vnprc/hashpool

Watch

Fork 0

bump CDK to 0.17.0 at vnprc/cdk 7011eebc (NUT-XX mint quote lookup) #8

Merged

vnprc merged 1 commit from agent/nutxx-lookup-cdk-017 into master

2026-08-13 06:31:44 +01:00

vnprc-agent commented

2026-08-07 22:51:34 +01:00

Collaborator

What changes for a running machine: the mint's HTTP API gains one route, POST /v1/mint/quote/pubkey (signed lookup of mint quotes by NUT-20 locking key), and on first start after deploy the mint DB runs two additive migrations (updated_at column backfill + pubkey index; the translator wallet DB gets one).
What stays identical: everything the roles do today — quote creation, payment, polling, sweeping — same endpoints, same JSON fields, no config changes; no hashpool role calls the new route yet.
What proves it: both workspaces compile with all targets and full suites green under the real devenv toolchain, rustc 1.86.0 (protocols 55 tests, roles 218 tests across 51 suites, 0 failures; cdk-ehash 16 tests under 1.97.1), and the pool's hand-rolled mint HTTP polling contract was verified by diffing cdk-axum routes and response structs between the revs — the three fields the poller reads all survive.
If it is wrong: revert the merge and redeploy; the migrations are additive so a rolled-back binary still runs against a migrated DB, but take the usual pre-deploy DB backup anyway. The full-stack devenv up mining smoke test remains a human gate, as with prior CDK bumps.

Closes vnprc/hashpool#7. Paired PR: vnprc/cdk-ehash#4 must merge first — this PR pins its commit.

Changes

protocols/Cargo.toml, roles/Cargo.toml: [patch.crates-io] → vnprc/cdk rev 7011eebc for all cdk crates (was cashubtc/cdk 1572941d, 0.16.0).
protocols/ehash, roles/mint, roles/translator Cargo.toml: cdk version reqs 0.16.0 → 0.17.0.
roles/mint/Cargo.toml: cdk-ehash rev 40fdebe → 1328180 (the paired cdk-ehash bump to the same CDK rev, branch agent/nutxx-cdk-017).
devenv.nix: cdkRepo/cdkCommit → vnprc/cdk 7011eebc…; the build:cdk:cli task now interpolates those variables instead of hardcoding a second copy of the URL and commit, so future bumps touch one place.
scripts/patch-cdk-path.sh: pin-line matcher broadened to github.com/(cashubtc|vnprc)/cdk so the local-path patcher keeps working after the source move (it would silently no-op otherwise).
protocols/ehash/src/quote.rs: MintQuoteCustomRequest.amount became Option<Amount> upstream — the sole code break in all of hashpool; construction site and test assert wrapped in Some(...).
roles/Cargo.lock: re-resolved. cdk crates to 0.17.0/7011eebc; three new transitives from upstream's wallet work (bdk_electrum, electrum-client, bitreq); no other pin movement — in particular the MSRV-sensitive time 0.3.41 / serde_with 3.17.0 / darling 0.21.3 / simple_asn1 0.6.3 pins are preserved, which is what keeps the workspace building on devenv rustc 1.86.
Merge commit 4147fec4 brings in master's bitcoind-gunix revert (PR #9); the PR's diff against master is unchanged by it.

Risk

265 upstream commits (1572941d..7011eebc) are absorbed on compile evidence, test suites, and targeted wire-contract diffs. Runtime behavior changes inside CDK internals (quote state machine timing, payment processor scheduling) are not exercised by unit tests; that residual risk is carried to the human-gated devenv up smoke test.
The pool polls GET /v1/mint/quote/ehash/{quote_id} with a locally defined response struct. Verified by source diff at both revs: route unchanged, response keeps amount/amount_paid/amount_issued (it gains method and updated_at, which serde ignores). The quote-creation, sweeper, and signatory paths go through cdk's own typed APIs and are covered by the compile.
A fresh (untracked, gitignored) protocols/Cargo.lock fails devenv's rustc 1.86 MSRV on any current tree, master included — pre-existing landmine, not introduced here; evidence and workaround in vnprc/hashpool#10. devenv up builds only the roles workspace and is unaffected.
fix/nutxx-lookup is a moving branch on vnprc/cdk; the rev pin keeps builds reproducible, but the branch must not be deleted or rebased away until the work lands upstream. Same for cdk-ehash rev 1328180, which is on branch agent/nutxx-cdk-017 until vnprc/cdk-ehash#4 merges (merge keeps the commit reachable).
Nothing consumes the new lookup endpoint yet, so a defect in it cannot break mining; wiring the translator/pool to use it is tracked in the issue as follow-up work.
Observed wart while validating, pre-existing on the reverted tree: the installed devenv CLI (1.11.1) is newer than the devenv input pinned in devenv.lock (1.6.1) and prints Error: TasksNotFound for the create:dirs/build:cdk:cli before-hooks on shell entry; shell and cargo runs work regardless. Worth watching on the first devenv up; devenv update would sync the input but is a separate change.

Validation

Under the real devenv shell on the merged branch (rustc 1.86.0 + cargo 1.86.0 — the reverted devenv.lock's toolchain; entering the shell takes seconds again now that gunix is gone):

cargo check --manifest-path protocols/Cargo.toml --all-targets: clean. cargo test: 55 passed, 0 failed. (Standalone protocols builds need a lock predating the time 0.3.55 releases or the #10 workaround pins; the committed roles lock is unaffected.)
cargo check --manifest-path roles/Cargo.toml --all-targets: clean. cargo test: 218 passed, 0 failed across 51 test binaries.
Merge sanity: zero gunix references on the branch; bitcoin-node.nix/bitcoind.nix restored; the cdk pin edits in devenv.nix merged intact.

Earlier validation of the pre-merge branch under rustc 1.97.1 (cdk repo nix develop .#stable, while devenv was blocked by the gunix input): same checks and suites, same results, plus cdk-ehash at 1328180: cargo check --all-targets clean, 16/16 tests.

Wire contract: cdk-axum custom_router.rs routes byte-identical between revs; MintQuoteCustomResponse field diff shows only additions (method, updated_at).

Not run (human-gated, matching prior CDK bumps): devenv up full-stack mining smoke; testnet4 deploy.

All hashpool binaries move from CDK 0.16.0 (cashubtc/cdk 1572941d) to CDK 0.17.0 at vnprc/cdk 7011eebc, branch fix/nutxx-lookup: upstream main plus the new NUT-XX quote lookup. The branch is current with master including the bitcoind-gunix revert (PR #9), so the dev stack starts from the prebuilt Core path without recompiling Bitcoin. - **What changes for a running machine:** the mint's HTTP API gains one route, POST /v1/mint/quote/pubkey (signed lookup of mint quotes by NUT-20 locking key), and on first start after deploy the mint DB runs two additive migrations (updated_at column backfill + pubkey index; the translator wallet DB gets one). - **What stays identical:** everything the roles do today — quote creation, payment, polling, sweeping — same endpoints, same JSON fields, no config changes; no hashpool role calls the new route yet. - **What proves it:** both workspaces compile with all targets and full suites green under the real devenv toolchain, rustc 1.86.0 (protocols 55 tests, roles 218 tests across 51 suites, 0 failures; cdk-ehash 16 tests under 1.97.1), and the pool's hand-rolled mint HTTP polling contract was verified by diffing cdk-axum routes and response structs between the revs — the three fields the poller reads all survive. - **If it is wrong:** revert the merge and redeploy; the migrations are additive so a rolled-back binary still runs against a migrated DB, but take the usual pre-deploy DB backup anyway. The full-stack `devenv up` mining smoke test remains a human gate, as with prior CDK bumps. Closes vnprc/hashpool#7. Paired PR: vnprc/cdk-ehash#4 must merge first — this PR pins its commit. ### Changes - `protocols/Cargo.toml`, `roles/Cargo.toml`: `[patch.crates-io]` → `vnprc/cdk` rev `7011eebc` for all cdk crates (was cashubtc/cdk `1572941d`, 0.16.0). - `protocols/ehash`, `roles/mint`, `roles/translator` Cargo.toml: cdk version reqs `0.16.0` → `0.17.0`. - `roles/mint/Cargo.toml`: cdk-ehash rev `40fdebe` → `1328180` (the paired cdk-ehash bump to the same CDK rev, branch `agent/nutxx-cdk-017`). - `devenv.nix`: `cdkRepo`/`cdkCommit` → vnprc/cdk `7011eebc…`; the `build:cdk:cli` task now interpolates those variables instead of hardcoding a second copy of the URL and commit, so future bumps touch one place. - `scripts/patch-cdk-path.sh`: pin-line matcher broadened to `github.com/(cashubtc|vnprc)/cdk` so the local-path patcher keeps working after the source move (it would silently no-op otherwise). - `protocols/ehash/src/quote.rs`: `MintQuoteCustomRequest.amount` became `Option<Amount>` upstream — the sole code break in all of hashpool; construction site and test assert wrapped in `Some(...)`. - `roles/Cargo.lock`: re-resolved. cdk crates to 0.17.0/`7011eebc`; three new transitives from upstream's wallet work (bdk_electrum, electrum-client, bitreq); no other pin movement — in particular the MSRV-sensitive `time` 0.3.41 / `serde_with` 3.17.0 / `darling` 0.21.3 / `simple_asn1` 0.6.3 pins are preserved, which is what keeps the workspace building on devenv rustc 1.86. - Merge commit `4147fec4` brings in master's bitcoind-gunix revert (PR #9); the PR's diff against master is unchanged by it. ### Risk - 265 upstream commits (`1572941d..7011eebc`) are absorbed on compile evidence, test suites, and targeted wire-contract diffs. Runtime behavior changes inside CDK internals (quote state machine timing, payment processor scheduling) are not exercised by unit tests; that residual risk is carried to the human-gated `devenv up` smoke test. - The pool polls `GET /v1/mint/quote/ehash/{quote_id}` with a locally defined response struct. Verified by source diff at both revs: route unchanged, response keeps `amount`/`amount_paid`/`amount_issued` (it gains `method` and `updated_at`, which serde ignores). The quote-creation, sweeper, and signatory paths go through cdk's own typed APIs and are covered by the compile. - A fresh (untracked, gitignored) `protocols/Cargo.lock` fails devenv's rustc 1.86 MSRV on any current tree, master included — pre-existing landmine, not introduced here; evidence and workaround in vnprc/hashpool#10. `devenv up` builds only the roles workspace and is unaffected. - `fix/nutxx-lookup` is a moving branch on vnprc/cdk; the rev pin keeps builds reproducible, but the branch must not be deleted or rebased away until the work lands upstream. Same for cdk-ehash rev `1328180`, which is on branch `agent/nutxx-cdk-017` until vnprc/cdk-ehash#4 merges (merge keeps the commit reachable). - Nothing consumes the new lookup endpoint yet, so a defect in it cannot break mining; wiring the translator/pool to use it is tracked in the issue as follow-up work. - Observed wart while validating, pre-existing on the reverted tree: the installed devenv CLI (1.11.1) is newer than the devenv input pinned in `devenv.lock` (1.6.1) and prints `Error: TasksNotFound` for the `create:dirs`/`build:cdk:cli` before-hooks on shell entry; shell and cargo runs work regardless. Worth watching on the first `devenv up`; `devenv update` would sync the input but is a separate change. ### Validation Under the real devenv shell on the merged branch (rustc 1.86.0 + cargo 1.86.0 — the reverted `devenv.lock`'s toolchain; entering the shell takes seconds again now that gunix is gone): - `cargo check --manifest-path protocols/Cargo.toml --all-targets`: clean. `cargo test`: 55 passed, 0 failed. (Standalone protocols builds need a lock predating the `time` 0.3.55 releases or the #10 workaround pins; the committed roles lock is unaffected.) - `cargo check --manifest-path roles/Cargo.toml --all-targets`: clean. `cargo test`: 218 passed, 0 failed across 51 test binaries. - Merge sanity: zero gunix references on the branch; `bitcoin-node.nix`/`bitcoind.nix` restored; the cdk pin edits in `devenv.nix` merged intact. Earlier validation of the pre-merge branch under rustc 1.97.1 (cdk repo `nix develop .#stable`, while devenv was blocked by the gunix input): same checks and suites, same results, plus cdk-ehash at `1328180`: `cargo check --all-targets` clean, 16/16 tests. - Wire contract: cdk-axum `custom_router.rs` routes byte-identical between revs; `MintQuoteCustomResponse` field diff shows only additions (`method`, `updated_at`). Not run (human-gated, matching prior CDK bumps): `devenv up` full-stack mining smoke; testnet4 deploy.

vnprc-agent added 1 commit

2026-08-07 22:51:34 +01:00

bump CDK to 0.17.0 at vnprc/cdk 7011eebc (NUT-XX mint quote lookup) fb4d26d589

Move all coordinated CDK pins from cashubtc/cdk 1572941d (0.16.0) to
vnprc/cdk 7011eebc, the tip of branch fix/nutxx-lookup: upstream main at
23fa905d plus the NUT-XX mint quote lookup endpoint. The mint now serves
POST /v1/mint/quote/pubkey (schnorr-signed, replay-protected lookup of
mint quotes by NUT-20 locking key); no hashpool role calls it yet.

- protocols/Cargo.toml, roles/Cargo.toml: [patch.crates-io] -> vnprc/cdk
  rev 7011eebc for all cdk crates
- protocols/ehash, roles/mint, roles/translator Cargo.toml: cdk version
  reqs 0.16.0 -> 0.17.0 to match the patched workspace version
- roles/mint/Cargo.toml: cdk-ehash rev 40fdebe -> 1328180 (branch
  agent/nutxx-cdk-017: the paired cdk-ehash bump to the same CDK rev)
- devenv.nix: cdkRepo/cdkCommit -> vnprc/cdk 7011eebc; build:cdk:cli now
  interpolates those variables instead of hardcoding a second copy of
  the URL and commit, so future bumps touch one place
- scripts/patch-cdk-path.sh: match github.com/(cashubtc|vnprc)/cdk so
  the local-path patcher keeps recognizing the pin lines
- protocols/ehash/src/quote.rs: MintQuoteCustomRequest.amount became
  Option<Amount> upstream; wrap the construction site and test assert
- roles/Cargo.lock: re-resolved; cdk crates to 0.17.0/7011eebc, new
  transitive deps bdk_electrum/electrum-client/bitreq from upstream's
  wallet work, no other pin movement

Upstream drift absorbed: 265 commits (1572941d..7011eebc). Mint DB gets
two additive migrations on first start (updated_at column backfill +
pubkey index); wallet DB gets one (updated_at). No destructive schema
changes.

Validation (rustc 1.97.1, cdk repo nix dev shell; devenv nixpkgs rustc
is 1.95.0, above cdk's 1.85 MSRV): cargo check --all-targets clean and
full test suites green in all three workspaces - protocols 55 tests,
roles 51 suites 0 failures, cdk-ehash 16 tests. Runtime devenv up
mining smoke test remains a human gate.

vnprc-agent referenced this pull request from vnprc/cdk-ehash

2026-08-07 22:51:44 +01:00

bump CDK to 0.17.0 at vnprc/cdk 7011eebc (NUT-XX mint quote lookup) #4

vnprc-agent commented

2026-08-07 22:54:03 +01:00

Author

Collaborator

Read-only review pass (required post-open review). No defects found; receipts for what was measured beyond the compile/test runs already in the body:

Body claims re-verified from raw output: 55 protocols tests (16+1+27+11), 51 roles suites all ok with an explicit failure-scan, 16/16 cdk-ehash, lock diff audited package-by-package — besides the cdk-family 0.16→0.17 moves, the only lock changes are the three added transitives (bdk_electrum 0.23.2, electrum-client 0.24.1, bitreq 0.3.7); zero version churn on any other existing package.
"No new warnings" given provenance: the three unused warnings in the all-targets run are at roles-utils/mint-pool-messaging/src/lib.rs:10 (tracing error), message_hub.rs:371 (test event), mint/tests/sv2_connection_integration.rs:8 (binary_sv2::Encodable) — all in files this PR does not touch, none involving cdk items, so the bump cannot have introduced them.
Consumer sweep: every cdk importer is in roles/mint (5 files) and roles/translator (4 files), both compile- and test-covered; the pool's only mint contact is the hand-rolled poller whose route and response fields were diffed at both revs (unchanged + additive); web-pool/web-proxy api/v1 URLs are Prometheus/monitoring, not the mint.
build:cdk:cli stays buildable: crates/cdk-cli exists at 7011eebc with a workspace version, so the retargeted devenv task can still build --bin cdk-cli.
patch-cdk-path.sh matcher functionally tested: rewrites all 9 patch lines in both workspace Cargo.tomls against the new vnprc URLs and correctly ignores the forge cdk-ehash line.

Read-only review pass (required post-open review). No defects found; receipts for what was measured beyond the compile/test runs already in the body: - **Body claims re-verified from raw output**: 55 protocols tests (16+1+27+11), 51 roles suites all `ok` with an explicit failure-scan, 16/16 cdk-ehash, lock diff audited package-by-package — besides the cdk-family 0.16→0.17 moves, the only lock changes are the three added transitives (bdk_electrum 0.23.2, electrum-client 0.24.1, bitreq 0.3.7); zero version churn on any other existing package. - **"No new warnings" given provenance**: the three `unused` warnings in the all-targets run are at `roles-utils/mint-pool-messaging/src/lib.rs:10` (tracing `error`), `message_hub.rs:371` (test `event`), `mint/tests/sv2_connection_integration.rs:8` (`binary_sv2::Encodable`) — all in files this PR does not touch, none involving cdk items, so the bump cannot have introduced them. - **Consumer sweep**: every cdk importer is in roles/mint (5 files) and roles/translator (4 files), both compile- and test-covered; the pool's only mint contact is the hand-rolled poller whose route and response fields were diffed at both revs (unchanged + additive); web-pool/web-proxy `api/v1` URLs are Prometheus/monitoring, not the mint. - **`build:cdk:cli` stays buildable**: `crates/cdk-cli` exists at `7011eebc` with a workspace version, so the retargeted devenv task can still build `--bin cdk-cli`. - **patch-cdk-path.sh matcher functionally tested**: rewrites all 9 patch lines in both workspace Cargo.tomls against the new vnprc URLs and correctly ignores the forge cdk-ehash line.

vnprc-agent commented

2026-08-08 17:31:04 +01:00

Author

Collaborator

Owner request (2026-08-08): the bitcoind-gunix revert (PR #9) is merged to master; bring this branch up to date with that master so the stack can be started quickly for testing without recompiling Bitcoin Core. Doing this as a merge of master into the branch (PR branches take commits, no force-push), then re-validating — the branch should become devenv-realizable, so the cargo checks can rerun under the real devenv toolchain, closing the Risk note about validation having used the cdk repo shell.

vnprc-agent added 1 commit

2026-08-08 17:47:25 +01:00

merge master: revert of bitcoind-gunix sourcing (PR #9 ), so the branch starts via the prebuilt Core path 4147fec4e6

vnprc-agent commented

2026-08-08 17:48:09 +01:00

Author

Collaborator

Done: master (with the PR #9 bitcoind-gunix revert) merged into this branch as 4147fec4 — a merge, not a rebase, so no force-push; the PR's diff against master is unchanged. The branch now starts the stack from the prebuilt Core path.

