مستندات داراRelease readiness
Assessment of 2026-10-31 (owner decisions: decisions/OWNER_DECISIONS_20261031.md).
Verdict: DEMO READY
Everything runs end to end on a local Stellar network in containers (make demo: 82 checks, every financial
invariant holds), with the full web suite, Dara Scan, monitoring, backups and the security, failure and concurrency
tests. It is not yet TESTNET READY: nothing has completed on a public network yet. Every Testnet blocker on the
owner's side is decided (one signer, Vault, GOLD) and the tooling runs in that layout (deployment/TESTNET.md);
the next gate is completing that end-to-end run on our own Testnet nodes.
Status by area
| Area | Status |
|---|---|
| Architecture | Implemented as designed (stellar/STELLAR_ARCHITECTURE.md): Classic assets, issuer with human multisig, hot/cold Treasury, sponsored custodial accounts, channel pool, intent/attempt lifecycle, own RPC nodes, self-hosted indexer |
| Product | All PRD functional requirements implemented (TRACEABILITY_MATRIX.md); fa/en wallet, admin console, landing, Dara Scan |
| Stellar asset | Flags AUTH_REQUIRED, AUTH_REVOCABLE, AUTH_CLAWBACK_ENABLED; SEP-1 stellar.toml generated and verified by activation; asset codes and domain pending (Q-13) |
| Issuer security | Master weight 0, human signers only for issuance and clawback, AUTH key limited to the low threshold; verified at every start and every reconciliation. Launch: one signer with a software key (accepted risks in the decisions record) |
| Treasury security | Cold store under the human signer, hot float bounded by target/ceiling with automatic sweep; online keys in Vault Transit (make vault-test) |
| RPC independence | Only our own nodes; failover and outage tested; ≥ 2 nodes enforced in UAT/production |
| Indexer independence | Own indexer on ledger metadata; backfill from our own Galexie lake on disk, checked hash for hash against our node (make datalake-test) |
| Ledger | Double-entry, append-only, invariants machine-checked (finance/INVARIANTS.md) |
| Reconciliation | One node, one ledger per run; all checks pass in every scenario; runbook written |
| Testing | Go unit, integration and e2e on PostgreSQL and local Stellar; web checks; alert rule tests; container demo; restore drill (testing/evidence/) |
| Performance | Local baseline recorded; settlement capacity ≈ one transaction per channel per ledger (size channels for the volume, Q-08) |
| Security | 0 reachable Go vulnerabilities; no known JS vulnerabilities; images rescanned after removing package managers; HTTP security suite; two review passes (reviews/) |
| Review pass 1 / 2 | All fixable findings fixed; open ones need operator decisions |
Known limitations
- One human signer: no second approval on-chain and no tolerance for losing that key (accepted by the owner).
- Human-signed
ChangeTrustfor adding a later asset to COLD is a manual procedure. - The backend does not export traces (logs carry request IDs).
- Settlement throughput is bounded by the number of channel accounts; payment batching is not implemented.
- The SEP-1 fetch has not run against a real domain (none chosen yet).
External dependencies and production risks
infrastructure/EXTERNAL_DEPENDENCIES.md. The main production risks: key custody (custody key controls every
customer account — mitigated by HSM, indexer detection and clawback), signer availability for proposals (24 h
expiry, three GOV channels, alerting), and settlement capacity at peak (channel sizing).
Layer 2 readiness
reserve.CapacityProvider is the only path from backing to issuance; the capacity engine is designed
(future/LAYER2_CAPACITY_ENGINE.md) and plugs in without changing the Stellar asset model.
Path to the next levels
| Level | Needs |
|---|---|
| TESTNET READY | deployment/TESTNET.md end-to-end passing on our own Testnet nodes |
| UAT READY | Hosts for two RPC nodes, PostgreSQL HA, monitoring with receivers; deployment/UAT.md signed off |
| MAINNET CANARY READY | Production Vault, the signer's key and backup, the GOLD domain, console limits; deployment/LAUNCH_CHECKLIST.md complete up to UAT sign-off |
| PRODUCTION READY | deployment/MAINNET_CANARY.md passed, plus business and legal approval |