مستندات دارامرجع فنیبررسی اولیه
این صفحه فقط به انگلیسی موجود است.
Port Log
Provenance of every backend module (Q-00 "port with review"). Source: apps/carbon-blockchain-ethereum-l1 at clean commit eefc5f2, exported with git archive (the sibling's uncommitted observability work is not included). Review Pass 1 treats every row as new code.
| Module | Origin | Changes for Stellar |
|---|---|---|
actor, apperr, audit, incident, ledger, identity, platform/clock, platform/ids, platform/db, testutil/pgtest | Ported unchanged (module path only) | — |
money | Ported | TokenDecimals 18 → 7; ToWei/FromWei replaced by ToStroops/FromStroops (int64, exact, bounded by the trustline maximum) and StellarAmount; tests rewritten for stroops |
platform/metrics | Ported | Ethereum-specific series are replaced when the Stellar gateway lands |
pricing, cash | Ported (module path only) | Quote eligibility is per asset (RequireEligible(customer, asset)); comments |
portfolio | Ported | Asset code instead of symbol; custodial Stellar account instead of wallet address; tx hash from stellar_transactions (hex, no 0x) |
assets | Rewritten from the sibling | DRAFT → CONFIGURING (RegisterIssuer: ceremony layout verified on-chain, Treasury trustlines authorized by AUTH) → ACTIVE (Activate: unit definition, Treasury trustlines authorized + clawback-enabled on-chain, SEP-1 home_domain/stellar.toml on non-local networks via the SDK's clients/stellartoml). No factory deployment |
customers | Rewritten from the sibling | KYC approval → sponsored custodial account (ONBOARD_ACCOUNT) with every ACTIVE asset; later assets via ENABLE_ASSET. Freeze = off-chain + SET_AUTHORIZATION revoke; unfreeze is four-eyes (authorization_changes, STELLAR_ARCHITECTURE.md §5, PRD FR-11), where the sibling used one officer. Lines authorized while frozen are re-revoked |
reserve | Ported, simplified | No on-chain cap and no Safe: an approved snapshot is EFFECTIVE at once; attestation reuse refused by a unique index; Publish added |
issuance | Rewritten from the sibling | ISSUE / BURN / REFILL as human multisig proposals after four-eyes approval; automatic SWEEP HOT → COLD above the float ceiling. Ledger posted at APPLIED (a closed ledger is final) |
trading | Ported | Settlement is one Payment (BUY signed by HOT, SELL/TRANSFER by CUSTODY). No cancel-authorization step and no daily Treasury limit: the HOT float bounds sales. Failure releases holds |
gate | Ported | Stellar conditions: no healthy RPC node, ledger age, signer, FUNDER balance, funded AUTO channels, UNKNOWN backlog, blocking incident, HOT Treasury active. No finality tracking |
reconciliation | Rewritten from the sibling | No finalized-block pin or single-use ids: reads are pinned to one node and one ledger, in-flight intents resolved per attempt hash (Lookup.LatestLedger). Adds HOT/COLD/customer balance checks, trustline-state and issuer-layout checks, and indexer checks (supply by movements, nothing outside known trustlines, lag). Own advisory lock key (the sibling's collided with the engine's) |
indexer | New (the sibling's is an Ethereum log indexer) | Ingest SDK over LedgerCloseMeta; GatewaySource (our RPC nodes) and BackendSource (any SDK LedgerBackend, e.g. a SEP-54 data lake). Projects every trustline in our assets, other holdings (claimable, LP, SAC contract), movements linked to intents by MEMO_HASH; incidents for unexplained movements, unknown holders, off-trustline supply, DEX use, authority changes, SAC deployment, gaps |
httpapi | Ported | Same middleware, idempotency and listener split. Asset actions for the Stellar lifecycle (register-issuer, unit-definition, activate, retries); unfreeze request + four-eyes decision; signing proposals (list envelope + hash + progress, upload signature); node, gate and indexer views; blockchain-operations instead of blockchain-transactions. Fix carried back as a finding for the sibling: a staff email with the right password on the public listener answered mfa_required, confirming the account and the password; the listener's allowed kinds are now checked inside identity.Login before MFA |
