chore(platform)!: update rust-dashcore (incl secp256k1 0.33) by lklimek · Pull Request #5307 · dashpay/platform

lklimek · 2026-10-06T12:13:00Z

Basic explanation

What this does: Pins rust-dashcore to 8fe0a38170059742ff902acc29a696b72490903c from rust-dashcore PR #1149 (fix/legacy-serde-bls-node-id), restoring legacy BLS public-key and canonical PlatformNodeId serialization and preserving the pre-v4 coinbase payload Serde layout. This is a port of #4932's migration to v5.1-dev.

Value: Gives #5150 a separately reviewable dependency base, so its diff focuses on wallet history and persistence repairs. #4932 and its existing dependent PRs remain unchanged.

Risks: This changes public Rust cryptography APIs and introduces a WebCrypto runtime requirement for WASM; the Node.js >=22 package requirements are being split into separate PR #5310. The merged base supplies the versioned Core v24 behavior. The SPV lifecycle and Node runtime requirements are addressed in stacked #5311 and #5310, which must land with this migration.

Issue being fixed or feature implemented

Port of #4932 from v5.0-dev to v5.1-dev, retaining its commit ancestry. Dependency base for #5150; no SQLite accounting migration, wallet history replay, or SwiftData accounting repair is included here.

What was done?

Stabilize test-suite proof verification across quorum rotation: on the specific missing-cache-key error, wait 65 seconds for sidecar publication and initial SDK bans to expire, then retry the proved read once. No transition rebroadcast or proof-validation bypass. The underlying service timing is tracked in quorum-list-server#16.

Port the secp256k1 0.33 API adaptations and WASM random-source configuration from chore(platform)!: bump rust-dashcore to 719de34b (secp256k1 0.33) #4932. Node.js package requirements and related README changes are excluded from this PR and will be raised directly to >=22 in a separate PR.
Pin all eight rust-dashcore workspace dependencies and all 13 upstream lockfile packages to 8fe0a38170059742ff902acc29a696b72490903c from fix/legacy-serde-bls-node-id. Cargo.lock uses the same revision for every upstream crate.
Adapt wasm-dpp2 private-key hex decoding to the removal of dashcore_hashes::hex, using its existing hex dependency.
Update the native wallet FFI node-ID helper to the explicit EddsaPkHash conversion, preserving canonical SHA256-prefix bytes and the C ABI. A fixed-vector test and invalid-input/no-write checks cover the exported function.
Adapt Core crypto, SPV and spent-height query APIs. Use the shared BLS backend through dpp::bls, convert Ed25519 byte keys through the public operational-key API, preserve canonical node-ID bytes, and read owned masternode snapshots through the public SPV queries. The branch includes the SPV lifecycle fixes from fix(platform-wallet): retain SPV client and track shutdown through cancellation #5311 and fix(platform-wallet)!: tell a retryable SPV stop from one that needs a restart #5322.
Remove DPP's core_key_wallet_bip_38 and SDK's core_key_wallet_bip38 forwards because upstream removed BIP38 support. Adapt raw hash extraction and coinbase test fixtures to the newer upstream API.
Merge v5.1-dev at c301cb60a5 after chore: merge v5.0-dev into v5.1-dev #5308. Keep the Core v24 identity, payout, port-resolution and persistence implementations from feat(platform)!: support Core v24 masternode identities at protocol version 14 #5227/feat(drive-abci)!: resolve Core v24 platform ports at protocol version 14 #5228 unchanged relative to the base. Remove this PR's superseded strict masternode conversions and legacy projection adapters.
Use the shared dash-pkc BLS backend with registry blst 0.3.17; blsful, blstrs_plus, and the workspace blst patch are removed. DPP's bls-signatures feature directly requires blst = "0.3.17" (>=0.3.17,<0.4), so external consumer lockfiles cannot retain incompatible 0.3.12. A TODO removes this temporary constraint once the pinned rust-dashcore graph enforces a compatible minimum.
Isolate quorum-key persistence from crypto Serde with an explicit fixed-48-byte storage adapter. Preserve V1 current keys and V2 current/previous keys, with no disk-format change or migration. Frozen fixtures generated by pre-migration commit 7c73e983b4 cover quorum records, full saved-state records and checkpoint state.

In-place changes to shipped generations

The existing generation methods receive mechanical secp256k1 API adaptations with unchanged digest construction, signature rules and canonical byte representations. Masternode processing, persistence and protocol-version tables now match the base branch; the historical/PV14 boundary comes from #5227/#5228. No additional consensus behavior change is intended by the local API adaptations.

choose_quorum/v0 (both selection helpers) and signature_verification_quorum_set/v0/quorums.rs keep their score bytes unchanged for all selecting protocol versions (1–14): the old From<Hash> for [u8; 32] and Hash::to_byte_array() both return the same inner array without reversal. Existing quorum-selection tests cover the adapted code.

QuorumForSavingV1 retains its exact 48 compressed key bytes without a length prefix for every protocol version that reads or writes it. The adapter uses the same validated DPP key parser and leaves the hash, index, quorum ordering and metadata unchanged. V1's C++-encoded previous quorums remain unchanged; V2 applies the adapter to both lists. Historical byte-for-byte fixture tests verify this storage-only refactor; it changes neither consensus outputs nor the disk format.

Merge order

This branch pins 8fe0a381 from unmerged rust-dashcore PR #1149 (fix/legacy-serde-bls-node-id) and depends on its compatibility fixes.

Land this migration together with the Node runtime requirements in #5310 and SPV lifecycle adaptation in #5311. #5150 remains stacked above this PR, but must retain or restore dashpay/rust-dashcore#1112 separately: current dev is the parent of that unmerged spent-claim restoration commit, and #5150 uses its additional API. #5307 itself does not require #1112.

How Has This Been Tested?

Validation on rust-dashcore PR #1149 (8fe0a381), Platform commit f475f72a11:

62 targeted tests passed: 8 frozen BLS tests, 4 historical transaction/hash/signature tests, 4 DashPay encryption tests, and 46 quorum/storage tests including historical saved states and checkpoints.
Native all-target/all-feature Clippy passed for dpp, platform-encryption, drive-abci, platform-wallet, platform-wallet-storage, dash-sdk, and wasm-dpp2 with --locked -- --no-deps -D warnings.
wasm-dpp2 library Clippy passed on wasm32-unknown-unknown with all features. The additional wasm32 test-harness check fails on use super::TS_TYPES in src/group/token_event.rs:149; that file is unchanged from the base. Native test-target linting passes. JavaScript/browser runtime tests were not rerun locally.
Formatting, whitespace and pin-consistency checks passed; unrelated lockfile packages are unchanged.
External DPP consumer regression on 069a5cab6a: an existing lockfile selected blst 0.3.12 before the constraint; cargo update -p dpp now selects 0.3.17. Fresh resolution also selects 0.3.17, and explicitly selecting 0.3.12 is rejected. WASM all-target Clippy passes with bls-signatures and state-transitions; DPP formatting passes. cargo-machete is unavailable locally; CI performs that check.
Proof-verifier regression: all nine unit tests and the full package lint pass in CI. Four new cases cover delayed quorum publication/address availability, persistent failure, affected-state proofs, and invalid signatures. The main Test Suite passes with 95 tests; both browser suites and package functional tests pass on c1c7b095c2.

Validation on e6873e95:

Native FFI CI repair: reproduced the missing-method compiler failure, then passed both new platform-wallet-ffi regression tests and all-target/all-feature Clippy for platform-wallet-ffi, rs-unified-sdk-jni and rs-unified-sdk-ffi.
drive-abci all-target/all-feature Clippy, formatting and whitespace checks passed after the quorum adapter change.
47 quorum/storage tests passed, including four new regression tests over five frozen historical fixtures, existing testnet/devnet saved states and the historical serialization fingerprint.
206 selected tests passed across platform-wallet, platform-wallet-storage and drive-abci: provider-key vectors, masternode tracking and service updates, SPV lifecycle and peer classification, quorum selection, coinbase credit-pool decoding, SQLite persistence and buffer semantics.
Clippy passed for platform-wallet, platform-wallet-storage, dash-sdk and drive-abci with --all-targets --all-features --locked --offline -- --no-deps -D warnings.
Locked Cargo test resolution, formatting, whitespace checks, and consistent pins across the eight direct dependencies and 13 lockfile packages passed.

CI on c1c7b095c2 passes Rust workspace tests, Kotlin, JS/WASM builds and tests, Docker builds, browser suites, Dashmate E2E and package functional tests (45 successful checks). Swift compiled the Rust library but failed when copying it: No space left on device on self-hosted mac-runner-pasta. Swift remains unverified on this head until runner disk space is restored and its job is rerun.

Outstanding review blockers

WASM Node runtime requirement: Node version declarations have been removed from this PR at the author's request. PR #5310 supplies the Node >=22 package requirements, documentation and matching Docker runtime; this dependency must be landed together with the migration.
Quorum storage is covered by frozen pre-migration records. These fixtures do not establish compatibility for every historical wallet transaction or masternode record layout.

