v0.3.14-pre.013

2026-09-12 20:43:43 +02:00
parent 8a0717c839
commit 09c91172ae
7 changed files with 537 additions and 9 deletions
--- a/crates/ksp-worker-raw-transaction-ingest-lib/tests/cross_layer_completeness.rs
+++ b/crates/ksp-worker-raw-transaction-ingest-lib/tests/cross_layer_completeness.rs
@@ -1,7 +1,7 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/cross_layer_completeness.rs
-// version: 2
+// version: 3

-//! Cross-layer completeness and security canaries through `0.3.13-pre.012`.
+//! Cross-layer completeness and security canaries through `0.3.14-pre.013`.

 fn dependency_names(manifest: &str) -> std::vec::Vec<&str> {
    let mut section = "";
@@ -363,3 +363,127 @@ fn v0_3_13_pre_012_security_redaction_matrix_covers_all_live_sources_and_lower_l
    assert!(postgres.contains("pre_009_backend_error_bridge_cannot_retain_external_error_or_secret_text"));
    return;
 }
+
+#[test]
+fn v0_3_14_pre_013_gap_repair_closure_keeps_one_transport_worker_common_raw_store_pipeline() {
+    let transport_transactions = include_str!("../../ksp-onchain-transport-lib/src/rpc_transactions.rs");
+    let transport_blocks = include_str!("../../ksp-onchain-transport-lib/src/rpc_blocks.rs");
+    let worker_root = include_str!("../src/lib.rs");
+    let worker_resources = include_str!("../src/runtime_resources.rs");
+    let worker_runtime = include_str!("../src/runtime.rs");
+    let worker_persistence = include_str!("../src/persistence.rs");
+    let common_raw_root = include_str!("../../ksp-raw-transaction-lib/src/lib.rs");
+    let store_api_root = include_str!("../../ksp-store-api/src/lib.rs");
+    let store = include_str!("../../ksp-store-lib/src/store.rs");
+    assert!(transport_transactions.contains("pub async fn get_transaction_observed("));
+    assert!(transport_blocks.contains("pub async fn get_block_observed("));
+    for required in [
+        "RawTransactionIngestContinuityContracts",
+        "RawTransactionIngestGlobalHydrationRegistry",
+        "RawTransactionAdmission",
+        "persist_raw_transaction_ingest_converged_acquisition",
+    ] {
+        assert!(
+            worker_root.contains(required) || worker_resources.contains(required) || worker_runtime.contains(required),
+            "pre.013 Worker single-pipeline proof missing: {required}"
+        );
+    }
+    assert!(worker_persistence.contains("ksp_store_lib::RawTransactionWrite::persist_raw_transaction_acquisition"));
+    assert!(common_raw_root.contains("pub use self::acquisition::RawTransactionAcquisition;"));
+    assert!(common_raw_root.contains("pub use self::wire::RawSolanaMessageVersion;"));
+    assert!(store_api_root.contains("pub use self::model::raw_transaction::RawTransaction;"));
+    assert!(store_api_root.contains("pub use self::model::raw_transaction::RawTransactionObservation;"));
+    assert!(store.contains("persist_raw_transaction_acquisition"));
+    assert!(store.contains("record_raw_transaction_observation"));
+    for forbidden in [
+        "ksp_store_postgres_lib::",
+        "ksp_config_lib::",
+        "ksp_job_backfill_lib::",
+        "reqwest::",
+        "tokio_tungstenite::connect_async",
+        "yellowstone_grpc_proto::",
+    ] {
+        assert!(
+            !worker_runtime.contains(forbidden) && !worker_resources.contains(forbidden) && !worker_persistence.contains(forbidden),
+            "pre.013 Worker bypassed the single facade pipeline: {forbidden}"
+        );
+    }
+    return;
+}
+
+#[test]
+fn v0_3_14_pre_013_security_redaction_covers_gap_repair_and_terminal_paths() {
+    let transport_subscribe = include_str!("../../ksp-onchain-transport-lib/unit_tests/grpc_subscribe.rs");
+    let transport_unary = include_str!("../../ksp-onchain-transport-lib/unit_tests/grpc_unary.rs");
+    let worker_hardening = include_str!("hardening.rs");
+    let worker_root = include_str!("../src/lib.rs");
+    let common_raw = include_str!("../../ksp-raw-transaction-lib/unit_tests/canonical.rs");
+    let store_api = include_str!("../../ksp-store-api/tests/security_hardening.rs");
+    let store = include_str!("../../ksp-store-lib/tests/hardening_completeness.rs");
+    let postgres = include_str!("../../ksp-store-postgres-lib/tests/hardening_completeness.rs");
