_to_i64 assert → SpendLedgerError::InvalidScale typ…
5f4ec90 
…ed error

S6c Round 1 security review finding #8: dqa_to_i64's scale == 0
invariant is an unconditional panic reachable from a storage path
— panic in a drain handler is an availability surface. S6c Round 2
code review LOW #5 echoed the gap and pointed at the adjacent
0862-c7 u64→i64 wrap mitigation as the right shape.

- New SpendLedgerError::InvalidScale { expected, actual } variant.
- dqa_to_i64: fn(Dqa) -> i64 → fn(Dqa) -> Result<i64, SpendLedgerError>.
  Returns InvalidScale on scale != 0; no debug_assert (typed-error
  path is testable under cargo test dev profile).
- seed + try_deduct reject scale != 0 at function entry, before
  the drain_lock + DB hit (mirrors NegativeCost guard per 0862-c8).
- Inline assert_eq! at dqa_to_i64 + duplicate asserts in seed +
  try_deduct removed (centralized into the typed-error gate).
- 2 new byte-exact TV (TV-0862-12 seed + TV-0862-13 try_deduct);
  existing 14 TV byte-stable (TV-01..05 + 07 + 08 + 04b + 09 +
  09b + 15 + 16 unchanged).
- RFC-0862 v2.0.4 entry + §Scale precondition subsection.

Verification:
- cargo test -p quota-router-storage: 191 lib + 16 integration TV pass.
- cargo clippy --all-targets --all-features -- -D warnings: clean.
- cargo build -p octo-paid-query -p octo-wallet: green (no public
  API change at the crate-root — SpendLedgerError is a new variant
  in the existing enum).

Closes mission 0862-c4.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

size/XS

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mmacedoeu