114721c24abc9e1be7d1e0050ccf1d10b797bc33
10
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  davidherranandClaude Fable 5
|
114721c24a |
fix(ink/credential): cota anti-griefing del Vec del holder (audit C, HIGH DoS)
Audit ultra 2026-07-04 (dimensión ink-contracts, decisión C de David): un issuer malicioso podía emitir credenciales ilimitadas a una VÍCTIMA, bloateando su holder_credentials: Vec hasta que cualquier op que lo cargara (issue/read) excedía el gas → griefing DoS. Fix: MAX_CREDENTIALS_PER_HOLDER=512 + error HolderCredentialLimitReached antes del push. (Nota: el índice issuer_credentials de un emisor de alto volumen debe migrar a Mapping<(issuer,i),id> paginado — trabajo futuro; no es griefing de terceros.) Contrato 4 tests verde. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
davidherranandClaude Fable 5
|
db4c8a37d3 |
fix(ink/staking): slash() sin guard de estado → insolvencia (CRITICAL audit ultra)
Audit ultra 2026-07-04 (dimensión ink-contracts): slash() checaba solo caller==slashing_authority, existencia y amount<=stake.amount — NUNCA el stake.state. Y withdraw() ponía state=Withdrawable pero NO ceroaba stake.amount. ⇒ tras un withdraw, el slashing_authority podía slashear el stake retirado (amount<=stake.amount pasaba con el principal ya devuelto), pagando el treasury_share desde el pool de OTROS stakers (insolvencia + doble decremento de total_staked). Alcanzable por el Tribunal (autoridad confiable), no cubierto por FIX-1 (CEI) ni FIX-6 (fake APR). Fix: (a) guard de estado en slash() — solo Active|Unbonding; Withdrawable/Slashed → InvalidState. (b) withdraw() cero stake.amount + rewards_accumulated tras computar to_return. +test E2E (ink v6, set_contract_balance). Contrato 5 tests verde. (No desplegado — fase futura; endurecido antes de que sea dinero real.) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
davidherranandClaude Opus 4.8
|
e6a803b54f |
feat(emission): FIX-6 Stage 1 — emision que paga validadores (V2-CA2) + remover APR falso
Build + tests verde: emission pallet 5 + runtime 28 (incl. emission_pallet_index_13)
+ staking contract 4. Verificacion adversarial ultracode (2 skeptics): correctitud
+ seguridad CONFIRMADAS (split exacto, sin overflow, autor solo-desde-Aura sin
input de usuario, mint-None-seguro, sin dispatchable explotable, APR removal
honesto). 'partial' solo por cobertura de tests en ramas triviales (None /
reward==0), NO por vulnerabilidad.
Cierra V2-CA2 (la cadena no tenia emision -> los validadores ganaban 0 OGC):
NUEVO pallet origin-chain-emission (Index 13):
- on_initialize cada bloque: identifica al autor Aura (FindAuthor =
pallet_session::FindAccountFromAuthorIndex<Runtime, Aura>), mintea un
BlockReward (10 OGC, ~5.26% inflacion anual) y lo reparte:
- 70% al autor (el validador que produjo el bloque).
- 20% al treasury (og/gvtry — la MISMA cuenta-vault de governance FIX-6).
- 10% al subsidy pool (og/subsy — proof-of-equity que financia el subsidio
de hardware anti-clasista #16).
- El residual del split va al subsidy (no pierde unidades por redondeo de bps).
- TotalEmitted trackea la inflacion acumulada on-chain. mint_into (fungible::
Mutate) = emision real (aumenta total issuance).
- El autor viene SOLO de FindAuthor/Aura (no de input de usuario) -> nadie puede
mintear a una cuenta arbitraria. Si FindAuthor devuelve None, no mintea. Sin
overflow (saturating_mul/div, 10^19 << u128::MAX).
sub_mult ORTOGONAL (David 2026-06-10): el subsidy pool financia el subsidio de
hardware SIN importar la suscripcion premium. Esta emision lo alimenta; el
OnChargeTransaction de Stage 2 lo consumira.
Remover APR falso (V1/V2 fake APR): staking contract default_chn3 reward rates
8/5/3% -> 0. Era enganoso (no habia motor que los pagara; los campos
reward_rate_bps se almacenaban pero NUNCA se leian, rewards_accumulated jamas se
acreditaba). Los validadores ahora cobran via la emision real; las tasas de
staking reales las define Stage 2 (NPoS por stake).
FIX-6 Stage 1 COMPLETO (con v0.0.56 treasury real): emision + treasury real +
APR removido. Stage 2: NPoS (pallet_staking + EraPayout) + fee unificado
(OnChargeTransaction con sub_mult ortogonal).
FOLLOW-UPS (low, documentados): anadir tests de cobertura para las ramas
FindAuthor==None (no mintea) y reward==0 (requieren un 2o mock runtime);
BlockReward fijo (decay schedule = Stage 2); el subsidy pool acumula pero no se
consume hasta el OnChargeTransaction de Stage 2; genesis mainnet del treasury
vault (pre-launch).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|
davidherranandClaude Opus 4.8
|
34a2041f2b |
fix(contracts): cierra migración ink! v6 (credential) + FIX-1 V1-H7 (escrow milestone sum)
Completa la capa de contratos: los 4 templates buildables migrados a ink! 6.0.0-beta.1 (17 tests verde). El 5º (mdk-reconciliation) es design-only (DESIGN.md, sin código Rust — nada que migrar). origin-credential-mint: migración ink! v6 (Address/U256/StorageLayout). Su issue() ya era CEI-correcto (muta estado antes del transfer) — es el template que el roadmap cita como referencia. 4 tests verde (+ guard test). NOTA: FIX-4 (verify de issuer_signature on-chain) sigue pendiente — necesita el payload canónico de credencial + precompile Ed25519 (Phase 3.x), no es parte de la migración. FIX-1 V1-H7 (escrow): enforce Σ milestone.amount <= total_amount en add_milestone (previene sobre-liberación) + completion vía milestone_total + sweep terminal del residual no-asignado al depositor (deposited − milestone_total). 5 tests verde (+ test del invariante con set_caller). El sweep (transfer) se valida E2E en nodo — node-gated. 17 tests verde totales (escrow 5 + staking 4 + nft 4 + credential 4). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
davidherranandClaude Opus 4.8
|
6663dbdc0f |
fix(contracts): FIX-1 contract-safety + migración ink! v6 (escrow/staking/nft)
REMEDIATION_ROADMAP_V1 FIX-1 (V1-C1 reentrancy + V1-C4 zero-burn). Los 3 templates ahora COMPILAN contra ink! 6.0.0-beta.1 + tests verde (12/12). Hallazgo (honesto): los templates se shippearon "scaffold compile-only" pero nunca compilaron contra su versión pinneada de ink!. ink! v6 / pallet-revive es H160-Address + U256 nativo (no AccountId + Balance, modelo viejo). Esta migración los vuelve reales (compilando + testeados). Migración ink! v6: - AccountId -> Address (H160) en parties / storage / events / reads / params. - transfer() + transferred_value() -> U256 (+ helper u256_to_balance saturante). - derive StorageLayout en tipos de storage (EscrowState/Milestone/Stake/...). - doctest fences sin lenguaje -> text (diagramas ASCII del lifecycle). - workspace: contracts/* excluidos (toolchain PolkaVM/pallet-revive distinta). FIX-1 hardening: - CEI (Checks-Effects-Interactions): muta TODO el storage ANTES de cualquier transfer() -> una reentrada ve el estado final y falla sus checks. Sitios: escrow confirm_milestone/resolve_dispute, staking withdraw/slash, nft mint/transfer. Cierra V1-C1. (nft mint encontrado más allá de la lista del roadmap; mismo patrón explotable -> incluido). - Burn real (V1-C4): elimina transfer([0;32]) (que no reduce emisión y ensucia la cuenta cero); el burn se RETIENE en el contrato (fuera de circulación), a barrer por el primitivo de burn del runtime -> una sola semántica, no dos. (staking slash, nft mint). - Tests de guarda de estado (la C de CEI) añadidos en los 3 contratos. Pendiente