harden(audit): close all remaining HIGH/MEDIUM/LOW (H3, M4 reasoned-deferred)#8
Merged
Conversation
… L2 domain reject - M3: orders that won't survive to an epoch's settlement are dropped at both the proposer's snapshot AND every peer's co-sign, via an epoch-DETERMINISTIC cutoff ((epoch+1)*epoch_secs + margin) so verifiers never disagree. Closes the griefing where a malicious proposer slips in a near-expiry order that match_epoch (expiry-blind by design, for the zk guest) would co-sign into an on-chain OrderExpired revert. The temporal check lives at the consensus layer, keeping the matcher kernel a pure function of the order set. - M5: pin core2 by rev (was a floating git branch) and blueprint-sdk / -networking / -crypto to exact alpha versions — no silent build drift. - M7: the co-sign wait now derives from epoch_secs (80%, clamped 1-8s) instead of a fixed 8s that overlapped any short epoch into the next round. - L2: orders whose price/qty exceed i64::MAX are rejected at admission with a clear reason instead of being silently dropped by match_epoch later. 51 Rust tests green (incl. mesh); blueprint+chain build clean.
…t visibility, L1 keys - H1: settled + cancelled finality sets journal to DATA_DIR/clob-finality.json on mutation and restore (expiry-filtered) on boot. The pool stays in-memory (peers re-gossip it), but losing the finality record would re-admit a settled or cancelled order into a batch-reverting re-match. Round-trip unit-tested. - H4: the clob router lifts the body limit to 16MB so a full-pool proposal (~5MB at MAX_POOL) isn't 413'd at the load the pool cap permits. Digest-list + pull-missing remains the scale-time redesign; this removes the cliff now. - H7: transport mode (mesh vs HTTP peer list) is logged loudly at boot and documented as a fleet-wide parameter — a mixed fleet partitions, and gossip_send_failures/quorum_failed surface it. - L1: e2e scripts moved ephemeral keys out of predictable /tmp into a gitignored repo-local .keys/ (0700 dir, 0600 files) and REFUSE a pre-seeded file not owned 0600 by the caller. - attest_deadline scaling + finality journal serde unit-tested. 19 operator + mesh tests green; blueprint+chain clean.
…anges The merged proof-of-service-receipt work changed receiptDigest / settleRedemption to carry a workCommitment and added _challengeWindow to the constructor, but the H8 test files (ErrorPaths, the invariant handler + suites) weren't updated in that merge — main's forge build was red. Updated to the new 7-arg constructor and the workCommitment receipt signature. 97 forge tests green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sweeps the remaining audit backlog. Closes every HIGH/MEDIUM/LOW that's safe to do well in one pass; two items are explicitly deferred with reasoning (not silently dropped). Full disposition in
.evolve/audit-status.md.Closed here
HIGH
settled/cancelledjournal toclob-finality.json, restored (expiry-filtered) on boot. Losing them re-opened a settled/cancelled order to a batch-reverting re-match.gossip_send_failures/quorum_failedsurface it).MEDIUM
match_epocha pure function of the order set (the zk guest needs that), so the temporal check lives at the consensus layer.epoch_secs(80%, clamped) instead of a fixed 8s that overlapped short epochs.LOW
.keys/with ownership/mode refusal.i64-domain orders rejected at admission with a clear reason.Plus: repaired main's forge build — the merged receipt/constructor change had left the H8 test files broken (97 forge tests now green).
Deferred, with reasoning
_applyBatchall-or-nothing + stateless verify) — the fix is finality-on-observed-settlement + pre-submit simulation, a consensus-semantics change to the live 3-node fleet. Its own focused PR with multi-node tests, not a sweep commit. Safety holds today; griefing self-limits by expiry.53 Rust + 97 forge tests green; blueprint+chain+mesh builds clean.
🤖 Generated with Claude Code