[USCMig]

Stacked on #38 (delay with veto), and through it on the earlier PRs. Merge those first; until then this diff also shows their changes.

Summary

Spending limits: routine payments can be approved automatically. Under a new group rule, members' apps may approve payments to trusted payees by themselves while the wallet has sent less than an amount in a period, for example 1 ZEC a week.

• Each member opts in for their own app. Under Rules, Approve automatically on this device turns it on, and shows how much of the limit the wallet has used. The others approve as they choose.
• An app approves by itself only when all of these hold:
  • every payment goes to a trusted payee;
  • no other rule needs more approvals or a wait;
  • the fee is usual;
  • the payment and its fee fit in what's left of the limit.
• Every other check runs first. The app still verifies the transaction and checks every other rule, and it tells the member when it approves.

Why the limit holds

• It counts everything the wallet sent in the period, however it was approved. So it holds however many members turn automatic approval on.
• That total comes from two sources:
  • History: the wallet's history since the height that long ago. The period is counted by block spacing because a chain's block times needn't be current; on the devnet they aren't, which is how this surfaced.
  • In flight: what this device approved automatically in the last 70 minutes that may not be in the history yet. A payment can count twice for up to an hour, never too little.
• No fresh sync, no automatic approval. Without a sync in the last 15 minutes, the app approves nothing by itself.
• One charge per transaction. An automatic approval is remembered by sighash like a manual one, so the transaction's later rounds go through and the limit counts it once.

Changes

• Core (rules.rs): SpendingLimit, may_approve_automatically, NotAutomatic with readable reasons, usual_fee, and validity limits on the period.
• App
  • rules.rs: spent_in_period, automatic_approval, record_automatic_approval, and the commands auto_approval_status and set_auto_approve.
  • private.rs: auto_approve added to private settings.
  • state.rs: the in-flight record of automatic approvals.
  • signing.rs: the gate decides and records automatic approvals, and adds an auto_limit annotation. The verdict's poll and limit reports are boxed to stay within clippy's size limit.
• Frontend
  • The toggle and the usage line on the Rules card.
  • The limit option in Propose rules.
  • In Approvals, "Approved automatically by your app … the wallet has now sent X of Y", or "Not approved automatically: why".
  • A notification when the app approves by itself.
• Docs: user guide (Rules), README, CHANGELOG, TODO.md.

Testing

• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• tsc, then vitest (47 tests)
• Core test: an_app_approves_routine_payments_to_trusted_payees_by_itself_within_the_limit, covering trusted payees, large payments, the fee, exactly up to the limit, and over it. Plus validity limits.
• Devnet (NU7), tests/devnet_send.rs, which passed:
  1. Bob's app syncs the wallet.
  2. A limit just above what the run has sent is adopted by poll, and Bob turns automatic approval on.
  3. A 0.05 payment to the trusted auditor is approved by Bob's app with no action from Bob.
  4. The next payment, which would go over the limit, is left to Bob, with "over the limit".
  5. Send-all completes the run.
• Frontend tests:
  • The toggle and its usage line.
  • Proposing a limit.
  • Approvals showing an automatic approval, and a request that wasn't approved automatically, with the reason.

🤖 Generated with Claude Code