68e057209c
Lock alpha scope, tracker auth, TOPLOC fraud verification, and deferred multi-tracker money-path work; supersede legacy fraud issues with ADR-0018. Co-authored-by: Cursor <cursoragent@cursor.com>
32 lines
1.1 KiB
Markdown
32 lines
1.1 KiB
Markdown
Status: ready-for-human
|
||
|
||
# 13 — C3/C4: Consensus-gated money mutations (deferred)
|
||
|
||
## What to build
|
||
|
||
Route money-affecting ledger events through Raft commit, not gossip-only apply. Extend `raft.py` command set beyond register/deregister. Settlement remains leader-only with treasury key.
|
||
|
||
**Code refs:**
|
||
|
||
- `packages/tracker/meshnet_tracker/server.py` — settlement leader gate (~3331–3332), payout batch (~3353–3356)
|
||
- `packages/tracker/meshnet_tracker/raft.py` — log entry types (~26–27)
|
||
- `packages/tracker/meshnet_tracker/billing.py` — `apply_events` (~301–311)
|
||
|
||
Design: ADR-0019 §2. **Deferred post-alpha** while single operator holds settlement.
|
||
|
||
## Acceptance criteria
|
||
|
||
- [ ] `charge`, `payout`, `forfeit`, `credit`, `settlement`, `bind` commit via Raft log
|
||
- [ ] Followers reject direct gossip money mutations
|
||
- [ ] Leader-only `_settlement_loop` unchanged in semantics
|
||
- [ ] Migration plan from gossip-only billing to Raft-backed log
|
||
|
||
## ADR links
|
||
|
||
- [ADR-0019](../../docs/adr/0019-money-path-consistency-multi-tracker.md) §2
|
||
|
||
## Blocked by
|
||
|
||
- `12-c2-on-chain-idempotency.md`
|
||
- `14-a3-raft-durable-term-vote.md`
|