repo: import doublezero-offchain and doublezero-solana with their history

.github/dependabot.yml

@@ -28,8 +28,19 @@ updates:
           - "go.uber.org/mock"
 
   - package-ecosystem: "cargo"
+    # Enumerated rather than "**/*" because that glob would also pick up
+    # offchain/Cargo.toml and solana/Cargo.toml, and no job in this repo builds
+    # either tree yet. A grouped update would edit their lockfiles, merge green
+    # with nothing compiled, and diverge them from the repos that still release
+    # them. These five are every directory that has its own lockfile, which is
+    # what the glob resolved to before the import. Step 4 folds offchain into
+    # the root workspace, at which point "/" covers it.
     directories:
-      - "**/*"
+      - "/"
+      - "/sdk/geolocation/testdata/fixtures/generate-fixtures"
+      - "/sdk/revdist/testdata/fixtures/generate-fixtures"
+      - "/sdk/serviceability/testdata/fixtures/generate-fixtures"
+      - "/sdk/telemetry/testdata/fixtures/generate-fixtures"
     schedule:
       interval: "monthly"
     open-pull-requests-limit: 10

CHANGELOG.md

@@ -14,6 +14,8 @@ All notable changes to this project will be documented in this file.
 - CI
   - The new `release-bump-dry-run` job dry-runs the release version bump on every PR, so a `cargo update --workspace` dependency rebind fails on the PR that causes it instead of a week later at release time, as it did for v0.37.0 (#4213, fixed in #4219). Advisory until its context is added to the `main` ruleset. (#4220)
   - Add `.cursor/BUGBOT.md` to enable Cursor review. This is an experiment. (malbeclabs/infra#2387)
+- Repo
+  - `doublezero-offchain` and `doublezero-solana` are imported into this repo, with their history and all 126 of their release tags, under new top-level `offchain/` and `solana/` directories. Nothing that was already here moves. Both trees stay excluded from the root Cargo workspace and keep their own `Cargo.toml`, `Cargo.lock` and `rust-toolchain.toml`, so they build exactly as they did in their own repos, and their workflows do not run yet. Imported commit messages are rewritten so that a reference that meant a pull request in a source repo now names that repo explicitly. `.github/dependabot.yml` enumerates its cargo directories instead of globbing them, so no update lands in a tree this repo does not build. The source repos are still the ones that release. (#4240)
 - CLI
   - `doublezero connect` with no mode provisions everything the server's AccessPass authorizes in one run — the IBRL tunnel plus a multicast tunnel joined to the groups or purchased feeds the pass grants — instead of requiring the operator to know their entitlements and issue `connect ibrl` and `connect multicast` separately. Each mode is reported on its own line; one the pass does not cover is skipped with the reason rather than failing the run. The two are attempted independently, so a failure in one keeps the other's work and names the command that finishes the rest, and the run exits non-zero if an attempted mode failed or the pass authorized nothing. Epoch expiry still gates unicast only, so an expired pass connects multicast and skips IBRL. The bare form also enables the reconciler up front, so a run that provisions nothing still leaves the daemon managing tunnels, and takes `--tenant`/`--allocate-addr` for its IBRL half (`connect ibrl` keeps its own positional tenant and `-a`). `connect ibrl` and `connect multicast` are unchanged.
   - `doublezero balance` takes an optional address, so `doublezero balance <pubkey>` reports that account's balance while the bare form keeps reporting the configured keypair's. Querying another account needs no local keypair. An address that was never funded prints `0 Credits` instead of failing the account lookup.

