feat(qt): back Dash Platform GUI internals with real grovedb/drive/dpp crates - #67
Open
PastaPastaPasta wants to merge 134 commits into
Open
feat(qt): back Dash Platform GUI internals with real grovedb/drive/dpp crates#67PastaPastaPasta wants to merge 134 commits into
PastaPastaPasta wants to merge 134 commits into
Conversation
|
Important Review skippedToo many files! This PR contains 160 files, which is 60 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (160)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This was referenced Aug 7, 2026
PastaPastaPasta
force-pushed
the
platform-gui-rust
branch
2 times, most recently
from
August 10, 2026 19:34
bd04fed to
d7ad8ad
Compare
Eventually, `rust/` will be hosting primarily subtrees, whose contents we cannot directly influence, so linting it makes little sense.
Co-authored-by: pasta <pasta@dashboost.org>
Needed for cross-compilation to work correctly
This can be removed alongside the whole minimal crate when we have actual crates to slot in.
We're using `depends` to provide us with the Rust compiler and `cxxbridge`, we can drop it from the CI container and save some space.
The conflict occurs due a difference in glibc version between the Guix environment and the targets compiled, this is only a problem for Linux targets so the issue doesn't extend to Windows
…ging Merging per-crate staticlibs with 'ar -x' into a flat directory silently drops object files once member basenames collide, which happens as soon as two crates share dependencies (measured: 373 of 374 members collide between two crates built from one workspace). Replace the merge with an umbrella staticlib crate, rust/dashrust, that depends on each component as an rlib: cargo deduplicates shared dependencies, applies LTO across the whole graph, and emits a single archive. Component crates keep their own cxx bridges and codegen; per-crate Makefile includes now contribute only cxxbridge artifacts. Optional components become cargo features on the umbrella crate, plumbed from configure via RUST_CRATE_FEATURES. Per-crate dist-hook recipes are replaced by an aggregate dist-hook so additional crates do not collide on automake's one-recipe-per-Makefile rule.
The dashpay/platform v4.1.0 workspace declares rust-version 1.92; rustc 1.85.1 refuses nine of its crates by name. Hashes regenerated with contrib/devtools/update-rust-hashes.py. cxx/cxxbridge stay at 1.0.192, which compiles unchanged under 1.92.
The offline cargo configuration was generated into the source tree, which pollutes srcdir and races when multiple out-of-tree builds for different hosts share one checkout. Cargo discovers .cargo/config.toml by walking up from its invocation directory, so a config under the build tree's root works for both in-tree and out-of-tree builds.
cargo vendor handles git dependencies, but consuming the vendor directory offline requires per-git-source replacement stanzas in .cargo/config.toml, which the build system previously did not generate (only crates.io was redirected). Derive the stanzas deterministically from Cargo.lock with contrib/devtools/cargo-vendor-git-sources.sh — output verified byte-identical to what cargo vendor itself prints — and append them when generating the offline config. Git dependencies are unavoidable for upcoming components: crates.io copies of the dashpay/platform crates are stale or name-squatted.