+    assert!(transport_subscribe.contains("yellowstone_subscribe_debug_omits_filter_names_and_future_payloads"));
+    assert!(transport_unary.contains("yellowstone_remote_status_does_not_copy_message_details_or_metadata"));
+    for required in [
+        "v0_3_14_pre_009_health_policy_is_present_future_coverage_gated_and_source_neutral",
+        "v0_3_14_pre_010_repair_fairness_shares_existing_bounds_without_second_pipeline",
+        "v0_3_14_pre_011_gap_observability_is_bounded_checked_and_redacted",
+        "v0_3_14_pre_012_shutdown_races_are_bounded_across_source_and_worker_drains",
+    ] {
+        assert!(worker_hardening.contains(required), "pre.013 Worker security closure proof missing: {required}");
+    }
+    for forbidden in ["source_key", "provider_gap", "endpoint_gap", "signature_gap", "payload_gap"] {
+        assert!(!worker_root.contains(forbidden), "pre.013 public Worker root leaked sensitive gap material: {forbidden}");
+    }
+    assert!(common_raw.contains("pre_002_material_and_wire_debug_do_not_render_transaction_or_meta_material"));
+    assert!(store_api.contains("pre_007_raw_debug_surfaces_do_not_render_payload_hash_signature_or_account_bytes"));
+    assert!(store.contains("pre_009_secret_canary_never_crosses_settings_or_pre_io_error_debug"));
+    assert!(postgres.contains("pre_009_backend_error_bridge_cannot_retain_external_error_or_secret_text"));
+    return;
+}
+
+#[test]
+fn v0_3_14_pre_013_legacy_v0_v1_remains_proven_after_gap_repair_hardening() {
+    let transport = include_str!("../../ksp-onchain-transport-lib/unit_tests/grpc_subscribe.rs");
+    let worker = include_str!("../unit_tests/runtime_resources.rs");
+    let common_raw = include_str!("../../ksp-raw-transaction-lib/unit_tests/wire.rs");
+    let store_api = include_str!("../../ksp-store-api/tests/public_api.rs");
+    for required in [
+        "yellowstone_transaction_update_decodes_current_storage_wire_including_v1_config_and_meta",
+        "yellowstone_block_update_reuses_transaction_account_entry_dtos_and_preserves_server_counts",
+    ] {
+        assert!(transport.contains(required), "pre.013 Transport Legacy/V0/V1 proof missing: {required}");
+    }
+    for required in [
+        "v0_3_13_pre_004_legacy_v0_v1_block_materials_are_direct_common_raw_with_exact_version_and_index",
+        "v0_3_13_pre_006_http_block_polling_qualifies_legacy_v0_v1_and_rejects_ambiguous_or_future_versions",
+        "v0_3_14_pre_008_proven_full_ledger_epoch_survives_filtered_peer_loss_without_worker_respawn",
+        "v0_3_14_pre_012_source_fault_preserves_first_fault_and_aborts_non_cooperative_sibling",
+    ] {
+        assert!(worker.contains(required), "pre.013 Worker Legacy/V0/V1 or continuity proof missing: {required}");
+    }
+    for required in [
+        "pre_006_legacy_v0_and_v1_wire_goldens_are_exact",
+        "RawSolanaMessageVersion::Legacy",
+        "RawSolanaMessageVersion::V0",
+        "RawSolanaMessageVersion::V1",
+    ] {
+        assert!(common_raw.contains(required), "pre.013 Common RAW version proof missing: {required}");
+    }
+    assert!(store_api.contains("public_pre_003_raw_transaction_and_observation_are_constructible_from_crate_root"));
+    return;
+}
+
+#[test]
+fn v0_3_14_pre_013_worker_and_backfill_remain_independent_producers() {
+    let worker = dependency_names(include_str!("../Cargo.toml"));
+    let backfill = dependency_names(include_str!("../../ksp-job-backfill-lib/Cargo.toml"));
+    assert!(!worker.contains(&"ksp-job-api"));
+    assert!(!worker.contains(&"ksp-job-backfill-lib"));
+    assert!(!backfill.contains(&"ksp-worker-api"));
+    assert!(!backfill.contains(&"ksp-worker-raw-transaction-ingest-lib"));
+    for shared in ["ksp-onchain-transport-lib", "ksp-raw-transaction-lib", "ksp-store-lib"] {
+        assert!(worker.contains(&shared), "Worker common RAW producer edge missing: {shared}");
+        assert!(backfill.contains(&shared), "Backfill common RAW producer edge missing: {shared}");
+    }
+    return;
+}
--- a/crates/ksp-worker-raw-transaction-ingest-lib/tests/dependency_boundary.rs
+++ b/crates/ksp-worker-raw-transaction-ingest-lib/tests/dependency_boundary.rs
@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/dependency_boundary.rs
-// version: 30
+// version: 31

