Skip to content

docs(cashu): state the real goal — a user-selectable backend, not a test harness - #232

Merged
grunch merged 1 commit into
mainfrom
docs/cashu-purpose-production-feature
Jul 24, 2026
Merged

docs(cashu): state the real goal — a user-selectable backend, not a test harness#232
grunch merged 1 commit into
mainfrom
docs/cashu-purpose-production-feature

Conversation

@grunch

@grunch grunch commented Jul 24, 2026

Copy link
Copy Markdown
Member

Doc-only. No code, no behaviour change.

Why

The spec said the purpose was to "test the daemon implementation end-to-end". That is a milestone, not the goal.

The goal is Cashu shipped to real users, in mostrod and in this client, so a user can choose whether to trade on a node that settles over Cashu or one that settles over Lightning. Both backends are first-class and permanent — Cashu is not an experiment, Lightning is not being replaced.

Worth correcting rather than leaving implicit, because the two framings disagree precisely where being wrong is expensive to undo.

What changes as a consequence

New §1.1 lays this out. The load-bearing differences:

Under "test the daemon" Under "users choose their node"
The wallet only has to survive a test run It holds user funds. Ecash is bearer — a lost wallet DB is lost money, so backup/restore is a release requirement
The dev override is the way in Users never see it. Detection must work off the node's own advertisement, promoting the upstream 38385 tags to a release blocker
The mint is a detail the tester already understands It is a new trust assumption users did not have in Lightning mode. If the choice is theirs, it must be informed — mint shown next to node, before funds move
Web can say "not available" indefinitely Web is first-class here; that would make a user's node choice depend on their platform

Concrete edits:

  • §1.1 added — goal, and the decision table above.
  • Non-goals sharpened — "no general-purpose wallet" bounds the wallet's feature set, not its quality bar; within scope it handles real money. Lightning stays fully supported: a choice offered, never a migration imposed.
  • Wave 4 renamed "optional hardening" → "required before general availability", and C10 split into release-blocking (backup/restore, NUT-07 reconciliation, in-flight-escrow restore, locktime countdowns + reachable refund path) versus genuine polish (error taxonomy, golden tests).
  • Risk docs: add Mostro Protocol reference as critical foundation #3 (38385 tags) — from "C1 ships the dev override" to: the override is a developer affordance, so the upstream tag PR is a release blocker. Land it early; it is a few tags off Settings::get_cashu().
  • Risk feat: add anonymous chat identity (nym) system to spec #9 (mint trust) — expanded into the product consequence, not just "surface the URL".
  • Testing strategy — new release acceptance row for the paths only a real user reaches: node advertises Cashu with no override, funds recovered after reinstall-from-backup, escrow reclaimed after locktime with the daemon offline, every reachable failure localized with a way out.
  • Status header updated (C0 merged, C1a in review).
  • C9 — records early evidence that cdk does target wasm (check-wasm recipe in its justfile, cargo check -p cdk --target wasm32-unknown-unknown in its AGENTS.md), so the open question is the storage backend (cdk-sqlite is native-only → can WalletDatabase be implemented over IndexedDB?) rather than the crate.

Phase order and the dependency graph are untouched. What changed is which phases are optional.

Note

This branches from main after #229, so it preserves C0's doc changes (the verified wire form in §2 and the resolved risk #1). An earlier draft of this change was accidentally based on a pre-C0 tree and would have reverted them — caught before pushing.

…est harness

The spec said the purpose was to "test the daemon implementation end-to-end".
That is a milestone, not the goal. The goal is Cashu shipped to real users in
both mostrod and this client, so a user can choose whether to trade on a node
that settles over Cashu or one that settles over Lightning. Both backends are
first-class and permanent.

Worth correcting because the two framings disagree exactly where it is
expensive to be wrong. New §1.1 spells out where, but the load-bearing ones:

- The wallet holds user funds. Ecash is bearer, so a lost wallet DB is lost
  money and backup/restore is a release requirement, not polish.
- Users never see the dev override, so detection has to work off the node's
  own advertisement — which promotes the upstream 38385 tags from convenience
  to release blocker (risk #3).
- The mint is a trust assumption users did not have in Lightning mode. If the
  choice is theirs it has to be informed, so the mint belongs next to the node
  wherever one is picked, before funds move, not after (risk #9).
- Web is first-class here, so "Cashu not available on web" would make the
  user's node choice depend on their platform.

Consequently Wave 4 is renamed from "optional hardening" to "required before
general availability", and C10 is split into release-blocking (backup/restore,
NUT-07 reconciliation, in-flight restore, locktime countdowns) versus actual
polish. Phase order and the dependency graph are untouched — what changed is
which phases are optional.

Also adds a release-acceptance row to the testing strategy for the paths only
a real user reaches, and records early evidence that cdk does target wasm, so
C9's open question is the storage backend rather than the crate.
@coderabbitai

coderabbitai Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

@grunch, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 20 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8df878c1-38de-44ee-90b7-453c98523774

📥 Commits

Reviewing files that changed from the base of the PR and between 4fc9453 and 2241bc3.

📒 Files selected for processing (1)
  • docs/cashu/README.md
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch docs/cashu-purpose-production-feature

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@grunch
grunch merged commit 1e7cc0f into main Jul 24, 2026
4 checks passed
@grunch
grunch deleted the docs/cashu-purpose-production-feature branch July 24, 2026 21:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant