davideandClaude Sonnet 5.5 c1b192f6d1 Harden the container: non-root, pinned images and dependencies, the key in a file (B-91, SEC-51, SEC-52, SEC-53; closes B-71, B-72) ...

- app runs as uid 1000; a one-shot data-permissions service chowns ./data to it
  and closes it to others (works on an older root-owned install with no host sudo);
  files are created 0600 (umask 077)
- python:3.12-slim and caddy:2-alpine pinned by digest; dependencies installed from
  requirements.lock with --require-hashes
- the Fernet key is XPRV_ENCRYPTION_KEY_FILE (./secrets/xprv_encryption.key, a compose
  secret), out of every environment variable and of a ./data backup
- setup.md no longer presents a second way to run the server (B-72)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

2026-10-18 00:54:23 +02:00

..

__init__.py

Scaffold project layout, DB schema and settings

2026-07-21 10:25:23 +02:00

conftest.py

Safe restore from a backup: START_PAUSED and the derivation-gap check (B-90, REG-15, OPS-27)

2026-10-18 00:43:45 +02:00

fake_network.py

Credit deposits at deposit_confirmations and verify the round's coins with the quorum before paying (B-82, DEP-03, DEP-04, DEP-09, DEP-12, DEP-14, ELC-17, ELC-27, RND-21, RND-22, RND-25, RND-39, DAT-10, DAT-11, DAT-24, DAT-62, DAT-67, DAT-68, AUD-12, AUD-44, AUD-45, API-30, API-31, API-36, ADR-06, ADR-52)

2026-10-16 14:25:41 +02:00

test_admin.py

Snapshot the bet cost, fee address and pool cap onto the round at open, and cap the pool (B-95, RND-05, RND-06, RND-23, BET-20, BET-21, DAT-26, DAT-27, DAT-61, DAT-62, API-21, API-30, API-31, ADR-10, LIM-16)

2026-10-16 15:12:00 +02:00

test_api_timeutil.py

Stamp UTC on naive API timestamps before serializing (B-35)

2026-07-27 12:20:22 +02:00

test_auth.py

Bound registrations with a per-IP quota instead of failure backoff (B-58)

2026-08-03 22:32:20 +02:00

test_balance.py

Refuse to open a round that could not pay its winner (B-66)

2026-08-04 14:13:00 +02:00

test_bets.py

Make the draw a commit-reveal at a fixed, confirmed, quorum-agreed height with a public proof (B-73, RND-14 … RND-20, RND-33 … RND-37, DAT-61 … DAT-66, API-25, API-45, AUD-24 … AUD-27, AUD-37, ELC-15, SEC-56, ADR-24, ADR-25)

2026-10-14 16:29:09 +02:00

test_broadcast_outcome.py

Never roll back an ambiguous broadcast as if it had been refused (B-76, TX-04, TX-05, TX-20, TX-21, BET-16, BET-17, BET-23, WDR-11, WDR-12, WDR-16, API-13)

2026-10-14 14:22:20 +02:00

test_broadcast.py

Give every payout a bump reserve output and refuse configs that cannot pay a round (B-79, RND-21, RND-23, RND-24, RND-27, RND-38, RND-40, DAT-73, API-31, API-36, TX-11, ADR-17, ADR-29)

2026-10-16 13:55:51 +02:00

test_bug_reports.py

Audit-log bug report status changes (B-60)

2026-08-03 22:59:00 +02:00

test_caddyfile_security_headers.py

Make X-Forwarded-For trustworthy instead of attacker-controlled (B-54)

2026-08-03 22:14:03 +02:00

test_client_ip.py

Make X-Forwarded-For trustworthy instead of attacker-controlled (B-54)

2026-08-03 22:14:03 +02:00

test_code_comments.py

Retire in-code comments that outlived what they described (B-69)

2026-08-04 16:00:57 +02:00

test_config.py

Refuse to start half-configured, and keep failures machine-readable

2026-07-27 00:34:33 +02:00

test_confirmation_proof.py

Credit deposits at deposit_confirmations and verify the round's coins with the quorum before paying (B-82, DEP-03, DEP-04, DEP-09, DEP-12, DEP-14, ELC-17, ELC-27, RND-21, RND-22, RND-25, RND-39, DAT-10, DAT-11, DAT-24, DAT-62, DAT-67, DAT-68, AUD-12, AUD-44, AUD-45, API-30, API-31, API-36, ADR-06, ADR-52)

2026-10-16 14:25:41 +02:00

test_confirmation.py

Confirm transactions by merkle proof and reinstate coins only on a quorum (B-83, TX-06, TX-22, TX-23, ELC-25, ELC-26, DEP-02, DEP-08, AUD-18, ADR-07)

2026-10-14 15:29:30 +02:00

test_container_hardening.py

Harden the container: non-root, pinned images and dependencies, the key in a file (B-91, SEC-51, SEC-52, SEC-53; closes B-71, B-72)

2026-10-18 00:54:23 +02:00

test_db_base.py

Real SQLite transactions: BEGIN IMMEDIATE and synchronous=FULL (B-88, DAT-74, DAT-52, ARC-07, TX-28, BET-11, DAT-16)