The wallet-seams importFriendshipKeychains (PR dashpay#7581) takes an explicit creation_time that bounds later rescans of the imported ranged descriptor. Derive it from the contact request document's created_at timestamp: the friendship chain cannot have received funds before the request existed. Falls back to 0 (genesis) when the document carries no timestamp. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Re-expressed from the original platform-gui-rust commit a4f1ea3 (build: build and link Rust only when --enable-platform-gui is set) on top of the feat/optional-rust-components base: instead of making the platform GUI the sole Rust switch, keep the base's --enable-rust machinery (toolchain validation, ENABLE_RUST conditional, RUST_COMPONENT_LIBS linkage) untouched and have --enable-platform-gui imply enable_rust=yes while appending 'platform' to RUST_CRATE_FEATURES. In depends, PLATFORM_GUI=1 likewise implies RUST=1. The umbrella crate grows an (empty for now) 'platform' cargo feature that the FFI crate will populate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New rust/platform crate exposing, through a cxx bridge, the pieces of the Dash Platform client that src/platform/ hand-implements in C++: drive proof verification for every DAPI query the GUI makes (identity balance, revision, nonce, contract nonce, keys, identity-by-public-key-hash, DPNS and DashPay document queries, contested vote state), DPP identity/document decoding, and state-transition construction and signing (DPNS preorder/domain, profile create/replace, contact request, identity create with instant and chain asset-lock proofs). Pinned to dashpay/platform v4.1.0 and grovedb v5.0.1, matching drive's verify feature: no storage engine and no async runtime. Wallet keys never cross the bridge: builders call back into a C++ platform_ffi::WalletSigner (src/platform/ffi/signer.h) with the key id and the 32-byte double-SHA256 digest of the signable bytes, receiving a 65-byte compact recoverable ECDSA signature, the exact contract of PR 49's platform::st::Signer / interfaces::Wallet::signPlatformDigest. Acceptance is pinned by PR 49's Rust-generated fixtures replayed through the crate: all 15 drive query vectors verify with matching root hashes and results, decoders are field-exact, and all 7 state-transition fixtures in dpp_st_vectors.json serialize byte-identically to the C++ implementation. cxx/cxxbridge is bumped 1.0.192 -> 1.0.198 across the manifests and the native_cxxbridge depends package (hash + vendored lockfile regenerated) so the crate pin, workspace lock, and depends-built CLI agree exactly. (cherry picked from commit 1a15ce3)
src/platform/'s hand-rolled internals now delegate to the dash-platform-ffi
crate: drive/queries.cpp, dpp/identity.cpp, dpp/document.cpp and
dpp/statetransitions.cpp become thin adapters over the platform_ffi cxx
bridge, converting arguments, catching rust::Error into the existing
Result-with-error-string style, and routing wallet signing callbacks through
platform_ffi::WalletSigner (per-key dispatch with the ASSET_LOCK_KEY_ID
sentinel for identity creation). Public headers are unchanged: the GUI,
transport and quorum-signature code compile untouched, and the surviving
platform_drive/dpp/client test suites now drive the original JSON vectors
through the C++-to-Rust round trip (31 cases, all passing).
Superseded C++ removed (net -5,808 lines):
- src/platform/proof/{merk,grovedb}.{h,cpp} - the layered merk/GroveDB proof
verifier, replaced by rs-drive's verify slice; the Hash256 alias the drive
layer still uses moved to src/platform/drive/hash256.h
- src/crypto/blake3/ - vendored portable-only blake3; grovedb's own blake3
now runs inside the Rust staticlib, and the -DBLAKE3_* defines left
libdash_platform_a_CPPFLAGS with it
- src/platform/dpp/bincode.{h,cpp} - bincode-v2 reader/writer; rs-dpp
serializes on the Rust side now
- platform_value machinery in dpp/document.{h,cpp} (Value, ValueKind,
EncodeDocumentData, GenerateDocumentId, DecodeDocumentHeader) - rs-dpp
decodes documents against the pinned system contracts
- BytesReader and the bincode/LEB128 read helpers in serialize.{h,cpp};
only WriteLEB128 survives for the Tenderdash StateId sign bytes
- src/test/platform_proof_tests.cpp and the merk/grovedb/element vector
files it consumed - that coverage lives in rust/platform/tests, which
replays the same drive/dpp/identity vectors through the real crates
The workspace panic profile flips abort -> unwind: verify_*/decode_* parse
attacker-controlled bytes from remote DAPI nodes deep inside grovedb/drive,
and with unwind cxx converts any residual panic into a catchable C++
exception at the bridge instead of aborting dash-qt. dashd links no Rust
either way.
