Repository navigation
feat(minter): report the automatic deposit flow in the metrics and on the dashboard - #287
Conversation
Replace the outdated section 3.1.1, which described per-transaction crediting with getSignaturesForAddress and quotas replenished by the removed process_deposit endpoint, with a design that builds on the balance sweep of deposit_sol: a free registration endpoint, a scan timer reading watched deposit addresses in batches with getMultipleAccounts, a schedule adapted from the ckETH minter, a fixed fee in SOL deducted from the minted amount, and a watchlist persisted only as a bounded snapshot at pre_upgrade. Every change to the interface, the arguments and the event log is additive, since the minter is deployed on mainnet. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
State that a re-armed account is reported as watching again, that the main account receives the sweepable amount minus the fee share, correct the worst-case cost arithmetic and state its success assumption, and distinguish a failed upgrade from a reinstallation. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ring Move the sequence diagram of the automatic flow ahead of its explanation, remove the semicolon that broke the mermaid parser on GitHub, and define the deposit id where it is first used in the section. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…he constraint State that scan ticks are guarded like the other timers so that they never overlap, and base the automatic deposit fee constraint on the single-signature fee share that a pending mint actually bears. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Drop the separate status query: calling the registration endpoint again returns the stored registration or the id of the deposit in flight, as deposit_eth does in the ckETH minter. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… signature lookup Spell out that scan ticks never overlap, that the fee derivation is a single-attempt estimate with re-arm costs absorbed by the minter, and that only manual deposits are retried by the caller. Remove getSignaturesForAddress from the RPC inventory and cost tables, since the minter no longer uses it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A re-armed entry restarts its schedule from the first gap, bounded by the remaining window, and a re-arm only ever follows a detection. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Record the watchlist snapshot on every upgrade so that an older one cannot be replayed after the watchlist emptied, and let the transaction submission section account for deposits queued by the balance scan. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The window ends with the last scan, and the next registration call starts a new window rather than reporting a registration without a next scan. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…it ids Follow the ckETH minter: a registration freezes neither the minimum deposit amount nor the automatic deposit fee, both are quoted and the values in force at detection apply, the fee being recorded with the queued deposit. deposit_sol compares the latest deposit id of the account before and after its balance read, and a registration is allowed while a deposit_sol call is in progress. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…edule Measure gaps from the previous scan as before, but end the window at a fixed 24 hours after registration, as the ckETH minter does, so that the accumulated tick and call delays have slack and clients and the re-arm share one unambiguous boundary. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ence Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…owner rationale The fee recorded at detection matters for deposits an upgrade finds not yet credited; a credited deposit has its mint amount in CreditedSweep. The minter's principal is excluded as a deposit owner because its default account is the ledger's minting account, not because of an address collision. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…xample with the automatic flow Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…er a concurrent scan Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…n delay and the fee worst case Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…or to new registrations Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…vents the automatic flow adds Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
1de2d70 to
9820615
Compare
There was a problem hiding this comment.
🟡 Changes recommended
The dashboard can display expired registrations as actively watched addresses.
1 open finding
What changed in this PR
Adds observability for the automatic deposit flow through metrics and the minter dashboard.
Changes:
- Adds watchlist, queued-deposit, age, and fee metrics.
- Adds fee metadata and a paginated watched-address table.
- Extends dashboard and integration tests.
| File | Description |
|---|---|
minter/templates/dashboard.html |
Renders fees and watched addresses. |
minter/src/metrics.rs |
Exposes automatic-deposit metrics. |
minter/src/dashboard/tests.rs |
Tests dashboard additions and pagination. |
minter/src/dashboard/mod.rs |
Builds new dashboard data and pagination. |
integration_tests/tests/tests.rs |
Checks exported metrics. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…de loses Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…be registered again Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…matic-flow-metrics
The sum only grows, across upgrades too, since replaying the event log rebuilds it whole before the first query can read it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…oldest registration The age of the oldest registration stays within the window whether the scan timer runs or not, so no threshold separates a healthy minter from a broken one. A due scan that has not run yet ages only while the timer does not keep up, e.g. when a tick whose calls never return keeps its guard, which an alert then sees within minutes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An alert on a filling watchlist can then compare the number of live registrations with the capacity in force instead of hard-coding it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…d after it ran Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An expired registration stays in the watchlist until the next tick evicts it, and replaying an older snapshot can bring back a batch of them, none of which is watched any more. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…the next scan Times in nanoseconds can't be read at a glance; they are shown as on the dashboard of the ckETH minter. The next scan of each address shows when the scan timer is behind. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
The pagination footer uses a five-column span for a six-column watched-address table, leaving it short of the “Next Scan At” column when there are more than 100 watched addresses.
1 open issue
2 resolved since last review
Review effort: Balanced
…t-snapshot # Conflicts: # docs/src/development/design.md # integration_tests/tests/tests.rs # minter/src/deposit/automatic/scan/mod.rs # minter/src/deposit/automatic/scan/tests.rs # minter/src/deposit/sweep/tests.rs # minter/src/state/event/candid/mod.rs # minter/src/state/tests.rs # minter/src/state/watchlist/mod.rs # minter/src/state/watchlist/tests.rs
… into DEFI-2780-12-automatic-flow-metrics
…atched address The age of the oldest live registration is bounded by the watch window, so it was replaced by the scan lag as a metric and has no caller. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…bled Without a snapshot, the previous version would still mint the automatic deposits already queued without deducting their fee. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… into DEFI-2780-12-automatic-flow-metrics # Conflicts: # minter/src/state/watchlist/mod.rs # minter/src/state/watchlist/tests.rs
…sits A sweep that keeps failing re-arms its automatic deposits over and over, and a full watchlist leaves them to their users; both are visible only in the logs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A dropped automatic deposit is re-armed while a dropped manual deposit waits for its user, so the two call for different follow-ups. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…c-flow-metrics # Conflicts: # minter/src/state/watchlist/mod.rs # minter/src/state/watchlist/tests.rs
…six columns Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…d collect the fee Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
Each metrics scrape now scans the permanently retained dropped-deposit history, causing its cost to grow with all historical failures instead of reading maintained per-origin totals.
1 open issue
1 resolved since last review
Review effort: Balanced
…between tests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
✅ No security or compliance issues detected. Reviewed everything up to f3e4b38. Security OverviewDetected Code Changes
|


Reports the automatic deposit flow of #272 in the metrics (watched addresses against the capacity, how long the earliest due scan has been waiting, scans by outcome, re-arms of dropped automatic deposits by outcome, dropped deposits by origin, collected fees) and on the dashboard (the fee parameter, the collected fees and a paginated table of the watched addresses).
🤖 Generated with Claude Code