Cargo.toml

@@ -20,6 +20,10 @@ members = [
 ]
 default-members = []
 exclude = [
+    # Both trees keep their own workspace, lockfile and toolchain until step 4
+    # of the monorepo migration merges them in.
+    "offchain",
+    "solana",
     "sdk/revdist/testdata/fixtures/generate-fixtures",
     "sdk/serviceability/testdata/fixtures/generate-fixtures",
     "sdk/telemetry/testdata/fixtures/generate-fixtures",

offchain/.githooks/pre-commit

@@ -0,0 +1,176 @@
+#!/bin/bash
+
+# Pre-commit hook:
+#   1. Checks CHANGELOG.md is updated when files in a crate/directory change
+#   2. Runs Rust checks (fmt, clippy) when Rust files change
+#   3. Runs Elixir checks (compile warnings, format, credo, tests) when Elixir files change
+#
+# To install this hook, run from the repo root:
+#   git config core.hooksPath .githooks
+#
+# Or to skip the check for a specific commit:
+#   git commit --no-verify
+
+set -e
+
+# Get list of staged files (excluding deleted files)
+STAGED_FILES=$(git diff --cached --name-only --diff-filter=d)
+
+if [ -z "$STAGED_FILES" ]; then
+    exit 0
+fi
+
+# ─── Rust checks ────────────────────────────────────────────────────────────────
+HAS_RUST_CHANGES=false
+for file in $STAGED_FILES; do
+    if [[ "$file" == *.rs ]] || [[ "$file" == "Cargo.toml" ]] || [[ "$file" == "Cargo.lock" ]]; then
+        HAS_RUST_CHANGES=true
+        break
+    fi
+done
+
+if [ "$HAS_RUST_CHANGES" = true ]; then
+    echo "🦀 Rust changes detected — running checks..."
+
+    echo "  → just fmt-check"
+    if ! just fmt-check 2>&1; then
+        echo ""
+        echo "❌ Rust formatting check failed. Run 'just fmt' to fix."
+        exit 1
+    fi
+
+    echo "  → just clippy"
+    if ! just clippy 2>&1; then
+        echo ""
+        echo "❌ Clippy found warnings/errors."
+        exit 1
+    fi
+
+    echo "✅ Rust checks passed."
+    echo ""
+fi
+
+# ─── Elixir checks ─────────────────────────────────────────────────────────────
+HAS_ELIXIR_CHANGES=false
+for file in $STAGED_FILES; do
+    if [[ "$file" == scheduler/*.ex ]] || [[ "$file" == scheduler/*.exs ]] || [[ "$file" == scheduler/mix.exs ]] || [[ "$file" == scheduler/mix.lock ]]; then
+        HAS_ELIXIR_CHANGES=true
+        break
+    fi
+done
+
+if [ "$HAS_ELIXIR_CHANGES" = true ]; then
+    echo "💧 Elixir changes detected — running checks..."
+
+    echo "  → just elixir-compile"
+    if ! just elixir-compile 2>&1; then
+        echo ""
+        echo "❌ Elixir compilation has warnings. Fix them before committing."
+        exit 1
+    fi
+
+    echo "  → just elixir-fmt-check"
+    if ! just elixir-fmt-check 2>&1; then
+        echo ""
+        echo "❌ Elixir formatting check failed. Run 'just elixir-fmt' to fix."
+        exit 1
+    fi
+
+    echo "  → just elixir-credo"
+    if ! just elixir-credo 2>&1; then
+        echo ""
+        echo "❌ Credo found issues."
+        exit 1
+    fi
+
+    echo "  → just elixir-test"
