Origin/arkhe-origin-chain
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity
Files
68fb969875d40bfd5be4ccf86e6828b45967cc92
arkhe-origin-chain/Cargo.toml
T
davidherranandClaude Opus 4.8 6663dbdc0f fix(contracts): FIX-1 contract-safety + migración ink! v6 (escrow/staking/nft) 
REMEDIATION_ROADMAP_V1 FIX-1 (V1-C1 reentrancy + V1-C4 zero-burn). Los 3
templates ahora COMPILAN contra ink! 6.0.0-beta.1 + tests verde (12/12).

Hallazgo (honesto): los templates se shippearon "scaffold compile-only" pero
nunca compilaron contra su versión pinneada de ink!. ink! v6 / pallet-revive es
H160-Address + U256 nativo (no AccountId + Balance, modelo viejo). Esta
migración los vuelve reales (compilando + testeados).

Migración ink! v6:
- AccountId -> Address (H160) en parties / storage / events / reads / params.
- transfer() + transferred_value() -> U256 (+ helper u256_to_balance saturante).
- derive StorageLayout en tipos de storage (EscrowState/Milestone/Stake/...).
- doctest fences sin lenguaje -> text (diagramas ASCII del lifecycle).
- workspace: contracts/* excluidos (toolchain PolkaVM/pallet-revive distinta).

FIX-1 hardening:
- CEI (Checks-Effects-Interactions): muta TODO el storage ANTES de cualquier
  transfer() -> una reentrada ve el estado final y falla sus checks. Sitios:
  escrow confirm_milestone/resolve_dispute, staking withdraw/slash,
  nft mint/transfer. Cierra V1-C1. (nft mint encontrado más allá de la lista
  del roadmap; mismo patrón explotable -> incluido).
- Burn real (V1-C4): elimina transfer([0;32]) (que no reduce emisión y ensucia
  la cuenta cero); el burn se RETIENE en el contrato (fuera de circulación),
  a barrer por el primitivo de burn del runtime -> una sola semántica, no dos.
  (staking slash, nft mint).
- Tests de guarda de estado (la C de CEI) añadidos en los 3 contratos.

Pendiente E2E (node-gated, requiere VPS + nodo pallet-revive):
- Correctitud económica native<->eth (NATIVE_TO_ETH_RATIO): asumido 1:1; debe
  validarse en nodo real antes de testnet/mainnet.
- Tests reales de reentrancy/double-spend: el env off-chain de #[ink::test] no
  modela el revert-on-Err ni la semántica de balances -> serían engañosos.
- V1-H7 (suma milestones == total_amount): no incluido en este commit.
- credential-mint + mdk-reconciliation necesitan la misma migración ink! v6.

Cross-pillar: DC ORIGIN_ATTESTATION_SIGNING_PAYLOAD_V1 abierto con Ergon
(payload postcard canónico + domain-separation FIX-3) — gate del verificador
de attestation on-chain. OAGIP-D10 (Charon identity attestation) definido a
Palace para el protocolo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-09 17:45:02 -05:00

261 lines
14 KiB
TOML
Raw Blame History

[workspace]
resolver = "2"
members = [
"crates/origin-chain-types",
"crates/origin-chain-consensus",
"crates/origin-coin-tokenomics",
"crates/origin-chain-provenance",
"crates/origin-chain-fees",
"crates/origin-chain-agent-identity",
"crates/origin-chain-bridges",
"crates/origin-chain-governance",
"crates/origin-chain-runtime",
"crates/origin-chain-node",
]
# ink! v6 contract templates — excluidos del workspace Substrate (toolchain
# PolkaVM/pallet-revive distinta; deps + lockfile NO compartibles con el runtime).
# Se buildean/testean standalone: cargo test --manifest-path contracts/<c>/Cargo.toml
exclude = [
"contracts/origin-nft-mint",
"contracts/origin-escrow",
"contracts/origin-credential-mint",
"contracts/origin-staking",
"contracts/origin-mdk-reconciliation",
]
[workspace.package]
version = "0.0.1"
edition = "2021"
rust-version = "1.88"
license = "MIT OR Apache-2.0"
authors = [
"Charon <charon@originmetaverse.com>",
"David Herran <david@dreamhousestudios.com>",
"Origin Metaverse community",
]
repository = "https://git.originmetaverse.com/Origin_Metaverse/arkhe-origin-chain"
homepage = "https://originmetaverse.com"
description = "Origin Chain: sovereign blockchain substrate for Origin Metaverse — consensus, OGC tokenomics, provenance ledger, ink! smart contracts, bridges, governance. Pilar 4 canonical."
keywords = ["blockchain", "substrate", "ink", "origin-metaverse", "ogc"]
categories = ["cryptography::cryptocurrencies", "no-std", "wasm"]
[workspace.dependencies]
# ============================================================
# Polkadot SDK canonical pin per DC SUBSTRATE_FOUNDATION_V1 SBS-1
# Release: polkadot-stable2512-3 (2026-03-23)
# Support window canonical: hasta 2027-03 (cubre testnet Q3 2026 + mainnet Q1 2027)
# ============================================================
# ============================================================
# Substrate workspace bump stable2509-3 (Ship 1.5 v0.0.38 Phase 3 precondition)
# Audit empírico revealed SBS-1 ratified label "stable2512-3" was incorrect —
# actual workspace pre-bump was stable2506-2 hybrid generation. Bumped al
# stable2509-3 (pallet-revive 0.10.1 disponible + rustc 1.88 compat preserved).
# Source: github.com/paritytech/polkadot-sdk?tag=polkadot-stable2509-3 verified
# vía WebFetch per-crate Cargo.toml [package] version sections.
# ============================================================
# Substrate Primitives (sp-*) — stable2509-3
sp-core = { version = "38.1.0", default-features = false }
sp-runtime = { version = "44.0.0", default-features = false }
sp-io = { version = "43.0.0", default-features = false }
sp-std = { version = "14.0.0", default-features = false }
sp-version = { version = "42.0.0", default-features = false }
sp-api = { version = "39.0.0", default-features = false }
sp-block-builder = { version = "39.0.0", default-features = false }
sp-transaction-pool = { version = "39.0.0", default-features = false }
sp-inherents = { version = "39.0.0", default-features = false }
sp-offchain = { version = "39.0.0", default-features = false }
sp-session = { version = "41.0.0", default-features = false }
sp-genesis-builder = { version = "0.20.0", default-features = false }
sp-consensus-aura = { version = "0.45.0", default-features = false, features = ["serde"] }
sp-consensus-grandpa = { version = "26.0.0", default-features = false, features = ["serde"] }
# Slice 4 v0.0.49 — node sc-service deps (stable2509-3)
sp-timestamp = { version = "39.0.0", default-features = false }
sp-blockchain = { version = "41.0.0" }
# FRAME canonical — runtime composition framework (stable2509-3)
frame-system = { version = "43.0.1", default-features = false }
frame-support = { version = "43.0.0", default-features = false }
frame-executive = { version = "43.0.1", default-features = false }
frame-benchmarking = { version = "43.0.0", default-features = false }
frame-metadata-hash-extension = { version = "0.11.0", default-features = false }
# FRAME pallets canonical Phase 1.3 (per SBS-4 ratified, stable2509-3)
pallet-balances = { version = "44.0.0", default-features = false }
pallet-timestamp = { version = "42.0.0", default-features = false }
pallet-transaction-payment = { version = "43.0.0", default-features = false }
# FRAME pallets canonical Phase 1.4 — Consensus PoA per CHN-1 ratified (stable2509-3)
pallet-aura = { version = "42.0.0", default-features = false }
pallet-grandpa = { version = "43.0.0", default-features = false }
# FRAME pallets canonical Phase 1.5 — Session rotation per CHN-1 4h epochs (stable2509-3)
pallet-session = { version = "43.0.0", default-features = false }
# ============================================================
# Phase 3 — pallet-revive smart contracts per SBS-5 ratified
# (supersedes CHN-6 v1.0 → CHN-6 v2.0 PolkaVM + ink! v6 + Solidity)
#
# **Critical version decision (Ship 2 v0.0.39 audit empirical refinement)**:
# Git source pin pulls duplicate copies de frame-system/sp-runtime canonical
# (cargo trata git source + crates.io como crates distintos). Switch a crates.io
# 0.10.1 published version post Ship 1.5 v0.0.38 workspace bump empírico —
# bumped substrate generation pulls newer transitive deps clean per cargo
# resolver canonical. pallet-revive 0.10.1 was pkg de polkadot-stable2509-3
# release tag, deps match my bumped workspace stable2509-3 pin generation.
# ============================================================
pallet-revive = { version = "0.10.1", default-features = false }
# pallet-revive entry CONSOLIDATED arriba (línea 92) — Ship 1 v0.0.37 puro
# crates.io 0.12.2 deprecated post Ship 1.5 v0.0.38 workspace bump + Ship 2
# v0.0.39 git source canonical polkadot-stable2509-3 tag (0.10.1 matched generation).
# pallet-identity DEFERRED a Phase 2.7 — canonical decision empírica 2026-05-21:
# pallet-identity 41.0.0 usa ReservableCurrency trait (deprecated en stable2512,
# replaced por fungible::Mutate). Compat work canonical es scope Phase 2.7 cuando
# se introduce `pallet_agent_identity` custom canonical (Inmutable #41 AGI DID).
# pallet-identity = { version = "41.0.0", default-features = false }
# RuntimeAPI canonical (consumed by node binary + RPC server Phase 1.6+, stable2509-3)
frame-system-rpc-runtime-api = { version = "39.0.0", default-features = false }
pallet-transaction-payment-rpc-runtime-api = { version = "43.0.0", default-features = false }
# Genesis canonical Phase 1.7 — chain_spec BM V2 allocation
# Nota canonical 2026-05-21: sp-keyring NO incluido — version conflict canonical
# con sp_core stable2512 (sp-keyring 42 trae sp_core diferente). En su lugar,
# hardcodeo canonical bytes de Substrate well-known dev accounts canonical
# (Alice/Bob/Charlie/Dave/Eve) en genesis_config_presets.rs — same canonical
# values que sp-keyring usaría but sin la dep brittle canonical.
serde_json = { version = "1", default-features = false, features = ["alloc"] }
# WASM builder canonical (Phase 1.6+ runtime WASM build para chain_spec, stable2509-3)
substrate-wasm-builder = { version = "29.0.0" }
# Substrate client canonical (Phase 1.6+ node binary service builder, stable2509-3)
sc-cli = { version = "0.54.0" }
sc-service = { version = "0.53.0" }
# Slice 3 (v0.0.13) canonical — `sc_chain_spec::GenericChainSpec` builder canonical
# para Phase 1.6+ ChainSpec serialization. Pattern canonical mock-WASM fallback.
sc-executor = { version = "0.45.0" }
sc-network = { version = "0.52.0" }
sc-consensus = { version = "0.51.0" }
sc-consensus-aura = { version = "0.52.0" }
sc-consensus-grandpa = { version = "0.37.0" }
sc-transaction-pool = { version = "42.0.0" }
sc-transaction-pool-api = { version = "42.0.0" }
sc-client-api = { version = "42.0.0" }
sc-basic-authorship = { version = "0.52.0" }
sc-telemetry = { version = "31.0.0" }
sc-offchain = { version = "47.0.0" }
# RPC server canonical (jsonrpsee, stable2509-3)
jsonrpsee = { version = "0.24.9", features = ["server"] }
substrate-frame-rpc-system = { version = "46.0.0" }
pallet-transaction-payment-rpc = { version = "46.0.0" }
# CLI + async canonical
clap = { version = "4.5.13", features = ["derive"] }
futures = { version = "0.3.31", features = ["thread-pool"] }
# SCALE codec canonical (canonical Substrate serialization)
parity-scale-codec = { version = "3.7", default-features = false, features = ["derive", "max-encoded-len"] }
scale-info = { version = "2.11", default-features = false, features = ["derive"] }
# ============================================================
# Cryptography canonical (CHN-7 + SBS-4 + tu choice canonical)
# ============================================================
ed25519-dalek = { version = "2", default-features = false }
blake3 = { version = "1", default-features = false }
# ============================================================
# Error handling + serialization canonical
# ============================================================
# no_std-compatible canonical (Slice 2 — required by substrate-wasm-builder WASM runtime build)
thiserror = { version = "2.0", default-features = false }
# serde pin Ship 1.5 v0.0.38 — relajado desde `=1.0.217` strict pin
# (Slice 2b workaround obsoleto post-Slice 2e RESUELTO). El strict pin causaba
# conflicto con stable2509-3 transitive deps requiriendo ^1.0.219 vía
# parity-scale-codec 3.7.5. Relajación 1.0.219 mínimum permite Cargo resolver
# picking latest compatible preservando WASM build correctness empíricamente
# validated Slice 2e (Layer 4 sp-io std leak resuelto via default-features=false
# discipline, NO serde version specific).
serde = { version = "1.0.219", default-features = false, features = ["derive"] }