Breaking Changes

Public Core/secp256k1 Rust types and methods change; Platform consumers are adapted here. The migrated WASM entropy backend requires global WebCrypto; the Node.js >=22 minimum and related package/documentation changes are handled in a separate PR. The FFI ABI is unchanged. Upstream restores legacy BLS public-key hex serialization and canonical PlatformNodeId bytes, and preserves the pre-v4 coinbase Serde shape. No database migration is included; compatibility with every historical record layout, or with records written by the intermediate raw-BLS/reversed-node-ID implementation, is not established by this pin. DPP's core_key_wallet_bip_38 and SDK's core_key_wallet_bip38 features are removed because upstream removed BIP38.

Checklist:

I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have added or updated relevant unit/integration/functional/e2e tests
I have added "!" to the title and described breaking changes in the corresponding section if my code contains any
I have made corresponding changes to the documentation if needed
If I added or changed GroveDB structure, I described it in the area's structure.rs, regenerated grovedb-structure.json, and checked the structure viewer link posted on this pull request

For repository code-owners and collaborators only

I have assigned this pull request to a milestone

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

PR Hygiene · `f475f72`

When every merge requirement is met, the PR Hygiene check passes. Reviewer limits do not block merging; other required GitHub checks and protections still apply.

Bump every rust-dashcore git dependency from e4208c90 to 719de34b (dashpay/rust-dashcore dev, the merge of #1049). The breaking change in range is rust-dashcore #1042: secp256k1 0.30 -> 0.33, rand 0.9, getrandom 0.4, and the secp256k1 context argument dropped API-wide. The range also carries key-wallet fixes #1035 (DIP-15 contact pools extend as payments arrive), #1009 (provider transactions consult every fund-bearing account), #1048, and test-only #920/#1038. Mechanical call-site migration: drop Secp256k1 contexts (derive_priv/from_priv/public_key/from_secret_key/Keypair::new take no context); secp.sign_ecdsa/recover_ecdsa/verify_ecdsa become methods on the key/signature; SecretKey::from_slice/from_byte_array become from_secret_bytes (slices go through <[u8; 32]>::try_from mapped to Error::InvalidSecretKey, the error from_slice returned); secret_bytes -> to_secret_bytes; SecretKey/SharedSecret lost AsRef<[u8]>, so use as_secret_bytes; thread_rng -> rng; StdRng::from_entropy -> from_os_rng. The secp256k1::hashes re-export is gone, so hex rendering uses the hex crate (same output). Seeded RNG bridging (rand 0.8 caller -> secp's rand 0.9 StdRng) now fills a 32-byte seed and calls from_seed, which is what rand_core 0.6 from_rng did, so seeded keys are unchanged; drive-abci tests that feed seed_from_u64 into Keypair::new use the secp re-exported StdRng (seed_from_u64 and ChaCha12 are identical across rand_core 0.6/0.9). rs-platform-encryption moves its own secp256k1 to 0.33.1 so only one secp256k1 is in the graph. simple-signer takes a direct rand 0.8 dep for the RngCore its callers pass. rs-dpp enables getrandom 0.3/0.4 wasm_js on wasm32-unknown-unknown, which the new transitive getrandom versions require there. Rust toolchain already at 1.98.1, matching rust-dashcore. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

infraclaw: install the reviewed publisher prerequisite only; no application or runner changes.

Conflicts resolved: - Cargo.toml: v5.0-dev's grovedb dce8252f, this branch's rust-dashcore 719de34b. - Cargo.lock: regenerated from v5.0-dev's lock; the only resolved change is secp256k1 0.30.0 -> 0.33.1 (sys 0.10.1 -> 0.14.1, bitcoin-io dropped), the same delta the bump produced before. - rs-platform-encryption tests: v5.0-dev's seeded StdRng, with secp 0.33's context-free generate_keypair. - rs-sdk put_document: v5.0-dev's restructured transition, with rand 0.9's from_os_rng / random. - runner-image-candidate.yml: v5.0-dev's version (controller 1be03edb); the feature-branch trigger is no longer needed now that this branch carries v5.0-dev's runner-image CI. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

secp256k1 0.33 draws randomness through rand 0.9 / getrandom 0.3, and key-wallet through getrandom 0.4. Their `wasm_js` backend reads only `globalThis.crypto.getRandomValues`; getrandom 0.2's `js` feature also fell back to Node's `require("crypto")`. Node.js exposes the WebCrypto global by default from v19, so on Node 18 even a deterministic call such as deriving a public key (secp256k1 rerandomizes its context afterwards) traps. Node 18 has been end-of-life since April 2025. Raise `engines.node` of wasm-sdk, wasm-dpp2 and js-evo-sdk to >=20, matching dashmate, and say why in the evo-sdk README and next to the getrandom features in rs-dpp. BREAKING CHANGE: @dashevo/wasm-sdk, @dashevo/wasm-dpp2 and @dashevo/evo-sdk require Node.js >= 20. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

…o secp256k1 0.33 Code that landed on v5.0-dev after this bump was first written (encrypted_for in rs-sdk and wasm-sdk, moderation charter requests) still used the secp256k1 0.30 / rand 0.8 API. Migrate it the same way as the rest of the bump: drop the `Secp256k1` context from `PublicKey::from_secret_key`, `SecretKey::from_slice` -> `from_secret_bytes`, `StdRng::from_entropy` -> `from_os_rng`, and `Bytes32::random_with_rng` -> `Bytes32::new(rng.random())` since platform-value's helper takes a rand 0.8 `StdRng`. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Merge PR #4932 into v5.1-dev and carry the compatibility adaptations for rust-dashcore PR #1112 at 870af146. Preserve the existing cryptography implementations, legacy RPC projection, and FFI ABI. Keep SQLite replay and accounting repairs, SwiftData accounting changes, and wallet accounting changes in the dependent PR #5150. 🤖 Co-authored by [Claudius the Magnificent](https://github.com/lklimek/claudius) AI Agent

coderabbitai · 2026-10-06T12:13:12Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: dashpay/platform/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: e3746eb5-a000-45c1-83ea-fd496b379123

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

thepastaclaw · 2026-10-06T12:19:46Z

⛔ Final review complete — 1 blocking finding(s) (commit f475f72) · triage: critical

thepastaclaw

Final validation — Phase 1 + Phase 2

Verified the supplied findings against head ad2b8c2, including the exact pinned upstream SPV implementation. Two migration regressions remain: successful SPV startup discards the runtime's client, and legacy WASM-DPP inherits an undeclared WebCrypto runtime requirement; the overlapping historical-storage test suggestions are consolidated below. Verification was static only: the supplied CI snapshot shows Kotlin build/tests passing, principal Rust and JS suites skipped, and PR Hygiene pending.

🔴 2 blocking | 🟡 1 suggestion(s)

Review provenance

Source: reviewer 1: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 2: gpt-6.1-sol (agent: phase2-reviewer, role: architecture-layering); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: ffi-engineer); reviewer 4: gpt-6.1-sol (agent: phase2-reviewer, role: platform-versioning); reviewer 5: gpt-6.1-sol (agent: phase2-reviewer, role: rust-quality); reviewer 6: gpt-6.1-sol (agent: phase2-reviewer, role: security-auditor); reviewer 7: muse-spark-1.3-contributor (agent: phase1-reviewer, role: general); reviewer 8: muse-spark-1.3-contributor (agent: phase1-reviewer, role: rust-quality); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

Triage: critical by gpt-6.1-sol (effort low) — The large cross-cutting diff directly adapts signature and key-handling implementations in packages/rs-dpp/src/identity/identity_public_key/key_type.rs and packages/rs-platform-wallet/src/wallet/provider_key_at_index.rs, alongside historical masternode processing and serialization, rather than merely bumping dependencies.
Phase 1 reviewers: muse-spark-1.3-contributor — general (completed, effort xhigh); agent phase1-reviewer, muse-spark-1.3-contributor — rust-quality (completed, effort xhigh); agent phase1-reviewer
Phase 1 model: muse-spark-1.3-contributor — not quota-gated; passed over gemini-3.8-flash-high (antigravity below 15% reserve: weekly 15% left, 5h 100% left), glm-5.3-flash (not used above high effort; tier asks max)
Single stage: Phase 1 and Phase 2 reviewed this head side by side, with no blocker gate between them (triage tier)
Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
Phase 2 reviewers: gpt-6.1-sol — general (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — architecture-layering (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — ffi-engineer (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — platform-versioning (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — security-auditor (completed, effort xhigh); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `Cargo.toml`:
- [BLOCKING] Cargo.toml:70: Adapt SpvRuntime to the newly non-blocking SPV run method
  The pinned revision changes DashSpvClient::run() from waiting for shutdown to spawning an internal sync task and returning after startup succeeds. packages/rs-platform-wallet/src/spv/runtime.rs:374–381 still treats that return as shutdown: it removes self.client and clears the peer tracker. Successful startup therefore makes broadcasts fail with "client not started", progress queries return None, and quorum lookups lose access to the running client. SpvRuntime::stop() subsequently finds no client and joins only the completed startup wrapper, so it reports success without stopping the upstream task. That task retains a client clone, storage and event handlers, allowing sync and callbacks to continue after the runtime reports shutdown. Retain the client after successful startup and adapt shutdown tracking to the new upstream task ownership, including the bounded-stop behavior. Add regression coverage for successful startup followed by client queries and explicit stop.

