bittensor-core: one Rust core (keys, keyfiles, timelock, codec, RFC-0078 digest, Ledger) under a thin Python SDK

.agents/skills/auditor/SKILL.md

@@ -11,7 +11,7 @@ You are running the Auditor persona locally against the user's working tree. The
 
 Same detection as the Skeptic skill:
 1. PR base via `gh pr view --json baseRefName` if a PR exists.
-2. Default to `devnet-ready`.
+2. Default to `devnet`.
 3. Override via skill argument: `/auditor main`.
 
 Compute the diff:

.agents/skills/skeptic/SKILL.md

@@ -11,7 +11,7 @@ You are running the Skeptic persona locally against the user's working tree. The
 
 Detect the base branch in this order:
 1. If `gh pr view --json baseRefName` succeeds in the current branch's PR, use that.
-2. Else, default to `devnet-ready` (the policy base for new PRs).
+2. Else, default to `devnet` (the policy base for new PRs).
 3. Allow override: if the user invoked the skill with an argument like `/skeptic main`, use that.
 
 Compute the diff:

.claude/skills

@@ -0,0 +1 @@
+../.agents/skills

.github/actionlint.yaml

@@ -0,0 +1,9 @@
+self-hosted-runner:
+  # Fireactions-provisioned runner pools plus the dedicated benchmarking box.
+  labels:
+    - fireactions-light
+    - fireactions-heavy
+    - fireactions-turbo
+    - fireactions-tryruntime
+    - fireactions-tryruntime-finney
+    - Benchmarking

.github/actions/rust-setup/action.yml

@@ -0,0 +1,110 @@
+name: "Rust setup"
+description: >-
+  Common prologue for Rust jobs: system dependencies, stable toolchain with
+  optional components, and the shared Swatinem cache.
+
+inputs:
+  cache-key:
+    description: "Swatinem/rust-cache key for this job"
+    required: true
+  components:
+    description: "Comma-separated toolchain components (e.g. clippy,rustfmt)"
+    default: ""
+  extra-packages:
+    description: "Extra apt packages beyond the standard build set"
+    default: ""
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install system dependencies
+      shell: bash
+      run: |
+        sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get update
+        sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y --no-install-recommends \
+          -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" \
+          build-essential clang curl git make libssl-dev llvm libudev-dev protobuf-compiler pkg-config \
+          python3 python3-dev \
+          ${{ inputs.extra-packages }}
+
+    - name: Install Rust (stable)
+      uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+      with:
+        components: ${{ inputs.components }}
+
+    - name: Fast linker and CI debuginfo trim
+      shell: bash
+      run: |
+        # mold links in a fraction of GNU ld's time, and cargo test alone
+        # links dozens of test binaries. Guarded so a runner image without
+        # the mold package falls back to the default linker instead of
+        # failing every Rust job at setup.
+        if sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends mold; then
+          mkdir -p "$HOME/.cargo"
+          cat >> "$HOME/.cargo/config.toml" <<'EOF'
+        [target.x86_64-unknown-linux-gnu]
+        linker = "clang"
+        rustflags = ["-C", "link-arg=-fuse-ld=mold"]
+        EOF
+          echo "mold enabled as linker"
+        else
+          echo "mold unavailable; keeping default linker"
+        fi
+        # Nothing in CI consumes full debuginfo; line tables keep panic
+        # backtraces readable while cutting codegen time and disk I/O.
+        # (Jobs that export RUSTFLAGS, like the warnings check, override the
+        # config rustflags above — harmless, since cargo check never links.)
+        {
+          echo "CARGO_PROFILE_DEV_DEBUG=line-tables-only"
+          echo "CARGO_PROFILE_TEST_DEBUG=line-tables-only"
+        } >> "$GITHUB_ENV"
+
+    # Registry/git-dependency cache only. Target-dir caching is deliberately
+    # off: nine jobs each snapshotting a multi-GB target dir thrashed the
+    # repo's 10 GB Actions-cache quota (constant LRU eviction, so most jobs
+    # ran cold anyway). Compiled objects are cached per-crate by sccache
+    # below, in one pool all Rust jobs share.
+    - name: Cargo registry cache
+      uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      with:
+        key: ${{ inputs.cache-key }}
+        cache-targets: false
+        cache-on-failure: true
+
+    - name: Install sccache
+      shell: bash
+      run: |
+        set -euo pipefail
+        version=v0.16.0
+        curl --fail --silent --show-error --location \
+          "https://github.com/mozilla/sccache/releases/download/${version}/sccache-${version}-x86_64-unknown-linux-musl.tar.gz" \
+          | tar -xz -C /tmp
+        sudo install -m 755 "/tmp/sccache-${version}-x86_64-unknown-linux-musl/sccache" /usr/local/bin/sccache
+        sccache --version
+
+    # The GHA cache backend needs the runner's cache-service URL and token,
+    # which GitHub only exposes to JS actions — hence the github-script hop
+    # (first-party, so no Actions-allowlist problem).
+    - name: Expose Actions cache credentials for sccache
+      uses: actions/github-script@v7
+      with:
+        script: |
+          for (const name of [
+            "ACTIONS_RESULTS_URL",
+            "ACTIONS_CACHE_URL",
+            "ACTIONS_CACHE_SERVICE_V2",
+            "ACTIONS_RUNTIME_TOKEN",
+          ]) {
+            if (process.env[name]) core.exportVariable(name, process.env[name]);
+          }
+
+    - name: Enable sccache
+      shell: bash
+      run: |
+        {
+          echo "RUSTC_WRAPPER=sccache"
+          echo "SCCACHE_GHA_ENABLED=true"
+          # sccache cannot cache incremental compilation, and CI never reuses
+          # a working tree, so incremental is pure overhead here.
+          echo "CARGO_INCREMENTAL=0"
+        } >> "$GITHUB_ENV"

.github/ai-review/README.md

@@ -29,7 +29,7 @@ workflow will automatically use its token instead.
 
 ### Setup
 
-1. Create a GitHub App under the `opentensor` org:
+1. Create a GitHub App under the `RaoFoundation` org:
    - Settings → Developer settings → GitHub Apps → New GitHub App.
    - Webhook: not needed; disable.
    - Repository permissions:
@@ -39,7 +39,7 @@ workflow will automatically use its token instead.
      - **Metadata**: Read
    - User permissions: none.
    - "Where can this GitHub App be installed?": Only on this account.
-2. Install the App on the `opentensor/subtensor` repo (only).
+2. Install the App on the `RaoFoundation/subtensor` repo (only).
 3. From the App settings page, generate a private key (`.pem` file).
 4. In repo Settings → Secrets and variables → Actions:
    - Variables tab: add `AI_REVIEW_APP_ID` = the App's numeric ID.
@@ -98,12 +98,12 @@ the PR number. `workflow_dispatch` runs in base context with secrets
 available, performs the real review, and the required checks turn green.
 
 ```bash
-gh workflow run ai-review.yml --repo opentensor/subtensor -f pr_number=<N>
+gh workflow run ai-review.yml --repo RaoFoundation/subtensor -f pr_number=<N>
 ```
 
 ## Required-checks setup
 
-After the first successful run, add these to branch protection on `devnet-ready`
+After the first successful run, add these to branch protection on `devnet`
 (and other protected branches) under Settings → Branches → Branch protection rules:
 
 - `ai-review / skeptic`
@@ -114,7 +114,7 @@ After the first successful run, add these to branch protection on `devnet-ready`
 Manual trigger:
 
 ```bash
-gh workflow run ai-review-index-gittensor.yml --repo opentensor/subtensor
+gh workflow run ai-review-index-gittensor.yml --repo RaoFoundation/subtensor
 ```
 
 Daily cron is already configured (06:17 UTC). The indexer opens a PR with any

.github/ai-review/auditor.md

@@ -70,7 +70,7 @@ Look up the PR author's gittensor association:
 
 1. Read `.github/ai-review/known-gittensor-accounts.json` (auto-maintained from on-chain bounty data).
 2. Read `.github/ai-review/gittensor-accounts.txt` (nucleus-curated supplement).
-3. If neither matches, apply the heuristic: ≥70% of the author's recent merged PRs are to gittensor-whitelisted repos (subtensor / opentensor / latent-to / etc.) AND average PR size is small. If so, classify as `LIKELY`.
+3. If neither matches, apply the heuristic: ≥70% of the author's recent merged PRs are to gittensor-whitelisted repos (subtensor / RaoFoundation / opentensor / latent-to / etc.) AND average PR size is small. If so, classify as `LIKELY`.
 
 Tier the author:
 - **KNOWN** (on-chain or curated): high confidence gittensor miner.
@@ -99,9 +99,9 @@ Apply `.github/copilot-instructions.md` in full. Particular emphasis:
 
   | Base branch | Network endpoint | CI workflow |
   | --- | --- | --- |
-  | `devnet` / `devnet-ready` | `wss://dev.chain.opentensor.ai:443` | check-devnet |
-  | `testnet` / `testnet-ready` | `wss://test.finney.opentensor.ai:443` | check-testnet |
-  | `finney` / `main` | `wss://entrypoint-finney.opentensor.ai:443` | check-finney |
+  | `devnet` | `wss://dev.chain.opentensor.ai:443` | check-devnet |
+  | `testnet` | `wss://test.finney.opentensor.ai:443` | check-testnet |
+  | `mainnet` | `wss://entrypoint-finney.opentensor.ai:443` | check-mainnet |
   | anything else | _(no spec-version check)_ | — |
 
   Also: a bump is NOT required if the PR carries the `no-spec-version-bump`

.github/ai-review/common.md

@@ -1,6 +1,6 @@
 # Subtensor AI Review — Shared Context
 
-You are reviewing a pull request to **opentensor/subtensor**, the Substrate-based runtime for the Bittensor blockchain (~$4B market cap). Lives and livelihoods depend on the security and correctness of this code. Be thorough, precise, and uncompromising on safety.
+You are reviewing a pull request to **RaoFoundation/subtensor**, the Substrate-based runtime for the Bittensor blockchain (~$4B market cap). Lives and livelihoods depend on the security and correctness of this code. Be thorough, precise, and uncompromising on safety.
 
 ## Repository topology
 
@@ -12,10 +12,10 @@ You are reviewing a pull request to **opentensor/subtensor**, the Substrate-base
 
 ## Branch strategy
 
-- All non-deployment PRs must target `devnet-ready`.
-- Deployment-only flow: `devnet-ready` → `devnet` → `testnet` → `main`.
-- A PR targeting `main` directly is only legitimate if it is a hotfix or a deployment PR.
-- `devnet` and `testnet` may only receive merges from their respective `-ready` branches.
+- All non-deployment PRs must target `devnet`.
+- Deployment-only flow: `devnet` → `testnet` → `mainnet`.
+- A PR targeting `mainnet` directly is only legitimate if it is a hotfix or a deployment PR.
+- `testnet` and `mainnet` may only receive promotion merges from the branch directly upstream of them.
 
 ## Severity tags
 

.github/ai-review/post_review.py

@@ -25,7 +25,7 @@
 
 Usage:
   GH_TOKEN=... python3 post_review.py \
-    --persona skeptic --pr 2668 --repo opentensor/subtensor \
+    --persona skeptic --pr 2668 --repo RaoFoundation/subtensor \
     --commit-sha <sha> --input-file skeptic-output.json
 """