[FREEZE-EXCEPTION] feat(crank): canary-cycle daemon (closes 6-gap audit)

.github/workflows/crank.yml

@@ -0,0 +1,57 @@
+name: Crank
+
+# Path-filtered: only fires when the crank service or its SDK dep change.
+# Branch-protection should NOT require this lane until the canary launch —
+# it's advisory while the service is being shaken out.
+on:
+  push:
+    branches: [main]
+    paths:
+      - "services/crank/**"
+      - "sdk/**"
+      - ".github/workflows/crank.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "services/crank/**"
+      - "sdk/**"
+      - ".github/workflows/crank.yml"
+
+concurrency:
+  group: crank-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  crank:
+    name: crank · typecheck + test (advisory)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 20
+
+      - name: Enable Corepack (resolves pnpm via packageManager)
+        run: |
+          corepack enable
+          corepack prepare pnpm@9.12.0 --activate
+          pnpm --version
+
+      - name: pnpm install
+        run: pnpm install --no-frozen-lockfile
+
+      - name: TypeScript typecheck
+        run: pnpm --filter @roundfi/crank typecheck
+
+      - name: Vitest
+        # Four pure-function spec files: classifyError, healthServer,
+        # settleDefaults (eligibility + INFRA classification), and
+        # pollingLoop (lease + RPC + per-pool isolation). The actual
+        # settle_default CPI is integration-level — bankrun/litesvm
+        # lanes cover that.
+        run: pnpm --filter @roundfi/crank test

FREEZE.md

@@ -67,6 +67,7 @@ The `.github/workflows/freeze-enforcement.yml` workflow automates checks #1 and
 | 2026-05-26 | Founder  | PR #412 (`[FREEZE-EXCEPTION]`)           | ECO-002/003 (item 5 — additive economics surface): `StressLabConfig.installmentUsdc` opt-in independent installment (presets byte-identical) + `FrameMetrics.overCollection`; ECO-003 "16.7% breakpoint" re-derived (artifact of retracted premises; gone under on-chain $600). Founder-approved.                                                                                                                                                                                                                                                                                 |
 | 2026-05-26 | Founder  | PR #413 (`[FREEZE-EXCEPTION]`)           | Wallet receive QR (item 7 — bounded front-end visibility): `/carteira` Receive modal QR code. No protocol behavior change. Founder-approved.                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | 2026-05-30 | Founder  | PR #402 (`[FREEZE-EXCEPTION]`)           | Canary grace gate (`pre-ceremony-beta` §6.3 Opção B): opt-in cargo feature `devnet-canary` lowers `GRACE_PERIOD_SECS` 604_800→86_400 (exactly the SEV-002 floor) for the 48h-cycle Canary phase. Feature is NOT default; SEV-002 floor guard runs in both modes (`86_400 >= 86_400`). No mainnet behavior change. Founder-approved.                                                                                                                                                                                                                                               |
+| 2026-06-01 | Founder  | PR #441 (`[FREEZE-EXCEPTION]`)           | Audit findings remediation (item 2): new `services/crank/` daemon closes the 6 gaps from the internal canary-readiness audit (settle_default firing, continuous polling, /health 503 contract, RPC liveness probe, typed `pool.all()` decoder, INFRA/LOGIC error classifier). Postgres lease mirrors the indexer's `reconciler_lease` pattern. No on-chain change, no schema change, no consumer wired yet — daemon doesn't run until Railway is pointed at it. Founder-approved.                                                                                                 |
 
 ## Self-imposed escape valve