Tracking: Dash Platform usernames and DashPay contacts in dash-qt (--enable-platform-gui)

[PastaPastaPasta]

What / why

Dash-QT has long lacked first-class Dash Platform support: usernames (DPNS), DashPay profiles, contact requests, and contact-to-contact payments — the feature set of the DashPay mobile wallets — without coupling Dash Core to Platform.

A complete implementation exists in PastaPastaPasta#67. The original implementation, PastaPastaPasta#49, was about 17.9k lines and included hand-written C++ versions of GroveDB proof verification, codecs, and BLAKE3. The architecture pivoted on 2026-08-07/08 to use the canonical Platform Rust crates and upstream transport-free query/verification components instead. #49 remains provenance; #67 is the composite integration and manual-test reference.

The implementation is being landed as small, reviewable PRs across dashpay/dash and dashpay/platform. This issue is the living cross-repo map.

Current status (2026-08-17)

State	PR	Current status
✅ Merged	#7511	DIP-14 256-bit child key derivation (Derive256)
✅ Merged	dashpay/platform#4344	dapi-grpc optional transport feature
✅ Merged	dashpay/platform#4345	Proof-vector regression corpus for rs-drive-proof-verifier
🔴 Changes needed	#7580	Optional Rust/CXX foundation. Mergeable, but source-tarball bridge freshness mishandles equal-second ustar timestamps; optional-Rust workflow documentation is also requested. Guix automation additionally needs a commit signed by an authorized Core team member.
🔴 Changes needed	#7581	Wallet seams. Mergeable, but only corrupt platform/seed-id records should fail wallet loading, and nonempty mnemonics must be validated before Platform seed derivation.
🟠 Rebase/tests needed	#7591	Node interfaces. Conflicts with current develop; targeted endpoint, quorum-key, and IS-lock serialization tests are missing. Domain endpoint widening is not currently planned because the first Platform endpoint is guaranteed to be a CService; tests should pin that invariant.
🟡 Small fix/review	dashpay/platform#4388	dash-platform-queries extraction. Mergeable; README must describe the declared breaking migrations instead of promising no SDK-user changes. Codecov reds are threshold noise on code motion.
🔴 Changes needed	dashpay/platform#4389	Request decoding and pure builders, stacked on #4388. CI green, but proof verification must reject wire versions unavailable at the supplied PlatformVersion and document limits above DEFAULT_QUERY_LIMIT.
🧪 Composite	PastaPastaPasta#67	Current full integration. Mergeable; ASAN red is known QDBus LSan noise. It pins #4389 and therefore inherits its verifier blockers. Seed recovery exists here but is not extracted and has not completed a live-testnet recovery E2E.
🗃️ Superseded carrier	dashpay/platform#4335	Draft and conflicting. Superseded by #4388/#4389 as the landing vehicle; close after the slices land.

The series is not only waiting for human review. #7580, #7581, #7591, #4388, and #4389 have concrete work remaining.

Known unrelated CI noise on the current Core branches:

• ASAN: 86-byte QDBusConnectionManager leak in Qt tests, reproduced across build: add optional Rust and CXX bridge support #7580, refactor: expose masternode Platform endpoints, quorum keys and islocks via node interface #7591, and fix walletpassphrase logic/params/description #67.
• refactor: expose masternode Platform endpoints, quorum keys and islocks via node interface #7591 multiprocess: feature_governance.py not(24 == 25) flake; the PR does not touch governance.

Architecture

• Compile-time optional GUI feature: --enable-platform-gui. dashd and dash-cli link no Rust; default developer builds do no Rust work. The target release configuration enables Platform GUI for dash-qt, making deterministic Guix builds with the feature enabled a release gate.
• Canonical Rust crates: proof verification, response decoding, and state-transition/document construction use the real dashpay/platform crates behind a CXX bridge. The in-Core rust/platform wrapper is interim.
• Core-owned C++ responsibilities: gRPC-Web/HTTP1.1/TLS transport using mbedTLS; endpoint selection, retry, and backoff from the locally synced deterministic masternode list; wallet signing seams; and Qt UI.
• Local trust anchor: queries use prove=true. Rust FromProof verification receives locally synced Platform LLMQ keys through ContextProvider; no remote key service is trusted.
• Keys do not cross the FFI: Rust produces signable digests; C++/wallet code signs them. Friendship receiving keychains are imported, while a contact's outgoing chain is derived statelessly and deliberately not imported as IsMine.
• Request construction target: move request construction to upstream dash-platform-queries so Core no longer maintains parallel protobuf/CBOR/bincode construction logic.
• End-state FFI: wrapper/FFI logic should live upstream in dashpay/platform, with Core pinning a released upstream revision and keeping only a thin bridge.

