feat: add PostgreSQL journals with fenced wallet ownership #18

Merged

thesimplekid merged 1 commit from fix/6-postgres-leases into main 2026-10-09 14:21:40 +00:00

Conversation 0 Commits 1 Files changed 21 +2610 -26

thesimplekid commented 2026-10-09 13:59:18 +00:00

Owner

Copy link

Applications can enable the postgres feature to store payment journals and CDK wallet state in PostgreSQL. decide_claim_in_transaction lets the application's resource reservation and Satsettle's capture decision commit or roll back together; the network claim happens after commit and remains recoverable.

Each namespace has one renewable Engine lease, so several application instances can contend for ownership or serve independent namespaces. PostgreSQL's clock and immutable ownership epochs govern takeover. Wallets must come from the acquired store's fenced CDK database factory: lease checks and wallet mutations use the same PostgreSQL transaction. Cancelled work retains ordering and its database lock; stale owners cannot write after takeover, and renewals blocked past expiry cannot revive an owner. Ordinary supplied databases and managed SQLite wallets are rejected in leased mode.

The embedded backend remains the default. PostgreSQL uses an explicit versioned migration, application-configured connection pool, stable per-wallet schemas/seeds, bounded wallet SQL, and documented release/recovery procedures. This supports one active owner per namespace; it does not run concurrent CDK recovery against one wallet. Eight real PostgreSQL tests cover the reusable backend contracts, application rollback, expiry/takeover, delayed renewal, cancellation across pooled connections, rejecting unfenced wallets, and Cashu lost-response recovery under a new owner.

Validation: formatting, all-feature Clippy, default and all-feature unit/integration/doc suites, API docs, isolated PostgreSQL 17 tests, and nix flake check path:. -L. The same all-feature and PostgreSQL tests also run against CDK 0.18.1 in an isolated compatibility checkout. A dedicated Nix shell, service helpers and CI job run the PostgreSQL checks. aarch64 was not checked.

Closes #6.

Stacked on #17; this PR contains the PostgreSQL and lease commit only.

Review follow-up: the isolated PostgreSQL helper now drops database-service privileges when running inside a root CI container.

Applications can enable the `postgres` feature to store payment journals and CDK wallet state in PostgreSQL. `decide_claim_in_transaction` lets the application's resource reservation and Satsettle's capture decision commit or roll back together; the network claim happens after commit and remains recoverable. Each namespace has one renewable Engine lease, so several application instances can contend for ownership or serve independent namespaces. PostgreSQL's clock and immutable ownership epochs govern takeover. Wallets must come from the acquired store's fenced CDK database factory: lease checks and wallet mutations use the same PostgreSQL transaction. Cancelled work retains ordering and its database lock; stale owners cannot write after takeover, and renewals blocked past expiry cannot revive an owner. Ordinary supplied databases and managed SQLite wallets are rejected in leased mode. The embedded backend remains the default. PostgreSQL uses an explicit versioned migration, application-configured connection pool, stable per-wallet schemas/seeds, bounded wallet SQL, and documented release/recovery procedures. This supports one active owner per namespace; it does not run concurrent CDK recovery against one wallet. Eight real PostgreSQL tests cover the reusable backend contracts, application rollback, expiry/takeover, delayed renewal, cancellation across pooled connections, rejecting unfenced wallets, and Cashu lost-response recovery under a new owner. Validation: formatting, all-feature Clippy, default and all-feature unit/integration/doc suites, API docs, isolated PostgreSQL 17 tests, and `nix flake check path:. -L`. The same all-feature and PostgreSQL tests also run against CDK 0.18.1 in an isolated compatibility checkout. A dedicated Nix shell, service helpers and CI job run the PostgreSQL checks. aarch64 was not checked. Closes #6. Stacked on #17; this PR contains the PostgreSQL and lease commit only. Review follow-up: the isolated PostgreSQL helper now drops database-service privileges when running inside a root CI container.

thesimplekid added 1 commit 2026-10-09 13:59:18 +00:00

feat: add PostgreSQL journals with fenced wallet ownership ... 66374dc80b

Allow application reservations and capture decisions to share a PostgreSQL
transaction. Keep one renewable Engine owner per namespace, with database
clock expiry and immutable fencing epochs for takeover and recovery.

Fence CDK SQL wallet operations on their own PostgreSQL sessions. Preserve
ordering through cancellation, reject unfenced wallets, and prevent delayed
renewals from reviving expired owners. Add real-server contract, transaction,
takeover and receive-recovery tests, a Nix shell and CI coverage.

Refs: #6

thesimplekid referenced this pull request 2026-10-09 14:08:17 +00:00

fix: replace vulnerable Lightning transport and legacy crypto #19

thesimplekid force-pushed fix/6-postgres-leases from 66374dc80b to 150194f0cb 2026-10-09 14:18:31 +00:00 Compare

thesimplekid changed target branch from fix/1-payment-storage to main 2026-10-09 14:21:38 +00:00

thesimplekid merged commit 150194f0cb into main 2026-10-09 14:21:40 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

thesimplekid/satsettle!18

No description provided.