E2E (node-gated, requiere VPS + nodo pallet-revive): - Correctitud económica native<->eth (NATIVE_TO_ETH_RATIO): asumido 1:1; debe validarse en nodo real antes de testnet/mainnet. - Tests reales de reentrancy/double-spend: el env off-chain de #[ink::test] no modela el revert-on-Err ni la semántica de balances -> serían engañosos. - V1-H7 (suma milestones == total_amount): no incluido en este commit. - credential-mint + mdk-reconciliation necesitan la misma migración ink! v6. Cross-pillar: DC ORIGIN_ATTESTATION_SIGNING_PAYLOAD_V1 abierto con Ergon (payload postcard canónico + domain-separation FIX-3) — gate del verificador de attestation on-chain. OAGIP-D10 (Charon identity attestation) definido a Palace para el protocolo. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
davidherran
|
c2aa04fe02 |
feat(contracts): v0.0.46 — Slice 3.6 origin-mdk-reconciliation DESIGN STUDY 🎉🎉🎉
Ship Slice 3.6 v0.0.46 — design study cerrando Phase 3 templates library
canonical. NO contract deployable: explora boundary arquitectural entre dos
sistemas WASM distintos que coexisten en Origin Metaverse:
1. **ink! v6 contracts** (this library 3.2-3.5): run inside pallet-revive
on-chain canonical, ABI pallet-revive, state Origin Chain storage.
2. **origin-mdk skills** (Marihan MDK skill-wasm-stdlib): run inside wasmtime
off-chain canonical, ABI OMC v1.0 SEALED, state ephemeral interpreter session.
Cambios:
- contracts/origin-mdk-reconciliation/DESIGN.md: 7-section comprehensive
design study filed:
* §0 Por qué es DESIGN STUDY no contract template
* §1 Problema arquitectural canonical (7 use cases requiring bridge)
* §2 Tres patterns canonical propuestos:
- Pattern A: Off-chain → On-chain via RPC client (host_invoke_chain_contract)
- Pattern B: On-chain → Off-chain via event subscription
- Pattern C: Shared state via Hash Anchoring (loose coupling, Inmutable #26)
* §3 Recomendación canonical per use case mapped (7 use cases → 3 patterns)
* §4 Implementation roadmap canonical 4-fases Q4 2026 → Q4 2027
* §5 Open questions pending cross-pillar coord (5 stakeholder questions)
* §6 KG triples canonical (7 triples Palace projection)
* §7 Cierre canonical + Charon Atelier visual bridge designer integration
Use cases cubiertos por design study:
- Atelier skill becomes NFT (Pattern B event subscription)
- Skill execution receipt on-chain (Pattern A RPC client)
- Chain credential verify in skill (Pattern A)
- Cross-pillar fee schedule from skill (Pattern A)
- Skill marketplace purchase (Pattern B event)
- AGI commercial reputation slash (Pattern A direct call)
- Soul TOML on-chain anchor (Pattern C hash anchoring inmutable)
Cross-pillar coord pending canonical:
- Marihan endorsement OMC ABI v2.0 host imports extension canonical
- Sussi Ethos attestation patterns canonical
- Ergon architectural review canonical
- Design Contract opens: ORIGIN_MDK_PALLET_REVIVE_BOUNDARY_V1
Implementation roadmap canonical 4-fases:
- Fase 1 Q4 2026: Design Contract + OMC ABI v2.0 spec draft (backwards compat)
- Fase 2 Q1 2027: Origin Navigator RPC bridge MVP + reference example
- Fase 3 Q2-Q3 2027: Origin Contract Atelier visual bridge designer
- Fase 4 Q4 2027+: Standard library bridge primitives + Daimonion auto-suggest
⚓ Phase 3 Slices 3.1-3.6 ALL SHIPPED end-to-end canonical:
- 3.1 SCAFFOLD COMPLETE pallet-revive integration (v0.0.37-41)
- 3.2 origin-nft-mint template (v0.0.42)
- 3.3 origin-escrow template (v0.0.43)
- 3.4 origin-credential-mint template (v0.0.44)
- 3.5 origin-staking template (v0.0.45)
- 3.6 origin-mdk-reconciliation DESIGN STUDY (v0.0.46)
10 ships shipped sesión 4+ Charon (v0.0.37-46) — la nave Origin Chain smart
contracts foundation armada end-to-end + design coherence cross-system
documented canonical pre-implementation Phase 3.x maduración.
🤖 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
davidherran
|
8634be5b87 |
feat(contracts): v0.0.45 — Slice 3.5 origin-staking template SCAFFOLD (3 stake kinds + slashing) 🎉
Ship Slice 3.5 v0.0.45 — fourth foundational template del Origin Contract Atelier.
Multi-purpose staking patterns: validator (CHN-3 NPoS Phase 2 prep) + beacon
(Pillar 6 featured visibility) + reputation (AGI commercial reputation per BM V2 §6.4).
Cambios:
- contracts/origin-staking/{Cargo.toml,lib.rs,README.md}: full template
- 3 StakeKind variants canonical: Validator + Beacon + Reputation
- 4 StakeState lifecycle: Active → Unbonding → Withdrawable + Slashed branch
- Storage canonical: config per kind (min_stake + lockup + reward_rate) + state +
per-kind totals + staker indices
- 4 events: Staked, UnbondRequested, Withdrawn, Slashed
- 8 error variants + Result type
- 2 constructors: new (full params) + default_chn3 (NPoS Phase 2 prep defaults
100 OGC validator min + 28 días lockup + 8% APR)
- 5 reads canonical (Inmutable #37 gratis): stake, stakes_of, total_staked,
min_stake, lockup_blocks
- 4 writes: stake_tokens (payable per kind), unbond_request (transitions Unbonding),
withdraw (post-lockup), slash (slashing_authority Tribunal-only, 50/50 treasury/burn)
- 3 unit tests canonical
Inmutables compliance:
- #16 HTS: min_stake graduated HardwareTier inclusion canonical Pi 5
- #37 Free perpetua: 5 reads sin payment
- #26 Content-Addressed: reason_hash BLAKE3 inmutable slash events
- #41 AGI Cross-Species: AGI stake canonical (especially Reputation kind)
Slashing canonical: 50% Treasury + 50% Burn (BM V2 burn matrix Pillar 3).
Tribunal Pillar 6 = slashing_authority typical (governance Phase 5 assigned).
Cross-pillar wire:
- Pillar 4 Charon: validator stake compose pallet-session NPoS Phase 2
- Pillar 6 Mathi/Tribunal: beacon stake + slashing authority
- BM V2 Pillar 4 §6.4: AGI reputation stake/slash mechanics
Próximo Ship Slice 3.6 v0.0.46: origin-mdk-reconciliation design study
(ink! ↔ origin-mdk WASM boundary architectural design + cross-pillar Marihan coord).
⚓ Path A Slice 3.5 SCAFFOLD shipped. Templates 4/5 complete + CHN-3 NPoS prep.
🤖 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
davidherran
|
a1be3609a1 |
feat(contracts): v0.0.44 — Slice 3.4 origin-credential-mint template SCAFFOLD (Ed25519+BLAKE3) 🎉
Ship Slice 3.4 v0.0.44 — third foundational template del Origin Contract Atelier.
Cryptographically verifiable credentials (academic + professional + KYB + skill
mastery) usando Ed25519 signatures + BLAKE3 content addressing. Sussi Ethos
schema integration canonical.
Cambios:
- contracts/origin-credential-mint/{Cargo.toml,lib.rs,README.md}: full template
- 5 CredentialType variants: Academic + Professional + Kyb + Skill + Custom
- Storage canonical: authorized_issuers whitelist + credentials + holder/issuer
indices
- 3 events: CredentialIssued, CredentialRevoked, IssuerAuthorized
- 10 error variants + Result type
- 7 read methods (free per Inmutable #37): owner, treasury, issue_fee,
total_credentials, is_issuer_authorized, credential, credentials_of_holder/issuer
- 1 verify() method canonical (read-only, gratis): valid si !revoked && !expired
- 3 write methods: authorize_issuer (owner-only), issue (authorized + payable),
revoke (issuer-only)
- 3 unit tests canonical
Inmutables compliance:
- #16 HTS: issue_fee modulated HardwareTier escuelas Pi 5
- #26 Content-Addressed: BLAKE3 + Ed25519 inmutables post-mint
- #37 Free perpetua: 7 reads + verify() sin payment
- #41 AGI Cross-Species: AGI puede ser issuer (Daimonion) OR holder
Sussi Ethos schema integration canonical pending Phase 3.x cross-pillar coord:
schema_type enum + signature pattern + KYB Oracle whitelist via governance Phase 5.
Cross-pillar wire:
- Sussi Pillar 6 (Ethos Oracle): KYB issuers
- Marihan Atelier: skill mastery credentials
- Charon Pillar 4: deploy + storage on-chain
Use cases:
- University diplomas (UCLA → student)
- Professional certs (PMP, AWS → professional)
- KYB Nivel 3+ (Sussi Oracle → institution)
- Skill mastery (Marihan Atelier → originner)
- Origin Wallet identity (Foundation → citizen)
Próximo Ship Slice 3.5 v0.0.45: origin-staking contract template
(validator + beacon + reputation patterns, CHN-3 NPoS Phase 2 prep).
⚓ Path A Slice 3.4 SCAFFOLD shipped. Templates 3/5 complete.
🤖 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
davidherran
|
9f7897c47c |
feat(contracts): v0.0.43 — Slice 3.3 origin-escrow template SCAFFOLD (multi-party + dispute) 🎉
Ship Slice 3.3 v0.0.43 — second foundational template del Origin Contract Atelier.
Multi-party escrow + time-locked milestones + dispute-enabled via Pillar 6 Tribunal.
Cambios:
- contracts/origin-escrow/Cargo.toml: ink! 6.0.0-beta.1 + scale codec aligned
- contracts/origin-escrow/lib.rs: full ink! v6 contract source ~500 LOC:
* 5-state machine canonical (Created → Active → Disputed → Releasing → Completed)
* Storage canonical: parties (depositor + beneficiary + arbiter + treasury) +
config (terms_hash + total + fee + windows) + state tracking + milestones mapping
* 5 events canonical (Deposited, MilestoneCompleted, DisputeRaised,
DisputeResolved, EscrowCompleted)
* 12 error variants canonical (InvalidState, UnauthorizedCaller, etc.)
* Constructor canonical con invariants compile-detect (fee ≤ 5% BM V2 §5.3,
depositor != beneficiary, terms_hash != zero)
* 9 read methods canonical (state, parties, amounts, milestones)
* 5 write methods canonical (deposit, add_milestone, confirm_milestone,
raise_dispute, resolve_dispute)
* 4 Resolution variants Tribunal: ReleaseToBeneficiary, RefundToDepositor,
SplitFifty, Custom (with depositor_bps + beneficiary_bps == 10_000 invariant)
* 3 unit tests canonical
- contracts/origin-escrow/README.md: use cases + state machine diagram +
resolution patterns + cross-pillar integration
Inmutables compliance:
- #16 HTS anti-clasista: escrow_fee_bps cap 5% BM V2 §5.3
- #26 Content-Addressed: terms_hash + description_hash BLAKE3 inmutable
- #37 Free perpetua: 9 read methods sin payment
- #41 AGI Cross-Species: AGI puede ser depositor/beneficiary/arbiter
Cross-pillar wire canonical:
- Pillar 6 Tribunal (Mathi): arbiter = Tribunal contract address
- Pillar 2 OMC Marketplace (Marihan): escrow integrado purchases
- Pillar 1 Hosting (Larihana): refundable hosting fees future
- Pillar 4 Origin Chain (Charon): deploy vía pallet-revive Index 11
Use cases canonical:
- Freelance contracts (client + worker + Tribunal)
- OMC marketplace purchases (buyer + seller + Tribunal)
- Institutional partnerships (university + researcher + Tribunal)
- Refundable event tickets (organizer + holder + Tribunal)
Próximo Ship Slice 3.4 v0.0.44: origin-credential-mint contract template
(Ed25519 + BLAKE3 attestation, Sussi Ethos schema integration).
