From 28112e1f6fdd1266acd0469448aa274221306928 Mon Sep 17 00:00:00 2001 From: jwinterm Date: Fri, 24 Jul 2026 11:23:20 -0400 Subject: [PATCH] docs: isolate stagenet canary funding RPC --- docs/STAGENET_FINANCIAL_CANARY.md | 9 ++++++--- test/stagenetFinancialCanary.test.js | 9 +++++++++ 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/docs/STAGENET_FINANCIAL_CANARY.md b/docs/STAGENET_FINANCIAL_CANARY.md index e5f2372..ca76ec2 100644 --- a/docs/STAGENET_FINANCIAL_CANARY.md +++ b/docs/STAGENET_FINANCIAL_CANARY.md @@ -42,7 +42,10 @@ Use two different stagenet wallets: 1. The canary application owns the normal house wallet used to create invoice subaddresses and dispatch payouts. 2. A separate, low-balance funding wallet sends the direct-entry payment and receives the payout. -Expose only the separate funding wallet RPC to the harness, on loopback. Do not give the harness the house-wallet RPC URL or credentials. Keep the funding balance no larger than needed for the selected invoice plus fees. +Expose only the separate funding wallet RPC to the harness, on loopback. Use a dedicated port such +as `38085`; port `38083` belongs to the promoted house wallet and must not be reused by the funding +wallet. Do not give the harness the house-wallet RPC URL or credentials. Keep the funding balance +no larger than needed for the selected invoice plus fees. Before live use, independently verify that both wallet files are recoverable according to the operator's wallet-backup procedure. Do not put seeds, private keys, wallet passwords, transaction keys, or mnemonic output in this runbook, shell history, screenshots, CI variables, or canary logs. This harness deliberately does not inspect or print seed material. @@ -145,7 +148,7 @@ E2E_TARGET=http://127.0.0.1:3102 \ E2E_EXPECT_DATABASE=monerogue_canary_direct_e2e \ E2E_DATABASE_URL_FILE=/run/credentials/canary/direct-database-url \ E2E_DATABASE_NONCE_FILE=/run/credentials/canary/database-nonce \ -E2E_FUNDING_RPC_URL=http://127.0.0.1:38083 \ +E2E_FUNDING_RPC_URL=http://127.0.0.1:38085 \ E2E_FUNDING_RPC_USER_FILE=/run/credentials/canary/funding-rpc-user \ E2E_FUNDING_RPC_PASSWORD_FILE=/run/credentials/canary/funding-rpc-password \ E2E_MAX_TRANSFER_ATOMIC=REPLACE_WITH_REVIEWED_ATOMIC_CEILING \ @@ -171,7 +174,7 @@ E2E_TARGET=http://127.0.0.1:3102 \ E2E_EXPECT_DATABASE=monerogue_canary_treasure_e2e \ E2E_DATABASE_URL_FILE=/run/credentials/canary/treasure-database-url \ E2E_DATABASE_NONCE_FILE=/run/credentials/canary/database-nonce \ -E2E_FUNDING_RPC_URL=http://127.0.0.1:38083 \ +E2E_FUNDING_RPC_URL=http://127.0.0.1:38085 \ E2E_FUNDING_RPC_USER_FILE=/run/credentials/canary/funding-rpc-user \ E2E_FUNDING_RPC_PASSWORD_FILE=/run/credentials/canary/funding-rpc-password \ E2E_MAX_TRANSFER_ATOMIC=REPLACE_WITH_REVIEWED_ATOMIC_CEILING \ diff --git a/test/stagenetFinancialCanary.test.js b/test/stagenetFinancialCanary.test.js index 30d7d56..98d1d20 100644 --- a/test/stagenetFinancialCanary.test.js +++ b/test/stagenetFinancialCanary.test.js @@ -30,6 +30,7 @@ const { } = require('../src/services/canaryDatabaseIdentity'); const SCRIPT = path.join(__dirname, '../src/scripts/stagenet-financial-canary.js'); +const RUNBOOK = path.join(__dirname, '../docs/STAGENET_FINANCIAL_CANARY.md'); function configEnv(overrides = {}) { return { @@ -475,4 +476,12 @@ describe('XMR stagenet financial canary safety contract', () => { expect(manifest.scripts['canary:stagenet']) .toBe('node scripts/stagenet-financial-canary.js'); }); + + test('runbook keeps the separate funding wallet off the house-wallet RPC port', () => { + const runbook = fs.readFileSync(RUNBOOK, 'utf8'); + expect(runbook).toContain('port `38083` belongs to the promoted house wallet'); + expect(runbook).not.toContain('E2E_FUNDING_RPC_URL=http://127.0.0.1:38083'); + expect(runbook.match(/E2E_FUNDING_RPC_URL=http:\/\/127\.0\.0\.1:38085/g)) + .toHaveLength(2); + }); });