… §9.5) (#474) * docs(spec): add custom-token policy + per-transfer readiness doctrine (#448) Normative doctrine governing token-policy installation (authoritative-source only, no absorption from peer/inbox/contact/offline/envelope), policy_commit binding in every transfer (§9.5), and per-transfer counterparty readiness (online published surface, offline direct exchange), with fail-closed semantics. Each enforcement surface is marked Layer A (shipped) or Layer B (planned), cross-referencing tracked issues #466-#473. Custom-token transfer readiness is marked INCOMPLETE until the Layer-B issues close. The first mandatory blocker (policy_commit binding into the signed Transfer op + conservation + fail-closed) lands in this branch. * feat(op): add required policy_commit field to Operation::Transfer (#448, #467) Per whitepaper §9.5 ("All TokenOps MUST include policy_commit") and the token-policy doctrine §4, bind the token's CPTA policy commitment into the signed Transfer operation. Adds a required [u8;32] `policy_commit` field to Operation::Transfer and threads it through both serializers in lockstep (operations.rs canonical to_bytes/from_bytes tag-3, and storage codecs). Production send sites resolve policy_commit from the local source-of-truth installed policy via CoreSDK/TokenSDK::resolve_policy_commit_strict (builtins -> canonical constants; custom -> BCR-history anchor walk; unknown -> fail closed). The b0x receiver reconstruction takes the sender's signed policy_commit from the canonical preimage. Commitment-scaffolding/placeholder and test literals use a zero placeholder. Wire-format change: persisted Transfer operation bytes (bcr_chain_states, bilateral_sessions) change layout — beta installs must reset their local DB. Round-trip verified for both serializers. Conservation guard + receive-side mismatch rejection follow in subsequent commits. * feat(core): enforce balance conservation by construction at DeviceState::advance (#448) Add validate_conservation() at the sole balance-mutation chokepoint (DeviceState::advance), called before the mutation loop. It requires the supplied BalanceDeltas to exactly realize the signed operation: - Transfer: exactly one delta, amount == op.amount, direction Credit iff this device is the recipient (op.to_device_id == self.devid) else Debit, and delta.policy_commit == op.policy_commit (§9.5 token binding). - Mint: one Credit == amount. Burn: one Debit == amount. - Every other operation: no balance deltas. This rejects value creation/substitution regardless of caller, replacing the previous enforce-by-convention model. Ports the rules of the dead, &State-typed verify_token_balance_consistency onto &[BalanceDelta]. Code correspondence: lean4 DSMOfflineFinality.lean commit_conservation / commitTransfer (no Lean change). Test fixtures that paired a Generic op with non-empty deltas (or empty deltas with a Transfer) updated to matching value ops (mint_op/burn_op/value_op helpers); two SMT-advance state_machine tests switched to a non-balance Generic op. Added conservation_guard_rules unit test. Full dsm lib suite green. * feat(sdk): bilateral fail-closed policy resolution + §9.5 receive binding (#448, #467) Make the bilateral BLE path consistent with the online path: the three sender/receiver delta builders now independently resolve the device's own installed policy_commit via the new AppRouter::resolve_policy_commit_strict (builtins -> constants; custom -> BCR-history anchor walk) instead of the builtin-only resolver that silently dropped the credit on any custom token. An unresolved/uninstalled policy yields empty deltas, which the conservation guard now rejects (fail closed) — no silent value skip, no peer-policy absorption. §9.5 receive-side enforcement is realized end-to-end: the signed op carries policy_commit, the receiver derives the balance delta's policy_commit by independent resolution, and DeviceState::advance's conservation guard rejects unless delta.policy_commit == op.policy_commit (i.e. the receiver's installed policy matches the sender's committed policy). Adds AppRouter::resolve_policy_commit_strict (default fails closed; AppRouterImpl delegates to CoreSDK). * fix(sdk): bind policy_commit in offline encoder + align test fixtures to guard (#448) - wallet.sendOffline: encode_offline_transfer_operation_canonical now writes the token's policy_commit (resolved from the local installed policy) so the offline-authored Transfer decodes and binds policy_commit like every other path. - Test fixtures aligned to the conservation guard: bcr sample_operation is now a recipient-credit bound to its delta's policy_commit with matching amounts; smart_commitment_sdk execute_commitment tests use the builtin ERA token so policy resolution succeeds. dsm (1434) and dsm_sdk (1506) lib suites pass; clippy clean. * fix(tools): add policy_commit to vertical_validation Transfer builders (#448) CI builds the whole workspace; the validation harness binaries construct Operation::Transfer and broke on the new required policy_commit field. These tools build+sign ops and never apply through DeviceState::advance (no guard interaction), so they carry a zero placeholder policy_commit. 7 sites across adversarial_bilateral, bilateral_throughput, implementation_traces (x3), property_tests, tla_trace_replay. Full workspace build + vertical_validation tests (19) pass; clippy clean.

Uh oh!

Extend policy_commit binding to Mint/Burn/CreateToken TokenOps (§9.5) #473

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions