Viable BitMask 0.12: cargo audit, TypeScript wasm, recovered tests

[cryptoquick]

Viable BitMask: completeness, reliability, TypeScript wasm

Agents never commit or push. Do not restore RGB 0.10 source files. Do not invent node URLs. bitmask-core crate 0.12.0 is not RGB 0.12. RGB stays Protocol 0.11.1-rc.11. carbonado-node stays unpublished.

This plan uses Concise American Technical English as specified in 0005_CATE.md (accessed: 2026-08-27).

Evidence: reports/plan-explore-test-recipes.md, reports/bitmask-core-deleted-paths.md, reports/git-hygiene-commit-prep.md, reports/git-ssh-remotes-checkout.md. Living leftover: RESIDUAL.md. Past tense: COMPLETED.md.

Read this first

Approve means you accept these decisions.

1. Goal is a viable BitMask, not a tidy test list. Viable means: product compiles, just check is green, TypeScript wasm support compiles against live bindgen, and tests cover the public APIs that still exist.
2. The RGB 0.11 source deletes stay. They are the layout hop (9a40b80 to 3723cf1), not an accident. We recover behavior with new 0.11 tests, not the old files.
3. Keep TypeScript wasm compiling. lib/web/*.ts is BitMask client support. Do not delete fullTransferAsset / fullIssueContract if that leaves a broken TS package. Every TS export must have a matching src/web.rs wasm_bindgen, or the TS export and its callers must move onto a live bindgen (create_rgb_transfer / issue_contract / transfer_asset) in the same change. wasm-pack / the TS build must still compile.
4. cargo audit is in this round. Re-run it on both product clones after crates.io carbonado 0.7.0. Any vulnerability ID is a must-fix. Already reported rows in SECURITY.md (ten bitmask-core unmaintained/unsound warnings; carbonado-node serde_cbor and the other node warnings) get a real answer each: bump when a patched crate exists without a format or RGB/Carbonado break, or keep the named reason after a fresh quote. Last advisory scan exit 0 was 2026-08-26, before this carbonado hop. See RustSec advisory-db (accessed: 2026-08-26).
5. Docs and TypeScript audits stay. Living docs, skip lists, crate metadata, and BMC.* vs src/web.rs must match HEAD. That is extra honesty, not a substitute for cargo audit.
6. Hermetic just check stays hermetic. Docker/network tests stay under tests/rgb/server, tests/rgb/web, tests/bp/server (Nix skip). GHA runs them.
7. No replace-in-place, airdrop, or auction-close product this round. Those are after viable. Sequential transfer_contract is the live transfer path.
8. Do not restore tests/scripts/*.sh. Keep docker-compose.yml and regtest/*.sh.

If send_sats then bump_fee is red because the first tx is not replaceable, report it. Do not add enable_rbf unless you later ask.

Agent notes

Acceptance: after this Approve, BitMask is viable in the sense of milestone 4. TypeScript wasm compiles. Docs and metadata match the tree. New tests exist for import, drain, bump_fee, inspect, ACP sighash, owner-onward, dual-seal. just check green.

Estimates: eight parallel groups (cargo audit, tree/docs audit, TS/wasm, five test slices).

Intended depth: L1 coordinates. L2 per group. L3 only if hard (bindgen mismatch list, dual-seal coinselect, PSBT parse).

Launch groups

1. cargo audit: nix develop --impure --option max-jobs 0 path:. --command cargo audit in bitmask-core and carbonado-node. Quote the new IDs. Fix every vulnerability. Walk SECURITY.md Open items 1–3 one by one.
2. Docs and metadata audit: AGENTS.md, RESIDUAL.md, COMPLETED.md, workspace PLAN.md, SECURITY.md after the cargo quote, child READMEs, Cargo.toml repository, Nix skip filter, GHA vs tests/scripts (gone). Write reports/bitmask-core-viable-audit.md, then patch every lie.
3. TypeScript wasm compile: audit every BMC.* in lib/web/*.ts vs src/web.rs. Wire or retarget every export so wasm-pack and TS still compile. Prefer binding live 0.11 functions over deleting public TS names.
4. Hermetic units: import Validation, get_contract Validation, unknown-txid bump_fee.
5. Bitcoin docker: drain_wallet, send_sats then bump_fee.
6. RGB docker import / inspect / sighash.
7. RGB docker owner-onward and dual-seal.
8. Wasm test twins: second-wallet import and get_contract in tests/rgb/web.

