[Kenbak]

Why

Production and main had diverged.

• Mainnet runs crosschain-20261021. It was built from 39e4ae3 plus uncommitted changes (release-info.json: "dirty": true).
• main was missing six commits that production has. These are the September payment isolation, replay protection, confirmation accounting and delivery fixes (bb06438…107ed00) and the subscription renewal fix (39e4ae3).
• Deploying main would have reverted all of them. It would also have dropped the NEAR cross-chain, email and scanner-API code that existed only on the server.

After this PR merges, main equals production plus the security fix, and releases can only be built from main.

Commits

1. c39affd Production snapshot. Records the exact source of crosschain-20261021. All 79 files match the release's backend-manifest.json SHA-256 hashes, and the archive matches its recorded sha256. I scanned it for secrets: credentials are read from environment variables only, and there are no keys or addresses in the code.

2. a3dc2d8 Merge of main, which includes Fix lockfile drift and clear cargo audit (rustls, h2, zstd, tokio) #4. This brings the security fix onto the production line:

   • Keeps production's stricter audit workflow (tests plus check-dependency-exposure.py).
   • actix-web keeps production's features minus compress-*. The API used no Compress middleware, but those features auto-decoded zstd, brotli and gzip request bodies through zstd-safe 7.3.0 (RUSTSEC-2026-0391..0410).
   • rustls 0.23.44 → 0.23.46, rustls-webpki 0.103.15 → 0.103.16 (emSign distrust), tokio 1.53.1 → 1.54.1.

3. 51c8d38 Release automation, so production can't drift from main again:

   • release-build.yml runs on every push to main. It runs the tests, builds on ubuntu-24.04 (matching the hosts) and publishes a build-<sha> prerelease containing the binary, source archive, build-info.json and SHA256SUMS.
   • scripts/release/stage.sh <sha> refuses commits that aren't on main and verifies the checksums. It then validates the migrations on a private copy of the database, proving every existing row is unchanged.
   • scripts/release/activate.sh generalizes activate-production.sh. It takes a backup, runs --check-database on the live database, writes a zz-release.conf drop-in and checks health, rolling back automatically if any step fails.
   • scripts/release/status.sh reports the serving commit and exits non-zero when it is dirty or not on main. Run against mainnet today, it reports DIRTY, as expected.
   • docs/RELEASING.md documents the flow.

4. 9d95a23 Referral source tracked, program off by default.

   • src/referrals.rs and src/referrals/guardrails.rs ran in production but were never committed. A global *REFERRAL* exclude hid them, and that is why CI failed. They are now committed, and the repo .gitignore explicitly re-includes them.
   • New REFERRALS_ENABLED, off by default. While it's off, POST /merchants/me/referral returns 404, and the billing summary returns "referrals": null without creating a code.
   • Fee-policy tables, migrations, service_bps and reconcile still run, because every invoice's fee snapshot depends on them.
   • Production has 0 applied referrals and 0 earnings, so nothing in flight is affected.

Testing

• cargo test --locked on rustc 1.99.1 (CI stable): 122 passed, 3 ignored.
• cargo audit --deny unmaintained --deny unsound with the CI ignores exits 0.
• check-dependency-exposure.py passes.
• The scripts pass bash -n and shellcheck, and status.sh was run read-only against mainnet.

Behaviour changes

• The referral program is unavailable unless REFERRALS_ENABLED=true.
• A request body sent with Content-Encoding: gzip/br/zstd is no longer decompressed. None of our clients send compressed requests, and responses are unchanged.

Not covered

Testnet (/root/cipherpay-api-testnet) runs April code from a source checkout and isn't covered by these scripts yet.

🤖 Generated with Claude Code