You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Verify token program attribution for ASPORE deposits - #308
Accept supported ASPORE Token-2022 deposits only when the canonical transfer instruction program matches every source/destination token-balance record. Missing, null, mixed or unknown program attribution fails closed. Fixes#181.
Reuse the existing implementation while preserving the current UUID owner-claim schema. Both legacy Token and Token-2022 direct transfer forms remain subject to the existing signed user-bound claim, finalized transaction identity, mint/authority/ownership checks, exact integer balances, amount limits, uniqueness and rollback. Unsupported hooks/CPI, fee-specific shapes, delegates, multisig, batches and account creation/closure remain rejected; this is not general extension support.
Validation: 154 signed-HTTP/service/repository cases passed on isolated PostgreSQL, including concurrency and rollback. The full combined backend completed cleanly: 2,290 passed, two skipped, zero failures/errors. The separately reviewed scheduler fix#307 was merged normally; exact backend-tree equality and all six frozen source hashes were verified across integration, so no unrelated full rerun was performed. Current backend tree: 7e07fc7820b72a206c4501ee5d6a9154c4694891; commit ce612dfc0af63d7ab2e5a50568a25f52547014f8. Independent review, Ruff/ty baseline checks, document links and staged quality gates passed.
Only six production/test/contract files change relative to main. Historical QA files remain outside Git. No migration, dependency, SDK, activity accrual, sender or automatic reward payment is added. CI and native image/production acceptance remain pending. No live deposit or actual funds transfer was used to validate this change.
Installed on production, independently verified at 2026-11-04 18:39:46 UTC.
Source 420614b5835a6e35882388ad4466fdb30fb05579; image sha256:caf58aafd10c600b872852134a43bc1e6a1d6502214ad9bb35ac335126d0b7fc. Includes #307 scheduler cancellation cleanup and #308 direct Token-2022 deposit validation. Combined local backend suite: 2,290 passed, 2 skipped; both PRs passed CI 5/5.
Backend healthy; internal, agentspore.com and agentspore.ru health endpoints returned 200. Installed source hashes match. Other 20 containers, nine volumes, semantic networks, mounts, worker, A4 and skill hashes preserved. Schema remains 110. Previous payout-reference guard preserved.
Rollback retained: sha256:ac10b3d74f0260766b278d4682600e0c8d957f9eaa316e60130e9d35b538ffec. No migration, actual funds transfer, reward activation or frontend switch. Production funded deposits and generic Token-2022 extensions are not claimed as verified.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Accept supported ASPORE Token-2022 deposits only when the canonical transfer instruction program matches every source/destination token-balance record. Missing, null, mixed or unknown program attribution fails closed. Fixes #181.
Reuse the existing implementation while preserving the current UUID owner-claim schema. Both legacy Token and Token-2022 direct transfer forms remain subject to the existing signed user-bound claim, finalized transaction identity, mint/authority/ownership checks, exact integer balances, amount limits, uniqueness and rollback. Unsupported hooks/CPI, fee-specific shapes, delegates, multisig, batches and account creation/closure remain rejected; this is not general extension support.
Validation: 154 signed-HTTP/service/repository cases passed on isolated PostgreSQL, including concurrency and rollback. The full combined backend completed cleanly: 2,290 passed, two skipped, zero failures/errors. The separately reviewed scheduler fix #307 was merged normally; exact backend-tree equality and all six frozen source hashes were verified across integration, so no unrelated full rerun was performed. Current backend tree:
7e07fc7820b72a206c4501ee5d6a9154c4694891; commitce612dfc0af63d7ab2e5a50568a25f52547014f8. Independent review, Ruff/ty baseline checks, document links and staged quality gates passed.Only six production/test/contract files change relative to main. Historical QA files remain outside Git. No migration, dependency, SDK, activity accrual, sender or automatic reward payment is added. CI and native image/production acceptance remain pending. No live deposit or actual funds transfer was used to validate this change.