Resolves the actors-refactor (#691) collision: gossip now starts in
sequencer_service::run() after ExecutorActor construction (which exposes
its mempool handle), and the RPC-side publish hook threads through
RpcServerActor::new into the actor's Service.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
BREAKING CHANGE: ping_receiver gains a config PDA holding the deliverer and the
peer sources it accepts, ReceiverInstruction gains InitConfig, and Record takes
[source marker, config, record] instead of the record alone. Every emitter aimed
at ping_receiver must name its config account in target_accounts. The
ping_receiver and ping_sender image ids move, and a fresh genesis is required.
BREAKING CHANGE: the wrapped-token config PDA holds a borsh WrappedTokenConfig
(minter plus authorized source pairs) rather than a bare minter id, and
Instruction::InitConfig takes it as a single field. Mint now refuses a source the
token has not authorized, checked against the inbox's source marker. The
wrapped_token image id moves, and bridge_lock's with it, since it links
wrapped_token_core.
BREAKING CHANGE: Instruction::Lock drops outbox_program_id and takes the
bridge-lock config PDA as its first account, changing both the instruction
encoding and the account list. bridge_lock's image id moves, relocating its
escrow and config PDAs and requiring a fresh genesis. Sequencer, indexer and
every peer zone must upgrade together: a stale decoder re-derives a different
dispatch and reports Forged.
BREAKING CHANGE: SenderInstruction::Send drops outbox_program_id and takes the
sender config PDA as its first account, changing both the instruction encoding
and the account list. ping_sender's image id moves, relocating its PDAs and
requiring a fresh genesis. Sequencer, indexer and every peer zone must upgrade
together: a stale decoder re-derives a different dispatch and reports Forged.
* refactor(keycard_wallet): replace keycard-py (pyo3) with native keycard-rs
Rewrites the Keycard integration to talk to the LEE-flavored applet
directly from Rust via keycard-rs (pinned git dependency), dropping the
pyo3 shim, python_path.rs, and the vendored keycard-py Python library
entirely. Verified end-to-end against real hardware: pairing, PIN
verification, mnemonic loading, BIP340 Schnorr signing, and transfers
between keycard and public/private accounts.
Also cleans up the pyo3 usage that had leaked into wallet's signing
path (signing.rs, account_manager.rs) beyond the keycard CLI itself,
and trims wallet_with_keycard.sh's Python setup down to just pyscard,
which is only needed by the force_unpower.py test helper now.
* Updated to v2 secure communication
* ci: install libpcsclite-dev for pcsc crate builds
* docs(keycard): clarify personalization is mandatory and document default CA
Reinstalling the applet via `./gradlew install` wipes any existing
personalization regardless of firmware source, which wasn't previously
called out and is a common source of "card not available" confusion.
Also state plainly that personalization is required before any command
works, and document keycard-rs's actual baked-in default CA public key
instead of only describing the override mechanism.
Export KEYCARD_CA_PUBLIC_KEY in all keycard test scripts so they work
against the dev/test-CA personalization flow they rely on.
* fix(keycard): address PR #595 review comments
- Propagate the load_mnemonic error instead of swallowing it behind
is_ok(), matching every other command handler in this file.
- Add deny.toml allowing the keycard-rs git source, fixing the
source-not-allowed failure in `cargo deny check`. Licenses and
advisories checks still have pre-existing, separate failures not
addressed here.
- Drop the pinned rev for the keycard-rs git dependency so it tracks
the upstream default branch instead.
* chore(deny): trim deny.toml to essentials and allow all in-use licenses
Replace the full cargo-deny init template with just the two sections
that matter: the keycard-rs git-source allowance, and an explicit
license allow-list covering every license currently in the dependency
tree. cargo deny check now passes on sources, bans, and licenses;
advisories still fails on a pre-existing, unrelated RUSTSEC advisory.
* fix(deny): remove second config and add source to the original one
* chore: pin keycard-rs dependency and fix factory-reset debug-gate doc
* chore: regenerate test fixture and lockfile after rebase onto dev
---------
Co-authored-by: Daniil Polyakov <arjentix@gmail.com>
erhant