In `packages/rs-dpp/Cargo.toml`:
- [BLOCKING] packages/rs-dpp/Cargo.toml:101-103: Propagate the new Node runtime requirement to legacy WASM-DPP
  The new entropy requirement also reaches @dashevo/wasm-dpp through its DPP dependency. Its ECDSA signByPrivateKey path calls the pinned Core signer, whose secp256k1 0.33 implementation rerandomizes the signing context using rand 0.9 and getrandom 0.3. That backend calls globalThis.crypto.getRandomValues without getrandom 0.2's CommonJS crypto fallback, so ordinary Node 18 scripts without a WebCrypto shim now fail when signing. packages/wasm-dpp/package.json declares no Node minimum, its production loader in lib/index.ts installs no shim, and the legacy dash SDK still documents support for any Node version. The test bootstrap explicitly installs crypto.webcrypto, masking this production failure. Apply the declared Node >=20 migration to the legacy package and update its consumers' advertised requirement, or initialize WebCrypto in the production Node loader to preserve previous support. Cover the production loader without relying on the test bootstrap's shim.

In `packages/rs-drive-abci/src/execution/platform_events/core_based_updates/update_masternode_list/update_state_masternode_list/v0/mod.rs`:
- [SUGGESTION] packages/rs-drive-abci/src/execution/platform_events/core_based_updates/update_masternode_list/update_state_masternode_list/v0/mod.rs:546-550: Pin pre-migration bytes in the historical storage compatibility test
  Both expected_bytes here and the actual bytes at lines 570–574 are generated with the migrated MasternodeV0 codec and current dependencies. This verifies that extended RPC records project to the same representation as legacy-shaped inputs, but it does not establish compatibility with previously persisted bytes: a shared encoding change would affect both sides and still pass. Preserving the shipped persisted layout is an explicit goal of this migration. Add a fixed fixture produced at base revision 723b09e63610057377ef4efc808476fae43e88ef, deserialize it through deserialize_masternode_entry, and reproduce it byte-for-byte through serialize_masternode_entry for a frozen historical protocol and PlatformVersion::latest(). Those helpers also exercise the versioned Masternode enum used by persistence, which this direct MasternodeV0 encoding test bypasses. No actual persisted-encoding incompatibility was established by this review.

Keep the Core v24 masternode handling and persistence from #5227/#5228, replacing the migration's superseded strict legacy conversions. Retain rust-dashcore #1112, the WASM blst patch, and existing rand versions. Validated formatting, scoped all-target/all-feature Clippy, 90 Core-update tests, 3 masternode persistence tests and the DPP BLS protocol-boundary test. Co-Authored-By: Codex <noreply@openai.com> 🤖 Co-authored by [Claudius the Magnificent](https://github.com/lklimek/claudius) AI Agent

Declare the minimum Node version in wasm-dpp and dash and align their README requirements with the existing WASM SDK packages. Validated the production WASM-DPP loader and ECDSA signing on Node 20.20.2 without the test bootstrap's WebCrypto shim. Co-Authored-By: Codex <noreply@openai.com> 🤖 Co-authored by [Claudius the Magnificent](https://github.com/lklimek/claudius) AI Agent

Restore package metadata and documentation from v5.1-dev so the Node minimum can be raised directly to 22 in a separately reviewable PR. The WASM entropy backend remains part of the rust-dashcore migration. Co-Authored-By: Codex <noreply@openai.com> 🤖 Co-authored by [Claudius the Magnificent](https://github.com/lklimek/claudius) AI Agent

Use 314f1060 across all workspace dependencies and lockfile sources. This merged dev revision excludes the separate unmerged spent-claim restoration API needed by PR #5150. Co-Authored-By: Codex <noreply@openai.com> 🤖 Co-authored by [Claudius the Magnificent](https://github.com/lklimek/claudius) AI Agent

github-actions · 2026-10-06T15:08:31Z

Waiting for bot review — coderabbitai not yet · thepastaclaw requested changes — dismiss the review or push a fix, 2 threads unresolved — resolve them. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

lklimek

/self-reviewed

thepastaclaw

Re-review — Final validation — Phase 1 + Phase 2

At d9149f1, two integration blockers remain: the dependency update changes SPV lifecycle ownership and introduces a WebCrypto requirement without the corresponding runtime adaptations. The historical-storage suggestion is outdated because its targeted projection test was removed and the retained persistence code matches the updated base. Validation was static only; the supplied CI snapshot still had Rust workspace, JS, Docker, and Swift schema checks queued, with dedicated wallet tests skipped.

🔴 2 blocking

1 finding(s) not shown inline (the lines are not part of this PR's diff)

🔴 Blocking: Adapt SpvRuntime to the newly non-blocking SPV run method
packages/rs-platform-wallet/src/spv/runtime.rs:379-381

At the pinned 314f1060 revision, DashSpvClient::run_locked starts an internally owned task, stores its handle and cancellation token in sync_loop, and returns Ok after startup. This unconditional cleanup therefore removes a successfully running client and clears its peer tracker. Broadcasts and quorum queries subsequently reject the missing client, progress queries return None, and stop() can report success after joining only the completed startup wrapper while upstream synchronization and event monitors remain active.

Shutdown also needs an ownership adaptation, not just client retention. The pinned upstream stop() takes SyncLoop out of its shared Option before awaiting the task, coordinator, network, and storage teardown. The direct timeout around c.stop() at runtime.rs:417 drops that future on expiry, abandoning the remaining teardown; retrying cannot recover it through the runtime's startup-wrapper handle. Retain the client after successful startup and own teardown in a tracked task that survives timeout and caller cancellation, with retries joining the same work and restart blocked until completion. The separately described #5311 fix is absent from this exact head and must land before or together with the migration.

_{source: muse-spark-1.3-contributor (phase1-reviewer: general, rust-quality); gpt-6.1-sol (phase2-reviewer: general)}

1 carried-forward finding(s) already raised on this PR; not re-posting as new inline comments.

Review provenance

Source: reviewer 1: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 2: gpt-6.1-sol (agent: phase2-reviewer, role: architecture-layering); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: ffi-engineer); reviewer 4: gpt-6.1-sol (agent: phase2-reviewer, role: platform-versioning); reviewer 5: gpt-6.1-sol (agent: phase2-reviewer, role: rust-quality); reviewer 6: gpt-6.1-sol (agent: phase2-reviewer, role: security-auditor); reviewer 7: muse-spark-1.3-contributor (agent: phase1-reviewer, role: general); reviewer 8: muse-spark-1.3-contributor (agent: phase1-reviewer, role: rust-quality); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

Triage: critical by gpt-6.1-sol (effort low) — This large cross-cutting migration directly changes cryptographic key generation in packages/rs-dpp/src/identity/identity_public_key/key_type.rs and BLS key validation, private-key serialization, and canonical node-ID derivation in packages/rs-platform-wallet/src/wallet/provider_key_at_index.rs, beyond merely bumping dependencies.
Phase 1 reviewers: muse-spark-1.3-contributor — general (completed, effort xhigh); agent phase1-reviewer, muse-spark-1.3-contributor — rust-quality (completed, effort xhigh); agent phase1-reviewer
Phase 1 model: muse-spark-1.3-contributor — not quota-gated; passed over gemini-3.8-flash-high (antigravity below 15% reserve: weekly 15% left, 5h 100% left), glm-5.3-flash (not used above high effort; tier asks max)
Single stage: Phase 1 and Phase 2 reviewed this head side by side, with no blocker gate between them (triage tier)
Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
Phase 2 reviewers: gpt-6.1-sol — general (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — architecture-layering (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — ffi-engineer (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — platform-versioning (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — security-auditor (completed, effort xhigh); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `packages/rs-platform-wallet/src/spv/runtime.rs`:
- [BLOCKING] packages/rs-platform-wallet/src/spv/runtime.rs:379-381: Adapt SpvRuntime to the newly non-blocking SPV run method
  At the pinned 314f1060 revision, DashSpvClient::run_locked starts an internally owned task, stores its handle and cancellation token in sync_loop, and returns Ok after startup. This unconditional cleanup therefore removes a successfully running client and clears its peer tracker. Broadcasts and quorum queries subsequently reject the missing client, progress queries return None, and stop() can report success after joining only the completed startup wrapper while upstream synchronization and event monitors remain active.

  Shutdown also needs an ownership adaptation, not just client retention. The pinned upstream stop() takes SyncLoop out of its shared Option before awaiting the task, coordinator, network, and storage teardown. The direct timeout around c.stop() at runtime.rs:417 drops that future on expiry, abandoning the remaining teardown; retrying cannot recover it through the runtime's startup-wrapper handle. Retain the client after successful startup and own teardown in a tracked task that survives timeout and caller cancellation, with retries joining the same work and restart blocked until completion. The separately described #5311 fix is absent from this exact head and must land before or together with the migration.