app | Rewritten from the sibling | No contract manifest: the account manifest's accounts are verified on-chain against the ceremony layouts with this signer's keys, then registered (idempotent) in stellar_accounts / channel_accounts. Emergency pause is off-chain (a Classic asset has no global pause): SUSPENDED + blocking incident |
platform/config, platform/manifest, cmd/dara | Ported / rewritten | STELLAR_NETWORK, STELLAR_RPC_NODES (≥ 2 own nodes in uat/production), human signer public keys (ISSUER_SIGNERS, TREASURY_SIGNERS; dev stand-ins only on local), stroop-denominated limits. Commands: serve, worker, all, migrate, bootstrap-admin(-approve), keys, bootstrap-local (local only; a no-op when the manifest matches the chain), demo-totp, seed, demo. rpc-proxy is not ported (Stellar RPC is our own nodes behind the gateway) |
seed, demo (cmd/dara) | Ported | devsafe → standIn: the stand-in human signers (H1–H4, T1–T4, local network only) verify the envelope's network and hash and upload signatures through the signing API. The demo adds the HOT refill, the four-eyes unfreeze with on-chain trustline checks, and waits on reads instead of polling mutations. Orders end COMPLETED (a closed ledger is final), not FINAL |
| Docker, compose, Makefile | Ported | Backend image as the sibling's (distroless, non-root) plus an owned /deployments for the manifest volume. Quickstart --local replaces Anvil; a bootstrap service replaces the contract deployment; no tools image. make demo, demo-seed, demo-totp, demo-down, demo-reset, test-up, test. Web apps, observability and the devnet are not ported yet |
packages/ui (Stage 14 part 8) | Ported | chain.ts rewritten: fromStroops (7 decimals) for fromWei, shortId for shortHex, Stellar states with only APPLIED labelled final, Scan links to account instead of address. Money, API client and locale unchanged. api-types.ts regenerated from the ported OpenAPI spec |
apps/admin (Stage 14 part 8) | Ported | Types match the Go JSON. Governance → Signing: proposals show the network passphrase, transaction hash and envelope XDR to copy and verify offline, per-account signature weight against the threshold, and a signature upload (signer G… + base64). Assets follow the Stellar lifecycle (register-issuer, unit definition, activate, retries; no factory, no Treasury limit). Supply: ISSUE / REFILL / BURN (+ system SWEEP). Reserves: no Safe or cap transaction. Overview: hot and cold Treasury, ledger against chain. Customers: Stellar account and the four-eyes unfreeze queue (new GET /v1/admin/authorization-changes). Chain operations (intent + latest attempt, fee in XLM), RPC nodes, gate, indexer lag. Emergency: off-chain pause, two-step resume (no Governance Safe) |
apps/wallet (Stage 14 part 8) | Ported | Custodial Stellar account instead of a wallet address; asset code and unit definition; COMPLETED is final (no FINAL state, no "final after 15 minutes"); issuer powers state freeze and clawback (two human signers, public) instead of a 48-hour timelock; Persian labels for the Stellar states |
apps/landing (Stage 14 part 8) | Ported, copy rewritten | No claim of an on-chain supply cap (a Classic asset has none): issuance needs 2 of 4 human issuer signers and the platform refuses issuance above backing; cold Treasury; finality within seconds; no XLM needed; issuer powers are freeze, clawback, platform pause and fixed asset flags (no upgradeable contract). A test fails if "Ethereum" reappears |