2026-09-29 16:26:01 +02:00

test_deposit_confirmations.py

Credit deposits at deposit_confirmations and verify the round's coins with the quorum before paying (B-82, DEP-03, DEP-04, DEP-09, DEP-12, DEP-14, ELC-17, ELC-27, RND-21, RND-22, RND-25, RND-39, DAT-10, DAT-11, DAT-24, DAT-62, DAT-67, DAT-68, AUD-12, AUD-44, AUD-45, API-30, API-31, API-36, ADR-06, ADR-52)

2026-10-16 14:25:41 +02:00

test_deposit_reconcile.py

Add a periodic deposit reconciler, and stop losing subscribe tasks (B-30)

2026-07-27 10:35:23 +02:00

test_deposits.py

Survive oversized Electrum replies and ignore dust deposits (B-75, ELC-20, DEP-01, DAT-10)

2026-10-14 12:14:12 +02:00

test_docs_current.py

Describe the code the docs actually ship with (B-68)

2026-08-04 14:33:32 +02:00

test_docs_disabled.py

Disable Swagger/ReDoc/OpenAPI JSON by default (B-42)

2026-07-27 15:34:49 +02:00

test_docs_no_bare_uvicorn.py

Align README and running-the-server.md with the Docker-only policy (B-44)

2026-07-27 16:04:24 +02:00

test_draw_proof.py

Resume a round in drawing from the database after an exception or a restart (B-81, RND-01, RND-15, RND-36, ARC-27, OPS-09, OPS-13, LIM-01)

2026-10-16 13:34:43 +02:00

test_draw.py

Make the draw a commit-reveal at a fixed, confirmed, quorum-agreed height with a public proof (B-73, RND-14 … RND-20, RND-33 … RND-37, DAT-61 … DAT-66, API-25, API-45, AUD-24 … AUD-27, AUD-37, ELC-15, SEC-56, ADR-24, ADR-25)

2026-10-14 16:29:09 +02:00

test_electrum_client.py

Refuse an Electrum server that is not on the PLM chain (B-99, ELC-30)

2026-10-18 00:32:24 +02:00

test_electrum_listener.py

Credit deposits at deposit_confirmations and verify the round's coins with the quorum before paying (B-82, DEP-03, DEP-04, DEP-09, DEP-12, DEP-14, ELC-17, ELC-27, RND-21, RND-22, RND-25, RND-39, DAT-10, DAT-11, DAT-24, DAT-62, DAT-67, DAT-68, AUD-12, AUD-44, AUD-45, API-30, API-31, API-36, ADR-06, ADR-52)

2026-10-16 14:25:41 +02:00

test_hd.py

Add wallet key derivation and PSBT building

2026-07-21 10:25:29 +02:00

test_master_key_check.py

Verify the master key against the database at startup (B-89, SEC-49, SEC-50, SEC-09)

2026-10-18 00:38:26 +02:00

test_migrations.py

Credit deposits at deposit_confirmations and verify the round's coins with the quorum before paying (B-82, DEP-03, DEP-04, DEP-09, DEP-12, DEP-14, ELC-17, ELC-27, RND-21, RND-22, RND-25, RND-39, DAT-10, DAT-11, DAT-24, DAT-62, DAT-67, DAT-68, AUD-12, AUD-44, AUD-45, API-30, API-31, API-36, ADR-06, ADR-52)

2026-10-16 14:25:41 +02:00

test_models_text_columns.py

Widen raw_tx_hex and payload_json from String to Text (B-47)

2026-07-27 16:24:05 +02:00

test_pause_reason.py

Abandon a transaction only on proof, and keep watching failed rows (B-78, TX-15, TX-17, TX-23, TX-26, ELC-28, DAT-33, DAT-36, DAT-69, DAT-72, AUD-11, AUD-12, AUD-31, AUD-39, API-32)

2026-10-14 15:07:09 +02:00

test_payout_builder.py

Give every payout a bump reserve output and refuse configs that cannot pay a round (B-79, RND-21, RND-23, RND-24, RND-27, RND-38, RND-40, DAT-73, API-31, API-36, TX-11, ADR-17, ADR-29)

2026-10-16 13:55:51 +02:00

test_pending_address.py

Give every round its own pool address (B-80, RND-35, DAT-60, DAT-11, REG-14, SEC-08, BET-12, RND-22, WDR-14, SEC-43, API-23, API-36)

2026-10-14 13:52:32 +02:00

test_pool_verification.py

Credit deposits at deposit_confirmations and verify the round's coins with the quorum before paying (B-82, DEP-03, DEP-04, DEP-09, DEP-12, DEP-14, ELC-17, ELC-27, RND-21, RND-22, RND-25, RND-39, DAT-10, DAT-11, DAT-24, DAT-62, DAT-67, DAT-68, AUD-12, AUD-44, AUD-45, API-30, API-31, API-36, ADR-06, ADR-52)

2026-10-16 14:25:41 +02:00

test_psbt_builder.py

Select coins until the change output is guaranteed (B-98, BET-24)

