Skip to content

feat(minter): report the automatic deposit flow in the metrics and on the dashboard - #287

Merged
mbjorkqvist merged 154 commits into
mainfrom
DEFI-2780-12-automatic-flow-metrics
Nov 11, 2026
Merged

mbjorkqvist merged 154 commits into
mainfrom
DEFI-2780-12-automatic-flow-metrics

Conversation

@gregorydemay

@gregorydemay gregorydemay commented Oct 14, 2026 •

Copy link
Copy Markdown
Contributor

Reports the automatic deposit flow of #272 in the metrics (watched addresses against the capacity, how long the earliest due scan has been waiting, scans by outcome, re-arms of dropped automatic deposits by outcome, dropped deposits by origin, collected fees) and on the dashboard (the fee parameter, the collected fees and a paginated table of the watched addresses).

🤖 Generated with Claude Code

gregorydemay and others added 22 commits October 14, 2026 06:41
Replace the outdated section 3.1.1, which described per-transaction
crediting with getSignaturesForAddress and quotas replenished by the
removed process_deposit endpoint, with a design that builds on the
balance sweep of deposit_sol: a free registration endpoint, a scan
timer reading watched deposit addresses in batches with
getMultipleAccounts, a schedule adapted from the ckETH minter, a fixed
fee in SOL deducted from the minted amount, and a watchlist persisted
only as a bounded snapshot at pre_upgrade. Every change to the
interface, the arguments and the event log is additive, since the
minter is deployed on mainnet.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
State that a re-armed account is reported as watching again, that the
main account receives the sweepable amount minus the fee share, correct
the worst-case cost arithmetic and state its success assumption, and
distinguish a failed upgrade from a reinstallation.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ring

Move the sequence diagram of the automatic flow ahead of its
explanation, remove the semicolon that broke the mermaid parser on
GitHub, and define the deposit id where it is first used in the section.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…he constraint

State that scan ticks are guarded like the other timers so that they
never overlap, and base the automatic deposit fee constraint on the
single-signature fee share that a pending mint actually bears.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Drop the separate status query: calling the registration endpoint again
returns the stored registration or the id of the deposit in flight, as
deposit_eth does in the ckETH minter.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… signature lookup

Spell out that scan ticks never overlap, that the fee derivation is a
single-attempt estimate with re-arm costs absorbed by the minter, and
that only manual deposits are retried by the caller. Remove
getSignaturesForAddress from the RPC inventory and cost tables, since
the minter no longer uses it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A re-armed entry restarts its schedule from the first gap, bounded by
the remaining window, and a re-arm only ever follows a detection.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Record the watchlist snapshot on every upgrade so that an older one
cannot be replayed after the watchlist emptied, and let the transaction
submission section account for deposits queued by the balance scan.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The window ends with the last scan, and the next registration call
starts a new window rather than reporting a registration without a
next scan.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…it ids

Follow the ckETH minter: a registration freezes neither the minimum
deposit amount nor the automatic deposit fee, both are quoted and the
values in force at detection apply, the fee being recorded with the
queued deposit. deposit_sol compares the latest deposit id of the
account before and after its balance read, and a registration is
allowed while a deposit_sol call is in progress.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…edule

Measure gaps from the previous scan as before, but end the window at a
fixed 24 hours after registration, as the ckETH minter does, so that
the accumulated tick and call delays have slack and clients and the
re-arm share one unambiguous boundary.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ence

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…owner rationale

The fee recorded at detection matters for deposits an upgrade finds not
yet credited; a credited deposit has its mint amount in CreditedSweep.
The minter's principal is excluded as a deposit owner because its
default account is the ledger's minting account, not because of an
address collision.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…xample with the automatic flow

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…er a concurrent scan

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…n delay and the fee worst case

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…or to new registrations

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…vents the automatic flow adds

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@gregorydemay
gregorydemay added this pull request to stack #288 October 14, 2026 08:50
@gregorydemay
gregorydemay force-pushed the DEFI-2780-12-automatic-flow-metrics branch from 1de2d70 to 9820615 Compare October 14, 2026 09:04
Copilot AI balanced review requested due to automatic review settings October 14, 2026 09:04

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The dashboard can display expired registrations as actively watched addresses.

1 open finding
What changed in this PR

Adds observability for the automatic deposit flow through metrics and the minter dashboard.

Changes:

  • Adds watchlist, queued-deposit, age, and fee metrics.
  • Adds fee metadata and a paginated watched-address table.
  • Extends dashboard and integration tests.
File Description
minter/​templates/​dashboard.html Renders fees and watched addresses.
minter/​src/​metrics.rs Exposes automatic-deposit metrics.
minter/​src/​dashboard/​tests.rs Tests dashboard additions and pagination.
minter/​src/​dashboard/​mod.rs Builds new dashboard data and pagination.
integration_tests/​tests/​tests.rs Checks exported metrics.

🧠 Review effort: Balanced


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread minter/src/dashboard/mod.rs Resolved
mbjorkqvist and others added 12 commits November 3, 2026 12:17
…de loses

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…be registered again

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The sum only grows, across upgrades too, since replaying the event log
rebuilds it whole before the first query can read it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…oldest registration

The age of the oldest registration stays within the window whether the
scan timer runs or not, so no threshold separates a healthy minter from
a broken one. A due scan that has not run yet ages only while the timer
does not keep up, e.g. when a tick whose calls never return keeps its
guard, which an alert then sees within minutes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An alert on a filling watchlist can then compare the number of live
registrations with the capacity in force instead of hard-coding it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…d after it ran

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An expired registration stays in the watchlist until the next tick
evicts it, and replaying an older snapshot can bring back a batch of
them, none of which is watched any more.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…the next scan

Times in nanoseconds can't be read at a glance; they are shown as on the
dashboard of the ckETH minter. The next scan of each address shows when
the scan timer is behind.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The pagination footer uses a five-column span for a six-column watched-address table, leaving it short of the “Next Scan At” column when there are more than 100 watched addresses.

1 open issue
2 resolved since last review

Review effort: Balanced

Comment thread minter/src/dashboard/mod.rs Resolved
…t-snapshot

# Conflicts:
#	docs/src/development/design.md
#	integration_tests/tests/tests.rs
#	minter/src/deposit/automatic/scan/mod.rs
#	minter/src/deposit/automatic/scan/tests.rs
#	minter/src/deposit/sweep/tests.rs
#	minter/src/state/event/candid/mod.rs
#	minter/src/state/tests.rs
#	minter/src/state/watchlist/mod.rs
#	minter/src/state/watchlist/tests.rs

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The watched-address table passes five columns to pagination despite having six, causing the pagination row to exclude “Next Scan At” when there are more than 100 addresses.

1 open issue

Review effort: Balanced

mbjorkqvist and others added 5 commits November 10, 2026 12:39
…atched address

The age of the oldest live registration is bounded by the watch window, so it was
replaced by the scan lag as a metric and has no caller.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…bled

Without a snapshot, the previous version would still mint the automatic deposits
already queued without deducting their fee.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… into DEFI-2780-12-automatic-flow-metrics

# Conflicts:
#	minter/src/state/watchlist/mod.rs
#	minter/src/state/watchlist/tests.rs
…sits

A sweep that keeps failing re-arms its automatic deposits over and over, and a
full watchlist leaves them to their users; both are visible only in the logs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A dropped automatic deposit is re-armed while a dropped manual deposit waits for
its user, so the two call for different follow-ups.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The watched-address pagination uses a colspan of five for a six-column table, leaving “Next Scan At” uncovered and misaligning controls when registrations exceed 100.

1 open issue

Review effort: Balanced

mbjorkqvist and others added 3 commits November 10, 2026 13:45
…c-flow-metrics

# Conflicts:
#	minter/src/state/watchlist/mod.rs
#	minter/src/state/watchlist/tests.rs
…six columns

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…d collect the fee

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Each metrics scrape now scans the permanently retained dropped-deposit history, causing its cost to grow with all historical failures instead of reading maintained per-origin totals.

1 open issue
1 resolved since last review

Review effort: Balanced

Comment thread minter/src/metrics.rs Resolved
…between tests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues are reported for the automatic-deposit metrics and dashboard changes.

1 open issue

Review effort: Balanced

@zeropath-ai

zeropath-ai Bot commented Nov 11, 2026

Copy link
Copy Markdown

✅ No security or compliance issues detected. Reviewed everything up to f3e4b38.

Security Overview
Detected Code Changes
Change Type Relevant files
Enhancement ► integration_tests/tests/tests.rs
    Modify imports and functions related to DepositSolArgs, DepositSolId, and sweep/finalize helpers; add sweep_deposit and finalize_and_credit_sweep helpers; adjust sweep/finalize flow and tests; update metric expectations and deposits handling
► minter/src/dashboard/mod.rs
    Add Timestamp import and format_timestamp helper; expose watched_deposit_addresses_start in pagination; expose watched_deposit_addresses data in dashboard template; adjust DashboardTemplate to accept now: Timestamp and to include watched_deposit_addresses_table
► minter/src/dashboard/tests.rs
    Update dashboard fixtures and tests to account for new watched deposit addresses table, timestamp formatting, and new fields; adapt imports and helper usage
► minter/src/main.rs
    Use current Timestamp from ic time for dashboard rendering; pass now to DashboardTemplate::from_state
► minter/src/metrics.rs
    Add metrics for watched_deposit_addresses, watched_deposit_address_capacity, oldest_due_deposit_address_scan_age_seconds, and collected_automatic_deposit_fees; adjust existing metric encoding to include per-origin dropped_deposits breakdown and additional RearmOutcome metrics
► minter/src/state/audit.rs
    Record automatic deposit rearms and watchlist full events in log; increment corresponding metrics
► minter/src/state/watchlist/mod.rs
    Expose capacity() and oldest_due_scan_at(now) methods; document live registrations and earliest due scan logic; extend live() to return WatchedAddress by expiry order
► minter/src/storage/mod.rs
    Add automatic_deposit_rearms: BTreeMap<RearmOutcome, u64> to Metrics; initialize in Metrics; ensure storage supports RearmOutcome counting
► minter/Cargo.toml
    Add time = workspace dependency for shared time utilities
► minter/templates/dashboard.html
    Add UI rows for Automatic deposit fee and Collected automatic deposit fees; introduce Watched Deposit Addresses section with new columns (Account, Deposit Address, Valid Until, Scans, Last Scanned At, Next Scan At) and ensure linkage to deposit addresses
► minter/src/dashboard/mod.rs (template integration visuals)
    Integrate new watched_deposit_addresses_table rendering into DashboardTemplate and template rendering logic
► minter/src/dashboard/tests.rs (additional tests)
    Add tests for unconfigured automatic deposit fee display, collected automatic deposit fees display, watched deposit addresses display ordering, live address filtering, and pagination behavior
► minter/src/state/watchlist/tests.rs
    Add tests asserting capacity() equals MAX_WATCHED_ADDRESSES and verify rearm behavior counts including WatchlistFull and Rearmed
► minter/src/state/audit.rs (additional logging context)
    Emit records when rearming after dropped deposits and when watchlist is full upon rearm attempts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants