v0.3.12-pre.003

crates/ksp-worker-raw-transaction-ingest-lib/tests/dependency_boundary.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/dependency_boundary.rs
-// version: 9
+// version: 10
 
 //! Dependency firewall canaries for the RAW transaction ingest Worker foundation.
 
@@ -63,6 +63,51 @@ fn v0_3_12_pre_002_manifest_opens_only_the_onchain_transport_live_source_edge()
     return;
 }
 
+#[test]
+fn v0_3_12_pre_003_transaction_and_status_adapters_are_private_offline_and_transport_facade_only() {
+    let root = include_str!("../src/lib.rs");
+    let resources = include_str!("../src/runtime_resources.rs");
+    for required in [
+        "RawTransactionIngestYellowstoneSignalView for ksp_onchain_transport_lib::YellowstoneTransactionUpdate",
+        "RawTransactionIngestYellowstoneSignalView for ksp_onchain_transport_lib::YellowstoneTransactionStatusUpdate",
+        "YellowstoneTransactionUpdate::transaction(self).signature()",
+        "YellowstoneTransactionUpdate::transaction(self).index()",
+        "YellowstoneTransactionStatusUpdate::signature(self)",
+        "YellowstoneTransactionStatusUpdate::index(self)",
+        "RawTransactionSignature::new",
+        "matched_filter_fingerprint",
+        "yellowstone_provider_unrepresentable",
+        "yellowstone_endpoint_unrepresentable",
+    ] {
+        assert!(resources.contains(required), "required pre.003 signal-adapter contract missing: {required}");
+    }
+    for forbidden in [
+        "pub struct RawTransactionIngestSourceSignal",
+        "pub(crate) struct RawTransactionIngestSourceSignal",
+        "pub use self::runtime_resources::RawTransactionIngestSourceSignal",
+        "open_standard_subscribe",
+        "next_update",
+        "get_transaction_observed",
+        "get_block_observed",
+        "ksp_store_postgres_lib::",
+        "reqwest::",
+        "tonic::",
+        "yellowstone_grpc_proto::",
+    ] {
+        assert!(!resources.contains(forbidden) && !root.contains(forbidden), "pre.003 crossed a private/offline boundary: {forbidden}");
+    }
+    let status_impl =
+        match resources.split_once("impl RawTransactionIngestYellowstoneSignalView for ksp_onchain_transport_lib::YellowstoneTransactionStatusUpdate") {
+            std::option::Option::Some((_, tail)) => match tail.split_once("impl std::convert::From<") {
+                std::option::Option::Some((value, _)) => value,
+                std::option::Option::None => tail,
+            },
+            std::option::Option::None => "",
+        };
+    assert!(!status_impl.contains("::error(self)"), "TransactionStatus remote error material must not enter the private signal");
+    return;
+}
+
 #[test]
 fn v0_3_12_pre_002_source_surface_hardens_shutdown_and_faults_without_backend_or_premature_live_io() {
     let root = include_str!("../src/lib.rs");

crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
-// version: 3
+// version: 4
 
 //! External public, security, redaction and release-boundary hardening canaries for `pre.010`.
 
@@ -278,6 +278,40 @@ fn v0_3_12_pre_002_production_sources_keep_transport_confined_to_runtime_resourc
     return;
 }
 
+#[test]
+fn v0_3_12_pre_003_private_signal_debug_and_shape_do_not_expose_signature_filters_or_payload() {
+    let root = include_str!("../src/lib.rs");
+    let resources = include_str!("../src/runtime_resources.rs");
+    assert!(resources.contains("struct RawTransactionIngestSourceSignal"));
+    assert!(!root.contains("RawTransactionIngestSourceSignal"));
+    assert!(!resources.contains(".field(\"matched_filter_fingerprint\", &self.matched_filter_fingerprint)"));
+    assert!(!resources.contains(".field(\"signature\", &self.signature)"));
+    let signal_struct = match resources.split_once("struct RawTransactionIngestSourceSignal {") {
+        std::option::Option::Some((_, tail)) => match tail.split_once("}\n\nimpl std::fmt::Debug for RawTransactionIngestSourceSignal") {
+            std::option::Option::Some((value, _)) => value,
+            std::option::Option::None => "",
+        },
+        std::option::Option::None => "",
+    };
+    for forbidden in ["transaction:", "meta:", "error:", "payload:", "body:", "is_vote:"] {
+        assert!(!signal_struct.contains(forbidden), "payload/provider-specific field leaked into private source signal: {forbidden}");
+    }
+    for required in [
+        "created_at:",
+        "family:",
+        "matched_filter_count:",
+        "matched_filter_fingerprint:",
+        "network:",
+        "route:",
+        "signature:",
+        "slot:",
+        "transaction_index:",
+    ] {
+        assert!(signal_struct.contains(required), "required private signal field missing: {required}");
+    }
+    return;
+}
+
 #[test]
 fn v0_3_12_pre_002_runtime_resource_contract_performs_no_live_io_or_source_spawn() {
     let resources = include_str!("../src/runtime_resources.rs");

crates/ksp-worker-raw-transaction-ingest-lib/tests/release_completeness.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/release_completeness.rs
-// version: 2
+// version: 3
 
 //! Release-completeness canaries through the `pre.010` public/release/security hardening tranche.
 
@@ -98,6 +98,7 @@ fn pre_010_external_hardening_suite_is_present_and_scoped() {
         "pre_010_external_error_codes_are_stable_unique_and_domain_scoped",
         "pre_010_debug_and_settings_errors_redact_worker_identity_and_invalid_values",
         "v0_3_12_pre_002_manifest_dependency_surface_opens_only_transport_and_remains_backend_neutral",
+        "v0_3_12_pre_003_private_signal_debug_and_shape_do_not_expose_signature_filters_or_payload",
         "pre_010_source_visibility_contract_uses_crate_root_for_shared_items",
         "pre_010_production_surface_has_no_historical_backfill_or_retriever_contract",
         "v0_3_12_pre_002_production_sources_keep_transport_confined_to_runtime_resources",
@@ -111,6 +112,7 @@ fn pre_010_external_hardening_suite_is_present_and_scoped() {
     assert!(dependency_boundary.contains("pre_002_manifest_dependency_surface_is_exact"));
     assert!(dependency_boundary.contains("v0_3_12_pre_002_source_surface_hardens_shutdown_and_faults_without_backend_or_premature_live_io"));
     assert!(dependency_boundary.contains("v0_3_12_pre_002_manifest_opens_only_the_onchain_transport_live_source_edge"));
+    assert!(dependency_boundary.contains("v0_3_12_pre_003_transaction_and_status_adapters_are_private_offline_and_transport_facade_only"));
     let public_api = include_str!("public_api.rs");
     assert!(public_api.contains("pre_003_kind_code_and_settings_are_consumable_from_crate_root"));
     assert!(public_api.contains("pre_004_start_handle_and_terminal_future_are_consumable_without_public_join_handle"));