Goal

Ship a BitMask that people can build, test, and call from TypeScript.

Word	Meaning here
Complete	Public TS and Rust APIs that BitMask still advertises actually exist on RGB 0.11. Missing bindgen is a hole. Deleted 0.10 modules that have 0.11 replacements are not holes.
Reliable	Those APIs have tests. Hermetic tests run in just check. Live tests run in GHA. We do not claim coverage we did not write.
Viable	Milestones 1 through 4 below are done. Auction close, airdrop, and replace-in-place are not required for viable.

Milestones

Milestone 1. Workspace and gate (done)

DIBA org workspace. Submodules carbonado-node and bitmask-core. Optional ref/ with update = none. Edition 2024, Rust 1.98. just check: local fmt, local clippy --deny warnings, remote nextest on Host surmount-1 (wasm nextest on bitmask-core). Last quoted: carbonado-node 2 passed; bitmask-core native 37 passed / 37 skipped, wasm 9 passed.

Milestone 2. Current engines (done)

crates.io carbonado 0.7.0. bitmask-core 0.12.0. RGB Protocol 0.11.1-rc.11. BDK 1.x (bdk_wallet 3.1). bitcoin 0.32. BIP-86 default, shared path with RGB. Payjoin 1.0.0. heed3 metrics. nostr 0.44.8. Named networks testnet3 / testnet4 / mutinynet with empty daemon slots. carbonado-node unpublished 0.1.0.

Milestone 3. RGB 0.11 product tree (done, deletes are this milestone)

The delete/create list you saw is this hop, one commit, zero git renames. New layout matches bitmask-next: src/wallet/, src/bp/, src/rgb/{compat,data,ext,mapper,models,server,store,...}, tests/bp/, tests/rgb/server|web. Old 0.10 modules and tests/rgb/integration/* are gone. They would not compile. Path map: reports/bitmask-core-deleted-paths.md.

Milestone 4. Reliable public APIs, TypeScript wasm, and an honest tree (this Approve; not done)

This is the gap that keeps BitMask from being viable as a complete, reliable product:

• Lost tests for APIs that still exist (import_contract, drain_wallet, bump_fee, watcher_inspect, get_contract, swap ACP, owner-onward, two contracts on one UTXO).
• TypeScript still names fullTransferAsset / fullIssueContract while Rust has no those bindgens. That is a compile or runtime hole in BitMask TS support. Fix it so wasm and TS compile, and so the names people still call hit live 0.11 issue/transfer.
• cargo audit has not been re-run after crates.io carbonado 0.7.0. SECURITY.md still holds ten bitmask-core warnings and carbonado-node serde_cbor / derivative / instant / proc-macro-error. Address those rows this round (bump or keep with a fresh quote).
• Docs and metadata still describe older git pins, old residual git SHAs, or diba-io crate URLs. Update those so a reader of HEAD is not lied to.

Milestone 5. Operator land (you; not agents)

SSH remotes are set. carbonado-node signed fffa807. bitmask-core signed 3723cf1. You push HB/update-2026, then parent gitlinks. Parent has no GitHub repo yet. Node URLs stay empty until you supply them.

Milestone 6. After viable (parked)

Auction close / coordinator HTTP. Airdrop. Multi-recipient one PSBT. Wasm clippy --allow clippy::all. Browser chrome tests stay GHA. serde_cbor only if this round confirms a catalog format break is still required.

What we have done so far

Short list. Detail lives in COMPLETED.md.

• Workspace, flakes, just check, SSH remotes, HB/update-2026 on all three trees.
• Carbonado 0.7 from crates.io. bitmask-core 0.12.0. RGB 0.11.1-rc.11 compile and hermetic tests green.
• BDK 1.x, BIP-86, PDK 1.0.0, heed3, named networks, auction GET/POST store.
• Mapped every deleted path: replacement, intentional drop, or lost test coverage only.

What we need for viable (this Approve)

1. cargo audit on both clones, then address SECURITY.md Open rows. Vulnerability IDs must go to zero. Warnings: take a patched crate when it does not break DIBA wallet-encrypt known-answers, RGB 0.11, or Carbonado 0.7 ciphertext. bincode 1.3 stays unless a bincode 2 known-answer is written in the same change. automerge / paste / instant / proc-macro-error only move if the parent crate we already pin allows it. carbonado-node serde_cbor stays a format break unless you later ask for a catalog codec change; this round still re-quotes it.
2. Docs and metadata match HEAD after that quote. Residual git facts, SSH remotes, crate 0.12.0, crates.io carbonado 0.7.0.
3. TypeScript wasm still compiles, and public TS issue/transfer names call live Rust. Audit every BMC.* in lib/web against src/web.rs. Implement missing bindgen as thin wrappers around issue_contract / transfer_contract / create_rgb_transfer where the TS name is still the BitMask surface. Only remove a TS export when nothing should call it and the package still compiles.
4. Tests for remaining public APIs, written like current seeders (recipes below). Hermetic in just check. Docker in GHA.
5. just check still green after those tests. Docker tests stay skipped in Nix.

That is enough to call the 0.12 / RGB 0.11 BitMask viable. It is not a full old-suite restore and not auction/airdrop.

Remaining after viable

Operator push and parent repo. Node URLs. Auction close. Airdrop. Replace-in-place. Audit warnings. Those do not block viable.

Approach (milestone 4)

cargo audit: run on both clones (Nix path:., max-jobs 0). Write the quote into SECURITY.md. Fix vulns. For each already reported warning, bump or keep with a reason. Do not silent-format-break bincode or the node catalog.

Docs audit: one L2 lists mismatches against HEAD, writes reports/bitmask-core-viable-audit.md, then patches law files. Completeness includes the words we leave on disk.

TypeScript wasm: completeness first. lib/web is product. Walk TS exports, match bindgen, fill holes with live 0.11 functions. Do not "fix" compile by deleting BitMask TS support.

Tests: copy an existing server/web test. Change the middle call. Assert HEAD fields only (IssueResponse.contract, not genesis.strict). Nix skip stays. New hermetic tests must not use skipped exact names (create_wallet, and the rest).

How the reliability tests are written

Copy-level recipes: reports/plan-explore-test-recipes.md. Short form:

Import. tests/rgb/server/import.rs: two wallets, create_new_contract(ContractSeed::fungible), import_contract(owner.sk, issue_res[0].contract), assert contract_id and iface. RGB21: ContractSeed::uda. Wasm twin in tests/rgb/web/import.rs via resolve(import_contract(...)). Hermetic: empty and "not-a-contract" Validation in tests/rgb/unit/import.rs.

Drain. tests/bp/server: drain_wallet after seeder fund. Assert received == 0, fee some, sent > 0. Do not assert sent + fee == funded sats (sent is output-sum).

RBF. Same module: send_sats then bump_fee on that txid. Not transfer_btc then bump. Hermetic unknown txid in tests/wallet.rs with a new name.

Inspect. watcher_inspect(sk, "bitcoin") after create_new_wallet. get_contract after issue. Wasm: get_contract only (no BMC.watcher_inspect unless we add bindgen as part of group 1).

ACP sighash. After create_swap_fungible_bitcoin bid, bid_swap_suppl, Psbt::from_base64, inputs none_anyone_can_pay.

Owner-onward. consecutive_transfers_with_dust_utxo but src_vault is the owner, third wallet is dest.

Two RGB20 one UTXO. quantity = 2, same issue_utxo, two transfers. Observe coinselect if the second fails.

RGB20+RGB21 one UTXO. Two create_new_contract on the same issuer vault (quantity cannot mix ifaces).

Not written: airdrop, collectible auction, tests/scripts, genesis hex.

Critical files

Path	Why
bitmask-core/src/web.rs	wasm_bindgen must match TS
bitmask-core/lib/web/rgb.ts	BitMask TS surface
bitmask-core/lib/web/*.ts	Full wasm TS audit
bitmask-core/Cargo.toml	version 0.12.0; repository vs bitmask-stack
/home/hunter/Projects/diba/{AGENTS,RESIDUAL,COMPLETED,PLAN,SECURITY}.md	Must match HEAD
bitmask-core/nix/cargo-quality.nix	Skip filter vs real test modules
bitmask-core/tests/rgb.rs	Module declarations
bitmask-core/tests/rgb/unit/import.rs	Hermetic Validation
bitmask-core/tests/rgb/server/import.rs	Docker import
bitmask-core/tests/rgb/server/transfers.rs	Owner-onward, dual-seal
bitmask-core/tests/rgb/server/swaps.rs	ACP
bitmask-core/tests/bp/server/transfers.rs	Drain, bump
bitmask-core/tests/wallet.rs	Hermetic bump
bitmask-core/tests/rgb/web/import.rs	Wasm import