docs/api/openapi.yaml (Stage 14 part 8) | Ported | Stellar paths (asset lifecycle actions, blockchain-operations, signing proposals and signature upload, authorization changes, nodes / gate / indexer); Safe, Treasury-limit, unpause and retry paths removed; schemas match the Go structs (AccountId, TxHash, 7-decimal Quantity). Dara Scan paths return with the scan API |
Web images, make demo-ui, make web-check (Stage 14 part 8) | Ported | Same deploy/web.Dockerfile (standalone Next.js, non-root); ui profile in the demo compose. Dara Scan added in the next stage (scan in the ui profile) |
clawback (new) | New | Not in the sibling (ERC-7943 forced transfer through a timelock instead). Request by compliance with a legal/recovery reference, four-eyes approval, on-chain trustline check, hold, issuer multisig Clawback, exactly-once settlement out of supply. docs/operations/CLAWBACK_POLICY.md |
scanapi, dara scan-api | Ported | Same isolation (a role that reads only the scan schema; TestScanRoleCannotReadCoreTables). Views over the indexer's trustlines and movements (ISSUE / BURN / TRANSFER / CLAWBACK, each marked explained or not), the issuer layout reconciliation observes on-chain (issuer_observations), published backing and the latest reconciliation. No finality labels: everything shown is in a closed ledger. Adds /.well-known/stellar.toml (SEP-1), generated from the same data activation verifies |
apps/scan | Ported | Accounts (G…) instead of addresses, asset codes, movements instead of logs, issuer controls (master weight, thresholds, flags, signers), hot and cold Treasury, backing share instead of cap usage; fa/en |
apps/landing /.well-known/stellar.toml | New | Relays the scan API's SEP-1 file from the issuers' home domain (CORS *) |
| Brand marks | Replaced | The inherited Carbon logo is replaced by a placeholder Dara mark until the brand assets are supplied |
ledger (Stage 14 part 4) | Extended | TREASURY_COLD_AVAILABLE / TREASURY_COLD_RESERVED; TREASURY_AVAILABLE/RESERVED are the HOT float. Only supply operations may post to COLD |
deploy/backup, make backup-drill | Ported | pgBackRest image, configuration and restore drill unchanged in method; names, database and table checks for Dara. Drill passed on the demo database (37 tables identical, RTO 19 s). docs/operations/BACKUP_RESTORE.md |
migrations | Consolidated, not replayed. The sibling's 12 migrations layered Ethereum columns (20-byte addresses, token_address, nonces) into base tables | 00001 identity = sibling 00001 + 00006 + 00012 (+ role RECONCILIATION_OPERATOR). 00002 assets + stellar_accounts + trustlines: new. 00003 ledger: verbatim sibling 00002. 00004 operations = sibling 00005 + incident columns from 00008 (+ rpc_node, ledger_seq on runs). 00005 Stellar chain: new. 00006 domain = sibling 00004 + 00007 + parts of 00009/00010, without the reserve cap, Safe proposals and finality columns; plus cold Treasury ledger kinds, asset home_domain and HOT float band, trustlines.id and authorization_changes. 00007 indexer: new |
Build environment notes
proxy.golang.orgreturns 403 for some module zips from this network (e.g.klauspost/compress), andgitlab.comreturns 403 (goose's test-onlymodernc.org/sqlite). Builds useGOPROXY=https://proxy.golang.org|direct: the pipe falls back to fetching directly from the VCS on any proxy error, andsum.golang.orgverification stays on.go mod tidy -etolerates the unreachable test-only dependency of goose. Recorded in../infrastructure/EXTERNAL_DEPENDENCIES.mdwhen that document is written.- Web images need Next.js 16.4.3, which the company npm mirror (
npm.carbon.ir) answers with 500, and container DNS cannot resolveregistry.npmjs.orghere (EAI_AGAIN). Images are built withpodman build --network=hostandNPM_REGISTRY=https://registry.npmjs.org/(review finding R2-04). The backend image is built the same way when container DNS fails. podman save -odoes not replace an existing archive: delete old archives before rescanning, or the scan reads the previous image.