⚓ Path A Slice 3.3 SCAFFOLD shipped. Templates library canonical 2/5 complete.
🤖 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
davidherran
|
f4f46767fe |
feat(contracts): v0.0.42 — Slice 3.2 origin-nft-mint template SCAFFOLD (BM V2 91/9) 🎉
Ship Slice 3.2 v0.0.42 — first contract template foundational del Origin Contract Atelier propuesto (Capacidad #10 OCC David 2026-05-27). origin-nft-mint contract template ink! v6 implementing BM V2 ratificado 2026-05-18 split 91% creator / 9% Treasury + transfer royalty 5% + Treasury burn 20% canonical. Cambios: - contracts/ nueva sub-workspace separate del runtime (toolchain divergence: ink! v6 needs wasm32-unknown-unknown + cargo-contract v6 + size-optimized release profile, vs runtime workspace wasm32v1-none + production speed). - contracts/README.md doc overall sub-workspace + templates roadmap + Contract Atelier integration explained. - contracts/origin-nft-mint/Cargo.toml: ink! 6.0.0-beta.1 + scale codec aligned con runtime workspace pin canonical + size-optimized release profile. - contracts/origin-nft-mint/lib.rs: full ink! v6 contract source 600+ LOC: * Storage canonical: owner + treasury + 8 config parameters + 6 mappings * 5 events canonical (Minted, Transferred, Approved, PauseToggled, +) * 12 error variants canonical (InsufficientPayment, MaxSupplyReached, etc.) * 2 constructors (new + default_bm_v2 con BM V2 ratified defaults) * 13 messages canonical: 9 reads (free per Inmutable #37) + 4 writes (mint payable + transfer payable + approve + emergency_pause/unpause) * 3 unit tests canonical: default_bm_v2 invariants + invalid_share_split rejected + excessive_royalty rejected - contracts/origin-nft-mint/README.md: deploy instructions + Inmutables compliance table + parameters config UI exposure docs + cross-pillar integration diagram (Pillar 2 OMC + 4 Chain + 6 Nexus + 7 Creator + Atelier). Inmutables compliance compile-detect (5 enforced canonical): - #16 HTS anti-clasista: mint_fee_base modulated por HardwareTier Phase 3.x - #25 Seeds Hosting Non-Gatekept: NFT ownership NO gates base world access - #26 Content-Addressed Immutability: BLAKE3 asset_hash required (zero rejected) - #37 Free perpetua: reads gratis sin payment (9 read methods sin payable) - #41 AGI Cross-Species: AccountId32 sin distinction Human/AGI canonical Cross-pillar wire canonical Phase 3.x maduración: - Pillar 2 OMC Marihan: marketplace 91/9 split enforcement compile-detect - Pillar 4 Origin Chain Charon: deploy vía pallet-revive Index 11 - Pillar 6 Nexus Mathi: Beacon stake + ONS naming opcional - Pillar 7 Creator Larihana: hosting payments wire post NFT mint Verificación: - cargo check --workspace runtime clean (213 tests verde no regression contracts/ sub-workspace separate) - contracts/origin-nft-mint compilation pending cargo-contract v6 install authorization (precedent Slice 2e brew LLVM pattern). Source 100% ready. Charon Atelier propuesta filed conversational con David 2026-05-27 — Capacidad #10 OCC visual policy designer + Charon copilot + templates library. Roadmap Q2-Q3 2027 MVP + Q4 2027 governance queue + Q1 2028 full Atelier + Q2-Q3 2028 public version originmetaverse.com/contracts community creators. Próximo Ship Slice 3.3 v0.0.43: origin-escrow contract template canonical (multi-party + time-locked + dispute-enabled via Pillar 6 Tribunal integration). ⚓ Path A continúa zarpando — Slice 3.2 SCAFFOLD shipped + Contract Atelier propuesta David visión arquitectónica canonical. La nave smart contracts armada. 🤖 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |