v0.2.0 — Milestone 2: DAR codegen, dpm component, Splice bindings

Milestone 2 of the Canton dev-fund grant (#407): typed Rust codegen from DARs, the dpm codegen-rust component, and the first prebuilt canton-splice-* crates — together with every finding from Equilibrium's independent review of Milestone 1.

Codegen

canton-codegen generates typed Rust from a DAR: templates, choices, interfaces and contract keys, with serde for the JSON lane and ToValue/FromValue for gRPC on every generated type. It decodes daml-lf-archive natively, so nothing downstream needs a JVM, and a conformance oracle in CI holds the decoder to the official reader.

cargo install canton-codegen-cli
dpm-codegen-rust --dar my-app-1.0.0.dar --out my-app-bindings

Prebuilt bindings ship as canton-splice-amulet, canton-splice-wallet and canton-splice-wallet-payments. The Daml-LF → Rust mapping is specified in docs/daml-lf-type-mapping.md, and what an SCU version bump does to generated code is measured in docs/scu-regeneration.md.

From the Milestone 1 review

Equilibrium reviewed M1 independently and published a regression branch stating the behaviour each finding requires. All of it is fixed here; their suite passes against this release.

The one worth naming: a submission whose response was lost is retried with the same change ID, the participant refuses the retry as a duplicate — and the SDK reported failure over a command that had committed. It now reports success, because that rejection is the participant saying the earlier attempt landed. CantonClient::submission hands back the change ID before anything is sent, so an ambiguous outcome is recoverable over either transport.

Also: a lossless ACS read (AcsEntry) that no longer drops incomplete reassignments; resumable streams that resume from the participant's own checkpoint and report the failure that stopped them; the JSON lane at parity on submission, recovery and event lookup; Auth0 and Okta presets that produce their providers' actual requests; stream-lifetime telemetry, WebSocket trace propagation and a supported OTLP metrics path; and two credential leaks through Debug closed.

Breaking, for code on 0.1.x

Two signatures change, both because the old one could not express a correct call — OidcConfig::auth0 now takes an audience, and await_completion takes a ChangeId rather than a command id and a party list. CHANGELOG.md has the migration.

Verified

356 tests without a node, and against a Canton 3.5.7 participant 33 ledger + 5 admin live tests with CANTON_TEST_REQUIRE_LIVE=1 so a missing environment fails rather than skipping quietly. CI is green on Linux, macOS and Windows, at MSRV 1.88, across the feature powerset, on aarch64 and musl.