In `packages/rs-dpp/Cargo.toml`:
- [BLOCKING] packages/rs-dpp/Cargo.toml:102-103: Propagate the new Node runtime requirement to legacy WASM-DPP
  (existing thread: https://github.com/dashpay/platform/pull/5307#discussion_r4195848422)
  Legacy WASM-DPP's ECDSA signByPrivateKey path reaches DPP's signer::sign and the pinned Core recoverable signer. DPP enables secp256k1's rand feature, and secp256k1 0.33.1 rerandomizes its signing context through rand::random(). The getrandom 0.3 wasm_js backend enabled here calls globalThis.crypto.getRandomValues without the previous CommonJS crypto fallback. Node 18 scripts without global WebCrypto therefore fail during signing.

  This head still declares no Node minimum in packages/wasm-dpp/package.json, installs no WebCrypto shim in its production loader, and advertises unrestricted Node support for the legacy SDK. Its test bootstrap explicitly supplies crypto.webcrypto, masking that production condition. The reported Node 22 smoke test validates the proposed supported environment but does not update the compatibility contract shipped here. Land #5310's package requirements, consumer documentation, and runtime alignment before or together with this migration, or preserve older environments through a production-loader shim. Keep production-loader coverage independent of the test bootstrap.

lklimek · 2026-10-06T15:45:24Z

Both @thepastaclaw blockers addressed in separate PRs #5310 and #5311

Pin all eight workspace dependencies and Cargo.lock to 40e7b24c from dashpay/rust-dashcore#1145. Adapt public Ed25519 and masternode snapshot APIs, raw hash extraction, and coinbase test fixtures to its newer base. Quorum scores retain identical raw digest bytes at every protocol version; the removed Into conversion and to_byte_array both return the inner array. PlatformNodeId storage migration remains outside this change. Validation: 151 targeted tests; scoped Clippy for wallet, storage, SDK and Drive ABCI; formatting, locked metadata and consistent dependency pins. BREAKING CHANGE: Remove core_key_wallet_bip_38 and core_key_wallet_bip38 feature forwards because upstream key-wallet removed BIP38 support. 🤖 Co-authored by [Claudius the Magnificent](https://github.com/lklimek/claudius) AI Agent Co-Authored-By: Codex GPT-6 <noreply@openai.com>

github-actions · 2026-10-08T13:25:41Z

Waiting for bot review — coderabbitai not yet · thepastaclaw requested changes — dismiss the review or push a fix, 1 thread unresolved — resolve it. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

thepastaclaw

Re-review — Final validation — Phase 1 + Phase 2

Static verification at 9af2033 confirms one blocking native FFI compilation defect and one remaining SQLite codec-compatibility suggestion. The prior SPV lifecycle, external BLS dependency, and Node runtime findings are addressed; the removed historical projection test makes its specific finding outdated. No local builds or tests were run: exact-head Android CI confirms the compilation failure, the supplied snapshot shows the principal Rust/JS/Swift checks skipped after package detection failed, and PR Hygiene remained pending.

🔴 1 blocking | 🟡 1 suggestion(s)

1 carried-forward finding(s) already raised on this PR; not re-posting as new inline comments.

Review provenance

Source: reviewer 1: muse-spark-1.3-contributor (agent: phase1-reviewer, role: general); reviewer 2: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: architecture-layering); reviewer 4: gpt-6.1-sol (agent: phase2-reviewer, role: ffi-engineer); reviewer 5: gpt-6.1-sol (agent: phase2-reviewer, role: platform-versioning); reviewer 6: gpt-6.1-sol (agent: phase2-reviewer, role: rust-quality); reviewer 7: muse-spark-1.3-contributor (agent: phase1-reviewer, role: rust-quality); reviewer 8: gpt-6.1-sol (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

Triage: critical by gpt-6.1-sol (effort low) — The large, cross-cutting diff directly changes cryptographic implementations and key serialization in packages/rs-dpp/src/bls/bls_signatures.rs and packages/rs-dpp/src/bls/serde.rs, alongside signature and key-handling adaptations across the SDK and consensus execution paths.
Phase 1 reviewers: muse-spark-1.3-contributor — general (completed, effort xhigh); agent phase1-reviewer, muse-spark-1.3-contributor — rust-quality (completed, effort xhigh); agent phase1-reviewer
Phase 1 model: muse-spark-1.3-contributor — not quota-gated; passed over gemini-3.8-flash-high (antigravity below 15% reserve: weekly 15% left, 5h 100% left), glm-5.3-flash (not used above high effort; tier asks max)
Single stage: Phase 1 and Phase 2 reviewed this head side by side, with no blocker gate between them (triage tier)
Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
Phase 2 reviewers: gpt-6.1-sol — general (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — architecture-layering (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — ffi-engineer (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — platform-versioning (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — security-auditor (completed, effort xhigh); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `packages/rs-platform-wallet-ffi/src/provider_key_at_index.rs`:
- [BLOCKING] packages/rs-platform-wallet-ffi/src/provider_key_at_index.rs:389: Convert the FFI node ID through EddsaPkHash
  This helper does not compile against the pinned dependency. EddsaPkBytes supplies hash() through dash-types' Hashable trait, which is not imported here; the exact-head Android job 113334723053 in run 37784185743 reports E0599 at this statement. Importing that trait alone would still return the backend hash type rather than dashcore's wrapper that supplies to_canonical_bytes(). The public EddsaPkHash::from(EddsaPkBytes) conversion performs the required wrapping, as the adapted wallet accessors and masternode locator already demonstrate. This module and platform-wallet-ffi are unconditional dependencies of both unified native bridge crates, so the failure prevents their libraries from being produced. Use the wrapper conversion to restore compilation and preserve the canonical 20-byte Tenderdash node ID.

In `Cargo.toml`:
- [SUGGESTION] Cargo.toml:68-71: Represent the Core transaction codec change in the SQLite schema
  (existing thread: https://github.com/dashpay/platform/pull/5307#discussion_r4218839067)
  The dependency update changes persisted transaction representations while SQLite retains the same schema identity. At base pin 40268cc0, CoinbasePayload has seven derived-Serde fields; pin 40e7b24c appends merkle_root_asset_unlocks. The new version-conditional native bincode implementation does not protect sqlite/schema/blob.rs, which uses bincode::serde. In an old coinbase TransactionRecord, the new deserializer consequently consumes the following txid's byte-length prefix as the added Option discriminator and fails; core_state.rs:944 propagates that failure out of wallet-state loading. The node-ID adaptation also changes binary Serde from canonical PlatformNodeId bytes to EddsaPkHash's reversed internal bytes, allowing old provider-transaction records to decode with reversed canonical IDs. Neither the blob codec nor migrations through V018 distinguish these generations. The documented accounting/history deferral explains why no migration was added, but these failures are introduced by the dependency pin and can be addressed without that broader redesign. Preserve the legacy persistence representation or establish an explicit schema-selected compatibility boundary, and cover it with frozen pre-upgrade transaction-record blobs.

Out-of-scope follow-up suggestions (1)

These are valid observations, but they are outside this PR's scope and should be handled in separate issues or author/maintainer-requested PRs rather than blocking this review.

Centralize the constructor-started persistence worker lifetime in dash-spv — Outside the required Platform adaptation: SpvRuntime explicitly stops the constructor worker before fallible client construction, and the pinned upstream starts persistence only after successful synchronization and network startup. Changing the ownership contract for other direct upstream consumers would expand this review beyond the Platform paths being migrated.
- Follow-up: Consider creating a separate issue or author/maintainer-requested PR for this.

Pin all rust-dashcore crates to e6873e95 from fix/legacy-serde-bls-node-id. Adapt PlatformNodeId accessors while preserving canonical wallet bytes. Validation: 206 targeted tests, scoped all-feature Clippy, and rustfmt pass. 🤖 Co-authored by [Claudius the Magnificent](https://github.com/lklimek/claudius) AI Agent Co-Authored-By: Codex GPT-6 <noreply@openai.com>

github-actions · 2026-10-09T07:47:30Z

Waiting for bot review — coderabbitai not yet · thepastaclaw 1 thread unresolved — resolve it. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

Encode quorum keys as exactly 48 compressed bytes through a storage adapter, validating points on decode. Keep current and previous quorum layouts unchanged. Add frozen quorum, saved-state and checkpoint records generated by the pre-migration writer at 7c73e98. Assert keys, metadata, full consumption and byte-identical re-encoding, including infinity and malformed key coverage. No disk-format change or migration is introduced. Validation: 47 targeted tests, all-target/all-feature drive-abci Clippy and fmt. 🤖 Co-authored by [Claudius the Magnificent](https://github.com/lklimek/claudius) AI Agent Co-Authored-By: Codex GPT-6 <noreply@openai.com>

github-actions · 2026-10-09T08:28:23Z

Waiting for bot review — coderabbitai not yet · thepastaclaw 1 thread unresolved — resolve it. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

Convert raw Ed25519 public keys through EddsaPkHash while preserving the canonical SHA-256 prefix returned by the C ABI. Cover fixed output bytes, output bounds, and rejected inputs, and correct the helper documentation. 🤖 Co-authored by [Claudius the Magnificent](https://github.com/lklimek/claudius) AI Agent Co-Authored-By: Codex GPT-6 <noreply@openai.com>

github-actions · 2026-10-09T08:36:56Z

Waiting for bot review — coderabbitai not yet · thepastaclaw requested changes — dismiss the review or push a fix, 2 threads unresolved — resolve them. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

thepastaclaw

Re-review — Final validation — Phase 1 + Phase 2

Verified the supplied findings and all ten prior identities against head d8b911d. The FFI conversion, SPV lifecycle, Node requirements, and specific legacy serialization regressions are addressed, but external WASM consumers can still retain an incompatible blst release because the shared backend does not declare its required minimum. This was static validation only: the supplied exact-head CI snapshot reports successful Rust and mobile checks, a failed platform Test Suite, and pending browser shard 1 and PR Hygiene; the integration failure is not independently attributed to this PR.

