ci: enforce Rust/TypeScript vector parity for verify_receipt (issue #53) - #245
Open
lawalajose wants to merge 1 commit into
Open
ci: enforce Rust/TypeScript vector parity for verify_receipt (issue #53)#245lawalajose wants to merge 1 commit into
lawalajose wants to merge 1 commit into
Conversation
…ccensa#53) Single source of truth: contracts/receipt-anchor/merkle-vectors.json owns the shared Merkle inclusion vectors, with a committed content hash (merkle-vectors.json.sha256). src/vectors.rs is now generated from it by scripts/build-vectors.mjs; a --check mode fails CI on drift or a stale hash. Cross-repo guard: a vector-parity job fetches accensa-app's vendored copy (pinned ref) and fails the build on hash divergence; accensa-app runs the mirror job (cross-repo/accensa-app). Strict on main/schedule/dispatch, warning on PRs so the sync PR itself is not blocked. Extended vectors to cover odd leaf counts requiring promotion, duplicate leaves, the sorted-pair tie (both siblings identical), and an over-long/wrong-length proof. A new test guard asserts these categories remain present. See docs/CONFORMANCE.md for ownership, mechanism, and limits.
|
@lawalajose Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
|
MergeKeeper review Scope: in scope for linked issue Successfully implements CI enforcement of Rust/TypeScript vector parity for verify_receipt along with single source of truth, extended edge cases, and comprehensive documentation. Reviewed commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #53. The
verify_receiptMerkle vectors were shared between this Rust contract and theaccensa-appTypeScript SDK, but nothing automated kept the two copies from silently diverging. This establishes a single source of truth and a CI guard that fails the build on divergence.What changed
contracts/receipt-anchor/merkle-vectors.jsonis now the canonical vector set, with a committed content hashmerkle-vectors.json.sha256.src/vectors.rsis generated from it byscripts/build-vectors.mjs(--checkfails CI on drift or a stale hash).vector-parityjob in.github/workflows/ci.ymlfetchesaccensa-app's vendoredpackages/sdk/merkle-vectors.json(pinnedACCELSA_APP_REF) and fails the build when its hash differs from ours. It runs on push tomain, PRs, a daily schedule, and onrepository_dispatch(a push here pingsaccensa-app). Strict on main/schedule/dispatch; a warning on PRs so the sync PR isn't blocked.[X,X]), and an over-long/wrong-length proof. A newtest_shared_vectors_cover_required_edge_casesguard asserts these categories remain present.docs/CONFORMANCE.mddocuments ownership, the three enforcement layers, and — importantly — what parity does not guarantee.accensa-app side (required for full closure)
The mirror workflow and install steps live in
cross-repo/accensa-app/(.github/workflows/vector-parity.yml+README.md). A maintainer with access toaccensa/accensa-appmust open the companion PR that vendors the JSON + hash and adds that job. I could not open it from this environment — the ready-to-merge file and steps are provided there.Verification
node contracts/receipt-anchor/scripts/build-vectors.mjs --checkpasses locally (vectors.rs + hash in sync).receipt-shard/src/lib.rs:127): everyexpected: trueverifies, every negative case is rejected.🤖 Generated with opencode