+    if ! just elixir-test 2>&1; then
+        echo ""
+        echo "❌ Elixir tests failed."
+        exit 1
+    fi
+
+    echo "✅ Elixir checks passed."
+    echo ""
+fi
+
+# Determine the base branch to compare against
+# Try main first, then master, then fall back to HEAD~1
+if git rev-parse --verify origin/main >/dev/null 2>&1; then
+    BASE_BRANCH="origin/main"
+elif git rev-parse --verify main >/dev/null 2>&1; then
+    BASE_BRANCH="main"
+elif git rev-parse --verify origin/master >/dev/null 2>&1; then
+    BASE_BRANCH="origin/master"
+elif git rev-parse --verify master >/dev/null 2>&1; then
+    BASE_BRANCH="master"
+else
+    BASE_BRANCH="HEAD~1"
+fi
+
+# Get the merge base (common ancestor) between current branch and base
+MERGE_BASE=$(git merge-base HEAD "$BASE_BRANCH" 2>/dev/null || echo "")
+
+# Get list of files changed in the branch (from merge base to HEAD, plus staged changes)
+if [ -n "$MERGE_BASE" ]; then
+    BRANCH_FILES=$(git diff --name-only "$MERGE_BASE" HEAD 2>/dev/null || echo "")
+else
+    BRANCH_FILES=""
+fi
+
+# Find all directories that have a CHANGELOG.md
+CHANGELOG_DIRS=$(find . -name "CHANGELOG.md" -type f | sed 's|/CHANGELOG.md$||' | sed 's|^\./||' | sort -u)
+
+# Track which changelog directories have changes but no changelog update
+MISSING_CHANGELOGS=()
+
+for changelog_dir in $CHANGELOG_DIRS; do
+    # Check if any staged file is in this directory (but not the changelog itself)
+    has_changes=false
+    changelog_updated_staged=false
+    changelog_updated_branch=false
+
+    # Check staged files
+    for file in $STAGED_FILES; do
+        # Check if file is in this changelog directory
+        if [[ "$file" == "$changelog_dir/"* ]]; then
+            if [[ "$file" == "$changelog_dir/CHANGELOG.md" ]]; then
+                changelog_updated_staged=true
+            else
+                has_changes=true
+            fi
+        fi
+    done
+
+    # Check if changelog was updated elsewhere in the branch
+    for file in $BRANCH_FILES; do
+        if [[ "$file" == "$changelog_dir/CHANGELOG.md" ]]; then
+            changelog_updated_branch=true
+            break
+        fi
+    done
+
+    # If there are changes but changelog wasn't updated (in staged or branch), add to missing list
+    if [ "$has_changes" = true ] && [ "$changelog_updated_staged" = false ] && [ "$changelog_updated_branch" = false ]; then
+        MISSING_CHANGELOGS+=("$changelog_dir")
+    fi
+done
+
+# Report missing changelog updates
+if [ ${#MISSING_CHANGELOGS[@]} -gt 0 ]; then
+    echo ""
+    echo "❌ CHANGELOG.md not updated for the following directories:"
+    echo ""
+    for dir in "${MISSING_CHANGELOGS[@]}"; do
+        echo "   • $dir/CHANGELOG.md"
+    done
+    echo ""
+    echo "Please update the relevant CHANGELOG.md file(s) with your changes."
+    echo ""
+    echo "To skip this check (use sparingly):"
+    echo "   git commit --no-verify"
+    echo ""
+    exit 1
+fi
+
+exit 0

offchain/.github/pull_request_template.md

@@ -0,0 +1,9 @@
+## Summary of Changes
+* Describe what changed in the PR
+* Explain why the change is necessary
+* Note any metrics that were exposed in this PR
+* Is there supporting documentation or external resources that explain the change?
+* Is a CHANGELOG.md update needed?
+
+## Testing Verification
+* Show evidence of testing the change

offchain/.github/workflows/changelog-reminder.yml

@@ -0,0 +1,79 @@
+name: changelog-reminder
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: check-changelogs
+        run: |
+          set -euo pipefail
+
+          if echo "${{ toJson(github.event.pull_request.labels.*.name) }}" | grep -q "skip-changelog"; then
+            echo "skip-changelog label present; passing without requiring changelog updates."
+            exit 0
+          fi
+
+          base_branch="${GITHUB_BASE_REF:-}"
+
+          if [ -z "$base_branch" ]; then
+            default_remote_head=$(git symbolic-ref --short refs/remotes/origin/HEAD)
+            base_branch="${default_remote_head#origin/}"
+          fi
+
+          git fetch origin "$base_branch"
+
+          base_ref="origin/$base_branch"
+          head_ref="HEAD"
+
+          changed_files=$(git diff --name-only "$base_ref"..."$head_ref")
+
+          projects=(
+            "crates/contributor-rewards::crates/contributor-rewards/CHANGELOG.md"
+            "crates/scheduled-command::crates/scheduled-command/CHANGELOG.md"
+            "crates/sentinel::crates/sentinel/CHANGELOG.md"
+            "crates/slack-notifier::crates/slack-notifier/CHANGELOG.md"
+            "crates/solana-admin-cli/passport::crates/solana-admin-cli/passport/CHANGELOG.md"
+            "crates/solana-admin-cli/revenue-distribution::crates/solana-admin-cli/revenue-distribution/CHANGELOG.md"
+            "crates/solana-admin-cli/sol-conversion::crates/solana-admin-cli/sol-conversion/CHANGELOG.md"
+            "crates/solana-cli::crates/solana-cli/CHANGELOG.md"
+            "crates/solana-client-tools::crates/solana-client-tools/CHANGELOG.md"
+            "crates/solana-fork::crates/solana-fork/CHANGELOG.md"
+            "crates/solana-interface/sol-conversion::crates/solana-interface/sol-conversion/CHANGELOG.md"
+            "crates/validator-debt::crates/validator-debt/CHANGELOG.md"
+            "scheduler::scheduler/CHANGELOG.md"
+          )
+
+          missing=()
+
+          for entry in "${projects[@]}"; do
+            subdir=${entry%%::*}
+            changelog=${entry##*::}
+
+            if echo "$changed_files" | grep -q "^${subdir}/"; then
+              if ! echo "$changed_files" | grep -q "^${changelog}$"; then
+                missing+=("$subdir (expected ${changelog})")
+              fi
+            fi
+          done
+
+          if [ ${#missing[@]} -eq 0 ]; then
+            exit 0
+          fi
+
+          echo "The following subprojects changed but their changelog was not updated:"
+          for m in "${missing[@]}"; do
+            echo "  - $m"
+          done
+
+          echo
+          echo "If this change intentionally does not require a changelog, add the 'skip-changelog' label to the PR."
+          exit 1

offchain/.github/workflows/ci.yml

@@ -0,0 +1,87 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+    tags: ["*"]
+
+jobs:
+  rust:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Setup | Cancel previous runs
+        uses: styfle/cancel-workflow-action@0.12.1
+
+      - name: Setup | Checkout
+        uses: actions/checkout@v4
+
+      - name: Check disk space before cleanup
+        run: df -h
+
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
+          sudo docker image prune --all --force
+          sudo docker builder prune -a --force
+
+      - name: Check disk space after cleanup
+        run: df -h
+
+      - name: Setup | Apt packages
+        run: sudo apt-get update
+
+      - name: Setup | Rust toolchain from rust-toolchain.toml
+        run: |
+          rustup toolchain install
+          rustup component add llvm-tools-preview
+
+      - name: Setup | Rust cache
+        uses: Swatinem/rust-cache@v2
+
+      - name: Setup | Install cargo-nextest
+        uses: taiki-e/install-action@nextest
+
+      - name: Setup | Install cargo-llvm-cov
+        uses: taiki-e/install-action@cargo-llvm-cov
+
+      - name: Setup | Just
+        uses: taiki-e/install-action@just
+
+      - name: Test | CI Pipeline
+        run: just ci
+
+  # All four release components ship as static musl binaries so they load on
+  # any Linux regardless of the host glibc version. Build each package
+  # individually (as goreleaser does, so feature unification matches the
+  # release) and assert every binary is fully static.
+  rust-musl-static:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup | Rust toolchain from rust-toolchain.toml
+        run: rustup toolchain install
+      - uses: Swatinem/rust-cache@v2
+      - name: Install musl toolchain
+        run: sudo apt-get update && sudo apt-get install -y musl-tools cmake
+      - name: Build release packages for musl and assert static linkage
+        env:
+          CC_x86_64_unknown_linux_musl: musl-gcc
+          CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER: musl-gcc
+        run: |
+          for entry in \
+            doublezero-solana-cli:doublezero-solana \
+            doublezero-contributor-rewards:doublezero-contributor-rewards \
+            doublezero-ledger-sentinel:doublezero-sentinel \
+            doublezero-solana-validator-debt:doublezero-solana-validator-debt
+          do
+            package="${entry%%:*}"
+            binary="target/x86_64-unknown-linux-musl/release/${entry##*:}"
+            cargo build --release --package "$package" --target x86_64-unknown-linux-musl
+            file "$binary"
+            if ! file "$binary" | grep -qE "statically linked|static-pie linked"; then
+              echo "::error::$binary is not statically linked"
+              exit 1
+            fi
+          done