2026-10-18 00:35:17 +02:00

test_qr.py

Validate and bound the QR endpoint (B-67)

2026-08-04 14:18:22 +02:00

test_rate_limit.py

Bound registrations with a per-IP quota instead of failure backoff (B-58)

2026-08-03 22:32:20 +02:00

test_rbf_dust.py

Drop a dust-sized change into the fee on an RBF bump and audit every refused bump (B-87, TX-11, TX-24, AUD-40, AUD-09, ADR-19)

2026-10-16 14:53:10 +02:00

test_reconcile_proof.py

Confirm transactions by merkle proof and reinstate coins only on a quorum (B-83, TX-06, TX-22, TX-23, ELC-25, ELC-26, DEP-02, DEP-08, AUD-18, ADR-07)

2026-10-14 15:29:30 +02:00

test_reconcile.py

Abandon a transaction only on proof, and keep watching failed rows (B-78, TX-15, TX-17, TX-23, TX-26, ELC-28, DAT-33, DAT-36, DAT-69, DAT-72, AUD-11, AUD-12, AUD-31, AUD-39, API-32)

2026-10-14 15:07:09 +02:00

test_restore_gap.py

Safe restore from a backup: START_PAUSED and the derivation-gap check (B-90, REG-15, OPS-27)

2026-10-18 00:43:45 +02:00

test_round_events.py

Cap SSE subscribers per client IP instead of only globally (B-38)

2026-07-27 14:44:15 +02:00

test_round_pool_address.py

Credit deposits at deposit_confirmations and verify the round's coins with the quorum before paying (B-82, DEP-03, DEP-04, DEP-09, DEP-12, DEP-14, ELC-17, ELC-27, RND-21, RND-22, RND-25, RND-39, DAT-10, DAT-11, DAT-24, DAT-62, DAT-67, DAT-68, AUD-12, AUD-44, AUD-45, API-30, API-31, API-36, ADR-06, ADR-52)

2026-10-16 14:25:41 +02:00

test_round_snapshot.py

Snapshot the bet cost, fee address and pool cap onto the round at open, and cap the pool (B-95, RND-05, RND-06, RND-23, BET-20, BET-21, DAT-26, DAT-27, DAT-61, DAT-62, API-21, API-30, API-31, ADR-10, LIM-16)

2026-10-16 15:12:00 +02:00

test_rounds_route.py

Snapshot the bet cost, fee address and pool cap onto the round at open, and cap the pool (B-95, RND-05, RND-06, RND-23, BET-20, BET-21, DAT-26, DAT-27, DAT-61, DAT-62, API-21, API-30, API-31, ADR-10, LIM-16)

2026-10-16 15:12:00 +02:00

test_rounds_service.py

Give every payout a bump reserve output and refuse configs that cannot pay a round (B-79, RND-21, RND-23, RND-24, RND-27, RND-38, RND-40, DAT-73, API-31, API-36, TX-11, ADR-17, ADR-29)

2026-10-16 13:55:51 +02:00

test_scheduler.py

Snapshot the bet cost, fee address and pool cap onto the round at open, and cap the pool (B-95, RND-05, RND-06, RND-23, BET-20, BET-21, DAT-26, DAT-27, DAT-61, DAT-62, API-21, API-30, API-31, ADR-10, LIM-16)

2026-10-16 15:12:00 +02:00

test_scripthash.py

Add Electrum SPV client and address listener

2026-07-21 10:25:38 +02:00

test_security.py

Hash and verify passwords off the event loop (B-55)

2026-08-03 22:18:33 +02:00

test_sqlite_transactions.py

Credit deposits at deposit_confirmations and verify the round's coins with the quorum before paying (B-82, DEP-03, DEP-04, DEP-09, DEP-12, DEP-14, ELC-17, ELC-27, RND-21, RND-22, RND-25, RND-39, DAT-10, DAT-11, DAT-24, DAT-62, DAT-67, DAT-68, AUD-12, AUD-44, AUD-45, API-30, API-31, API-36, ADR-06, ADR-52)

2026-10-16 14:25:41 +02:00

test_tx_versions.py

Confirm transactions by merkle proof and reinstate coins only on a quorum (B-83, TX-06, TX-22, TX-23, ELC-25, ELC-26, DEP-02, DEP-08, AUD-18, ADR-07)

2026-10-14 15:29:30 +02:00

test_users.py

Credit deposits at deposit_confirmations and verify the round's coins with the quorum before paying (B-82, DEP-03, DEP-04, DEP-09, DEP-12, DEP-14, ELC-17, ELC-27, RND-21, RND-22, RND-25, RND-39, DAT-10, DAT-11, DAT-24, DAT-62, DAT-67, DAT-68, AUD-12, AUD-44, AUD-45, API-30, API-31, API-36, ADR-06, ADR-52)

2026-10-16 14:25:41 +02:00

test_withdrawals.py

Never roll back an ambiguous broadcast as if it had been refused (B-76, TX-04, TX-05, TX-20, TX-21, BET-16, BET-17, BET-23, WDR-11, WDR-12, WDR-16, API-13)

2026-10-14 14:22:20 +02:00