Land verified AssumeUTXO stack

CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+## Unreleased
+
+- Verified snapshot state for AssumeUTXO import (`crates/utxo/src/core_snapshot.rs`, `crates/chainstate/src/assumeutxo.rs`, `crates/node/src/snapshot.rs`). `read_verified` seals the decoded portable set with its base hash, height, commitment and coin statistics, so portable activation performs no second commitment pass or statistics scan. Sets that arrive without proof (native v4 input) are verified exactly once under the lifecycle lock. Caller digests and snapshot trailers still establish no trust. Recorded compatibility boundary: files repeating txid groups are refused (`TransactionOrder`, RPC `-22`); Core 31.1 accepts such a file. No performance gain is claimed.

bin/bitcoin-rs/src/config.rs

@@ -501,3 +501,87 @@ assumevalid=0000000000000000000000000000000000000000000000000000000000000000
         }
     }
 }
+
+#[cfg(test)]
+mod feature_option_tests {
+    use std::ffi::OsString;
+    use std::path::Path;
+
+    use anyhow::Result;
+    use bitcoin_rs_node::{Network, NodeConfig};
+    use clap::Parser as _;
+
+    use super::{CliArgs, parse_for_network, resolve};
+
+    fn load(args: &[&str], vars: &[(&str, &str)]) -> Result<NodeConfig> {
+        let argv = std::iter::once("bitcoin-rs").chain(args.iter().copied());
+        let cli = CliArgs::try_parse_from(argv)?;
+        resolve(
+            cli,
+            vars.iter()
+                .map(|(key, value)| (OsString::from(*key), OsString::from(*value))),
+        )
+    }
+
+    fn refusal(args: &[&str], vars: &[(&str, &str)]) -> String {
+        match load(args, vars) {
+            Ok(_) => panic!("configuration must be refused"),
+            Err(error) => error.to_string(),
+        }
+    }
+
+    #[test]
+    fn index_bundle_directories_resolve_from_the_command_line_and_stay_exclusive() -> Result<()> {
+        let import = load(&["--txindex=true", "--index-bundle-import", "/srv/in"], &[])?.indexes;
+        assert_eq!(import.bundle_import.as_deref(), Some(Path::new("/srv/in")));
+        assert_eq!(import.bundle_export, None);
+
+        let export = load(
+            &["--txindex=true"],
+            &[("BITCOIN_RS_INDEX_BUNDLE_EXPORT", "/srv/out")],
+        )?
+        .indexes;
+        assert_eq!(export.bundle_export.as_deref(), Some(Path::new("/srv/out")));
+
+        // A command-line request never overrides a conflicting environment one.
+        let conflict = refusal(
+            &["--txindex=true", "--index-bundle-import", "/srv/in"],
+            &[("BITCOIN_RS_INDEX_BUNDLE_EXPORT", "/srv/out")],
+        );
+        assert!(conflict.contains("mutually exclusive"));
+        assert!(refusal(&["--index-bundle-export", "/srv/out"], &[]).contains("--txindex"));
+        Ok(())
+    }
+
+    #[test]
+    fn empty_index_bundle_directories_are_refused_by_clap_and_the_environment() {
+        for flag in ["--index-bundle-import", "--index-bundle-export"] {
+            assert!(CliArgs::try_parse_from(["bitcoin-rs", flag, ""]).is_err());
+            assert!(CliArgs::try_parse_from(["bitcoin-rs", flag, "  "]).is_err());
+            assert!(CliArgs::try_parse_from(["bitcoin-rs", flag]).is_err());
+        }
+        for key in [
+            "BITCOIN_RS_INDEX_BUNDLE_IMPORT",
+            "BITCOIN_RS_INDEX_BUNDLE_EXPORT",
+        ] {
+            assert!(load(&["--txindex=true"], &[(key, "")]).is_err());
+        }
+    }
+
+    /// A one-shot restore or export is operator opt-in on the options the
+    /// table names; the Core-compatible file has no spelling for it.
+    #[test]
+    fn bitcoin_conf_cannot_request_a_bundle() {
+        let layers = parse_for_network(
+            "
+index-bundle-import=/srv/in
+indexbundleexport=/srv/out
+",
+            Network::Regtest,
+        );
+        for layer in &layers {
+            assert_eq!(layer.indexes.bundle_import, None);
+            assert_eq!(layer.indexes.bundle_export, None);
+        }
+    }
+}

bin/bitcoin-rs/tests/gates/g17_dependency_direction.rs

@@ -52,6 +52,55 @@ pub fn observe_sync(chain: &dyn SyncChain) -> Option<Arc<TipSnapshot>> {
 }
 ";
 
+/// Approved exact-payload edge: `primitives` owns `BlockPayload` on the
+/// workspace `bytes` buffer; chainstate/p2p/node/mining consume it.
+/// The gate pins the approved direction without forbidding the `bytes` edge
+/// and without reintroducing a cycle.
+#[test]
+fn primitives_owns_block_payload_with_approved_bytes_edge() -> Result<(), Box<dyn std::error::Error>>
+{
+    let manifest = dependency_graph::workspace_root_manifest();
+    let root = manifest.parent().ok_or("workspace root")?.canonicalize()?;
+    let read_manifest = |relative: &str| {
+        std::fs::read_to_string(root.join(relative))
+            .unwrap_or_else(|error| panic!("read {relative}: {error}"))
+    };
+    // Approved producer edge: primitives names the workspace `bytes`
+    // dependency that backs `BlockPayload::from_raw/from_local/from_prefix`.
+    let primitives = read_manifest("crates/primitives/Cargo.toml");
+    assert!(
+        primitives.contains("bytes"),
+        "primitives must own the approved bytes edge for BlockPayload"
+    );
+    let lib = read_manifest("crates/primitives/src/lib.rs");
+    assert!(
+        lib.contains("BlockPayload"),
+        "primitives must re-export the BlockPayload owner type"
+    );
+    // Approved consumer direction: every payload consumer depends on
+    // primitives; primitives never depends back (no cycle reintroduced).
+    for consumer in [
+        "crates/chainstate/Cargo.toml",
+        "crates/p2p/Cargo.toml",
+        "crates/node/Cargo.toml",
+        "crates/mining/Cargo.toml",
+    ] {
+        let text = read_manifest(consumer);
+        assert!(
+            text.contains("bitcoin-rs-primitives"),
+            "{consumer} must consume the primitives BlockPayload owner"
+        );
+    }
+    assert!(
+        !primitives.contains("bitcoin-rs-chainstate")
+            && !primitives.contains("bitcoin-rs-p2p")
+            && !primitives.contains("bitcoin-rs-node")
+            && !primitives.contains("bitcoin-rs-mining"),
+        "primitives must not depend back on its payload consumers"
+    );
+    Ok(())
+}
+
 #[test]
 fn workspace_dependency_direction_is_one_way() {
     let graph = WorkspaceGraph::from_cargo_metadata();