(cherry picked from commit 6858c6a)
Follow-ups from review of the Rust bridge swap: - WalletSigner::SignDigestForKey swallows exceptions from the wallet signer callback and reports signing refusal; it is invoked from Rust frames and a C++ exception must not unwind through them (unsupported by cxx). - Bridged() in drive/queries.cpp catches std::exception rather than only rust::Error, so cxx marshalling throws (e.g. rust::String rejecting invalid UTF-8 in contested-index values) surface as error strings too. - Drop element/grovedb_proof/merk_proof vector JSONs orphaned by the C++ verifier removal; their coverage lives in rust/platform's crate tests. (cherry picked from commit 133a308)
…dder-core Repoint dpp/drive/platform-version to dashpay/platform rev db332fe054 and add the new transport-free upstream layer (dapi-grpc types-only, dash-context-provider, dash-platform-queries, drive-proof-verifier) as dependencies. grovedb now resolves through drive's own pin instead of a direct tag. tenderdash-proto (via dapi-grpc/drive-proof-verifier) downloads the tenderdash sources from GitHub at build time, which breaks offline depends builds. Add a source-only depends package staging the sha256-pinned tenderdash v1.5.3 zip, exposed to configure as TENDERDASH_SOURCES and copied into the cargo target directory before the build so build.rs finds it in its download cache. Online dev builds (--enable-online-rust) keep downloading it themselves. (cherry picked from commit aaaee6f)
New rust/platform/src/provider.rs implements dash_context_provider::ContextProvider from node-local state: quorum BLS keys pushed across the bridge from the synced LLMQ store, the pinned DPNS/DashPay system contracts, and the network/activation-height context. verify.rs gains a FromProof-driven layer taking the exact protobuf (request, response) byte pair the transport exchanged; drive-proof-verifier reconstructs the query from the request, replays the GroveDB proof, and checks the Tenderdash BLS quorum signature internally, returning the signature-authenticated ResponseMetadata fields the C++ freshness tracker consumes. The old proof-only verification surface stays temporarily so the C++ side keeps building; it is removed together with the C++ seam rework. tests/from_proof.rs replays the fixture corpus end to end (grovedb + quorum signature) through the new seam, pins the clean decode failure for the placeholder document payloads, and covers tampered signature/proof/metadata and unknown-quorum rejection. (cherry picked from commit 745a8f3)
…pure builders st.rs now assembles the DPNS preorder/domain documents through dash-platform-queries' build_dpns_preorder_and_domain_documents and the DashPay contactRequest through build_contact_request_document, instead of hand-assembled property maps. The shared create path runs the upstream put-document guards (ensure_entropy_matches_document_id, prepare_document_for_transition) before signing. The preorder seam now takes (label, preorder salt) instead of the precomputed salted domain hash: the upstream builder derives the hash itself, and the bridge keeps using it as the document entropy, so the built transitions stay byte-identical to the pinned fixtures (rust signing tests and platform_dpp_tests both still check exact bytes). The domain seam drops its redundant entropy parameter (the preorder salt doubled as entropy on both sides already). (cherry picked from commit 4958004)
The C++ drive layer no longer reimplements the Tenderdash quorum-signature binding: transport/client.cpp threads the exact protobuf request it sent and the full response it received into the drive/queries.cpp adapters, and the Rust bridge (drive-proof-verifier FromProof) reconstructs the query, replays the GroveDB proof and checks the BLS quorum threshold signature against the keys pushed via updateQuorumKeys. The signature-authenticated ResponseMetadata (height, core-chain-locked height, time, chain id) comes back for the chain-id check and the per-endpoint freshness tracker; root hashes no longer cross the boundary. drive/quorumsig.* and drive/verify.* (the C++ ports of the signature preimage assembly) are deleted along with drive/hash256.h; the digest-intermediate vectors they were tested against are covered upstream by the rs-drive-proof-verifier corpus. getIdentity now issues a single proved request (Drive::verify_full_identity_by_identity_id) instead of three root-matched sub-queries, and getIdentityByPublicKeyHash resolves the full identity from one proof instead of chaining a second lookup. platform_drive_tests now drives the (request bytes, response bytes) seam: it synthesizes the DAPI protobufs around the fixture grovedb proofs and the fixture quorum signature, verifies the identity-nonce and contested-vote families end to end, pins the clean decode failure for the placeholder document payloads, and covers tampered signature/proof/metadata and unknown-quorum rejection. The old proof-only bridge surface and its rust drive_vectors tests are removed; tests/from_proof.rs covers the same pipeline on the Rust side. (cherry picked from commit 8393fe7)