log = { version = "0.4", default-features = false }
# ============================================================
# Internal crates canonical (workspace path deps)
# ============================================================
origin-chain-types = { path = "crates/origin-chain-types", version = "0.0.1", default-features = false }
origin-chain-consensus = { path = "crates/origin-chain-consensus", version = "0.0.1", default-features = false }
origin-coin-tokenomics = { path = "crates/origin-coin-tokenomics", version = "0.0.1", default-features = false }
origin-chain-provenance = { path = "crates/origin-chain-provenance", version = "0.0.1", default-features = false }
origin-chain-fees = { path = "crates/origin-chain-fees", version = "0.0.1", default-features = false }
origin-chain-agent-identity = { path = "crates/origin-chain-agent-identity", version = "0.0.1", default-features = false }
origin-chain-bridges = { path = "crates/origin-chain-bridges", version = "0.0.1", default-features = false }
origin-chain-governance = { path = "crates/origin-chain-governance", version = "0.0.1", default-features = false }
origin-chain-runtime = { path = "crates/origin-chain-runtime", version = "0.0.1", default-features = false }
origin-chain-node = { path = "crates/origin-chain-node", version = "0.0.1" }
# ============================================================
# Slice 2e v0.0.35 — canonical [patch.crates-io] WASM dependency overrides
# ============================================================
#
# Empirical finding canonical 2026-05-26: getrandom 0.2.17 default config NO
# compatible canonical wasm32-unknown-unknown target. Substrate runtime WASM
# requires custom canonical RNG source canonical, NOT browser JS fallback.
#
# Patch canonical: enable getrandom `custom` feature para permit FRAME runtime
# provide RNG via sp-io::offchain (off-chain worker) o panic placeholder
# (no on-chain RNG needed para Phase 1.6 ChainSpec build).
# ============================================================
# Slice 2e v0.0.36 — Direct getrandom deps para activate `custom` feature
# via Cargo feature unification (both 0.2 + 0.3 transitive in FRAME stack).
# ============================================================
#
# Empirical Slice 2e investigation:
# - getrandom 0.2.17 transitive via const-random-macro → frame-support-procedural
# - getrandom 0.3.4 transitive via ahash → schnellru → sp-trie → frame-support
#
# Cargo feature unification ensures wasm32-unknown-unknown target compat
# vía custom RNG source (FRAME runtime provides via sp-io).
#
# `custom` feature activates pre-0.3 versions; `std` para 0.3+ branches.
getrandom_02 = { package = "getrandom", version = "0.2", default-features = false, features = ["custom"] }
getrandom_03 = { package = "getrandom", version = "0.3", default-features = false, features = ["wasm_js"] }
# ============================================================
# Slice 4 v0.0.49 — [patch.crates-io] yanked dep unblock
# ============================================================
#
# `sc-network-types 0.16.0` (stable2509-3) depende de `cid ^0.9`. La única
# versión 0.9.x es `cid 0.9.0` (yanked), que a su vez requiere `core2 ^0.4` —
# y `core2 0.4.0` también está yanked (las publicadas no-yanked son 0.3.x, que
# NO satisfacen `^0.4`). Cargo no auto-selecciona versiones yanked, así que la
# resolución falla. polkadot-sdk upstream lo evita porque commitea su Cargo.lock
# con esas versiones; al consumir los crates publicados sin ese lock, golpeamos
# el wart.
#
# Fix: vendorizamos el `.crate` publicado de `core2 0.4.0` (yanked pero aún
# descargable desde static.crates.io) en `vendor/core2-0.4.0/` y lo aplicamos
# como patch path. Una path source SÍ es seleccionable por cargo independiente
# del estado yanked, y su Cargo.toml declara exactamente 0.4.0 → satisface el
# `^0.4` de cid sin tocar el árbol sc-*. (El git source master resultó ser un
# workspace con versión ≤0.3.x, no servía.) Era el blocker real que difirió
# sc-service en Slice 3 (documentado en chain_spec.rs: "cid 0.9.0 yanked core2
# 0.4.0"). El crate vendorizado es idéntico al artefacto publicado original.
[patch.crates-io]
core2 = { path = "vendor/core2-0.4.0" }
[profile.release]
# Slice 2b finding canonical: lto/codegen-units customization triggers alloc
# recompile en wbuild → duplicate exchange_malloc lang item canonical. Defaults
# canonical preservan stdlib alloc cache canonical sin recompile.
opt-level = 3
[profile.dev]
opt-level = 1
Reference in new issue View Git Blame Copy Permalink