Cutover validator endpoints to per-RM pool gate (PR 3)

[rickyrombo]

Summary

Wires up the rotation flow on top of #222 (PR 1 — schema) and #225 (PR 2 — pool primitive + cometbft txs). Once this lands, an OAP authority change for a launchpad coin's pool can be followed by validator-signed Solana CreateSenderPublic / DeleteSenderPublic instructions, bringing the on-chain reward manager into agreement with the OAP-side authority list.

This is PR 3 of 3 in the reward-authority rotation initiative.

Dispatch: senderGateForRM

Single helper resolves which gating regime applies to a given Solana reward manager pubkey:

senderGateForRM(rm) →
  if exists pool with rewards_manager_pubkey == rm:
    return (pool, true, nil)        // per-RM pool gate
  else:
    return (nil, false, nil)        // fall through to validator/AAO trust set

Transient DB errors are propagated rather than silently downgrading — a temporary blip must not weaken the gate from per-RM to network-wide.

Cutover

GetRewardSenderAttestation

• Pool-managed RM: sign iff addr ∈ pool.authorities.
• Non-pool RM (AUDIO): existing validator/AAO check.

GetDeleteRewardSenderAttestation

• Pool-managed RM: sign iff addr ∉ pool.authorities. This is the rotation-out signal — once OAP removes a key from its pool, validators can sign a Solana DeleteSenderPublic attestation, deregistering the rotated-out key from on-chain attestation duties.
• Non-pool RM (AUDIO): existing "must NOT be a validator/AAO" check.

GetRewardAttestation restored

Removes the kill-switch from #215. The handler is the original implementation, but the authority check is now pool-gated for free: dbReward.ClaimAuthorities is sourced from core_reward_pools.authorities via PR 1's LEFT JOIN. Rotating an authority out via SetRewardPoolAuthorities immediately revokes their ability to authenticate claim attestations — no separate code path needed.

PR 1 backfilled all existing rewards to RM-bound pools using the launchpad mapping in launchpad_authority_rm, so the leaked-key attestation vector closes the moment an authority is rotated via SetRewardPoolAuthorities.

AUDIO RM denylist

config.AudioRewardsManagerPubkey() returns the AUDIO RM pubkey for the current runtime environment:

• Dev: DJPzVothq58SmkpRb1ATn5ddN2Rpv1j2TcGvM3XsHf1c
• Stage: intentionally unset
• Prod: 71hWFVYokLaN1PNYzTAWi13EfJ7Xt9VbSWUKsXUT8mxE

validateRewardsManagerPubkey refuses CreateRewardPool that targets the configured AUDIO RM. Without this, an attacker could create a pool for the AUDIO RM with their own keys as initial authorities; senderGateForRM would resolve AUDIO sender requests to the attacker-controlled pool, validators would sign, and the attacker could become an AUDIO sender on Solana. The denylist closes that vector by structurally preventing the AUDIO RM from ever having a pool.

SDK helpers

Adds Rewards.GetRewardSenderAttestation and Rewards.GetDeleteRewardSenderAttestation so rotation tooling (or the API repo) can drive Solana sender registration / deregistration without constructing connect requests by hand.

Test plan

• go build ./... clean.
• go vet ./pkg/core/... — no new warnings.
• Unit tests for validateRewardsManagerPubkey (pkg/core/server/reward_pools_test.go):
  • shape rejections (empty, whitespace, non-base58, wrong length)
  • AUDIO denylist (configured AUDIO RM rejected; other RMs pass)
• Integration tests (pkg/integration_tests/13_reward_pools_test.go) — full rotation flow against validator endpoints:
  • CreateSender attestation signed for current pool authority
  • CreateSender attestation refused for rotated-out address
  • DeleteSender attestation signed for rotated-out address
  • DeleteSender attestation refused for current pool authority
• 12_rewards_test.go skip markers removed now that GetRewardAttestation is restored.
• Devnet smoke: full rotation cycle end-to-end.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR completes the reward-authority rotation initiative by cutting validator attestation endpoints over to per–reward-manager (RM) reward-pool gating (with a safe fallback to the legacy validator/AAO trust set for unmanaged RMs like AUDIO), restoring programmatic reward attestations, and adding SDK + test coverage for the new rotation flow.

Changes:

• Add per-RM sender attestation dispatch (senderGateForRM) so Create/Delete sender attestations gate on core_reward_pools.authorities when a pool exists, else fall back to validator/AAO eligibility.
• Restore GetRewardAttestation now that claim authorities are pool-backed (post-PR1 LEFT JOIN).
• Add AUDIO RM denylist for CreateRewardPool, plus SDK helpers and integration/unit tests for rotation flows.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
pkg/core/server/connect.go	Restores GetRewardAttestation and adds per-RM pool gating for sender attestations via senderGateForRM.
pkg/core/server/reward_pools.go	Adds AUDIO RM denylist enforcement in validateRewardsManagerPubkey.
pkg/core/config/rewards.go	Introduces env-specific AUDIO RM pubkey configuration used by the denylist.
pkg/sdk/rewards/rewards.go	Adds SDK wrappers for GetRewardSenderAttestation / GetDeleteRewardSenderAttestation.
pkg/core/server/reward_pools_test.go	Adds unit tests for RM pubkey validation and AUDIO denylist behavior.
pkg/integration_tests/13_reward_pools_test.go	Adds end-to-end integration coverage for Create/Delete sender attestation rotation behavior.
pkg/integration_tests/12_rewards_test.go	Removes skip markers now that GetRewardAttestation is restored.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

pkg/sdk/rewards/rewards.go:197

• SDK signing for GetRewardAttestation does not include req.RewardAddress in the pkgrewards.RewardClaim it signs. If the server starts binding programmatic-reward claims to RewardAddress (recommended to prevent cross-reward replay), this client will produce unverifiable signatures; also, leaving RewardAddress out keeps the replay surface open when reward_id/specifier collide across rewards.

func (r *Rewards) GetRewardAttestation(ctx context.Context, req *v1.GetRewardAttestationRequest) (*v1.GetRewardAttestationResponse, error) {
	// Create a RewardClaim to compile the data in the correct format
	claim := pkgrewards.RewardClaim{
		RecipientEthAddress: req.EthRecipientAddress,
		Amount:              req.Amount,
		RewardID:            req.RewardId,
		Specifier:           req.Specifier,
		ClaimAuthority:      req.ClaimAuthority, // Use claim authority as oracle
		Decimals:            req.AmountDecimals,
	}

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 6 comments.

Comments suppressed due to low confidence (1)

pkg/core/server/connect.go:1866

• The error returned from rewards.GetCreateSenderAttestation is discarded and the RPC responds with a generic "could not create attestation". Keeping the underlying error (or at least its message) would make malformed addresses / invalid base58 pubkeys much easier to diagnose for clients and in logs.

	owner, attestation, err := rewards.GetCreateSenderAttestation(c.core.config.EthereumKey, &rewards.CreateSenderAttestationParams{
		NewSenderAddress:            address,
		RewardsManagerAccountPubKey: rewardsManagerPubkey,
	})