Repository navigation
id: poc: currency gateway boundary — UserDO snapshot cache, signed transfer + hold, idempotent retry across hibernation #2298
Description
Gated PoC — follow-up from the #2066 design (PR #2297, doc/2026-10-29T12-20-00Z_design_currency_centralised_exception/).
Gate: do not start until (a) the currencies v1 synthesis #2043 accepts the #2066 boundary (one gateway API for both editions; hosted tier holds signed balance snapshots only, never ledger truth), and (b) the #2062 control-plane design fixes the gateway's registry/account-factory shape. This is a proof of concept that makes its own simplifications — flag it for a review round; do NOT build the permanent currency service on top of it unreviewed.
Prove, end to end:
- A stub gateway (single process, the only TigerBeetle client) in front of a single-node development TigerBeetle, exposing
POST /v1/transfers,POST /v1/holds+ post/void, andGET /v1/balances/{account}returning a gateway-signed snapshot (balance + transfer watermark). - A hosted-edition client: one UserDO that persists
{request ID, intent hash, state}in its SQLite before the gateway fetch, caches the signed snapshot, and reconciles by request-ID lookup on wake. - One client-signed transfer and one hold → post cycle driven through the UserDO relay (the Worker/DO never holds the signing key; signing happens client-side).
- An idempotency test: kill/restart the DO between submit and response (hibernation), retry with the same request ID, and show exactly one transfer exists; a retry with a mutated field under the same ID must surface TigerBeetle's
exists_with_different_*as a hard error.
Out of scope: conversions, corrections, registry UI, multi-replica cluster, production auth — all synthesis/#2062 territory.
Acceptance: a short results doc in doc/ linked here, with the four proofs above demonstrated (commands/output), and an explicit list of every simplification the PoC made.
Program: ID wave-1 follow-on. Parent epic #2056. Source design: #2066 / PR #2297.
Acceptance criteria
- Gate respected: work starts only after id: design: ID currencies v1 #2043 accepts the id: design: currency as the centralised exception — how the hosted (Workers) edition reaches the currency service #2066 boundary and id: design: currency control plane — registry, account factory, gateway #2062 fixes the gateway shape
- Stub gateway + single-node TigerBeetle demonstrates transfers, holds (post/void), and signed balance snapshots end to end
- Hibernation idempotency proof: kill/restart between submit and response, same request ID → exactly one transfer; mutated retry surfaces exists_with_different_* as a hard error
- Results doc in doc/ linked here, with every PoC simplification listed explicitly; not built upon as the permanent service unreviewed
Activity
developing-today commentedon Oct 29, 2026
CODE-1153
dezren39 commentedon Oct 29, 2026
Intake review
Related: #2066 / PR #2297 (source design), #2062 (control-plane shape), #2043 (currencies synthesis gate), epic #2056
Notes: Gated PoC with unusually crisp prove-end-to-end items already in the body; the appended criteria restate them as checkable items.
Risks: Building before the #2062/#2043 gates land risks a gateway shape that gets thrown away; the body flags this itself.
Suggested approach: Wait for the gates; then implement in the order transfers → holds → snapshot cache → hibernation test.
🤖 Agent note · filed
meta/enrichedapplied. Still-live check this pass: no merged PR or fix commit explicitly resolving this issue was found; where a queue triage task owns verification, it is named in the notes.design(id): currency control plane — registry, account factory, gatew…
7 remaining items
developing-today commentedon Nov 3, 2026
agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03
developing-today commentedon Nov 3, 2026
agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03
dezren39 commentedon Nov 4, 2026
agent-note:v1 — picked up (queue task 8731)
repo-worker-code), OpenChamber scheduled laneec118cad-0fd3-4652-91c4-27432f2f2efdses_e5e5b493d69ffec6EaH0i4IWGO/ queue task 8731repo-health-code-pilotatomic claimdezren39 commentedon Nov 4, 2026
agent-note:v1 — escalated (queue task 8731)
repo-worker-code), OpenChamber scheduled laneec118cad-0fd3-4652-91c4-27432f2f2efdses_e5e5b493d69ffec6EaH0i4IWGO/ queue task 8731repo-health-code-pilotatomic claim12fcad972places id: poc: currency gateway boundary — UserDO snapshot cache, signed transfer + hold, idempotent retry across hibernation #2298 in phase 4 (anchored transfer/issuance and snapshots) and says the production currency model is not yet implemented./home/user/git/fleet/8731-2298-currency-gateway-triage, branchqueue/8731-2298-currency-gateway-triage, based onorigin/main@12fcad972.