[PastaPastaPasta]

Motivation

The reference implementation v24.0.0 reads a governance object's signature as a vector of at most 96 bytes, and refuses a longer length before reading the bytes (dashpay/dash#7831). dash-primitives reads it up to MAX_SER_SIZE. This pull request bounds it at 96, using impl_vec!'s field: limit from #119. #119 named this field as a follow-up.

Additional Information

Description	Notes	Reference implementation	Corpus
Bound GovObject::sig at 96 bytes	GovObject::MAX_SIGNATURE_SIZE is 96. GovObject declares itself with impl_new! and takes its codec from codec_base!'s $ty, $max, { fields } form, which now passes a field: limit through to impl_vec!. The signature count is checked before any signature byte is read, and a longer count is DecodeError::CompactSizeExceedsLimit. The other fields, data included, read as before. Encoding is unchanged.	bound, read, data	govobj.json5, proposals.json5 and triggers.json5, unchanged
Update the changelog	"Added" and "Changed".	none	none

Breaking Changes

GovObject refuses a signature longer than 96 bytes when decoding, which it read before. dash-p2p-core's govobj message, which carries a GovObject, refuses it too.

How Has This Been Tested?

• decodes_a_sig_up_to_the_bound decodes an empty signature and one of 96 bytes. refuses_a_sig_one_over_the_bound refuses 97, with and without the signature bytes after the count.
• Every vector in govobj.json5, proposals.json5 and triggers.json5 still decodes and encodes to the same bytes.

Checklist

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional tests
• I have made corresponding changes to the documentation
• I did not use agentic assistance (i.e. LLMs, AI) except as disclosed and can answer questions,
  comments and concerns without said assistance. I assume authorship of the code submitted.
• I have assigned this pull request to a milestone (for repository code-owners and collaborators only)

Agent disclosure

Code, commit messages and this description were generated with Claude Code using Claude Opus 5.5, running autonomously as an agent on behalf of the author.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: dashpay/base-sdk
• Branch: pasta/gov-object-sig
• File: .coderabbit.yml
• Commit: 7b552ac
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: c56d56d7-2499-4caf-a0f8-96f3ee9f3d97

Commits

Reviewing files that changed from the base of the PR and between 74b1364 and 7b552ac.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• New Features
  • Encoding declarations now support optional limits on individual fields, while existing declarations remain supported.
  • Governance objects now expose a 96-byte maximum signature size.
• Bug Fixes
  • Decoding rejects governance-object signatures longer than 96 bytes, including when the oversized signature data is missing.

The codec-only codec_base! form now accepts optional per-field limits. GovObject uses this support to cap signatures at 96 bytes and exposes the limit through MAX_SIGNATURE_SIZE. Tests cover decoding signatures at the boundary and rejection of a declared size above the limit, whether or not the signature bytes are present.

Merge Risk: Minimal · previous review 74b13

No actionable issue is established; the change is mergeable after normal checks.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title identifies the 96-byte governance object signature limit.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description matches the changes. It covers the 96-byte signature limit, codec macro update, tests, and changelog.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: dashpay/base-sdk
• Branch: pasta/gov-object-sig
• File: .coderabbit.yml
• Commit: 74b1364
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5228ac45-852d-4a0f-8f11-77d4ed88f249

Commits

Reviewing files that changed from the base of the PR and between 90952f8 and 74b1364.

Files selected for processing: 3

• pkgs/primitives/CHANGELOG.md
• pkgs/primitives/src/codec.rs
• pkgs/primitives/src/gov/object.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[thepastaclaw]

♻️ No change to this PR's diff since commit 74b1364 (an empty commit, a merge of the base or a rebase onto it): that review stands — approved; @thepastaclaw review asks for a review of this commit (commit 7b552ac)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[thepastaclaw]

Final validation — Phase 1 + Phase 2

Verified the complete diff at 74b1364 and found no actionable defects. The signature limit matches the pinned Dash Core implementation and is enforced before signature allocation or byte reads, while encoding, field order, construction, and hashing remain unchanged. Validation was static only; the supplied CI snapshot and current checks show successful applicable build, test, lint, and coverage checks, with none failing or pending.

Review provenance

Source: reviewer 1: glm-5.3-flash (agent: phase1-reviewer, role: general); reviewer 2: glm-5.3-flash (agent: phase1-reviewer, role: rust-quality); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 4: gpt-6.1-sol (agent: phase2-reviewer, role: rust-quality); reviewer 5: gpt-6.1-sol (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

• Triage: low by gpt-6.1-sol (effort low) — This is a small, contained decoding-bound fix with focused boundary tests and a straightforward macro passthrough, not a large or intricate change despite touching peer-facing deserialization.
• Phase 1 reviewers: glm-5.3-flash — general (completed, effort high); agent phase1-reviewer, glm-5.3-flash — rust-quality (completed, effort high); agent phase1-reviewer
• Phase 1 model: glm-5.3-flash — zai quota: 5h 99% left, weekly 44% left; passed over gemini-3.8-flash-high (antigravity quota lookup failed)
• Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
• Phase 2 reviewers: gpt-6.1-sol — general (completed, effort medium); agent phase2-reviewer, gpt-6.1-sol — rust-quality (completed, effort medium); agent phase2-reviewer, gpt-6.1-sol — security-auditor (completed, effort medium); agent phase2-reviewer

[github-actions]

Warning

This pull request may have conflicts, please coordinate with the authors of these pull requests.

Potential conflicts

• primitives%feat: add payload sign hashes, read signatures of any length #121