Sulkta-Coop/aldabra
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Pull-mirror of github.com/Sulkta-Coop/aldabra. Canonical lives on GitHub; this is a LAN-fast read-only cache.
106 commits 1 branch 0 tags 950 KiB
Find a file
Kayos 30a7137de5 feat(escrow): drop escrow_wip feature gate, ship as default surface 
Per Cobb 2026-05-09 directive: after the audit + preprod E2E green-light
(6/6 builders, 9 successful txs, 0 failures), drop the compile-time gate
and integrate escrow as a default-on feature. The "not third-party
audited" framing becomes a runtime notice carried by escrow_open_unsigned
rather than a Cargo feature.

Changes:
- aldabra-dao/Cargo.toml: drop [features] block + escrow_wip = []
- aldabra-dao/src/agora/mod.rs: pub mod escrow (no cfg gate)
- aldabra-dao/src/builder/mod.rs: 6 escrow_* modules unconditional
- aldabra-mcp/Cargo.toml: drop features = ["escrow_wip"] from dao dep
- aldabra-mcp/src/tools.rs:
  - Drop "WIP — UNAUDITED:" prefix from all 6 escrow tool descriptions
  - Drop "wip_warning" JSON field from all 6 spend-tool responses
  - Add "audit_notice" field on escrow_open_unsigned response only
    (per Cobb's framing — once-per-escrow-conversation, not repeated
    on every subsequent tool)
  - Update section header comment to reflect post-WIP status
- 7 escrow source files (1 agora + 6 builder): replace
  "WIP / UNAUDITED. Feature-gated behind escrow_wip" docstring with
  "Not third-party audited — preprod-only" + audit doc reference

Verified: 133 dao tests pass (was 132 under --features escrow_wip;
+1 from the rejects_no_initial_contributor test that's now always
compiled). aldabra-mcp release build clean.

The runtime audit_notice on escrow_open_unsigned reads:
  "This escrow validator has had an internal review and a 9-tx preprod
   E2E pass, but has NOT been audited by an external third party. Use
   at your own risk. If the user is opening this with anything beyond
   test-net or low-value funds, pass this notice along and confirm they
   accept the risk. Validator hash: a8081acef26935d9b5f44b92052178e17301b6d6e6808c91c5b56f5d."

This carries the same caveat the WIP framing did, but in a form the
calling agent can surface inline to the user opening the escrow.
2026-05-09 23:08:30 -07:00
.cargo build: strip Gitea token from pallas patch URLs + add cargo config 2026-05-06 07:45:37 -07:00
aiken-escrow fix(escrow_wip): apply 2026-05-09 internal audit findings 2026-05-09 14:06:17 -07:00
audits audits: settle path landed — full 6/6 escrow builders proven on chain 2026-05-09 20:33:39 -07:00
crates feat(escrow): drop escrow_wip feature gate, ship as default surface 2026-05-09 23:08:30 -07:00
docs rename: sulkta-wallet → aldabra (per Cobb 2026-05-04) 2026-05-04 10:11:23 -07:00
.dockerignore phase 1: full read path — bip39 + cip-3 + cip-1852 + koios + age-mnemonic + rmcp 2026-05-04 11:09:00 -07:00
.gitignore phase 1 scaffold: cargo workspace + 3 crates + roadmap + architecture 2026-05-04 10:02:32 -07:00
Cargo.lock audit: cargo fmt + clippy --fix across workspace + retract_votes cooldown bug fix 2026-05-09 10:27:48 -07:00
Cargo.toml build: switch aldabra-pallas patch URLs to SSH 2026-05-06 07:55:32 -07:00
Dockerfile fix(escrow_wip): apply 2026-05-09 internal audit findings 2026-05-09 14:06:17 -07:00
LICENSE phase 1 scaffold: cargo workspace + 3 crates + roadmap + architecture 2026-05-04 10:02:32 -07:00
README.md rename: sulkta-wallet → aldabra (per Cobb 2026-05-04) 2026-05-04 10:11:23 -07:00
ROADMAP.md rename: sulkta-wallet → aldabra (per Cobb 2026-05-04) 2026-05-04 10:11:23 -07:00

README.md

aldabra

Rust-native Cardano lite wallet with an MCP-server interface — built for LLM-first usage (send, receive, mint, Plutus interaction).

Status: Phase 1 scaffold (2026-05-04). Compiles, structure in place, real wallet primitives still landing. See ROADMAP.md.

Why

The existing Cardano MCP servers are either read-only doc gateways (Jimmyh-world/Cardano_MCP) or built on Blockfrost (web3-mcp) which is a centralized API we deliberately don't depend on. Sulkta runs its own Koios + Ogmios endpoints on Rackham; we want a wallet that talks directly to those.

Also: it's the first Sulkta Rust project — useful as a workout for crafting-table's Rust toolchain (per Sulkta-Coop/lucy-infra spec-crafting-table.md).

Architecture

Three crates in a Cargo workspace:

Crate Responsibility
aldabra-core Pure crypto + types. Mnemonic → root key (CIP-3), root → payment + stake key (CIP-1852), address construction, signing. No I/O, no network. This is the security boundary.
aldabra-chain Pluggable backends for chain queries. ChainBackend trait, with Koios as the phase-1 implementation. Ogmios + submission paths in phase 2.
aldabra-mcp Binary. MCP server speaking stdio. Glues core + chain together, exposes tools to the LLM client. 
            ┌─────────────────────────────┐
LLM client  │       aldabra-mcp (bin)      │  stdio
─────────►  │   tool handlers, lifecycle  │  ────►
            └──────────┬──────────────────┘
                       │
              ┌────────┴────────┐
              ▼                 ▼
       ┌──────────────┐  ┌──────────────┐
       │ aldabra-core  │  │ aldabra-chain │
       │ keys, sign   │  │ Koios/Ogmios │
       └──────────────┘  └──────────────┘

MCP tools (target)

Phase 1:

  • wallet.address — derived base address at account 0, index 0
  • wallet.balance — ADA + native asset balance at the wallet's address
  • wallet.utxos — list UTXOs

Phase 2:

  • wallet.send — build, sign, submit a payment (ADA or native)
  • wallet.tx_status — poll a submitted tx hash

Phase 3:

  • wallet.mint — mint a CIP-25 / CIP-68 native asset
  • wallet.policy.create — generate a policy script (timelock, multisig)

Phase 4:

  • wallet.script.attach — attach an inline datum + reference script
  • wallet.script.spend — spend a Plutus-locked UTXO with redeemer
  • wallet.stake.delegate — delegate to a pool

Build

# Local (requires rustc 1.75+)
cargo build --release

# Through crafting-table (preferred — validates the toolchain there)
crafting-table build aldabra

Run

# Direct invocation (smoke test only — does nothing useful in phase 1)
./target/release/aldabra

# As an MCP server registered with Claude Code:
# add to ~/.claude.json:
#   "aldabra": {
#     "command": "/path/to/aldabra",
#     "env": {
#       "ALDABRA_DATA": "/mnt/cache/appdata/aldabra"
#     }
#   }

Security model

  • Mnemonic source: interactive bootstrap on first run, paste once, encrypted at rest with age. Never written to disk in plaintext.
  • Derived keys: in-memory only, ZeroizeOnDrop on every container.
  • Network exposure: stdio MCP transport — never opens a TCP socket. Only the spawning client process can reach it.
  • Multi-network: mainnet by default, but --network preview / --network preprod for testing without real ADA.

See also