refactor: remove native Hyperliquid integration - #130
Conversation
- Reject legacy mainnet_url/testnet_url keys in HyperliquidConfig (deny_unknown_fields) instead of silently swallowing them. - Warn on startup when legacy sealed agent keys exist on disk under home/hyperliquid/. - Add Enso config to legacy_hyperliquid_config test so the DeFi handler mount path is actually exercised.
…l migration - Replace 5 stale Hyperliquid rows in parity ledger with single petal row. - Condense GAP_PLAN sections 4/4.1 to note move to bloom-petal-hyperliquid. - Update Interaction Modes and Sealed Approvals to list Hyperliquid as an installed Petal, not a native built-in. - Update Agent-native Documentation example to reference the installed Petal README.
71fd28e to
886952f
Compare
violet-agent
left a comment
violet-agent
left a comment
There was a problem hiding this comment.
Requesting changes for the five blocking/correctness issues documented inline: the migration does not recognize the actual prior default config, stateful Hyperliquid Petal replacement has no session/key continuity boundary, the recommended session overstates safety guarantees, the documented write payloads do not parse against the pinned Petal, and core status retains a misleading native-style Hyperliquid mention. I reproduced the migration, payload, and status failures locally and reviewed the exact pinned v0.1.4 Petal implementation.
| let had_legacy_hyperliquid_surface = legacy_hyperliquid.is_some_and(|table| { | ||
| table.get("mainnet_url").is_some() || table.get("testnet_url").is_some() | ||
| }); | ||
| if had_legacy_hyperliquid_surface && self.petals.preinstalled == ["polymarket"] { |
There was a problem hiding this comment.
Blocking migration bug: this recognizes the wrong generated legacy shape. At base commit f84f5f7, default_preinstalled_petals() serialized ["polymarket", "near-intents", "enso"], not a Polymarket-only list. I loaded that exact base-shaped config through this PR: the endpoints migrated, but hyperliquid_present=false. Because this PR removes the native surface, ordinary existing users lose Hyperliquid without receiving the replacement Petal. Please migrate the actual prior default while preserving explicit empty/custom lists, and add a regression fixture serialized from the base-version default rather than a hand-built Polymarket-only fixture.
| fn preinstalled_petal(name: &str) -> Option<&'static PreinstalledPetal> { | ||
| match name { | ||
| "polymarket" => Some(&PREINSTALLED_POLYMARKET), | ||
| "hyperliquid" => Some(&PREINSTALLED_HYPERLIQUID), |
There was a problem hiding this comment.
Blocking state-continuity gap: cataloguing Hyperliquid here opts a stateful trading package into the generic Outdated auto-replacement path used by init/serve. Replacement swaps the package owner to a new content hash, while bloom:store reads/writes are namespaced by package hash. The pinned Petal stores both session.json and the secret agent key in that store, so the replacement cannot recover the old package's active sessions/keys even though delegated venue authority and open orders may remain live. Please define an explicit migration/quiescence/revocation boundary (or a safe stable application-state identity) before automatically updating this Petal, and cover an upgrade with persisted active-session state.
|
|
||
| # 2) Create the session (one approveAgent signature) | ||
| echo '{}' > /bloom/hyperliquid/mainnet/agent_sessions/<wallet>/new.json | ||
| echo '{"id":"bounded-session"}' \ |
There was a problem hiding this comment.
Blocking safety mismatch: this exact request supplies no max_notional_usd, max_leverage, or assets. In pinned v0.1.4 those are optional; empty assets means all assets, and absent caps are not enforced. The Petal also has no background loss/position monitor or automatic breach flattening; expiry only rejects subsequent route writes. That contradicts the immediately preceding claims that this trades inside policy bounds and auto-flattens on risk breach. Please either implement and test those guarantees (including required bounds and cleanup/revocation), or remove the claims and do not recommend this unbounded session shape.
| echo '{"asset":"ETH","is_buy":true,"order_type":"Limit", | ||
| "price":"3000","sz":"0.01","reduce_only":false}' \ | ||
| > /bloom/hyperliquid/mainnet/agent_sessions/<wallet>/<session>/order.json | ||
| > /bloom/petals/hyperliquid/mainnet/agent_sessions/<wallet>/<session>/order.json |
There was a problem hiding this comment.
Blocking documentation/API mismatch: the body above retains the removed native handler's friendly JSON schema. Pinned Petal v0.1.4 expects SignSubmit { action: ExchangeAction, ... }, with a tagged nested action and Hyperliquid wire-order fields/numeric asset IDs. Compiling the documented order and update-leverage bodies against the pinned parser produces missing field 'action' for both. Please update the session and direct-exchange examples to the actual v0.1.4 schema and make them executable documentation tests against the pinned artifact so this cannot drift again.
| } else { | ||
| println!("hyperliquid_vfs: disabled (add [hyperliquid] to config.toml)"); | ||
| } | ||
| println!("hyperliquid_vfs: default Petal (/petals/hyperliquid)"); |
There was a problem hiding this comment.
Please remove hyperliquid_vfs and audit/remove other dangling native-surface Hyperliquid mentions from the core Bloom codebase rather than converting this one into an unconditional Petal advertisement. This line is already incorrect when [petals] preinstalled = [] or installation is absent: I reproduced a fresh home with zero Petal owners that still printed hyperliquid_vfs: default Petal. Core status should either report actual installed Petals generically or omit this line. Retain only deliberately shared protocol/deposit/signing identifiers that the external Petal host boundary still requires.
|
Addressed all five review threads in commit
Validation completed successfully: formatting, diff checks, Clippy with warnings denied, The pinned test also exposed a separate confirmed defect in the published Hyperliquid Petal v0.1.4 after deserialization: session creation writes pending key material under the public |
2 participants
Summary
Removes Bloom's native Hyperliquid integration and replaces it with the pinned,
default-installed
bloom-petal-hyperliquidpackage. This mirrors the priorPolymarket extraction (#107): Bloom no longer mounts a native
/hyperliquidVFS subtree or exposes a
bloom hyperliquidCLI, whilebloom initnowprovisions both external applications under
/petals/.What changed
bloom-hyperliquid— removed the native exchange client,signing implementation, HyperCore API surface, CLI, daemon IPC, and VFS
handler.
API-wallet keystore and obsolete Hyperliquid review/session types.
v0.1.4 release
by source commit, release archive, checksum-verified provenance, and package
hash.
overrides migrate to
petals.runtime.hyperliquid.endpoints; explicit newendpoint settings win, insecure origins fail with remediation, and explicit
Petal opt-outs remain persistent.
[hyperliquid]now contains only thebridge address and deposit-chain settings used by Bloom's generic DeFi
handler.
agent-key material remains on disk rather than silently abandoning it.
VFS guidance, architecture docs, migration notes, and parity records now
describe Hyperliquid as a default external Petal.
The external package was made release-ready in
Petal PR #1,
PR #2,
PR #3,
PR #4,
and PR #5.
PR #5 fixes large public
/inforesponses by validating and returning theoriginal JSON bytes instead of materializing and pretty-printing a second tree.
This prevents the current testnet
spotMetaAndAssetCtxspayload from trappinginside the WASM route.
Net: 40 files changed, 1,351 insertions, 12,328 deletions (−10,977 lines).
Verification
cargo fmt --all -- --check— OKcargo test -p bloom-proto— 149 passedcargo test -p bloom github_source::tests— 18 passedcargo test -p bloom-daemon legacy_hyperliquid_config_does_not_restore_native_surface— OKcargo test -p bloom --test cli init_respects_persistent_preinstalled_petal_opt_out_without_network— OKcargo clippy -p bloom-proto -p bloom --all-targets -- -D warnings— OKcomponents, deterministic release packaging, local install/dispatch, and
GitHub-source install/dispatch
fa722a986c2a0a23977e9e00df54ebd291a686db, archive SHA-25622a9757ab07eeeb51340a4c98127d0d237d2533f5b78393bb266f45e2ea6c0bf,package hash
1de2eb50b7ce0f0da03d3ef1ae6554c6f1b89393096d50183fe4f2dbca6b2af7,62 packaged routes
bloom initagainst published releases — installed Polymarket andHyperliquid v0.1.4 with catalog provenance/hash validation
both networks, public market/account reads, route discovery, stored-state
reads, descriptions, invalid inputs, and every safe pre-signing write
controller path
broadcast was performed
5c3df49— all checks passed: formatting, clippy, doctests,locked release build, test-archive build, unit tests, local integration
tests, external E2E tests, and checklist enforcement
Checklist
catalog integrity, endpoint migration, and removed native-surface behavior.
and legacy sealed key material is detected.