Three faults a first tag would have hit. The version check and the
collect step looked for target/release/wallet-app, but the binary has
been blackbeard-wallet since the product was renamed for packaging. The
bundle step ran the Tauri CLI with --dir ui, where there is no Tauri
project to find; it now runs from crates/wallet-app, checked with
`tauri info`, and the CLI is pinned to 2.11.4 as doc/reproducibility.md
said it would be once a release was cut. The publish job's `rpm -K`
right after signing would exit non-zero on a runner whose rpm database
does not hold the lair.cafe key; the check now runs on the repo host
after the rsync, where gitea_ci verifies cichlid-0.1.9 as OK today.
Refs #32
Refs #33
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ftBXYuba8ARhQeF74oUgW
wallet_data::ramp::StubRamp builds a session URL on our own host from
the request (direction, asset, destination, currency) and nothing else;
it is what proves the plumbing before a provider is signed (#44). The
ramp_session command decodes the address, builds the request, refuses a
URL that is not https, and hands the URL back; the receive screen's Buy
and Sell buttons pass it to the opener, whose capability allows
blackbeard.observer and the explorer and nothing else. The wallet's
webview never navigates: driven live, the client returned
https://blackbeard.observer/ramp?direction=buy&asset=dev%2Fnative&…,
Buy handed it to the opener without error, and the webview stayed on
#/receive.
doc/reproducibility.md records what the build pins and what a second
build of the same tag is expected to differ in; the release workflow
exports SOURCE_DATE_EPOCH from the tagged commit. The diffoscope
comparison waits on the first tag.
Closes#43
Refs #51
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ftBXYuba8ARhQeF74oUgW
keys/wormhole.rs derives the wormhole keys from the seed at the wormhole
coin type (m/44'/189189189'/i'/0'/0'), pinned to what quantus-node's
`key quantus --scheme wormhole` prints for the public dev phrase at
index 0 and 1, and derives a miner's address from its published inner
hash (bob's, as the observer shows it). The nullifier that spends a leaf
is mirrored on the Poseidon core alone, pinned to four vectors produced
once with the circuit crate, so the wallet does not carry the prover to
know what it has spent.
substrate/wormhole.rs reads ZkTree::LeafCount, scans ZkTree::Leaves in
pages of 500 locally computed keys for leaves paying an address, and
checks Wormhole::UsedNullifiers. Nothing on chain indexes leaves by
recipient, so the scan runs once from zero and then only over what was
appended; the SQLite cache keeps the leaves and the frontier under a
ShieldedCache port. The wormhole_summary command derives the keys from
the session's seed for the call, scans, marks spent leaves, and answers
with the address, the inner hash and the shielded and received totals;
the accounts page shows it with copy and rescan. A raw-seed wallet with
no seed is told so rather than shown a fake address.
Verified on mainnet through the public endpoint: a full scan of 107,127
leaves in 16 s found 31 leaves paying bob's wormhole address for
9.34 QTC, the observer's 30-reward attribution of 9.33 plus the one
since; the dev phrase restored in the app shows
qzq32vN2ZtX2T9YrvCh69CMvbC2nWmEq4tCjRWKg4CyuxeShg and inner hash
0x5a5891e7…, the node's own numbers, with the tree scanned to its end.
doc/threat-model.md names the assets, the boundaries and the file behind
each mitigation; its review by someone else is what closes#48.
Closes#45
Refs #48
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ftBXYuba8ARhQeF74oUgW
On Linux, before Tauri, tokio or any thread exists, the app reads what
the machine says (NVIDIA module loaded, Wayland session, an explicit
WALLET_WEBKIT_DMABUF=on|off) and sets __NV_DISABLE_EXPLICIT_SYNC=1 for
NVIDIA on Wayland and WEBKIT_DISABLE_DMABUF_RENDERER=1 for NVIDIA at all,
each logged with its reason so a blank-window report says which path was
taken. A variable already set in the environment is left alone. The
decision is a pure function with tests for the paths this Intel machine
cannot take.
doc/platform-smoke.md carries the v1 checklist and today's Linux pass
(Fedora 44, GNOME 50 on Wayland, webkitgtk 2.52.5). Windows 11 and
macOS 15 are not run: no such machine here; #31 stays open for them.
Refs #31
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ftBXYuba8ARhQeF74oUgW
grenadeandClaude Opus 5