 //! Dependency firewall canaries for the RAW transaction ingest Worker foundation.

@@ -758,3 +758,36 @@ fn v0_3_14_pre_012_shutdown_hardening_stays_worker_local_and_facade_only() {
    }
    return;
 }
+
+#[test]
+fn v0_3_14_pre_013_cross_layer_closure_keeps_dependency_and_producer_boundaries_exact() {
+    let manifest = include_str!("../Cargo.toml");
+    let dependencies = dependency_section(manifest);
+    let names = manifest_dependency_names(dependencies);
+    assert_eq!(
+        names,
+        vec![
+            "ksp-core-lib",
+            "ksp-logging-lib",
+            "ksp-onchain-transport-lib",
+            "ksp-raw-transaction-lib",
+            "ksp-store-lib",
+            "ksp-worker-api",
+            "sha2",
+            "tokio",
+        ],
+    );
+    let cross_layer = include_str!("cross_layer_completeness.rs");
+    for required in [
+        "v0_3_14_pre_013_gap_repair_closure_keeps_one_transport_worker_common_raw_store_pipeline",
+        "v0_3_14_pre_013_security_redaction_covers_gap_repair_and_terminal_paths",
+        "v0_3_14_pre_013_legacy_v0_v1_remains_proven_after_gap_repair_hardening",
+        "v0_3_14_pre_013_worker_and_backfill_remain_independent_producers",
+    ] {
+        assert!(cross_layer.contains(required), "pre.013 cross-layer closure proof missing: {required}");
+    }
+    for forbidden in ["ksp-config-lib", "ksp-job-api", "ksp-job-backfill-lib", "ksp-store-api", "ksp-store-postgres-lib"] {
+        assert!(!names.contains(&forbidden), "pre.013 Worker dependency boundary expanded: {forbidden}");
+    }
+    return;
+}
--- a/crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
+++ b/crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
-// version: 36
+// version: 37

 //! External public, security, redaction and release-boundary hardening canaries through `v0.3.14-pre.011`.

@@ -1352,3 +1352,25 @@ fn v0_3_14_pre_012_shutdown_races_are_bounded_across_source_and_worker_drains()
    }
    return;
 }
+
+#[test]
+fn v0_3_14_pre_013_cross_layer_completeness_security_closure_is_exact_and_redacted() {
+    let cross_layer = include_str!("cross_layer_completeness.rs");
+    let dependency_boundary = include_str!("dependency_boundary.rs");
+    let public_api = include_str!("public_api.rs");
+    for required in [
+        "v0_3_14_pre_013_gap_repair_closure_keeps_one_transport_worker_common_raw_store_pipeline",
+        "v0_3_14_pre_013_security_redaction_covers_gap_repair_and_terminal_paths",
+        "v0_3_14_pre_013_legacy_v0_v1_remains_proven_after_gap_repair_hardening",
+        "v0_3_14_pre_013_worker_and_backfill_remain_independent_producers",
+    ] {
+        assert!(cross_layer.contains(required), "pre.013 cross-layer hardening proof missing: {required}");
+    }
+    assert!(dependency_boundary.contains("v0_3_14_pre_013_cross_layer_closure_keeps_dependency_and_producer_boundaries_exact"));
+    assert!(public_api.contains("v0_3_14_pre_013_completeness_closure_adds_no_public_surface"));
+    let root = include_str!("../src/lib.rs");
+    for forbidden in ["source_key", "provider_gap", "endpoint_gap", "signature_gap", "payload_gap", "pub mod "] {
+        assert!(!root.contains(forbidden), "pre.013 public Worker root leaked forbidden material: {forbidden}");
+    }
+    return;
+}
--- a/crates/ksp-worker-raw-transaction-ingest-lib/tests/public_api.rs
+++ b/crates/ksp-worker-raw-transaction-ingest-lib/tests/public_api.rs
@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/public_api.rs
-// version: 23
+// version: 24

 //! External public-surface proofs for the RAW transaction ingest Worker foundation.

