thesimplekid/satsettle
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

feat: allow persistent source-wallet providers #16

Merged
thesimplekid merged 1 commit from fix/3-source-wallet-provider into main 2026-10-09 14:21:30 +00:00
Conversation 0 Commits 1 Files changed 12 +532 -216
thesimplekid commented 2026-10-09 13:04:11 +00:00
Owner
Copy link

Applications can now control source-wallet construction and persistence through EngineOptions::with_source_wallet_provider. The async provider receives a stable attempt ID, mint and unit, and supplies an Arc<cdk::Wallet> reused through durable lookup on retries, restarts, proof release and change recovery. The default remains persistent per-attempt SQLite wallets and seeds.

Satsettle validates the returned mint/unit and rejects detectable database-handle reuse across attempts or with supplied trusted wallets, including cloned Wallet values sharing a database handle. The provider contract requires separate persistent namespaces, stable seed/state, exclusive mutation/recovery, and retention of unresolved state. Separate handles to an arbitrary backend cannot prove isolation; providers must prevent those aliases themselves. No fallback source database or seed is created for a supplied provider.

Source URL checks still run before provider lookup. CDK retains its standard transport, no preliminary swap is introduced, and deployments/providers retain responsibility for egress and redirect restrictions. Durable rejection still prevents remelting, original proofs remain outside trusted balances/payouts, and only recovered change is exported.

Validation: formatting, Clippy, documentation and all 55 tests pass in the x86_64 Linux Nix checks. Direct-melt lost-response/change recovery, pending melts across restart, cancelled melts, and manual claim/reject/original-proof release now run with both managed wallets and a persistent caller provider. Additional tests reject wrong mint/unit, shared database handles, and unsupported arbitrary-source URLs before provider invocation. aarch64 was not checked.

Stacked on #15; this diff contains the issue #3 provider change.

Closes #3.

Applications can now control source-wallet construction and persistence through `EngineOptions::with_source_wallet_provider`. The async provider receives a stable attempt ID, mint and unit, and supplies an `Arc<cdk::Wallet>` reused through durable lookup on retries, restarts, proof release and change recovery. The default remains persistent per-attempt SQLite wallets and seeds. Satsettle validates the returned mint/unit and rejects detectable database-handle reuse across attempts or with supplied trusted wallets, including cloned Wallet values sharing a database handle. The provider contract requires separate persistent namespaces, stable seed/state, exclusive mutation/recovery, and retention of unresolved state. Separate handles to an arbitrary backend cannot prove isolation; providers must prevent those aliases themselves. No fallback source database or seed is created for a supplied provider. Source URL checks still run before provider lookup. CDK retains its standard transport, no preliminary swap is introduced, and deployments/providers retain responsibility for egress and redirect restrictions. Durable rejection still prevents remelting, original proofs remain outside trusted balances/payouts, and only recovered change is exported. Validation: formatting, Clippy, documentation and all 55 tests pass in the x86_64 Linux Nix checks. Direct-melt lost-response/change recovery, pending melts across restart, cancelled melts, and manual claim/reject/original-proof release now run with both managed wallets and a persistent caller provider. Additional tests reject wrong mint/unit, shared database handles, and unsupported arbitrary-source URLs before provider invocation. aarch64 was not checked. Stacked on #15; this diff contains the issue #3 provider change. Closes #3.
feat: allow persistent source-wallet providers
Some checks failed
Checks / format (pull_request) Failing after 4s
Details
Checks / checks (pull_request) Failing after 3s
Details
Checks / cdk-compatible (pull_request) Failing after 3s
Details
Checks / format (push) Has been cancelled
Details
Checks / checks (push) Has been cancelled
Details
Checks / cdk-compatible (push) Has been cancelled
Details
4bbc840962 
Add an asynchronous provider contract keyed by stable settlement attempt,
mint and unit. Keep managed persistent source wallets as the default and
validate supplied wallet identity and detectable database-handle isolation.

Preserve original-proof melts, durable rejection, restart recovery and change
export. Document provider ownership, lifecycle and deployment network policy.

Closes #3.
thesimplekid changed target branch from fix/2-caller-trusted-wallets to main 2026-10-09 14:21:28 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
thesimplekid/satsettle!16
No description provided.