Test lane: fee-charging signet mint on CLN (inr2) + rune-authorized driver
Los mantenedores suelen responder en 1 día
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 5/5
- Tiempo estimado
- Más de una semana
- Aptitud para principiantes
- 25/100
- Tipo de issue
- Nueva funcionalidad
- Claridad
- Bastante claro
- Estado de actividad
- Activo
- Stack tecnológico
- go
- Área
- infrastructure, payments, testing
Línea de trabajo
Start by reading the cloud-lab/QEMU suite and its existing mint-fees profile from #413, then inspect SECURITY.md and the cdk-mintd 0.17.6 CLN configuration referenced here (src/env_vars/cln.rs). First resolve whether inr2 exposes a co-locatable lightning-rpc socket or only clnrest; that decision determines the mint integration. Done means a signet profile tests fee refusal, net-of-fee credit, settled melts, reseller fees, rune-restricted access, and a keyset fee change across rotation.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Test-lane request: fee-charging signet mint backed by our CLN (inr2.cashu.exchange), rune-authorized test driver — the "real world" tier of the fee-mirroring test programme.
Why: real-world mints charge input fees; our signet mint does not. Verified today: testnut.cashu.exchange is a nutshell FakeWallet mint whose keysets all report input_fee_ppk: 0 — every fee behavior #409/#413 hardened (below-fee refusal, net-of-fee credit, keyset resolution) is currently invisible on the fleet that most resembles production. The lab's mint-fees (#413) covers the hermetic tier; what's missing is the signet tier where settlement is real (melt → Lightning invoice → payout lands) and keyset IDs/rotation shapes come from a real operator setup.
Proposed architecture (two components):
mint-signet-fees— cdk-mintd 0.17.6 with the CLN backend (env vars verified against the 0.17.6 source,src/env_vars/cln.rs):CDK_MINTD_LN_BACKEND=cln,CDK_MINTD_CLN_RPC_PATH=<lightning-rpc socket>,CDK_MINTD_CLN_FEE_PERCENT,CDK_MINTD_CLN_RESERVE_FEE_MIN, plusCDK_MINTD_INPUT_FEE_PPK=100to mirror coinos. cdk's CLN backend speaks the raw UNIX socket, not clnrest — so the wiring depends on what inr2 exposes (see decision below).- Rune-authorized test driver — the test runner gets a CLN rune (restricted:
invoice,listpays,listfunds) and drives/asserts the settlement loop directly: melt with fees → invoice created via rune → signet payment → payout observed. Runes also gate the driver's access without handing it the node.
Decision needed (infra, @Amperstrand): does inr2 expose lightning-rpc co-locatable (mount/socket-forward) or only clnrest (HTTPS+rune)?
- (a) socket available → run
mint-signet-feesco-located with (or SSH-forwarded to) the socket; no rune needed for the mint itself; driver uses clnrest+rune. - (b) clnrest only → a small socket↔clnrest bridge is required for cdk-mintd, or we contribute/reuse an existing one; alternatively evaluate cdk's
grpc-processor/LND backends if the node multiplexes those.
Acceptance criteria:
- A signet mint at a stable host with
input_fee_ppk=100, settling through inr2's CLN. - Cloud-lab/QEMU suite extended with a
signetprofile: below-fee refusal + net-of-fee credit + melt-with-fee settlement (invoice paid on signet, payout received) + reseller chain with asymmetric fees (free upstream / fee downstream). - Test driver authenticated by a restricted rune; rune stored per the SECURITY.md secret rules (never committed).
- Keyset rotation on the signet mint exercised at least once (fee change across rotation) to cover
mintKeysetFees' inactive-keyset branch in production shape.
Hermetic predecessor landed meanwhile: #413 (mint-fees in cloud-lab, 4 e2e tests green). A keyset-rotation variant using cdk-mintd's CDK_MINTD_FAKE_WALLET_KEYSET_ROTATIONS (env verified in 0.17.6 source) is being added on top of it.
Refs: #409 (swap-fee handling), #413 (hermetic fee mint), #339 (v0.6.0), #403 (the fund-safety family that started this).
- Lenguaje dominante
- Go
- Estrellas
- 12
- Forks
- 14
- Merge medio
- 1 d 8 h
- PR fusionados (30 d)
- 201
Preparar el entorno
- Sin Dockerfile ni archivo de Docker Compose
- Sin plantilla de pull request
- Leer la guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de OpenTollGate/tollgate-module-basic-go
-
changelog: dependency-security sweep missing from [Unreleased] [Amperstrand fork #105 review debt]Abierto
Dificultad 1/5 Menos de una hora Aptitud para principiantes 72/100
OpenTollGate/tollgate-module-basic-go#1055 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
OpenTollGate/tollgate-module-basic-go#1027 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
bug
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
OpenTollGate/tollgate-module-basic-go#1026 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100
OpenTollGate/tollgate-module-basic-go#833 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 65/100
OpenTollGate/tollgate-module-basic-go#813 ·
Los mantenedores suelen responder en 1 día
Todos los issues de OpenTollGate/tollgate-module-basic-go
Issues similares
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 73/100
prime-radiant-inc/evener#5028 ·
Los mantenedores suelen responder en 1 día
-
Dificultad 1/5 Menos de una hora Aptitud para principiantes 85/100
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 70/100
-
[BUG] v4.2.9 PostgreSQL 启动迁移失败:DROP INDEX CURRENT_SCHEMA() 语法错误Posiblemente ocupada @renovate la tomó hoy. Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100
OpenListTeam/OpenList#3267 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
'ignore' is called 'deny'Abierto
Dificultad 1/5 Menos de una hora Aptitud para principiantes 88/100
openpubkey/opkssh#670 ·
Los mantenedores suelen responder en 1 día