Revalidation under the real devenv shell (rustc 1.86.0, the reverted lock's toolchain — shell entry is seconds again):

roles: cargo check --all-targets clean; 218 tests passed, 0 failed across 51 binaries. The committed roles/Cargo.lock needed no changes — it already preserves the MSRV-critical pins (time 0.3.41, serde_with 3.17.0, darling 0.21.3, simple_asn1 0.6.3), which is what keeps 1.86 viable.
protocols: cargo check --all-targets clean; 55 tests passed, 0 failed. Caveat: a fresh protocols lock resolves time 0.3.55 (MSRV 1.88) and fails under 1.86 on any current tree including master — pre-existing, filed with evidence and workaround as vnprc/hashpool#10; devenv up builds only roles and is unaffected.
One wart to watch on first devenv up, also pre-existing on the reverted tree: installed devenv CLI 1.11.1 vs devenv input 1.6.1 in devenv.lock prints Error: TasksNotFound for the create:dirs/build:cdk:cli before-hooks at shell entry (shell + cargo unaffected). If it bites process startup, devenv update syncs the input as a separate change.

PR body updated to reflect the merged state and the devenv-toolchain validation (the earlier body cited rustc 1.95.0 from gunix-master's nixpkgs; the reverted lock ships 1.86.0).

Done: master (with the PR #9 bitcoind-gunix revert) merged into this branch as `4147fec4` — a merge, not a rebase, so no force-push; the PR's diff against master is unchanged. The branch now starts the stack from the prebuilt Core path. Revalidation under the real devenv shell (rustc 1.86.0, the reverted lock's toolchain — shell entry is seconds again): - roles: `cargo check --all-targets` clean; 218 tests passed, 0 failed across 51 binaries. The committed `roles/Cargo.lock` needed no changes — it already preserves the MSRV-critical pins (`time` 0.3.41, `serde_with` 3.17.0, `darling` 0.21.3, `simple_asn1` 0.6.3), which is what keeps 1.86 viable. - protocols: `cargo check --all-targets` clean; 55 tests passed, 0 failed. Caveat: a *fresh* protocols lock resolves `time` 0.3.55 (MSRV 1.88) and fails under 1.86 on any current tree including master — pre-existing, filed with evidence and workaround as vnprc/hashpool#10; `devenv up` builds only roles and is unaffected. - One wart to watch on first `devenv up`, also pre-existing on the reverted tree: installed devenv CLI 1.11.1 vs devenv input 1.6.1 in `devenv.lock` prints `Error: TasksNotFound` for the `create:dirs`/`build:cdk:cli` before-hooks at shell entry (shell + cargo unaffected). If it bites process startup, `devenv update` syncs the input as a separate change. PR body updated to reflect the merged state and the devenv-toolchain validation (the earlier body cited rustc 1.95.0 from gunix-master's nixpkgs; the reverted lock ships 1.86.0).

vnprc-agent commented

2026-08-08 23:35:56 +01:00

Author

Collaborator

What works:

Signed lookup → HTTP 200 in 8 ms, all 207 custom-method quotes, 67 KB; responses are the flattened NUT-04 custom shape (no enum envelope) with updated_at populated. Both new migrations (updated_at backfill + pubkey index) applied cleanly on first start; all 207 rows have real updated_at values.
nuts.XX.supported: true and pubkey both present in /v1/info (pubkey derives from the mint seed — no config needed).
Error paths all 400 with typed codes, no 500s: bad signature → 20008; pubkeys/signatures length mismatch → 20008; 51 pubkeys → 11017 "max 50"; valid signature with no quotes → 200 {"quotes":[]} (no existence oracle).

Feedback candidates for the CDK PR author:

No filtering or pagination: the query is WHERE pubkey IN (...) with no state/expiry filter plus two follow-up queries per quote (payments, issuance). One mining key accrued 207 quotes in ~20 min of regtest mining; a production miner reaches tens of thousands of mostly-ISSUED quotes, all returned on every lookup. A state filter (or updated_at > cursor delta sync — the field is already in the response) would keep this usable at scale.
The signature is a permanent per-mint bearer credential: the signed message is domain ‖ mint_pubkey ‖ wallet_pubkey with no nonce or timestamp, so a captured request replays forever — demonstrated by resending the identical body and receiving the full quote list again. Domain separation binds it to one mint, but within that mint anyone who ever sees a request (logs, proxies) can re-fetch the quote list indefinitely. If intended, the NUT should say so; a signed timestamp with a freshness window would close it.
Minor: each failed verification logs at ERROR on the mint (Failed to validate signature) — unauthenticated endpoint, so anyone can spam ERROR-level logs; debug/warn seems right.
Spec nit: custom-method quote responses (this endpoint and GET /v1/mint/quote/{method}/{id}) carry no state field — clients infer from amount_paid/amount_issued. Worth spelling out in the NUT so wallet authors converge.
Color for the PR: the session ended with 27 paid-but-unissued quotes (2,232 ehash) stranded in mint state by a shutdown — exactly the wallet-recovery case this endpoint exists for.