🔴 1 blocking

Review provenance

Source: reviewer 1: gemini-3.8-flash-high (agent: phase1-reviewer, role: general); reviewer 2: gemini-3.8-flash-high (agent: phase1-reviewer, role: rust-quality); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 4: gpt-6.1-sol (agent: phase2-reviewer, role: architecture-layering); reviewer 5: gpt-6.1-sol (agent: phase2-reviewer, role: ffi-engineer); reviewer 6: gpt-6.1-sol (agent: phase2-reviewer, role: platform-versioning); reviewer 7: gpt-6.1-sol (agent: phase2-reviewer, role: rust-quality); reviewer 8: gpt-6.1-sol (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

Triage: critical by gpt-6.1-sol (effort low) — The large, cross-cutting diff directly changes cryptographic and key-handling implementations in packages/rs-dpp/src/bls/bls_signatures.rs, packages/rs-dpp/src/bls/serde.rs and packages/rs-platform-wallet/src/wallet/provider_key_at_index.rs, beyond merely updating dependencies.
Phase 1 reviewers: gemini-3.8-flash-high — general (completed, effort high); agent phase1-reviewer, gemini-3.8-flash-high — rust-quality (completed, effort high); agent phase1-reviewer
Phase 1 model: gemini-3.8-flash-high — antigravity quota: weekly 46% left, 5h 49% left
Single stage: Phase 1 and Phase 2 reviewed this head side by side, with no blocker gate between them (triage tier)
Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
Phase 2 reviewers: gpt-6.1-sol — general (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — architecture-layering (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — ffi-engineer (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — platform-versioning (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — security-auditor (completed, effort xhigh); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `packages/rs-dpp/Cargo.toml`:
- [BLOCKING] packages/rs-dpp/Cargo.toml:15: Make the WASM BLS compatibility fix reach external Cargo consumers
  Removing blsful/blstrs_plus and the workspace patch fixes fresh dependency resolution, but does not exclude the incompatible registry release from existing consumer lockfiles. At the pinned base-sdk revision e6402ced, pkgs/pkc/Cargo.toml declares blst = "0.3", and scheme_ietf.rs unconditionally calls fast_aggregate_verify and aggregate_verify. Registry blst 0.3.12 satisfies that requirement and appears in Platform's base lockfile, but its src/lib.rs gates both methods behind std; its build.rs deliberately does not enable std for wasm32-unknown-unknown. An external dash-sdk or drive-proof-verifier consumer upgrading with that registry version already locked can therefore retain it and fail to compile the new backend. Platform's selection of 0.3.17 and the reported fresh-lockfile validation do not cover this upgrade path. Raise the minimum on dash-pkc's owning blst dependency to at least 0.3.13, whose bindings provide the no_std implementations, then update DPP and rust-dashcore to matching backend pins. Validate an external consumer retaining the old registry lock as well as fresh resolution.

…proofs The quorum sidecar publishes keys every 60 seconds. CI twice received a proof signed by the next quorum before its key appeared, then exhausted SDK addresses through the initial 60-second node bans. Retry only a missing-cache-key proof read once after 65 seconds. Keep signature verification, node banning, and transition broadcasting unchanged. Cover delayed publication, expiry of address bans, permanent misses, affected-state proofs, and invalid signatures with fake-timer tests. Validation: 4 regression tests failed before the fix; all 9 verifier tests pass after it. ESLint passes with the unbuilt local evo-sdk import excluded; two pre-existing unused catch-variable warnings remain. 🤖 Co-authored by [Claudius the Magnificent](https://github.com/lklimek/claudius) AI Agent Co-Authored-By: Codex GPT-6 <noreply@openai.com>

github-actions · 2026-10-09T09:56:59Z

Waiting for bot review — coderabbitai not yet · thepastaclaw requested changes — dismiss the review or push a fix, 1 thread unresolved — resolve it. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

thepastaclaw

Re-review — Final validation — Phase 1 + Phase 2

Verified the combined reviewer findings and all 11 prior identities against c1c7b09. One external-consumer WASM build blocker remains, along with a non-blocking SQLite format-versioning concern; the other prior findings are fixed or outdated. This was a static review: the supplied CI snapshot shows successful Rust, Kotlin and WASM/JS checks, pending Test Suite and PR Hygiene checks, and Swift and functional failures whose inspected logs show disk exhaustion and a BusyBox pull HTTP 502, respectively.

🔴 1 blocking | 🟡 1 suggestion(s)

2 carried-forward finding(s) already raised on this PR; not re-posting as new inline comments.

Review provenance

Source: reviewer 1: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 2: gemini-3.8-flash-high (agent: phase1-reviewer, role: general); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: architecture-layering); reviewer 4: gemini-3.8-flash-high (agent: phase1-reviewer, role: rust-quality); reviewer 5: gpt-6.1-sol (agent: phase2-reviewer, role: ffi-engineer); reviewer 6: gpt-6.1-sol (agent: phase2-reviewer, role: platform-versioning); reviewer 7: gpt-6.1-sol (agent: phase2-reviewer, role: rust-quality); reviewer 8: gpt-6.1-sol (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

Triage: critical by gpt-6.1-sol (effort low) — The large cross-cutting diff directly changes cryptographic signature and key handling in packages/rs-dpp/src/bls/bls_signatures.rs and packages/rs-dpp/src/signing.rs, as well as persisted quorum-key serialization in packages/rs-drive-abci/src/platform_types/signature_verification_quorum_set/v0/for_saving_v0.rs.
Phase 1 reviewers: gemini-3.8-flash-high — general (completed, effort high); agent phase1-reviewer, gemini-3.8-flash-high — rust-quality (completed, effort high); agent phase1-reviewer
Phase 1 model: gemini-3.8-flash-high — antigravity quota: weekly 43% left, 5h 28% left
Single stage: Phase 1 and Phase 2 reviewed this head side by side, with no blocker gate between them (triage tier)
Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
Phase 2 reviewers: gpt-6.1-sol — general (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — architecture-layering (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — ffi-engineer (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — platform-versioning (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — security-auditor (completed, effort xhigh); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `packages/rs-dpp/Cargo.toml`:
- [BLOCKING] packages/rs-dpp/Cargo.toml:15: Make the WASM BLS compatibility fix reach external Cargo consumers
  (existing thread: https://github.com/dashpay/platform/pull/5307#discussion_r4228708918)
  The shared backend fixes fresh external dependency resolution, but it still permits an incompatible release when an upgrading consumer retains registry blst 0.3.12 in its lockfile. At the pinned base-sdk revision e6402ced, dash-pkc declares blst = "0.3" and calls fast_aggregate_verify and aggregate_verify unconditionally in scheme_ietf.rs. Registry blst 0.3.12 exposes both methods only under its std configuration, while its build script excludes that configuration for wasm32-unknown-unknown. Its version satisfies the new dependency graph, so Cargo is not required to replace it; Platform's own lockfile selecting 0.3.17 does not protect external workspaces. Encode the compatible minimum in the ordinary dependency chain, preferably by updating the shared dash-pkc revision to declare blst = "0.3.13" or newer and aligning the upstream pins. Add external-consumer coverage starting with a registry 0.3.12 lockfile, not only a freshly generated lockfile.

In `Cargo.toml`:
- [SUGGESTION] Cargo.toml:68-71: Represent the Core transaction codec change in the SQLite schema
  (existing thread: https://github.com/dashpay/platform/pull/5307#discussion_r4218839067)
  The pinned codec preserves historical pre-v4 coinbase blobs, but introduces a separate forward-format boundary: CoinbasePayload writes eight Serde fields for payload version 4, whereas the base dependency's derived codec writes seven. Transaction and TransactionRecord use derived Serde, and core_state.rs persists the enclosing record directly through bincode::serde into core_transactions.record_blob. blob.rs explicitly assigns format evolution to the refinery migration version, yet this range leaves the migrations and supported-version guard unchanged. A database containing a newly written v4 coinbase record therefore passes an older binary's schema gate even though its seven-field decoder consumes the remaining bytes as subsequent record fields or fails loading. Advance the database compatibility marker for this encoding, or introduce a storage-owned transaction format boundary, with historical-read and forward-version-refusal coverage. This concerns transaction codec versioning, not the accounting migrations or history repairs reserved for #5150.

thepastaclaw

Re-review after discussion — commit `c1c7b09`

Standing review was CHANGES_REQUESTED; this re-review is COMMENT: no blocking findings remain.

Not approved: the verifier record an approval after discussion rests on is not available for the standing review of this commit.

Same commit as the standing review; the inline threads above carry the per-finding outcome. This follow-up exists only to correct the verdict.

Review provenance

Source: conversation lane gpt-6.1-sol (agent: conversation); no reviewer or verifier lanes ran for this follow-up

Verdict moved because the inline discussion withdrew or deferred findings of the standing review of this commit; the code was not re-reviewed

Enforce blst >=0.3.17,<0.4 through the BLS feature so existing consumer lockfiles cannot retain incompatible 0.3.12. Remove the temporary constraint once the pinned rust-dashcore graph supplies the minimum. Verified fresh and existing-lock external DPP resolution, rejection of 0.3.12, and WASM clippy with state-transitions and bls-signatures. Co-Authored-By: Codex GPT-6 <noreply@openai.com>

github-actions · 2026-10-09T11:21:37Z

Waiting for bot review — coderabbitai not yet · thepastaclaw requested changes — dismiss the review or push a fix. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

thepastaclaw

Re-review — Final validation — Phase 1 + Phase 2

Verification at 069a5ca confirms the SPV lifecycle, canonical FFI node-ID conversion, Node runtime declarations, and removal of the earlier workspace-patch dependency problem. One blocker remains: Core-only DPP feature paths bypass the new compatible blst minimum; newly persisted v4 coinbase records also introduce a separate SQLite format boundary that merits a schema gate. This was static verification only: the supplied CI snapshot still had Rust workspace tests, the main Test Suite, browser shard 1, and PR Hygiene pending, and did not establish completed Swift integration validation.

🔴 1 blocking | 🟡 1 suggestion(s)

1 carried-forward finding(s) already raised on this PR; not re-posting as new inline comments.

Review provenance

Source: reviewer 1: gemini-3.8-flash-high (agent: phase1-reviewer, role: general); reviewer 2: gemini-3.8-flash-high (agent: phase1-reviewer, role: rust-quality); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 4: gpt-6.1-sol (agent: phase2-reviewer, role: architecture-layering); reviewer 5: gpt-6.1-sol (agent: phase2-reviewer, role: ffi-engineer); reviewer 6: gpt-6.1-sol (agent: phase2-reviewer, role: platform-versioning); reviewer 7: gpt-6.1-sol (agent: phase2-reviewer, role: rust-quality); reviewer 8: gpt-6.1-sol (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

Triage: critical by gpt-6.1-sol (effort low) — The large, cross-cutting diff directly changes cryptographic signing and BLS handling in packages/rs-dpp/src/bls/bls_signatures.rs and packages/rs-dpp/src/signing.rs, plus persisted quorum-key serialization in packages/rs-drive-abci/src/platform_types/signature_verification_quorum_set/v0/for_saving_v0.rs.
Phase 1 reviewers: gemini-3.8-flash-high — general (completed, effort high); agent phase1-reviewer, gemini-3.8-flash-high — rust-quality (completed, effort high); agent phase1-reviewer
Phase 1 model: gemini-3.8-flash-high — antigravity quota: weekly 40% left, 5h 100% left
Single stage: Phase 1 and Phase 2 reviewed this head side by side, with no blocker gate between them (triage tier)
Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
Phase 2 reviewers: gpt-6.1-sol — general (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — architecture-layering (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — ffi-engineer (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — platform-versioning (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — security-auditor (completed, effort xhigh); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `Cargo.toml`:
- [SUGGESTION] Cargo.toml:68-71: Stamp the new v4 coinbase blob format in the SQLite schema
  This pin preserves historical BLS and pre-v4 coinbase encodings, but introduces a distinct forward-write format boundary: CoinbasePayload now serializes an eighth field, merkle_root_asset_unlocks, for version >= 4. The base dependency at 40268cc0402a8933ec539f16b2d634c4e25876ad derives a seven-field decoder. TransactionRecord embeds the transaction directly, and sqlite/schema/core_state.rs writes the entire record through blob::encode into core_transactions.record_blob. The migration set remains at V018 even though blob.rs explicitly delegates blob-format evolution to the refinery schema version. An older binary therefore passes the schema gate for a database containing these new records, then interprets the added payload field as the following record fields, causing misdecoding or a typed-load error rather than a newer-format rejection. Add a storage migration that stamps this expanded blob format, or a storage-owned compatible codec, and cover a frozen v4 TransactionRecord plus older-reader open/restore rejection. This is separate from the withdrawn historical backward-read allegation and requires neither a PlatformVersion bump nor an accounting migration.

In `packages/rs-dpp/Cargo.toml`:
- [BLOCKING] packages/rs-dpp/Cargo.toml:16-18: Make the WASM BLS compatibility fix reach external Cargo consumers
  (existing thread: https://github.com/dashpay/platform/pull/5307#discussion_r4228708918)
  The direct blst requirement fixes the bls-signatures path, including SDK and proof-verifier consumers, but does not cover every DPP route into the migrated backend. With default-features = false, core_verification and core_quorum_validation enable dashcore/message_verification and dashcore/quorum_validation without activating dep:blst. At the exact rust-dashcore pin, both features enable dashcore-crypto/bls → dash-pkc/bls. The pinned dash-pkc still requires blst = "0.3" and unconditionally calls fast_aggregate_verify and aggregate_verify in scheme_ietf.rs. An external consumer can therefore retain registry blst 0.3.12, whose methods are gated behind std while its build script excludes std on wasm32-unknown-unknown, and fail to compile. The reported existing-lockfile validation covers bls-signatures, not these Core-only routes. Raise the compatible minimum in the owning dash-pkc dependency and propagate aligned pins, or activate the interim DPP constraint on every feature route that enables upstream BLS. Extend the existing-lockfile regression to a Core-only external DPP consumer.

thepastaclaw · 2026-10-09T12:11:54Z

+dashcore = { git = "https://github.com/dashpay/rust-dashcore", rev = "e6873e95ff3386ce7a0a03df9b2baca59e960700" }
+dash-network-seeds = { git = "https://github.com/dashpay/rust-dashcore", rev = "e6873e95ff3386ce7a0a03df9b2baca59e960700" }
+dash-spv = { git = "https://github.com/dashpay/rust-dashcore", rev = "e6873e95ff3386ce7a0a03df9b2baca59e960700" }
+key-wallet = { git = "https://github.com/dashpay/rust-dashcore", rev = "e6873e95ff3386ce7a0a03df9b2baca59e960700" }


🟡 Suggestion: Stamp the new v4 coinbase blob format in the SQLite schema

This pin preserves historical BLS and pre-v4 coinbase encodings, but introduces a distinct forward-write format boundary: CoinbasePayload now serializes an eighth field, merkle_root_asset_unlocks, for version >= 4. The base dependency at 40268cc0402a8933ec539f16b2d634c4e25876ad derives a seven-field decoder. TransactionRecord embeds the transaction directly, and sqlite/schema/core_state.rs writes the entire record through blob::encode into core_transactions.record_blob. The migration set remains at V018 even though blob.rs explicitly delegates blob-format evolution to the refinery schema version. An older binary therefore passes the schema gate for a database containing these new records, then interprets the added payload field as the following record fields, causing misdecoding or a typed-load error rather than a newer-format rejection. Add a storage migration that stamps this expanded blob format, or a storage-owned compatible codec, and cover a frozen v4 TransactionRecord plus older-reader open/restore rejection. This is separate from the withdrawn historical backward-read allegation and requires neither a PlatformVersion bump nor an accounting migration.

_{source: gpt-6.1-sol (phase2-reviewer: general, architecture-layering, ffi-engineer, platform-versioning, rust-quality, security-auditor)}

Cover populated GroveDB state and auxiliary entries, Core transaction and lock hashes, Platform preimages and signatures, and encrypted DashPay fields inside a signed document batch. Generate expectations with the pre-upgrade Platform/rust-dashcore implementations and retain generators. Consolidate six quorum fixture files into constants without changing bytes. Validation: 62 targeted tests, scoped all-target/all-feature clippy with --no-deps -D warnings, and rustfmt. No production or storage format changes. Co-Authored-By: Codex GPT-6 <noreply@openai.com>

github-actions · 2026-10-09T12:58:27Z

Waiting for bot review — coderabbitai not yet · thepastaclaw requested changes — dismiss the review or push a fix, 1 thread unresolved — resolve it. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

thepastaclaw

Re-review — Final validation — Phase 1 + Phase 2

Verified the combined reviewer claims and all 12 prior findings against cbb694d. One blocking external-consumer WASM dependency gap remains in Core-only feature configurations, alongside the existing SQLite format-versioning suggestion; the inspected SPV, node-ID, Node-runtime, and historical-fixture fixes are incorporated. This was static verification only: current CI reports successful Rust, Swift, Kotlin, JS/WASM, browser, Docker, and functional checks, with PR Hygiene pending and the dedicated wallet and ARM64 jobs skipped.

🔴 1 blocking | 🟡 1 suggestion(s)

1 carried-forward finding(s) already raised on this PR; not re-posting as new inline comments.

Review provenance

Source: reviewer 1: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 2: gpt-6.1-sol (agent: phase2-reviewer, role: architecture-layering); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: ffi-engineer); reviewer 4: gemini-3.8-flash-high (agent: phase1-reviewer, role: general); reviewer 5: gemini-3.8-flash-high (agent: phase1-reviewer, role: rust-quality); reviewer 6: gpt-6.1-sol (agent: phase2-reviewer, role: platform-versioning); reviewer 7: gpt-6.1-sol (agent: phase2-reviewer, role: rust-quality); reviewer 8: gpt-6.1-sol (agent: phase2-reviewer, role: security-auditor); reviewer 9: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 10: gpt-6-astra (agent: phase2-reviewer, role: architecture-layering); reviewer 11: gpt-6-astra (agent: phase2-reviewer, role: ffi-engineer); reviewer 12: gpt-6-astra (agent: phase2-reviewer, role: platform-versioning); reviewer 13: gpt-6-astra (agent: phase2-reviewer, role: rust-quality); reviewer 14: gpt-6-astra (agent: phase2-reviewer, role: security-auditor); reviewer 15: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 16: gpt-6.1-sol (agent: phase2-reviewer, role: architecture-layering); reviewer 17: gpt-6.1-sol (agent: phase2-reviewer, role: ffi-engineer); reviewer 18: gpt-6.1-sol (agent: phase2-reviewer, role: platform-versioning); reviewer 19: gpt-6.1-sol (agent: phase2-reviewer, role: rust-quality); reviewer 20: gpt-6.1-sol (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

Triage: critical by gpt-6.1-sol (effort low) — The large, cross-cutting diff directly changes BLS cryptography and serialization in packages/rs-dpp/src/bls/bls_signatures.rs and serde.rs, signing and key handling, and persisted quorum-key encoding in packages/rs-drive-abci/src/platform_types/signature_verification_quorum_set/v0/for_saving_v0.rs.
Phase 1 reviewers: gemini-3.8-flash-high — general (completed, effort high); agent phase1-reviewer, gemini-3.8-flash-high — rust-quality (completed, effort high); agent phase1-reviewer
Phase 1 model: gemini-3.8-flash-high — antigravity quota: weekly 32% left, 5h 51% left
Single stage: Phase 1 and Phase 2 reviewed this head side by side, with no blocker gate between them (triage tier)
Fresh final gate: an independent Phase-2 review ran after iterative findings were reconciled
Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
Phase 2 reviewers: gpt-6.1-sol — general (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — architecture-layering (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — ffi-engineer (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — platform-versioning (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — security-auditor (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — general (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — architecture-layering (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — ffi-engineer (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — platform-versioning (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — security-auditor (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — general (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — architecture-layering (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — ffi-engineer (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — platform-versioning (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — security-auditor (completed, effort xhigh); agent phase2-reviewer
Model comparison: every Phase-2 reviewer also ran on gpt-6-astra; the verifier weighed both sets without knowing which model wrote which

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `packages/rs-dpp/Cargo.toml`:
- [BLOCKING] packages/rs-dpp/Cargo.toml:123: Enforce the compatible blst minimum for Core-only BLS callers
  Only `bls-signatures` activates the new `dep:blst` minimum. An external DPP consumer with `default-features = false` and either `core_verification` or `core_quorum_validation` instead enables `dashcore/message_verification` or `dashcore/quorum_validation`, which both reach `dashcore-crypto/bls` and `dash-pkc/bls` without this constraint. At the exact pinned backend revision e6402ced, dash-pkc still accepts `blst = "0.3"` and unconditionally calls `fast_aggregate_verify` and `aggregate_verify`. Registry blst 0.3.12 satisfies that requirement, but both methods are gated behind `std`, which its build script does not enable for `wasm32-unknown-unknown`. An existing external lockfile can therefore retain 0.3.12 and make these supported feature configurations fail to compile after the migration, even though SDK/proof-verifier consumers using `bls-signatures` are repaired. Enforce the minimum in the owning upstream dependency and update aligned pins, or activate the temporary `dep:blst` constraint from both Core-only features. Cover each minimal configuration with an existing 0.3.12 consumer lockfile.

In `Cargo.toml`:
- [SUGGESTION] Cargo.toml:68-71: Stamp the new v4 coinbase blob format in the SQLite schema
  (existing thread: https://github.com/dashpay/platform/pull/5307#discussion_r4229946929)
  The exact upstream pin preserves the seven-field pre-v4 CoinbasePayload Serde layout but writes an eighth field, `merkle_root_asset_unlocks`, for version >= 4. SQLite's `schema/core_state.rs::apply` embeds that payload in a directly serialized TransactionRecord, while migrations still end at V018 and `blob.rs` explicitly delegates blob-format evolution to the migration version. A database containing a newly written v4 record consequently passes the older binary's schema gate despite its seven-field nested decoder being unable to consume the record correctly. The restore path makes this boundary particularly important: `backup.rs` validates the source and staged database through schema-history and integrity checks, without decoding transaction blobs, before replacing the destination. The new frozen consensus-transaction and GroveDB fixtures protect different codecs and do not close this boundary. Add a storage-format migration marker or equivalent minimum-reader gate, plus a v4 TransactionRecord regression covering open/restore rejection by the older compatibility ceiling. Compatible pre-v4 rows need not be rewritten, and this requires neither a PlatformVersion activation nor the deferred accounting migration.

thepastaclaw · 2026-10-09T14:15:10Z

 core_rpc_client = ["dep:dashcore-rpc"]
-bls-signatures = ["dashcore/bls"]
-ed25519-dalek = ["dashcore/eddsa"]
+bls-signatures = ["dashcore/bls", "dep:dash-pkc", "dep:blst", "dep:zeroize"]


🔴 Blocking: Enforce the compatible blst minimum for Core-only BLS callers

Only bls-signatures activates the new dep:blst minimum. An external DPP consumer with default-features = false and either core_verification or core_quorum_validation instead enables dashcore/message_verification or dashcore/quorum_validation, which both reach dashcore-crypto/bls and dash-pkc/bls without this constraint. At the exact pinned backend revision e6402ced, dash-pkc still accepts blst = "0.3" and unconditionally calls fast_aggregate_verify and aggregate_verify. Registry blst 0.3.12 satisfies that requirement, but both methods are gated behind std, which its build script does not enable for wasm32-unknown-unknown. An existing external lockfile can therefore retain 0.3.12 and make these supported feature configurations fail to compile after the migration, even though SDK/proof-verifier consumers using bls-signatures are repaired. Enforce the minimum in the owning upstream dependency and update aligned pins, or activate the temporary dep:blst constraint from both Core-only features. Cover each minimal configuration with an existing 0.3.12 consumer lockfile.

_{source: gpt-6.1-sol (phase2-reviewer: architecture-layering)}

Pin the eight workspace dependencies and all upstream lockfile packages to 8fe0a381. Adapt WASM private-key hex decoding to the removed hashes::hex API using the package's existing hex dependency. 🤖 Co-authored by [Claudius the Magnificent](https://github.com/lklimek/claudius) AI Agent

github-actions · 2026-10-09T14:24:40Z

Waiting for bot review — coderabbitai not yet · thepastaclaw requested changes — dismiss the review or push a fix, 1 thread unresolved — resolve it. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

thepastaclaw

Re-review — Final validation — Phase 1 + Phase 2

Verified the combined reviewer findings and all 13 prior identities against f475f72. One Core-only WASM dependency blocker and one SQLite format-versioning suggestion remain; the SDK/proof-verifier dependency path, SPV lifecycle, FFI conversion, Node requirements, and historical storage coverage are addressed. This was a static review with no local builds or tests; the exact-head CI snapshot reports successful Rust workspace, Swift, Kotlin, and package checks, while the main Test Suite, browser shard 1, and PR Hygiene remain pending.

🔴 1 blocking | 🟡 1 suggestion(s)

2 carried-forward finding(s) already raised on this PR; not re-posting as new inline comments.

Review provenance

Source: reviewer 1: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 2: gpt-6.1-sol (agent: phase2-reviewer, role: architecture-layering); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: ffi-engineer); reviewer 4: gpt-6.1-sol (agent: phase2-reviewer, role: platform-versioning); reviewer 5: gpt-6.1-sol (agent: phase2-reviewer, role: rust-quality); reviewer 6: gpt-6.1-sol (agent: phase2-reviewer, role: security-auditor); reviewer 7: muse-spark-1.3-contributor (agent: phase1-reviewer, role: general); reviewer 8: muse-spark-1.3-contributor (agent: phase1-reviewer, role: rust-quality); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

Triage: critical by gpt-6.1-sol (effort low) — The large, cross-cutting diff directly changes cryptographic implementations and historical key serialization in packages/rs-dpp/src/bls/bls_signatures.rs and packages/rs-dpp/src/bls/serde.rs, alongside persisted quorum-key representation in packages/rs-drive-abci/src/platform_types/signature_verification_quorum_set/v0/for_saving_v0.rs.
Phase 1 reviewers: muse-spark-1.3-contributor — general (completed, effort xhigh); agent phase1-reviewer, muse-spark-1.3-contributor — rust-quality (completed, effort xhigh); agent phase1-reviewer
Phase 1 model: muse-spark-1.3-contributor — not quota-gated; passed over gemini-3.8-flash-high (antigravity below 15% reserve: weekly 24% left, 5h 0% left), glm-5.3-flash (not used above high effort; tier asks max)
Single stage: Phase 1 and Phase 2 reviewed this head side by side, with no blocker gate between them (triage tier)
Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
Phase 2 reviewers: gpt-6.1-sol — general (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — architecture-layering (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — ffi-engineer (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — platform-versioning (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — security-auditor (completed, effort xhigh); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `packages/rs-dpp/Cargo.toml`:
- [BLOCKING] packages/rs-dpp/Cargo.toml:115-116: Enforce the compatible blst minimum for Core-only BLS callers
  (existing thread: https://github.com/dashpay/platform/pull/5307#discussion_r4231068845)
  The ordinary blst >=0.3.17 dependency fixes consumers that enable DPP's `bls-signatures`, but these two public feature forwards bypass it. A downstream consumer selecting `default-features = false` with `core_verification` or `core_quorum_validation` enables Core BLS without activating DPP's optional `blst` constraint. At rust-dashcore 8fe0a381, both features enable `dashcore/bls`, which reaches dash-pkc e6402ced; its manifest still permits `blst = "0.3"`. An existing consumer lockfile can therefore retain 0.3.12. That release gates `aggregate_verify` and `fast_aggregate_verify` behind `std`, and its build script deliberately omits `std` on wasm32-unknown-unknown, while dash-pkc's IETF implementation calls both methods unconditionally. These Core-only configurations consequently retain the missing-method compilation failure even though the SDK/proof-verifier path is repaired. Activate the compatible minimum from both feature forwards, or raise it in the owning dash-pkc dependency and propagate aligned pins. Add a retained-lockfile external WASM regression with DPP's `bls-signatures` disabled.

In `Cargo.toml`:
- [SUGGESTION] Cargo.toml:68-71: Stamp the new v4 coinbase blob format in the SQLite schema
  (existing thread: https://github.com/dashpay/platform/pull/5307#discussion_r4229946929)
  The pinned CoinbasePayload serializer preserves seven fields for versions below 4, but emits an eighth field, `merkle_root_asset_unlocks`, for version 4 and later. Wallet storage persists the enclosing TransactionRecord directly through `blob::encode` in `sqlite/schema/core_state.rs:101`, so this new representation reaches `core_transactions.record_blob`. The blob codec explicitly delegates format evolution to the refinery schema version, but the migration history remains unchanged through V018. After a v4 coinbase record is written, a base binary still accepts the database or backup at `assert_schema_version_supported`, although its seven-field payload decoder leaves the extra field to be consumed as subsequent TransactionRecord data, causing a decoding failure or misalignment. This is distinct from the repaired historical BLS and pre-v4 backward-read issue, and the Drive quorum adapter does not cover this SQLite boundary. Advance the storage compatibility gate before writing the new representation, or provide an equivalent wallet-owned codec boundary with a defined downgrade policy. Add a complete persisted v4 TransactionRecord regression covering older-reader rejection at that boundary; no accounting or PlatformVersion migration is needed.

github-actions · 2026-10-10T15:26:32Z

Your move: thepastaclaw requested changes on this head; dismiss the review or push a fix; thepastaclaw left review threads unresolved; resolve them.
Full checklist in the description.

PastaPastaPasta and others added 7 commits September 23, 2026 11:37

$@infraclaw-dash$

ci: bootstrap trusted publisher before feature runner adoption

7b63fc6

Merge pull request #5175: bootstrap trusted CI image publisher

e2fd47d

infraclaw: install the reviewed publisher prerequisite only; no application or runner changes.

github-actions Bot added this to the v5.1.0 milestone Oct 6, 2026

lklimek mentioned this pull request Oct 6, 2026

fix(platform-wallet)!: restore Core spending state and repair persisted accounting #5150

Open

5 of 7 tasks

thepastaclaw suggested changes Oct 6, 2026

View reviewed changes

Comment thread Cargo.toml Outdated

Comment thread packages/rs-dpp/Cargo.toml

Comment thread ...form_events/core_based_updates/update_masternode_list/update_state_masternode_list/v0/mod.rs Outdated

lklimek added 2 commits October 6, 2026 13:49

lklimek changed the title ~~chore(platform)!: port rust-dashcore migration from #4932 to v5.1-dev~~ chore(platform)!: update rust-dashcore Oct 6, 2026

lklimek changed the title ~~chore(platform)!: update rust-dashcore~~ chore(platform)!: update rust-dashcore and require node >= 20 in wasm Oct 6, 2026

lklimek changed the title ~~chore(platform)!: update rust-dashcore and require node >= 20 in wasm~~ chore(platform)!: update rust-dashcore Oct 6, 2026

This was referenced Oct 6, 2026

chore!: require Node.js >=22 for JS packages and >=24 for dashmate #5310

Merged

fix(platform-wallet): retain SPV client and track shutdown through cancellation #5311

Merged

This was referenced Oct 6, 2026

feat(sdk)!: key limits, DIP-14 sub-feature derivation and decode-any-kind for DashPay Connect #4844

Draft

chore(platform)!: bump rust-dashcore to 719de34b (secp256k1 0.33) #4932

Closed

lklimek changed the title ~~chore(platform)!: update rust-dashcore~~ chore(platform)!: update rust-dashcore (incl secp256k1 0.33) Oct 6, 2026

lklimek marked this pull request as ready for review October 6, 2026 15:08

github-actions Bot added the waiting-bots Waiting for the review bots to report on this head label Oct 6, 2026

lklimek commented Oct 6, 2026

View reviewed changes

thepastaclaw suggested changes Oct 6, 2026

View reviewed changes

lklimek mentioned this pull request Oct 8, 2026

fix(crypto): deserialize legacy BLS public keys dashpay/rust-dashcore#1145

Closed

2 of 4 tasks

thepastaclaw suggested changes Oct 8, 2026

View reviewed changes

Comment thread packages/rs-platform-wallet-ffi/src/provider_key_at_index.rs Outdated

thepastaclaw suggested changes Oct 9, 2026

View reviewed changes

Comment thread packages/rs-dpp/Cargo.toml

thepastaclaw suggested changes Oct 9, 2026

View reviewed changes

thepastaclaw reviewed Oct 9, 2026

View reviewed changes

thepastaclaw suggested changes Oct 9, 2026

View reviewed changes

lklimek mentioned this pull request Oct 9, 2026

test(platform): freeze historical storage and signing vectors #5359

Merged

11 of 15 tasks

thepastaclaw suggested changes Oct 9, 2026

View reviewed changes

github-actions Bot added waiting-self-review Waiting for the author to post /self-reviewed bot-review-skipped A required review bot did not report; it was skipped by the window or by a person. and removed waiting-bots Waiting for the review bots to report on this head labels Oct 10, 2026

PastaPastaPasta mentioned this pull request Oct 10, 2026

feat(platform-wallet): return dash-spv's verification status with an SPV quorum key #5366

Open

3 of 6 tasks

Conversation

lklimek commented Oct 6, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Basic explanation

Issue being fixed or feature implemented

What was done?

In-place changes to shipped generations

Merge order

How Has This Been Tested?

Outstanding review blockers

Breaking Changes

Checklist:

PR Hygiene · f475f72

Uh oh!

coderabbitai Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

thepastaclaw commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thepastaclaw left a comment

Choose a reason for hiding this comment

Final validation — Phase 1 + Phase 2

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lklimek left a comment

Choose a reason for hiding this comment

Uh oh!

thepastaclaw left a comment

Choose a reason for hiding this comment

Re-review — Final validation — Phase 1 + Phase 2

1 finding(s) not shown inline (the lines are not part of this PR's diff)

Uh oh!

lklimek commented Oct 6, 2026

Uh oh!

github-actions Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thepastaclaw left a comment

Choose a reason for hiding this comment

Re-review — Final validation — Phase 1 + Phase 2

Uh oh!

Uh oh!

github-actions Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thepastaclaw left a comment

Choose a reason for hiding this comment

Re-review — Final validation — Phase 1 + Phase 2

Uh oh!

Uh oh!

github-actions Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thepastaclaw left a comment

Choose a reason for hiding this comment

Re-review — Final validation — Phase 1 + Phase 2

Uh oh!

thepastaclaw left a comment

Choose a reason for hiding this comment

Re-review after discussion — commit c1c7b09

Uh oh!

github-actions Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thepastaclaw left a comment

Choose a reason for hiding this comment

Re-review — Final validation — Phase 1 + Phase 2

lklimek commented Oct 6, 2026 •

edited by github-actions Bot

Loading

PR Hygiene · `f475f72`

coderabbitai Bot commented Oct 6, 2026 •

edited

Loading

thepastaclaw commented Oct 6, 2026 •

edited

Loading

github-actions Bot commented Oct 6, 2026 •

edited

Loading

github-actions Bot commented Oct 8, 2026 •

edited

Loading

github-actions Bot commented Oct 9, 2026 •

edited

Loading

github-actions Bot commented Oct 9, 2026 •

edited

Loading

github-actions Bot commented Oct 9, 2026 •

edited

Loading

github-actions Bot commented Oct 9, 2026 •

edited

Loading

Re-review after discussion — commit `c1c7b09`

github-actions Bot commented Oct 9, 2026 •

edited

Loading

github-actions Bot commented Oct 9, 2026 •

edited

Loading

github-actions Bot commented Oct 9, 2026 •

edited

Loading