Plan — dashpay/platform

• lint: fix linter failure in lint-python-dead-code.sh #4344 — dapi-grpc optional transport feature
• backport v0.18 (13529) and Qt5 connect syntax for Dash specific code #4345 — proof-vector regression corpus
• gitian: various backports #4388 — finish dash-platform-queries extraction documentation and obtain review
• Backport v18 vijay new #4389 — enforce Platform wire-version and query-limit parity, add tests, and restack on gitian: various backports #4388
• Close Merge bitcoin#14272: init: Remove deprecated args from hidden args #4335 after gitian: various backports #4388/Backport v18 vijay new #4389 land
• Prototype and choose the upstream FFI home (rs-platform-primitives-ffi vs. adapting rs-sdk-ffi)
• Move the interim Core wrapper surface upstream and pin a released Platform revision
• Hygiene: DPP license metadata, unpinned vsss-rs branch="main", MSRV policy
• Make the Tenderdash proto dependency path offline-clean upstream

Plan — dashpay/dash

Foundations

• feat: add DIP-14 256-bit child key derivation (Derive256) #7511 — DIP-14 Derive256
• build: add optional Rust and CXX bridge support #7580 — fix source-distribution freshness semantics, document the optional Rust build, obtain an authorized signed commit, and complete review

Wallet/node seams

• feat(wallet): add Platform key provider, data records and DIP-15 friendship keychain seams #7581 — narrow fatal Platform-record corruption to platform/seed-id; validate mnemonics; add regression tests
• refactor: expose masternode Platform endpoints, quorum keys and islocks via node interface #7591 — rebase, add focused interface tests, and obtain explicit acceptance of the scoped CService endpoint contract
• Extract seed-only Platform recovery from fix walletpassphrase logic/params/description #67 into a focused PR after the foundations are corrected

Platform client and GUI

• C++ transport + thin Rust verification adapter pinned to corrected upstream query/verification components
• Qt Platform service, identity registration, username flow, dashboard, and profile editing
• Friendship keychain import, contacts/contact requests, and send-to-username
• Release enablement for Platform GUI in dash-qt

Composite reference and recovery state

PastaPastaPasta#67 currently combines:

• the build: add optional Rust and CXX bridge support #7580 optional-Rust foundation;
• the feat(wallet): add Platform key provider, data records and DIP-15 friendship keychain seams #7581 wallet seams;
• the Backport v18 vijay new #4389 Platform pin;
• seed-only Platform recovery; and
• Guix Platform-build enablement.

Two independent aarch64 builders cross-compiling x86_64 produced byte-identical main, debug, and source artifacts. This is useful deterministic-build evidence, but it does not prove reproducibility across different build architectures.

Seed recovery is implemented only on the composite and currently:

• supports identity index 0; nonzero identity indexes are explicitly refused;
• has not completed a live-testnet recovery E2E;
• reconstructs the payment cursor using a fixed 100-entry window, which could reuse a destination after more than 100 historical payments;
• logs rescan BUSY/FAILURE without surfacing or retrying it; and
• still needs extraction into a focused Core PR with functional coverage.

Release gates

• Deterministic Guix builds with Platform GUI enabled across release targets.
• Seed-only recovery extracted and covered by full-backup, mnemonic-only, and interrupted-registration recovery tests.
• Live-testnet recovery E2E.
• Malformed-input fuzzing of all attacker-controlled verify_* and decode_* bridge inputs.
• Explicit decision on DAPI TLS authentication/certificate pinning. Reads are proof-gated, but transport authentication remains a release-level design decision.
• Flag-on builds from release source tarballs, including pre-generated CXX bridge artifacts and every Platform GUI header/source.
• Correct upstream verifier parity for supported wire versions and server query limits.

Immediate critical path

1. Fix build: add optional Rust and CXX bridge support #7580's tarball timestamp comparison and add optional-Rust build documentation.
2. Have an authorized Core team member contribute a signed commit so Guix automation can run.
3. Correct gitian: various backports #4388's README and clear stale review threads.
4. Fix both Backport v18 vijay new #4389 verifier blockers with tests and restack it.
5. Fix both feat(wallet): add Platform key provider, data records and DIP-15 friendship keychain seams #7581 wallet blockers with tests.
6. Rebase refactor: expose masternode Platform endpoints, quorum keys and islocks via node interface #7591 and add its missing interface tests.
7. Repin fix walletpassphrase logic/params/description #67 to corrected Backport v18 vijay new #4389 and rerun the Rust/Platform test suites.
8. Run live-testnet seed-recovery E2E.
9. Extract seed recovery as the next focused Core PR.
10. Continue the transport, identity/profile UI, and contacts/send-to-username train.

The earlier Aug. 20–21 RC1 target assumed the foundations would already be review-clear. With multiple correctness blockers still open on Aug. 17, that schedule is at material risk and should not be represented as committed until the immediate items above are cleared.

Decisions log

• 2026-08-01 — IsMine watch-only guard deferred. fix(wallet): report public-only descriptors in signing wallets as watch-only #7510 was closed because the current series does not consume it: the friendship receiving chain is private, and the contact chain is never imported.
• 2026-08-01 — DIP-14 compatibility semantics. Sub-2^32 indexes use raw BIP32 index space; the private path folds the hardened flag into the high bit, while the public path rejects high-bit indexes.
• 2026-08-01 — No QWizard. Registration uses QDialog + QStackedWidget because the depends/Guix Qt build disables the wizard feature.
• 2026-08-07 — Canonical Rust crates replace C++ reimplementations. This removed roughly 6,300 lines of hand-maintained security-critical C++ and retained byte-exact fixture coverage.
• 2026-08-08 — Refactor upstream rather than duplicate. Platform gained an optional transport surface and the query core is being extracted; proof verification uses upstream FromProof + ContextProvider with local LLMQ keys.
• 2026-08-08 — panic=unwind for the bridge. Residual parser panics from attacker-controlled bytes become catchable C++ exceptions rather than aborting dash-qt.
• 2026-08-11 — Keep mbedTLS transport. Drogon/Trantor did not satisfy HTTPS, cancellation, deadline, and bounded-input requirements. The transport swap seam remains isolated.
• 2026-08-11 — build: add optional Rust and CXX bridge support #7580 supersedes build: add rudimentary support for Rust components in build system, crate vendoring, patch loader paths to Guix store locations #7109. The replacement preserves provenance while making Rust genuinely opt-in and giving it a dedicated CI lane.
• 2026-08-12 — Do not extract the fork's asset-lock seam. Merged feat: asset lock tx v2 with basic RPC support + tests #7294 supersedes it and correctly handles v2 activation.
• 2026-08-12 — Final release target enables Platform GUI in dash-qt. Guix/release validation with the feature enabled is therefore mandatory.
• 2026-08-12 — Seed-only recovery is required for the wallet wave. The composite implementation is progress toward this gate, not completion of it.
• 2026-08-12 — FFI end state is upstream; mechanism remains TBD. Decide through a target-state E2E prototype rather than maintaining a permanent Core-owned wrapper.

[PastaPastaPasta]

Seed-only recovery of Platform state — design answer

Raised at the 2026-08-12 dev sync (kwvg): DashPay wallet data is stored as opaque per-wallet records — how does mnemonic-only recovery restore Platform state? Investigated against both the current implementation and the mobile wallets' shared recovery policy (rs-platform-wallet, the crate behind dashwallet-ios/android). Design below ships in v24 with the wallet wave; implementation is on the reference branch (PastaPastaPasta#67) first, then extracted into the train.

