[USCMig]

Stacked on #36 (pay if agreed), and through it on #35, #34, #33 and #32. Merge those first; until then this diff also shows their changes.

Summary

Group rules for payments, adopted by poll and enforced by every member's app.

• Pay only trusted payees.
  • A payee is trusted once as many members trust its address as a payment needs approvals: its author, plus others who click Trust.
  • Trust is tied to the address, so if the address changes the others have to trust it again.
• Larger payments need more approvals. For example, "payments of 100 ZEC or more, together in one transaction, need 4 of 5" on a 3-of-5 key.

How they're enforced

Zcash has no contracts for shielded funds, so nothing on chain enforces these. Each app refuses to sign a payment that breaks them.

• What rules stop: a careless approval, a swapped address, or one compromised device.
• What they can't stop: as many members as a payment needs acting together. That's the same trust the wallet already depends on.
• The UI says so: the Rules card, the docs and the README all state this limit.

Design

• Adopting rules works like pay if agreed.
  • A poll proposes a complete rule set (Poll.rules, options Adopt / Don't adopt), and polls::rules_in_effect picks the latest set the group agreed to adopt.
  • Changing the rules takes as many members as spending does.
  • create_poll refuses a rule this group can't meet: needing more approvals than it has members, or no more than its threshold.
• The sender and approvers run the same check. commands::rules::check takes the payments a verified transaction makes.
  • Sender: wallet_send verifies its own draft exactly as approvers will, then refuses before asking anyone.
  • Approvers: the gate refuses a request that breaks the rules, or whose rules it can't read (it fails closed). Otherwise it reports which rules the request met.
  • Transfers within the group: they make no payments, so the rules don't apply to them.
• The approval count can't be faked. An approver counts the signers committed in the signing package (AwaitingApproval.signers). A FROST signature needs a share from each of them, so the coordinator can't overstate how many will approve.

Changes

• Core
  • New rules.rs: GroupRules, check, approvals_needed.
  • polls.rs: Poll.rules, PayeeTrust and rules_in_effect.
  • payees.rs: trusted_by and trusted.
  • events.rs and signing.rs: the signer count on the approval event.
• App
  • New commands/rules.rs: group_rules and check.
  • payees.rs: new trust_payee command.
  • polls.rs: create_poll accepts and checks rules.
  • wallet.rs: the sender's rules check.
  • signing.rs: the gate's rules check and annotation. Its arguments are grouped into a WalletRequest struct to stay within clippy's limit.
• Frontend
  • A Rules card on Home: the rules in effect, and Propose rules.
  • A Trust column on the Payees card.
  • Rule polls in Votes, showing whether they were adopted and are still in effect.
  • In the send form, batch rows and payment proposals, an error for an untrusted recipient.
  • In the review and the agreed-payment sender, the approvals the rules need.
  • "Meets the group's rules" in Approvals.
• Docs: user guide (Rules, and trusted payees), VOTING.md, README (features and security model), CHANGELOG, TODO.md.

Testing

• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• tsc, then vitest (40 tests)
• Core tests:
  • rules::tests: no rules, trusted payees only, large payments counted together, malformed rules.
  • the_latest_rules_the_group_agreed_to_are_in_effect
  • a_poll_proposing_rules_is_refused_unless_well_formed
  • a_payee_is_trusted_once_enough_members_trust_its_address, including a changed address and trust taken back.
• Live test over a real frostd, tests/group_payees.rs, extended:
  • Bob trusts Alice's payee, which makes it trusted.
  • An impossible rule is refused.
  • "Trusted payees only" takes effect for both once both adopt it.
• Devnet (NU7), tests/devnet_send.rs, which passed:
  • With "trusted payees only" adopted by poll, a payment to an untrusted address is refused before anyone is asked.
  • Send-all to the trusted auditor goes through, and Bob's app reports the rule it checked, with 2 of 2 approvals.
• Frontend tests:
  • Trusting a payee.
  • Proposing rules.
  • Rules in effect, and the poll that adopted them.
  • An untrusted recipient blocked in the send form.
  • A large payment needing 3 of 3 in review.
  • The rules line in Approvals.
• Screenshots of the Rules card, the proposal form and payee trust were checked against a production build.

Next

Delay with veto, and spending limits (automatic approval), will build on these rules.

🤖 Generated with Claude Code