DECE expose fresh full-node sync capability

.github/workflows/ci.yml

@@ -74,6 +74,27 @@ jobs:
           bash scripts/mining-amd/install-configs.sh --force
           cmp scripts/mining-amd/poworker.amd.ini.example target/release/poworker.config.ini
 
+      # The crate that holds the pool wallet and signs the payouts. It was built
+      # for the first time at TAG time, in release.yml, so every defect in it had
+      # to be found by a human reading it. Its own suite covers the money rules:
+      # the coinbase hold-back, the payout verdicts, the chain-identity gate, the
+      # refusal to run on an unreadable ledger, and the deployment files.
+      - name: Build and test the HBIT payout pool
+        run: |
+          cargo build --locked --release -p hbit-pool
+          cargo test --locked -p hbit-pool
+
+      # --no-deps is load-bearing, not tidiness. Clippy lints path dependencies
+      # by default, and `-p hbit-pool` alone reports 55 findings from `field` and
+      # `sys` and 0 from this crate - including one deny-by-default lint
+      # (inherent_to_string_shadow_display on Amount) that fails the run outright.
+      # Those are consensus crates: fixing that lint would remove a method used
+      # across the tree and change what Amount renders, which is not something a
+      # pool change may do. --no-deps lints exactly the crate that signs payouts,
+      # which is clean at -D warnings and will not go quietly red.
+      - name: Lint the payout pool
+        run: cargo clippy --locked --no-deps -p hbit-pool --all-targets -- -D warnings
+
       - name: Build and test miner panel
         run: |
           cargo build --locked --release -p miner-panel

