Dara DocsReferenceTest evidenceEvidence
Evidence: transaction manager on local Stellar (Stage 14 / 22 / 24 / 25 subset)
Date: 2026-10-29. Network: Quickstart v689-b1585.1-latest, --local, protocol 30. Database: PostgreSQL 17.6. Command:
TEST_DATABASE_URL=… STELLAR_RPC_URL=http://localhost:8000/rpc REQUIRE_INTEGRATION=1 \
go test -count=1 -race ./internal/txmanager/Result: 7/7 PASS (-race). Every scenario uses the production signer layout (ceremony package: issuer H1–H4 ×10 + AUTH ×1, thresholds 1/20/30; Treasury COLD T1–T4; HOT online key; sponsored customers).
| Test | Proves | Brief |
|---|---|---|
TestIssueOnboardAndConcurrentSettlement | Issuance via human multisig (AUTH alone and AUTH + H1 refused, H1 + H2 completes); refill via T-signers; sponsored onboarding; 40 concurrent settlements through 4 channels each applied exactly once; supply unchanged; every channel FREE at the chain sequence + 1 | §29, §45, §48, §49, §121, INV-03/04 |
TestTimeoutAfterAcceptanceAppliesOnce | RPC response lost after acceptance (3×): the attempt is UNKNOWN, resolved from the chain; one attempt, one effect | §52, §122, §123 |
TestLostSubmissionExpiresThenRetriesOnce | Submission never reached the network: a new envelope is built only after expiry is proven; one APPLIED attempt | §52, §121, INV-10 |
TestInLedgerFailure | Unauthorized destination fails in the ledger: intent FAILED (InLedger, NOT_AUTHORIZED), sequence consumed, channel free | §90, §119 |
TestForeignChannelUseIsQuarantined | Someone else consumed a channel sequence: txBAD_SEQ → channel QUARANTINED + CRITICAL incident; intent applied on another channel | §48, §126 (sequence attack) |
TestCrashAfterSignBeforeSubmit | Process "crash" after the signed envelope was persisted: a fresh engine submits the persisted bytes; one effect | §122 |
TestSignatureUploadsAreVerified | A signature over another hash and a non-signer's signature are refused | §57, §126 |
Defects found by these tests and fixed
CHECK (ledger IS NOT NULL)on APPLIED/FAILED was violated by a two-statement update; now recorded in one statement.txBAD_AUTH_EXTRAon human proposals with more signatures than needed; now a minimal sufficient subset is attached.txBAD_AUTH_EXTRAon onboarding: the CUSTODY signature was unused; removed from the signature set.- A foreign sequence bump of exactly +1 was mistaken for our own consumption; channel release now knows whether the attempt applied.