Review follow-ups on the FromProof rework: the two flagship identity paths (verify_get_identity, verify_get_identity_by_pubkey_hash) had no coverage. The fixture corpus cannot positively test them - its pubkey-hash vectors prove only the unique-hash-to-id mapping while the verifier requires the full identity subtree, and no full-identity vector exists - so pin them negatively for now: an id-mapping-only proof and a wrong-shape proof must fail cleanly, never verify and never panic. Generating a full-identity fixture is flagged as vector-regeneration follow-up work. Also: deduplicate decode_identity through the ffi_identity helper and fix the stale endpoint_retry.h rationale that still described getIdentity as a multi-proof operation. (cherry picked from commit e4eed91)
(cherry picked from commit 8e611a6)
(cherry picked from commit cb1c568)
(cherry picked from commit ebe2fab)
(cherry picked from commit a706ccd)
(cherry picked from commit 474a2a6)
(cherry picked from commit 5f4a543)
…-builders base Move all seven dashpay/platform git dependencies from the old feat/transport-free-embedder-core pin (e8e1961fe54f) to rev 2a6dbe39065104981b7f9bb4fbee598aab869fe4, the head of refactor/document-query-decode-builders (PR dashpay/platform#4389) whose content is the rebased equivalent on the current v4.2-dev base. No FFI-visible API drift: the crate builds unchanged and all 31 rust/platform tests pass against the new revision. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Follow-up to the wallet-seams signature adaptation: the DashPay flow hardening commit routes both the send and accept paths through prepareReceivingKeychain, so the creation_time bound must be threaded through it. The accept path forwards the contact request document's created_at; the send path passes 0 (unknown) since it may re-run for a friendship first established before this session. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The ENABLE_PLATFORM_GUI block linking libdash_platform.a and mbedtls into test_dash was lost while re-expressing the Rust link gating on the optional-rust-components base; the platform unit tests reference the client library directly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
PastaPastaPasta
force-pushed
the
platform-gui-rust
branch
from
August 13, 2026 02:40
662d017 to
558b54f
Compare
Thread PLATFORM_GUI through the Guix pipeline: the host-side pre-download now fetches the Rust standard libraries and vendored crates (network and git are unavailable inside the build container), the flag survives the --pure environment whitelist, and the in-container depends invocation enables the Platform packages. Default Guix builds are unchanged; the flag is opt-in via the environment. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Extract the identity flow's persisted record and the contact payment
cursor encoding into src/platform/walletrecords.{h,cpp} so they are
shared with the recovery orchestrator and unit-testable without Qt. Add
IdentityFlow::reload() for externally synthesized records, let a
recovered identity without a username (IDENTITY_CONFIRMED, empty label)
wait for the user and register just the name from its existing credits,
and let PlatformRecovery reuse ContactFlow's request crypto.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
PlatformRecovery probes getIdentityByPublicKeyHash over MASTER auth keys (gap limit 5, three-way found/proven-absent/unanswered tally so a network outage is never read as 'no identity'), synthesizes the identity/0 record from namesOfIdentity (REGISTERED with the proven name, or IDENTITY_CONFIRMED so the GUI offers registration), restores established contacts by decrypting their xpub from the incoming request and re-importing friendship keychains, rebuilds outbound payment cursors from wallet history, and starts a bounded background rescan. Armed from updateNodeContext() once evonode endpoints exist; runs at most once per session and leaves everything retryable when incomplete. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A recovered identity without a username shows a dedicated dashboard state with a 'Choose a username' action, and the wizard starts at name entry with funding-free wording instead of dead-ending on the progress view. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Round-trips the shared identity record serialization (including the nameless shape seed-only recovery synthesizes) and rejects malformed payloads; pins the pure payment-cursor computation and its 4-byte LE record encoding; and rebuilds a cursor end to end from a restored wallet's transaction history via real DIP-15 derivations. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The prebuilt rust binaries request /lib/ld-linux-*.so.1 which does not exist inside the guix shell container, so fix-elf-interpreter.sh must patch them. It silently skipped because patchelf was absent from the manifest, leaving cargo unable to exec (ENOENT) when native_cxxbridge built. Add patchelf to the manifest and make the script fail hard when patchelf is missing inside a Guix environment; the patch change also invalidates the stale native_rust depends cache. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
With the interpreter patched, rustc still failed to start inside the guix container because librustc_driver needs libz.so.1 and no zlib is on any runtime search path there. Add zlib to the manifest and extend fix-elf-interpreter.sh to copy libz.so.1 (like libgcc_s.so.1) into the toolchain lib directory resolved via the ORIGIN-based RPATH. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
mbedtls ships as a .tar.bz2 and tar delegates to lbzip2 inside the Guix container, which the manifest did not provide; extraction failed with Cannot exec. First bzip2-compressed depends package to enter the Guix path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Cargo-compiled build scripts link libgcc_s.so.1 without an RPATH; in the Guix container GUIX_LD_WRAPPER_DISABLE_RPATH is set and the loader has no default search path providing it, so they fail to start. Set LD_LIBRARY_PATH in CARGO_ENV to the rustc sysroot lib directory, where the depends toolchain stages libgcc_s.so.1 and libz.so.1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…nces libcxxbridge and libdashrust reference each other: C++ bridge wrappers call Rust-implemented externs while Rust code calls generated C++ shims like the WalletSigner one. With a single-pass linker, binaries that never call a bridge's C++ wrappers directly (dashd with the platform bridge) leave the shim object unextracted, and references introduced later by libdashrust fail with undefined platform_ffi cxxbridge symbols. List both archives twice in RUST_COMPONENT_LIBS so a second scan converges. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
The composite reference implementation of Dash Platform usernames, profiles, and DashPay contacts in dash-qt, assembled from the current train foundations (tracked in dashpay#7512). It exists to prove the whole path end-to-end — platform crates, core build, wallet seams, GUI — while the individual train PRs are reviewed and merged. It is an integration branch, not a merge candidate.
Branch structure (bottom-up)
feat/optional-rust-components, headeeb3b915) — opt-in Rust + cxxbridge build foundation, validated-hosts target set, Guix-baseline-proven.dashpay/wallet-seams) — DIP-13/14/15 key provider, opaque platform data records, fail-closed platform-seed pinning, friendship keychain import with preserved descriptor state. Includes the cross-implementation derivation vector against rust-dashcore's key-wallet (mobile parity).rust/platformcxx bridge over canonical Platform crates, Qt identity/username/profile/contacts flows.--enable-platform-guinow layers on the base's--enable-rust(implies it, adds theplatformcrate feature and the mbedtls/tenderdash/protoc depends packages) instead of replacing it. Default builds do zero Rust work; dashd links no Platform code in any configuration.Pinned upstream
rust/platformpins dashpay/platform#4389 head (2a6dbe390651, branchrefactor/document-query-decode-builders, on currentv4.2-dev) — the transport-free embedder series: dapi-grpctransportfeature (dashpay#4344, merged), proof-vector corpus (dashpay#4345, merged),dash-platform-queriessplit (dashpay#4388), wire-request decode + pure DPNS/DashPay builders (dashpay#4389). Zero API drift from the previous pin; includes DashPay contract v2 (dashpay#4380 — optional profile payment-address fields; no changes required to the DIP-15 flows).Validation
rust/platform: 31 crate tests green at the new pin.platformkeys_tests,dip14_tests,platform_client_tests,platform_dpp_tests,platform_drive_tests— 54 cases green; dash-qt links with 941 bridge symbols.Known follow-ups
panic = "unwind"workspace profile now also applies to--enable-rust-only builds (deliberate: cxx converts residual panics into catchable C++ exceptions at the bridge) — called out for review.