.github/workflows/release-node.yml

@@ -0,0 +1,205 @@
+name: Release (HPAY-compatible fullnode)
+
+on:
+  push:
+    tags:
+      - "node-v*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+  RELEASE_REF_NAME: ${{ github.ref_name }}
+
+jobs:
+  build-windows:
+    name: Fullnode (Windows x64)
+    runs-on: windows-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable branch
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          shared-key: release-node-windows
+
+      - name: Build CPU-only fullnode
+        run: cargo build --locked --release --bin hacash
+
+      - name: Verify fullnode capabilities
+        run: cargo test --locked -p app node_capabilities_tests
+
+      - name: Package standalone node
+        shell: pwsh
+        run: |
+          $version = "manual"
+          if ($env:GITHUB_REF_TYPE -eq "tag") {
+            $candidate = $env:RELEASE_REF_NAME
+            if ($candidate -notmatch '^node-v(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)(?:-hpay\.(?:0|[1-9][0-9]*))?$') {
+              throw "Refusing unsafe node release tag: $candidate"
+            }
+            $version = $candidate
+          }
+          & "$env:GITHUB_WORKSPACE\scripts\pack-node-release.ps1" -Version $version
+
+      - name: Verify Windows node package boundary
+        shell: pwsh
+        run: |
+          $archives = @(Get-ChildItem "$env:GITHUB_WORKSPACE\dist-node" -Filter "*.zip" -File)
+          if ($archives.Count -ne 1) { throw "Expected one standalone node ZIP" }
+          $archive = $archives[0]
+          $actual = (Get-FileHash -Algorithm SHA256 -LiteralPath $archive.FullName).Hash.ToLowerInvariant()
+          $expected = [IO.File]::ReadAllText("$($archive.FullName).sha256").Trim()
+          if ($expected -ne "$actual  $($archive.Name)") { throw "Node ZIP checksum mismatch" }
+          $extract = Join-Path $env:RUNNER_TEMP "node-package"
+          Expand-Archive -LiteralPath $archive.FullName -DestinationPath $extract
+          $root = @(Get-ChildItem -LiteralPath $extract -Directory)
+          if ($root.Count -ne 1) { throw "Node ZIP must contain one package root" }
+          $files = @(Get-ChildItem -LiteralPath $root[0].FullName -File | Select-Object -ExpandProperty Name)
+          $expectedFiles = @("hacash.exe", "hacash.config.ini.example", "README.txt", "SOURCE-COMMIT.txt", "VERSION.txt")
+          if ((Compare-Object $files $expectedFiles).Count -ne 0) { throw "Unexpected standalone node package contents: $($files -join ', ')" }
+
+      - name: Upload Windows node artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: hpay-compatible-fullnode-windows-x64
+          path: |
+            dist-node/*.zip
+            dist-node/*.zip.sha256
+          if-no-files-found: error
+          retention-days: 30
+
+  build-linux:
+    name: Fullnode (Linux x86_64)
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable branch
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          shared-key: release-node-linux
+
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y build-essential pkg-config libssl-dev
+
+      - name: Build CPU-only fullnode
+        run: cargo build --locked --release --bin hacash
+
+      - name: Verify fullnode capabilities
+        run: cargo test --locked -p app node_capabilities_tests
+
+      - name: Verify linked libraries
+        run: |
+          test -x target/release/hacash
+          if ldd target/release/hacash | grep -q 'not found'; then
+            ldd target/release/hacash
+            exit 1
+          fi
+          if ldd target/release/hacash | grep -qi opencl; then
+            echo "Standalone fullnode must not depend on OpenCL"
+            exit 1
+          fi
+
+      - name: Package and verify Linux node
+        run: |
+          version="manual"
+          if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
+            candidate="$RELEASE_REF_NAME"
+            if [[ ! "$candidate" =~ ^node-v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-hpay\.(0|[1-9][0-9]*))?$ ]]; then
+              echo "Refusing unsafe node release tag: $candidate"
+              exit 1
+            fi
+            version="$candidate"
+          fi
+          bash scripts/pack-node-release-linux.sh "$version"
+          archives=(dist-node/*.tar.gz)
+          test "${#archives[@]}" -eq 1
+          tar -tzf "${archives[0]}" >/dev/null
+          (cd dist-node && sha256sum -c ./*.tar.gz.sha256)
+          root=dist-node/hpay-compatible-hacash-fullnode-linux-x86_64
+          test -x "$root/hacash"
+          mapfile -t files < <(find "$root" -maxdepth 1 -type f -printf '%f\n' | sort)
+          expected=(README.txt SOURCE-COMMIT.txt VERSION.txt hacash hacash.config.ini.example)
+          [[ "${files[*]}" == "${expected[*]}" ]]
+
+      - name: Upload Linux node artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: hpay-compatible-fullnode-linux-x86_64
+          path: |
+            dist-node/*.tar.gz
+            dist-node/*.tar.gz.sha256
+          if-no-files-found: error
+          retention-days: 30
+
+  publish:
+    name: Publish standalone fullnode release
+    if: startsWith(github.ref, 'refs/tags/node-v')
+    needs: [build-windows, build-linux]
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - name: Validate release tag
+        run: |
+          if [[ ! "$RELEASE_REF_NAME" =~ ^node-v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-hpay\.(0|[1-9][0-9]*))?$ ]]; then
+            echo "Refusing unsafe node release tag: $RELEASE_REF_NAME"
+            exit 1
+          fi
+
+      - name: Download node artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+        with:
+          path: release-assets
+          merge-multiple: true
+
+      - name: Attest node artifacts
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+        with:
+          subject-path: |
+            release-assets/*.zip
+            release-assets/*.tar.gz
+
+      - name: Publish node release
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: HPAY-compatible Hacash Full Node ${{ github.ref_name }}
+          make_latest: false
+          files: release-assets/*
+          generate_release_notes: true
+          body: |
+            ## Standalone Hacash full node for HPAY Fast Pay and L2 hubs
+
+            This is the same CPU-only `hacash` fullnode binary used by the full
+            miner package. It does not change Hacash consensus and it does not
+            include mining workers, a pool, a wallet or private keys.
+
+            Verify the GitHub build attestation before running an archive:
+
+            ```
+            gh attestation verify <file> --repo ${{ github.repository }}
+            ```
+
+            The included mainnet configuration binds the HTTP API to
+            `127.0.0.1:8080` and keeps both miners disabled.