مستندات دارامرجع فنیمالی
این صفحه فقط به انگلیسی موجود است.
Financial invariants
The PRD's invariants (../product/PRD.md §6), how each is enforced and which tests and checks prove it.
| ID | Invariant | Enforced by | Proven by |
|---|---|---|---|
| INV-01 | On-chain supply ≤ approved backing | Issuance refused above effective backing (issuance.checkLimits, capacity_exceeded); attestations count 35 days; shortfall blocks issuance and BUY | Reconciliation ledger_supply_within_unexpired_backing; alert DaraSupplyAboveBacking; TestPlatformLifecycle (issue 1000.001 refused) |
| INV-02 | Supply = HOT + COLD + Σ customers (closed holder set) | AUTH_REQUIRED: only accounts the platform authorizes can hold; unknown holders raise CRITICAL | Reconciliation onchain_supply_matches_ledger, no_supply_outside_known_trustlines, indexed_supply_matches_holdings; e2e outsider tests |
| INV-03 | BUY, SELL, TRANSFER, refill and sweep leave supply unchanged | Ledger posting rules (allowedKinds): only supply operations and clawbacks post to TOKEN_SUPPLY | Demo steps 8 and 12; TestPlatformLifecycle reconcile after every step |
| INV-04 | Each approved issuance or burn changes supply exactly once by its amount | Settlement posted once per intent (CAS on status, unique posting key); UNKNOWN attempts never rebuilt | TestTimeoutAfterAcceptanceAppliesOnce, TestLostSubmissionExpiresThenRetriesOnce, TestClawback (exactly once) |
| INV-05 | Every ledger transaction balances | Code validation + deferred DB constraint | TestValidationRejectsBadPostings, TestDatabaseEnforcesAppendOnlyAndBalance; reconciliation ledger_transactions_balanced |
| INV-06 | No customer cash or token position below zero; reserved ≤ total | Non-negative balance projections in the posting transaction | TestConcurrentHoldsNeverOverspend, TestReversalCannotOverdrawCustomer; reconciliation ledger_restricted_non_negative |
| INV-07 | HOT reserved ≤ HOT on-chain balance | BUY reserves from TREASURY_AVAILABLE (non-negative) before signing; HOT is only debited by our intents | TestConcurrentBuysNeverOversellTheHotFloat; reconciliation balance_matches_ledger:HOT |
| INV-08 | One attestation backs at most one snapshot; one approved request yields at most one applied transaction | Unique index on attestation reference; one intent per (purpose, source) | Reserve tests in TestPlatformLifecycle; unique-constraint behaviour in the engine tests |
| INV-09 | A duplicated API request has one economic effect | Idempotency keys stored with the response (byte-exact replay); domain uniqueness (a quote is used once) | TestHTTPSecurity (replay, used quote), TestDuplicatePostingHasOneEffect |
| INV-10 | An UNKNOWN attempt is never rebuilt until proven EXPIRED | Expiry proof requires a closed ledger past maxTime on a healthy node | TestTimeoutAfterAcceptanceAppliesOnce (one attempt), TestLostSubmissionExpiresThenRetriesOnce |
Additional rules added on Stellar: a clawback reduces supply exactly once and only after four-eyes and two issuer
signatures (TestClawback); trustline authorization on-chain equals the customer's frozen state
(trustline_states_match).