feat: manage Cashu infrastructure and durable wallet operations #39

Open
asmo wants to merge 7 commits from feat/cashu-infrastructure-wallets into main
Owner

This extends Cashu Operator from mint deployment to independently managed Bitcoin, Lightning, payment processor, Ark and persistent wallet resources. Existing CashuMint manifests continue to select CDK when implementation is omitted; existing external and inline backends are preserved.

The commits separate API/schema contracts, managed mint integration, infrastructure controllers, native wallet execution, operator/admission wiring, and samples/documentation/verification receipts.

  • Adds retained single-writer resources for Bitcoin Core, LND, CLN/hold, LDK Server, generic/LDK/Bark processors, Ark and three wallet implementations. References validate network, UID, health, credentials and exact live method/unit settings; no backend fallback or implicit adoption occurs.
  • Adds a dedicated Nutshell mint adapter and CDK BDK configuration. Optional cert-manager/Prometheus APIs no longer prevent minimal installation.
  • Adds immutable, explicitly authorized Mint/Send/Receive/Melt/Recover operations with named-wallet SubjectAccessReview, fail-closed admission, private result Secrets, durable instance/request idempotency, native operation IDs and lifetime storage fencing.
  • Uses native CDK, Nutshell and Coco SDK storage/cryptography. Pinned downstream patches retain uncertain native reservations and prevent blind compensation/redispatch. Managed mint dependencies and wallet recovery remain bound to the original resource identities; unavailable or replaced dependencies stop native calls. Coco exposes only BOLT11/sat Mint/Send/Receive; all Coco Melt and other wallet methods remain disabled pending qualification.

Bark incoming BOLT11 qualification exposed an upstream gross/net accounting error: a 10,000 sat payment credited 9,880 sat after fees. The pinned native patch now uses verified immutable net credit for both status and events; four actual-SDK tests pass, and readback of the same original paid request returns 9,880 sat with its original storage/identity retained. The failed original receipt is preserved.

Validation and exact receipts are in docs/implementation/status.md and compatibility/lock.json: generated schemas/RBAC and seven-CRD installer, Go unit/envtest/vet/build, zero-issue lint and strict MkDocs build; eight inspected local ARM64 native images with embedded source/dependency/patch records; native node/processor authentication and identity-retention tests; 12 complete native wallet/mint/backend financial combinations (eight CDK/Nutshell plus four Coco); four real-Lightning accepted/delayed lost-response Melt cases; native identity/restart and bounded original-operation recovery evidence. Final-image Pod replacements for all three wallet implementations also preserved original journals, private results, native database digests and independent settlement evidence without new financial operations.

New profiles are explicitly experimental and restricted to regtest. No image is published and no profile is production-qualified. Native AMD64, production recovery/upgrade qualification, funded BDK issuance/redemption, Ark rounds and the remaining experimental payment-method gates are listed individually. LDK's original outgoing BOLT12 attempt expired and is recorded as failed acceptance, without retry; the verified BOLT11 and incoming BOLT12 cases are recorded separately.

No production cluster or production financial state was changed. Capacity interruptions in the isolated k3d environment retained financial databases, identity Secrets, PVCs and original request IDs; native chain recovery procedures and their precise limits are documented in the receipts.