@@ -479,3 +479,36 @@ fn v0_3_14_pre_011_gap_observability_is_public_bounded_and_source_neutral() {
    }
    return;
 }
+
+#[test]
+fn v0_3_14_pre_013_completeness_closure_adds_no_public_surface() {
+    let root = include_str!("../src/lib.rs");
+    let public_exports = root.lines().filter(|line| line.trim().starts_with("pub use ")).count();
+    assert_eq!(public_exports, 43);
+    for required in [
+        "RawTransactionIngestGapId",
+        "RawTransactionIngestGapReason",
+        "RawTransactionIngestGapSnapshot",
+        "RawTransactionIngestGapState",
+        "RawTransactionIngestRepairMethod",
+        "RawTransactionIngestSnapshot",
+        "RawTransactionIngestWorker",
+    ] {
+        assert!(root.contains(required), "pre.013 expected stable public Worker surface missing: {required}");
+    }
+    for forbidden in [
+        "RawTransactionIngestContinuityContracts",
+        "RawTransactionIngestGlobalHydrationRegistry",
+        "RawTransactionIngestSourceInventory",
+        "RawTransactionIngestTrafficClass",
+        "RawTransactionIngestFairTurnGate",
+        "RawTransactionIngestSourceLossDecision",
+    ] {
+        assert!(
+            !root.lines().any(|line| line.trim().starts_with("pub use ") && line.contains(forbidden)),
+            "pre.013 private type leaked publicly: {forbidden}"
+        );
+    }
+    assert!(!root.contains("pub mod "));
+    return;
+}
--- a/crates/ksp-worker-raw-transaction-ingest-lib/tests/release_completeness.rs
+++ b/crates/ksp-worker-raw-transaction-ingest-lib/tests/release_completeness.rs
@@ -1,7 +1,7 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/release_completeness.rs
-// version: 31
+// version: 32

-//! Release-completeness canaries through the `v0.3.14-pre.011` gap observability tranche.
+//! Release-completeness canaries through the `v0.3.14-pre.013` cross-layer closure tranche.

 #[test]
 fn pre_010_production_module_inventory_is_exact() -> std::io::Result<()> {
@@ -441,3 +441,25 @@ fn v0_3_14_pre_012_shutdown_race_canaries_cover_bounded_source_and_worker_drains
    assert!(!root.contains("SourceDrain"));
    return;
 }
+
+#[test]
+fn v0_3_14_pre_013_cross_layer_closure_canaries_are_complete_without_behavior_or_surface_growth() {
+    let cross_layer = include_str!("cross_layer_completeness.rs");
+    let dependency_boundary = include_str!("dependency_boundary.rs");
+    let hardening = include_str!("hardening.rs");
+    let public_api = include_str!("public_api.rs");
+    for required in [
+        "v0_3_14_pre_013_gap_repair_closure_keeps_one_transport_worker_common_raw_store_pipeline",
+        "v0_3_14_pre_013_security_redaction_covers_gap_repair_and_terminal_paths",
+        "v0_3_14_pre_013_legacy_v0_v1_remains_proven_after_gap_repair_hardening",
+        "v0_3_14_pre_013_worker_and_backfill_remain_independent_producers",
+    ] {
+        assert!(cross_layer.contains(required), "required pre.013 cross-layer canary missing: {required}");
+    }
+    assert!(dependency_boundary.contains("v0_3_14_pre_013_cross_layer_closure_keeps_dependency_and_producer_boundaries_exact"));
+    assert!(hardening.contains("v0_3_14_pre_013_cross_layer_completeness_security_closure_is_exact_and_redacted"));
+    assert!(public_api.contains("v0_3_14_pre_013_completeness_closure_adds_no_public_surface"));
+    assert!(include_str!("../src/lib.rs").contains("RawTransactionIngestGapSnapshot"));
+    assert!(include_str!("../src/lib.rs").contains("RawTransactionIngestWorker"));
+    return;
+}