fc29ad6e03
Per Sulkta 2026-05-09 directive: after the audit + preprod E2E green-light
(6/6 builders, 9 successful txs, 0 failures), drop the compile-time gate
and integrate escrow as a default-on feature. The "not third-party
audited" framing becomes a runtime notice carried by escrow_open_unsigned
rather than a Cargo feature.
Changes:
- aldabra-dao/Cargo.toml: drop [features] block + escrow_wip = []
- aldabra-dao/src/agora/mod.rs: pub mod escrow (no cfg gate)
- aldabra-dao/src/builder/mod.rs: 6 escrow_* modules unconditional
- aldabra-mcp/Cargo.toml: drop features = ["escrow_wip"] from dao dep
- aldabra-mcp/src/tools.rs:
- Drop "WIP — UNAUDITED:" prefix from all 6 escrow tool descriptions
- Drop "wip_warning" JSON field from all 6 spend-tool responses
- Add "audit_notice" field on escrow_open_unsigned response only
(per Sulkta's framing — once-per-escrow-conversation, not repeated
on every subsequent tool)
- Update section header comment to reflect post-WIP status
- 7 escrow source files (1 agora + 6 builder): replace
"WIP / UNAUDITED. Feature-gated behind escrow_wip" docstring with
"Not third-party audited — preprod-only" + audit doc reference
Verified: 133 dao tests pass (was 132 under --features escrow_wip;
+1 from the rejects_no_initial_contributor test that's now always
compiled). aldabra-mcp release build clean.
The runtime audit_notice on escrow_open_unsigned reads:
"This escrow validator has had an internal review and a 9-tx preprod
E2E pass, but has NOT been audited by an external third party. Use
at your own risk. If the user is opening this with anything beyond
test-net or low-value funds, pass this notice along and confirm they
accept the risk. Validator hash: a8081acef26935d9b5f44b92052178e17301b6d6e6808c91c5b56f5d."
This carries the same caveat the WIP framing did, but in a form the
calling agent can surface inline to the user opening the escrow.
79 lines
2.8 KiB
TOML
79 lines
2.8 KiB
TOML
# aldabra-dao — Agora-on-Cardano DAO interaction.
|
|
#
|
|
# This crate is a community-publishable, multi-DAO client for any
|
|
# Agora deployment. Bob's DAO and Alice's DAO are both first-class —
|
|
# nothing is hardcoded to any single DAO.
|
|
#
|
|
# Layout:
|
|
# config — per-DAO config files at $ALDABRA_DATA/daos/<name>.json
|
|
# + .active selector. Loaded fresh on every tool call so
|
|
# add/remove/switch take effect without daemon restart.
|
|
# agora — Plutarch type ports (StakeDatum, ProposalDatum, etc) with
|
|
# PlutusData encode/decode. One module per Agora module.
|
|
# reader — Read-only Koios-backed state queries for governor /
|
|
# stakes / proposals UTxOs. Decodes datums into typed Rust.
|
|
# builder — Plutus tx assembly per operation (stake_create,
|
|
# proposal_vote, etc). Each operation is its own file
|
|
# for readability.
|
|
# error — Crate-internal error type.
|
|
#
|
|
# Boundary rules:
|
|
# - We depend on aldabra-core for crypto / signing / address ops only.
|
|
# - We depend on aldabra-chain for raw Koios queries.
|
|
# - We do NOT touch keys directly; signing is delegated to aldabra-core.
|
|
# - We do NOT do MCP. The dao_* MCP tools live in aldabra-mcp.
|
|
#
|
|
# Why a separate crate (not just a module under aldabra-core):
|
|
# - DAO ops are a separate auditable surface from the core wallet.
|
|
# - Community users can depend on aldabra-dao without pulling in the
|
|
# full MCP binary.
|
|
# - Plutus DAO tx assembly is enough code that mixing it with raw
|
|
# wallet sends would bloat aldabra-core past the auditability threshold.
|
|
|
|
[package]
|
|
name = "aldabra-dao"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license-file.workspace = true
|
|
repository.workspace = true
|
|
authors.workspace = true
|
|
|
|
[dependencies]
|
|
aldabra-core = { path = "../aldabra-core" }
|
|
aldabra-chain = { path = "../aldabra-chain" }
|
|
|
|
# Pallas — PlutusData encode/decode + tx building + addresses.
|
|
pallas-primitives = { workspace = true }
|
|
pallas-codec = { workspace = true }
|
|
pallas-crypto = { workspace = true }
|
|
pallas-addresses = { workspace = true }
|
|
pallas-txbuilder = { workspace = true }
|
|
pallas-traverse = { workspace = true }
|
|
|
|
# Async + I/O for chain reads.
|
|
tokio = { workspace = true }
|
|
async-trait = "0.1"
|
|
reqwest = { workspace = true }
|
|
|
|
# Serde for DaoConfig persistence + Koios JSON.
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
|
|
# Bech32 for parsing addresses we don't get pre-decoded.
|
|
bech32 = "0.9"
|
|
|
|
# Hex for handling token names + script hashes.
|
|
hex = "0.4"
|
|
|
|
# Errors.
|
|
thiserror = { workspace = true }
|
|
|
|
# Logging.
|
|
tracing = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
# DaoStore tests use a temp dir as the data root.
|
|
tempfile = "3"
|
|
# `from_slice` for round-trip CBOR tests in agora module.
|
|
pallas-codec = { workspace = true }
|
|
|