This extends Cashu Operator from mint deployment to independently managed Bitcoin, Lightning, payment processor, Ark and persistent wallet resources. Existing CashuMint manifests continue to select CDK when implementation is omitted; existing external and inline backends are preserved. The commits separate API/schema contracts, managed mint integration, infrastructure controllers, native wallet execution, operator/admission wiring, and samples/documentation/verification receipts. - Adds retained single-writer resources for Bitcoin Core, LND, CLN/hold, LDK Server, generic/LDK/Bark processors, Ark and three wallet implementations. References validate network, UID, health, credentials and exact live method/unit settings; no backend fallback or implicit adoption occurs. - Adds a dedicated Nutshell mint adapter and CDK BDK configuration. Optional cert-manager/Prometheus APIs no longer prevent minimal installation. - Adds immutable, explicitly authorized Mint/Send/Receive/Melt/Recover operations with named-wallet SubjectAccessReview, fail-closed admission, private result Secrets, durable instance/request idempotency, native operation IDs and lifetime storage fencing. - Uses native CDK, Nutshell and Coco SDK storage/cryptography. Pinned downstream patches retain uncertain native reservations and prevent blind compensation/redispatch. Managed mint dependencies and wallet recovery remain bound to the original resource identities; unavailable or replaced dependencies stop native calls. Coco exposes only BOLT11/sat Mint/Send/Receive; all Coco Melt and other wallet methods remain disabled pending qualification. Bark incoming BOLT11 qualification exposed an upstream gross/net accounting error: a 10,000 sat payment credited 9,880 sat after fees. The pinned native patch now uses verified immutable net credit for both status and events; four actual-SDK tests pass, and readback of the same original paid request returns 9,880 sat with its original storage/identity retained. The failed original receipt is preserved. Validation and exact receipts are in [docs/implementation/status.md](https://git.cashu.dev/asmo/cashu-operator/src/branch/feat/cashu-infrastructure-wallets/docs/implementation/status.md) and [compatibility/lock.json](https://git.cashu.dev/asmo/cashu-operator/src/branch/feat/cashu-infrastructure-wallets/compatibility/lock.json): generated schemas/RBAC and seven-CRD installer, Go unit/envtest/vet/build, zero-issue lint and strict MkDocs build; eight inspected local ARM64 native images with embedded source/dependency/patch records; native node/processor authentication and identity-retention tests; 12 complete native wallet/mint/backend financial combinations (eight CDK/Nutshell plus four Coco); four real-Lightning accepted/delayed lost-response Melt cases; native identity/restart and bounded original-operation recovery evidence. Final-image Pod replacements for all three wallet implementations also preserved original journals, private results, native database digests and independent settlement evidence without new financial operations. New profiles are explicitly experimental and restricted to regtest. No image is published and no profile is production-qualified. Native AMD64, production recovery/upgrade qualification, funded BDK issuance/redemption, Ark rounds and the remaining experimental payment-method gates are listed individually. LDK's original outgoing BOLT12 attempt expired and is recorded as failed acceptance, without retry; the verified BOLT11 and incoming BOLT12 cases are recorded separately. No production cluster or production financial state was changed. Capacity interruptions in the isolated k3d environment retained financial databases, identity Secrets, PVCs and original request IDs; native chain recovery procedures and their precise limits are documented in the receipts.
asmo force-pushed feat/cashu-infrastructure-wallets from 5a39cb7e25
Some checks failed
Lint / Run on Ubuntu (pull_request) Has started running
Docs / Build docs site (pull_request) Failing after 56s
E2E Tests / Run on Ubuntu (pull_request) Has started running
Tests / Run on Ubuntu (pull_request) Has started running
to db53faaafe
Some checks failed
Docs / Build docs site (pull_request) Has been cancelled
Lint / Run on Ubuntu (pull_request) Has been cancelled
E2E Tests / Run on Ubuntu (pull_request) Has been cancelled
Tests / Run on Ubuntu (pull_request) Has been cancelled
2026-10-20 13:20:51 +00:00
Compare
docs: link qualification evidence from the rendered site
All checks were successful
Docs / Build docs site (pull_request) Successful in 1m20s
Lint / Run on Ubuntu (pull_request) Successful in 1m42s
Tests / Run on Ubuntu (pull_request) Successful in 6m54s
E2E Tests / Run on Ubuntu (pull_request) Successful in 12m40s
76519d7a11
All checks were successful
Docs / Build docs site (pull_request) Successful in 1m20s
Lint / Run on Ubuntu (pull_request) Successful in 1m42s
Tests / Run on Ubuntu (pull_request) Successful in 6m54s
E2E Tests / Run on Ubuntu (pull_request) Successful in 12m40s
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/cashu-infrastructure-wallets:feat/cashu-infrastructure-wallets
git switch feat/cashu-infrastructure-wallets

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff feat/cashu-infrastructure-wallets
git switch feat/cashu-infrastructure-wallets
git rebase main
git switch main
git merge --ff-only feat/cashu-infrastructure-wallets
git switch feat/cashu-infrastructure-wallets
git rebase main
git switch main
git merge --no-ff feat/cashu-infrastructure-wallets
git switch main
git merge --squash feat/cashu-infrastructure-wallets
git switch main
git merge --ff-only feat/cashu-infrastructure-wallets
git switch main
git merge feat/cashu-infrastructure-wallets
git push origin main
Sign in to join this conversation.
No description provided.