Reuse

Symbol	Path	How
import_contract / issue_contract / transfer_contract	src/rgb.rs / src/web.rs	Tests and TS wrappers
create_rgb_transfer / transfer_asset	src/web.rs	Live TS transfer names
create_new_wallet / create_new_contract	tests/rgb/server/seeder.rs	Copy
bid_swap_suppl	src/rgb.rs	ACP
drain_wallet / send_sats / bump_fee	src/bitcoin.rs	BDK only

Steps

1. cargo audit both clones. Quote IDs. Fix vulnerabilities. Walk SECURITY.md Open 1–3. Size 2.
2. Tree audit report (reports/bitmask-core-viable-audit.md): docs, Cargo metadata, GHA, Nix skip, TS vs bindgen, residual git facts. Size 2.
3. Patch every documented lie from that report (AGENTS, RESIDUAL, COMPLETED open vs history, PLAN.md, SECURITY after the new cargo quote, child README, repository URL). Size 2.
4. TS/wasm audit: list every BMC.* in lib/web vs #[wasm_bindgen] in src/web.rs. Size 2.
5. Fill bindgen holes so BitMask TS still compiles; wrap live 0.11 issue/transfer rather than drop public names. Size 2.
6. Hermetic import + get_contract Validation. Size 1.
7. Hermetic bump_fee unknown txid. Size 1.
8. Docker import RGB20/RGB21. Size 2.
9. Docker drain_wallet. Size 2.
10. Docker send_sats then bump_fee. Size 2.
11. Docker inspect + get_contract. Size 1.
12. Docker ACP on bid_swap_suppl. Size 1.
13. Docker owner-onward. Size 2.
14. Docker dual-seal RGB20/RGB20 and RGB20/RGB21. Size 2.
15. Wasm import + get_contract twins. Size 2.
16. just check green. Size 1.
17. RESIDUAL.md restated from the audit: viable vs parked. Size 1.

Risks

• Silent bincode 2 or serde_cbor hop breaks known-answers or the node catalog. Mitigation: keep those pins unless this round writes the new codec tests.
• Deleting TS exports "to match Rust" breaks BitMask clients. Mitigation: wrap live bindgen, keep names, prove with wasm-pack / tsc.
• Audit patches only the open law files and leaves COMPLETED.md as past tense. Do not rewrite history bullets into a false present.
• Dual-seal second transfer fails. Observe product. Do not invent batch.
• bump_fee red if first tx is not replaceable. Report. Do not silent-enable RBF.

Verification

Red then green per named test. File-level infer-from-path.

cargo audit: both clones re-quoted in SECURITY.md. Vulnerability IDs are 0, or each remaining ID has a product fix in this round. Each previously listed warning is either gone or still named with why.

Docs audit: reports/bitmask-core-viable-audit.md exists; RESIDUAL.md item 1 matches signed child SHAs and crates.io carbonado; AGENTS.md clone URLs are SSH.

TypeScript wasm: wasm-pack / the existing bitmask-core wasm job must compile after bindgen work. Do not claim TS support if BMC.full_transfer_asset is still imported and missing.

just check: hermetic new tests pass; docker tests stay skipped.

GHA: --test rgb and wallet --skip rgb (runs tests/bp) plus wasm-pack chrome for web twins.

Open questions

None that block Approve if Read this first is accepted.

Critical Files for Implementation

• diba SECURITY.md: fresh cargo audit quote and Open rows
• bitmask-core/Cargo.lock and carbonado-node/Cargo.lock: audit-driven bumps only
• bitmask-core/src/web.rs: wasm_bindgen for BitMask TS
• bitmask-core/lib/web/rgb.ts: keep TS compiling
• diba AGENTS.md, RESIDUAL.md, COMPLETED.md, PLAN.md: audit to HEAD
• bitmask-core/Cargo.toml: repository vs bitmask-stack
• bitmask-core/tests/rgb.rs: module declarations
• bitmask-core/tests/rgb/unit/import.rs: hermetic Validation
• bitmask-core/tests/rgb/server/import.rs: second-wallet import
• bitmask-core/tests/rgb/server/transfers.rs: owner-onward and dual-seal
• bitmask-core/tests/rgb/server/swaps.rs: ACP
• bitmask-core/tests/bp/server/transfers.rs: drain and bump
• bitmask-core/tests/wallet.rs: hermetic unknown txid