What is derivable from seed alone: every private key (identity auth m/9'/coin'/5'/0'/0'/i'/k', asset-lock funding, DIP-15 friendship chains). What is not: the local records — identity id/state, contact set, payment cursors, and the DPNS preorder salt (CSPRNG).

Recovery flow (auto-probe on wallet load when a seed exists but no identity record; bounded ~20s, never blocks wallet function; mirrors mobile's policy):

1. Identity: scan MASTER auth keys (key index 0, identity index gap limit 5) via the proof-verified getIdentityByPublicKeyHash query, with a three-way outcome — found / proven-absent / network-incomplete — so an outage is never misreported as "no identity". Materialize the full on-chain key set with per-key verification against published pubkeys.
2. Username: namesOfIdentity (+ contested-state check) rebuilds the registration record.
3. Contacts: contact requests fetched in both directions (the sent side is what turns established contacts back from bare incoming requests); xpubs decrypted via the seed-derived ECDH keys; friendship receiving keychains re-imported as private descriptors.
4. Rescan from the earliest contact-request core height, so pre-restore inbound DashPay payments appear.
5. Payment cursors: rebuilt by matching derived outbound scripts (5× the DIP-15 gap = 100 per contact, scriptPubKey-based) against wallet tx history.

Documented limitation (same as both mobile wallets): an in-flight DPNS registration (preorder broadcast, domain not yet) is not recoverable seed-only — the salt is random. A REGISTERED identity recovers fully; mid-registration needs the full backup. Follow-up idea recorded, not v24: derive the salt deterministically (e.g. HMAC of an auth key and the normalized label) — consensus-transparent, would make even mid-registration state recoverable, and no client does it today.

Full backup/restore (backupwallet/restorewallet) remains the complete-state path and is unaffected.

---

🤖 Posted autonomously by Claude on behalf of pasta.

[PastaPastaPasta]

Guix reproducibility confirmed for the Rust/Platform-enabled build.

Two independent builders built commit c9d6fbd459d9 with PLATFORM_GUI=1 HOSTS=x86_64-linux-gnu — the GitHub-hosted ubuntu-24.04-arm runner (workflow run 31720606525) and a local OrbStack container — and all three artifacts are bit-identical, including the debug tarball:

ee1a85a060178923b6eb10a84d3781a087103b1393657be3f726a2199f8c3701  dashcore-23.1.8-1380-gc9d6fbd459d9.tar.gz
620f0b732db138ac637001266e488c6e80437858a36e417a1c3ec06d190ec64a  dashcore-23.1.8-1380-gc9d6fbd459d9-x86_64-linux-gnu-debug.tar.gz
c1033b0e6a92968a4e41766fdc41db1329ebc5f1625875457f8ddc4eef078f4e  dashcore-23.1.8-1380-gc9d6fbd459d9-x86_64-linux-gnu.tar.gz

Scope of the claim: both builders are aarch64 hosts cross-compiling to x86_64-linux-gnu, so this proves host-to-host reproducibility between independent environments, not yet reproducibility across differing build architectures — an x86_64-host run of the same commit would close that gap.

Getting there required five bring-up fixes on this branch, all of which are Guix-environment issues rather than Rust-integration ones: patchelf and zlib added to the Guix manifest (the prebuilt rust toolchain's ELF interpreter fix silently skipped without patchelf, and rustc needs libz at runtime), lbzip2 added (mbedtls is the first .tar.bz2 depends package to reach the Guix path), the rustc sysroot lib dir on LD_LIBRARY_PATH for cargo build scripts (the Guix ld wrapper strips RPATH by design), and an archive rescan for the cxxbridge↔dashrust mutual references.

One latent hazard worth recording: Rust does not get a --remap-path-prefix equivalent to the C++ -ffile-prefix-map. It cannot bite in the standard flow because every builder compiles at the same in-container path, but a builder using a non-canonical mount point would see a differing debug tarball while the stripped tarball still matched.

---

🤖 Posted autonomously by Claude on behalf of pasta.