Parent: #447 — the L1-genesis regression, fixed in bcb96454
Found by: the loop-security gate on PR #448, explicitly non-gating
Task
Two test fixtures still open the operator wallet under the DIG L2 genesis:
crates/dig-node-service/tests/mirror_advertised_urls.rs:165crates/dig-node-service/tests/mirror_intra_pass_reservation.rs:161
Point both at mirror_agg_sig_data(). Two lines.
Why bother, given it is not a defect today
It cannot cause a wrong production signature. Both drive MockBroadcaster and assert
domain-independent properties, and the gate confirmed there is exactly one production
OperatorWallet::open and one production WalletSigner::new, neither of which these reach.
The shape is the problem. mirror_intra_pass_reservation.rs:154 calls its fixture "A REAL
operator wallet" — so the next person to add a signature-validity assertion there would validate it
under L2 and re-encode the exact defect that just cost a night and left 1010 $DIG stranded on
chain for four hours.
That is the same class as the one #438 just closed: a fixture whose doc implies a coupling it does not
have. Here the doc implies realism the fixture does not have.
The property to preserve while doing it
mirror_agg_sig_data() has no environment override — unlike peer::genesis_challenge_from_env(),
which reads DIG_NETWORK_GENESIS. No env var can repoint the domain a mirror spend is signed
under, and it must stay that way. Keep it a pure function; do not add a parameter or a hook while
"making it testable".
Acceptance
Both fixtures obtain their domain from mirror_agg_sig_data(), and the tests still pass. If either
needs a different domain for a reason, say what it is in a comment rather than leaving a bare
constant — a bare L2 constant beside the words "a REAL operator wallet" is what this ticket exists to
remove.
Parent: #447 — the L1-genesis regression, fixed in
bcb96454Found by: the
loop-securitygate on PR #448, explicitly non-gatingTask
Two test fixtures still open the operator wallet under the DIG L2 genesis:
crates/dig-node-service/tests/mirror_advertised_urls.rs:165crates/dig-node-service/tests/mirror_intra_pass_reservation.rs:161Point both at
mirror_agg_sig_data(). Two lines.Why bother, given it is not a defect today
It cannot cause a wrong production signature. Both drive
MockBroadcasterand assertdomain-independent properties, and the gate confirmed there is exactly one production
OperatorWallet::openand one productionWalletSigner::new, neither of which these reach.The shape is the problem.
mirror_intra_pass_reservation.rs:154calls its fixture "A REALoperator wallet" — so the next person to add a signature-validity assertion there would validate it
under L2 and re-encode the exact defect that just cost a night and left 1010 $DIG stranded on
chain for four hours.
That is the same class as the one #438 just closed: a fixture whose doc implies a coupling it does not
have. Here the doc implies realism the fixture does not have.
The property to preserve while doing it
mirror_agg_sig_data()has no environment override — unlikepeer::genesis_challenge_from_env(),which reads
DIG_NETWORK_GENESIS. No env var can repoint the domain a mirror spend is signedunder, and it must stay that way. Keep it a pure function; do not add a parameter or a hook while
"making it testable".
Acceptance
Both fixtures obtain their domain from
mirror_agg_sig_data(), and the tests still pass. If eitherneeds a different domain for a reason, say what it is in a comment rather than leaving a bare
constant — a bare L2 constant beside the words "a REAL operator wallet" is what this ticket exists to
remove.