Hashpool-side log review of the same session, none of it CDK-related: mint had zero runtime errors (a few [SLOW QUERY] COMMIT 21–68 ms warns under the mining burst); proxy/pool saw a 13-share stale burst (seq 86–98, new-job race) and 4× ArithmeticOverflow deriving hashrate from SetTarget (pre-existing sv1 path); jd-server EmptyMempool warns are normal regtest noise. The 27 unissued quotes should sweep on the next devenv up (~15 s poll) — balance should jump by 2,232 ehash.

Live validation of the NUT-XX lookup endpoint against this branch's mined state (2026-08-08 session: 207 ehash quotes, one NUT-20 locking key, 6,706 ehash issued across 179 quotes). Method: restarted the mint alone against `.devenv/state/mint/mint.sqlite`, built a 20-line signer against the branch's own `mint_quote_lookup_msg_to_sign`, probed `POST /v1/mint/quote/pubkey` with curl. What works: - Signed lookup → HTTP 200 in 8 ms, all 207 custom-method quotes, 67 KB; responses are the flattened NUT-04 custom shape (no enum envelope) with `updated_at` populated. Both new migrations (updated_at backfill + pubkey index) applied cleanly on first start; all 207 rows have real `updated_at` values. - `nuts.XX.supported: true` and `pubkey` both present in `/v1/info` (pubkey derives from the mint seed — no config needed). - Error paths all 400 with typed codes, no 500s: bad signature → 20008; pubkeys/signatures length mismatch → 20008; 51 pubkeys → 11017 "max 50"; valid signature with no quotes → 200 `{"quotes":[]}` (no existence oracle). Feedback candidates for the CDK PR author: 1. **No filtering or pagination**: the query is `WHERE pubkey IN (...)` with no state/expiry filter plus two follow-up queries per quote (payments, issuance). One mining key accrued 207 quotes in ~20 min of regtest mining; a production miner reaches tens of thousands of mostly-ISSUED quotes, all returned on every lookup. A state filter (or `updated_at > cursor` delta sync — the field is already in the response) would keep this usable at scale. 2. **The signature is a permanent per-mint bearer credential**: the signed message is domain ‖ mint_pubkey ‖ wallet_pubkey with no nonce or timestamp, so a captured request replays forever — demonstrated by resending the identical body and receiving the full quote list again. Domain separation binds it to one mint, but within that mint anyone who ever sees a request (logs, proxies) can re-fetch the quote list indefinitely. If intended, the NUT should say so; a signed timestamp with a freshness window would close it. 3. Minor: each failed verification logs at ERROR on the mint (`Failed to validate signature`) — unauthenticated endpoint, so anyone can spam ERROR-level logs; debug/warn seems right. 4. Spec nit: custom-method quote responses (this endpoint and `GET /v1/mint/quote/{method}/{id}`) carry no `state` field — clients infer from `amount_paid`/`amount_issued`. Worth spelling out in the NUT so wallet authors converge. 5. Color for the PR: the session ended with 27 paid-but-unissued quotes (2,232 ehash) stranded in mint state by a shutdown — exactly the wallet-recovery case this endpoint exists for. Hashpool-side log review of the same session, none of it CDK-related: mint had zero runtime errors (a few `[SLOW QUERY] COMMIT` 21–68 ms warns under the mining burst); proxy/pool saw a 13-share stale burst (seq 86–98, new-job race) and 4× `ArithmeticOverflow` deriving hashrate from SetTarget (pre-existing sv1 path); jd-server EmptyMempool warns are normal regtest noise. The 27 unissued quotes should sweep on the next `devenv up` (~15 s poll) — balance should jump by 2,232 ehash.