Dara DocsReferenceReviews
Review pass 2
Stage 36–37, 2026-10-30. A second pass with different questions from pass 1: how the system behaves over days of operation (long-lived proposals, expiries, queues), what an operator can and cannot do when something is pending, and whether the documents describe what the code does.
Findings
| ID | Sev. | Finding | Evidence | Impact | Fix | Regression test | Status |
|---|---|---|---|---|---|---|---|
| R2-01 | MEDIUM | Every proposal awaiting human signatures holds a GOV channel until signed or expired (24 h); the local ceremony created one GOV channel, so all human-signed operations were serialized behind the oldest pending one | txmanager.buildOne leases a channel per attempt; bootstrap-local | An urgent clawback or refill could wait up to a day behind an unsigned issuance | Ceremony creates three GOV channels (BOOTSTRAP_GOV_CHANNELS); sizing rule in ISSUER_OPERATIONS.md §1; alert SigningChannelsExhausted | make observability-check (rule test) | Fixed |
| R2-02 | LOW | An expired proposal is rebuilt with a new hash: signatures collected for the old one do not carry over | Expiry → new attempt | Signers must sign again after 24 h | Expected (the old envelope can never apply); SigningProposalWaiting warns at 12 h | — | Accepted, documented in MONITORING.md |
| R2-03 | LOW | The ledger-model document described the cash legs with the wrong debit/credit sides | LEDGER_MODEL.md vs trading.go | Misleading for finance reviewers | Rewritten from the code's postings | Worked-example tests | Fixed |
| R2-04 | INFO | Building images needs the public npm registry for Next.js 16.4.3 (the mirror answers 500) and host DNS (container DNS fails here) | Image builds | Environment-specific | podman build --network=host with NPM_REGISTRY=https://registry.npmjs.org/ | — | Environment |
Checked with no finding
- Reconciliation does not skip balances because of proposals awaiting signatures: only signed or submitted attempts are in flight, and each is resolved against the chain by its hash at the run's ledger.
- A customer frozen while a BUY settles: the payment fails on-chain (not authorized), the order fails and holds are
released (
TestPlatformLifecycle, settlement failure). - Clawback against tokens held by an open order: the clawback hold needs available tokens, so it is refused rather
than overdrawing (
TestClawback). - Restarting any process mid-operation: intents and holds are in the database; the engine resumes from persisted
envelopes (
TestCrashAfterSignBeforeSubmit; worker loops are leader-elected). - Restore from backup: drill passed; intents applied after the restore point are found again through the indexer
(
BACKUP_RESTORE.md§3). - Configuration cannot reach Mainnet with demo shortcuts: the derived signer and dev signers refuse it; seed, demo and bootstrap-local refuse every network but local; Friendbot is refused on Mainnet.
- Public surfaces (landing, Dara Scan,
stellar.toml) expose no identity; the scan role cannot read core tables (TestScanRoleCannotReadCoreTables).
Result
No open CRITICAL or HIGH finding is fixable without the operator's decisions; the open ones are listed in
../deployment/LAUNCH_CHECKLIST.md (HSM/KMS signer, human signers, volume-based sizing, data lake, alert
receivers).