feat: productionize Corner Store compliance and RFQ stack - #89
Merged
Conversation
…d reorgs Constraint: RFQ service remains SDK/reference code without adding a production database dependency. Rejected: In-memory nonce and inventory reservation only | unsafe across server restart and multi-instance concurrency. Confidence: high Scope-risk: moderate Directive: Production deployment must supply an HA transactional database adapter and keep the bundled file store reference-only. Tested: npm RFQ, forge 857, RFQ E2E, diff, init race Not-tested: scripts/check fails pre-existing forge fmt in script/DeployProductionCore.s.sol and script/DemoScenarios.s.sol
…observable host boundary Constraint: Demo backend remains unchanged and no new runtime dependency was added. Rejected: Hardening the demo backend | mixes local-only and production boundaries. Confidence: high Scope-risk: moderate Directive: Production deploy must replace reference bearer auth, in-memory limiter, and file store with operator auth, shared limiter, transactional DB, TLS, and WORM audit. Tested: RFQ/host/demo tests, hostile auth/rate/freshness/signer/audit/reserved recovery, diff Not-tested: scripts/check blocked by pre-existing forge fmt drift in script/DeployProductionCore.s.sol and script/DemoScenarios.s.sol; E2E skipped to preserve untracked deployments.
…r failing open Constraint: ERC-3643/ONCHAINID remain issuer-controlled external trust boundaries and no vendor API is assumed. Rejected: Vendor-specific adapter/mock promotion | would couple core to unverified provider contracts. Confidence: high Scope-risk: moderate Directive: Production must supply authenticated provider adapter, transactional HA store/WORM audit, and issuer-approved claim writer. Tested: compliance-data npm, AcquisitionSource 8, BUIDLLikeFlow 7, identity/claim Elements 8, hostile 8, diff Not-tested: scripts/check blocked by pre-existing forge fmt drift in script/DeployProductionCore.s.sol and script/DemoScenarios.s.sol; E2E skipped to preserve deployments.
…rvice open Constraint: Live ERC-3643/ONCHAINID wiring must remain read-only verified before operator activation, and local demo/untracked deployments stay untouched. Rejected: Direct service activation from unchecked config | would bypass Safe/operator review and fail-closed live wiring gates. Confidence: high Scope-risk: moderate Directive: Production operators must review generated calldata and Safe proposal, execute externally, then run live verification before enabling venue, maker, signer, and inventory. Tested: toolkit npm, CLI npm, staged diff/secret/scratch scan, independent review. Not-tested: scripts/check blocked by pre-existing forge fmt drift in script/DeployProductionCore.s.sol and script/DemoScenarios.s.sol; E2E skipped to preserve untracked deployments and because no live production RPC was provided.
Constraint: Preserve legacy numeric RecipeBinding compatibility and existing local Anvil plus GIWA testnet flows. Rejected: Runtime-mutable recipe aliases without compiled enforcement plans | it leaves production policy behavior mutable after activation. Confidence: high Scope-risk: broad Directive: Treat recipeKey as canonical and version-independent; never rebind activated Element IDs, recipe key/version slots, or compiled token policy plans. Tested: Element/Recipe/TokenPolicy registry targeted tests; ComplianceEngine targeted tests; RegD integration; full forge suite; toolkit and CLI smoke tests; isolated scripts/check; local Anvil E2E profiles for reg-d and buidl-like. Not-tested: External production RPC execution, Safe transaction submission, and live venue/maker/signer approvals.
Constraint: Preserve existing Anvil, GIWA and generated-project compatibility without adding dependencies or publishing credentials. Rejected: Treating repository-relative Toolkit output as package validation | it does not prove a clean external consumer can install the artifact. Confidence: high Scope-risk: narrow Directive: Keep npm versions separate from persisted schema and capability versions; incompatible schemas require explicit adapters and migration tests. Tested: Toolkit, RFQ and CLI package tests; Node 20 clean-project SDK product smoke including packed Toolkit import, RFQ conformance, CLI doctor/deploy and packaged Foundry contract build; shell syntax; git diff check. Not-tested: Public npm registry publish, release credentials, or live production deployment; scripts/check stops at pre-existing Solidity formatting drift.
Constraint: The source CLI intentionally compiles sibling Toolkit sources, whose package-local dependencies are absent in a fresh runner until Toolkit installation. Rejected: Relying on developer node_modules hoisting | clean CI does not resolve ethers from the sibling CLI package. Confidence: high Scope-risk: narrow Directive: Keep source-checkout dependency installation ordered before compiling cross-package source imports. Tested: scripts/check.sh shell syntax and git diff check; failure reproduced in PRs #87-#89 as TS2307 for Toolkit ethers resolution. Not-tested: GitHub CI rerun pending push.
Constraint: PR #88 is stacked on #87 and must include the clean-runner Toolkit installation order. Confidence: high Scope-risk: narrow Directive: Preserve stacked branch ancestry when correcting shared CI prerequisites. Tested: Merge completed without conflicts; downstream CI pending. Not-tested: GitHub CI rerun pending push.
Constraint: PR #89 is stacked on #88 and must inherit the clean-runner Toolkit installation prerequisite. Confidence: high Scope-risk: narrow Directive: Preserve stacked branch ancestry when shared CI prerequisites change. Tested: Merge completed without conflicts; downstream CI pending. Not-tested: GitHub CI rerun pending push.
0xMuang
changed the title
0xMuang
changed the base branch from
feature/compliance-core-production-hardening
to
main
September 3, 2026 17:42
This was referenced Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This consolidated delivery PR contains the complete production-readiness stack previously reviewed as #84–#88:
Verification
Delivery
Supersedes component PRs #84, #85, #86, #87 and #88 after the author requested a reduced open-PR surface. Their branches and discussion remain available for audit history.
Production gaps
Public npm publish, production RPC execution, Safe submission, and live venue/maker/signer/inventory activation were not performed.