ci: enable Rust tests in CI, migrate to nextest, fix broken tests

.github/workflows/ci.yml

@@ -8,12 +8,18 @@ on:
 
 jobs:
   check:
-    runs-on: ubuntu-large
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 
       - uses: DeterminateSystems/nix-installer-action@main
 
+      - name: Rust cache
+        uses: swatinem/rust-cache@v2
+        with:
+          cmd-format: "nix develop .#default --command {0}"
+          workspaces: ./src-tauri -> target
+
       - name: Install dependencies
         run: nix develop --command just install
 
@@ -29,8 +35,8 @@ jobs:
       - name: Rust clippy
         run: nix develop --command just cargo-clippy
 
-      # - name: Rust tests
-      #   run: nix develop --command just cargo-test
+      - name: Rust tests
+        run: nix develop --command just cargo-test
 
   build:
     if: github.event_name == 'push' && github.ref == 'refs/heads/master'
@@ -39,13 +45,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - platform: macos-26
+          - platform: blacksmith-6vcpu-macos-latest
             args: --target aarch64-apple-darwin
             arch: aarch64
-          - platform: macos-26
-            args: --target x86_64-apple-darwin
-            arch: x86_64
-          - platform: ubuntu-22.04
+          - platform: blacksmith-8vcpu-ubuntu-2404
             args: ""
             arch: x86_64-linux
 
@@ -54,7 +57,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install Linux dependencies
-        if: matrix.platform == 'ubuntu-22.04'
+        if: contains(matrix.platform, 'ubuntu')
         run: |
           sudo apt-get update
           sudo apt-get install -y \
@@ -76,8 +79,6 @@ jobs:
 
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ startsWith(matrix.platform, 'macos') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
       - name: Rust cache
         uses: swatinem/rust-cache@v2
@@ -101,14 +102,14 @@ jobs:
           args: ${{ matrix.args }}
 
       - name: Upload DMG artifact
-        if: startsWith(matrix.platform, 'macos')
+        if: contains(matrix.platform, 'macos')
         uses: actions/upload-artifact@v4
         with:
           name: dmg-${{ matrix.arch }}
           path: src-tauri/target/${{ matrix.arch }}-apple-darwin/release/bundle/dmg/*.dmg
 
       - name: Upload Linux artifacts
-        if: matrix.platform == 'ubuntu-22.04'
+        if: contains(matrix.platform, 'ubuntu')
         uses: actions/upload-artifact@v4
         with:
           name: linux-${{ matrix.arch }}
@@ -120,7 +121,7 @@ jobs:
   release:
     if: github.event_name == 'push'
     needs: [build]
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     permissions:
       contents: write
     steps:

docs/architecture/deadcat-core-normative-map.md

@@ -0,0 +1,151 @@
+# deadcat-core Normative Map
+
+Status: Normative guide to the `deadcat-core` design documents.
+
+This document is a map of the `deadcat-core` design docs. The design docs are
+the map of the implementation.
+
+This document does not specify `deadcat-core` directly. It specifies which
+design documents are authoritative for each part of `deadcat-core`, and how to
+resolve scope, status, and priority between them. If this document conflicts
+with a referenced spec, fix the underlying specs rather than treating this file
+as a parallel implementation spec.
+
+## Source Priority
+
+When documents disagree, use this order:
+
+1. [`deadcat-core-design.md`](deadcat-core-design.md)
+   is authoritative for public Rust API shape, engine behavior, store traits,
+   contract state enums, transition interpretation, PSET builder placement,
+   ingestion, chain sync, error semantics, implementation scope, and design
+   decisions for `deadcat-core`.
+
+2. [`market-contract-principles.md`](../contracts/market-contract-principles.md)
+   is authoritative for covenant-level security principles shared by market
+   contracts: solvency, RT burn requirements, sibling UTXO checks, oracle power,
+   deterministic RT blinding, permissionlessness, and terminal-path
+   completeness.
+
+3. [`contract-specification.md`](../contracts/contract-specification.md)
+   is authoritative for per-contract covenant behavior where it agrees with
+   `deadcat-core-design.md` and `market-contract-principles.md`.
+
+4. Focused protocol specs are authoritative for their named surfaces:
+   - [`chain-only-recovery.md`](../protocol/chain-only-recovery.md)
+   - [`deterministic-rt-blinding.md`](../protocol/deterministic-rt-blinding.md)
+   - [`oracle-bip340-tagged-hash.md`](../protocol/oracle-bip340-tagged-hash.md)
+
+5. Focused architecture specs are authoritative for their named mechanisms,
+   except where explicitly superseded by `deadcat-core-design.md`:
+   - [`transaction-composability-model.md`](transaction-composability-model.md)
+   - [`trade-routing-algorithm.md`](trade-routing-algorithm.md)
+   - [`enforcement-layers.md`](enforcement-layers.md)
+
+6. Contract-specific focused specs are authoritative for their named contract
+   or math surface, subject to the higher-priority docs above:
+   - [`lmsr-pool-design.md`](../contracts/lmsr-pool/lmsr-pool-design.md)
+   - [`lmsr-deterministic-table-spec.md`](../contracts/lmsr-pool/lmsr-deterministic-table-spec.md)
+   - [`lmsr-pool-close-path.md`](../contracts/lmsr-pool/lmsr-pool-close-path.md)
+   - [`multi-outcome-market-contract.md`](../contracts/multi-outcome/multi-outcome-market-contract.md)
+   - [`market-dormant-terminal-paths.md`](../contracts/prediction-market/market-dormant-terminal-paths.md)
+
+7. Historical, decision-record, refactor, and future-design docs explain why
+   choices were made or preserve rejected paths. They are not implementation
+   specs unless a normative doc links to a specific section and says it is
+   authoritative for the current implementation.
+
+## Topic Ownership
+
+| Topic | Authoritative source |
+| --- | --- |
+| Public Rust API | [`deadcat-core-design.md`](deadcat-core-design.md) |
+| Core type shapes | [`deadcat-core-design.md`](deadcat-core-design.md) |
+| Engine methods and view types | [`deadcat-core-design.md`](deadcat-core-design.md) |
+| Store trait and atomicity | [`deadcat-core-design.md`](deadcat-core-design.md) |
+| Ingestion and tracking policy | [`deadcat-core-design.md`](deadcat-core-design.md), then [`chain-only-recovery.md`](../protocol/chain-only-recovery.md) |
+| Chain sync and rollback | [`deadcat-core-design.md`](deadcat-core-design.md) |
+| Output classification | [`deadcat-core-design.md`](deadcat-core-design.md) |
+| Market state machines | [`deadcat-core-design.md`](deadcat-core-design.md), then [`contract-specification.md`](../contracts/contract-specification.md) |
+| Market covenant principles | [`market-contract-principles.md`](../contracts/market-contract-principles.md) |
+| Binary market covenant behavior | [`contract-specification.md`](../contracts/contract-specification.md), subject to [`market-contract-principles.md`](../contracts/market-contract-principles.md) |
+| Multi-outcome market covenant behavior | [`multi-outcome-market-contract.md`](../contracts/multi-outcome/multi-outcome-market-contract.md), subject to [`deadcat-core-design.md`](deadcat-core-design.md) and [`market-contract-principles.md`](../contracts/market-contract-principles.md) |
+| LMSR pool parameters and lifecycle | [`lmsr-pool-design.md`](../contracts/lmsr-pool/lmsr-pool-design.md) |
+| LMSR deterministic table generation | [`lmsr-deterministic-table-spec.md`](../contracts/lmsr-pool/lmsr-deterministic-table-spec.md) |
+| LMSR pool close path | [`lmsr-pool-close-path.md`](../contracts/lmsr-pool/lmsr-pool-close-path.md) |
+| Maker order behavior | [`deadcat-core-design.md`](deadcat-core-design.md), then [`contract-specification.md`](../contracts/contract-specification.md) |
+| Trade routing | [`trade-routing-algorithm.md`](trade-routing-algorithm.md), with public API from [`deadcat-core-design.md`](deadcat-core-design.md) |
+| Multi-covenant transaction layout | [`transaction-composability-model.md`](transaction-composability-model.md) |
+| OP_RETURN recovery | [`chain-only-recovery.md`](../protocol/chain-only-recovery.md) |
+| Oracle attestation message | [`oracle-bip340-tagged-hash.md`](../protocol/oracle-bip340-tagged-hash.md) |
+| RT blinding | [`deterministic-rt-blinding.md`](../protocol/deterministic-rt-blinding.md) |
+| Burn script and enforcement layering | [`market-contract-principles.md`](../contracts/market-contract-principles.md), then [`enforcement-layers.md`](enforcement-layers.md) |
+| Implementation phases | [`deadcat-core-implementation-plan.md`](deadcat-core-implementation-plan.md) |
+
+## V1 Scope
+
+V1 includes:
+
+- Binary markets.
+- Multi-outcome markets for N in `{3, 4}`.
+- Market issuance, cancellation, oracle resolution, expiry, and redemption.
+- Multi-outcome split/merge primitives.
+- LMSR pools.
+- Maker orders.
+- Trade routing across pools and maker orders.
+- Existing-pool market-assisted routes via `build_trade_pset -> PreBlindedPset`.
+- Chain-only recovery using canonical OP_RETURN hints.
+- Strict-canonical tracking policy.
+- Store compliance requirements sufficient for atomic multi-contract state
+  updates.
+
+V1 excludes:
+
+- Cross-outcome arb quote/build API.
+- Cross-outcome arb aggregate transaction classification.
+- LP-tokenized pools.
+- Atomic market creation plus pool bootstrap.
+- Exact-output trade routing.
+- N greater than 4 unless explicitly added.
+- Fixed-point Taylor LMSR runtime optimization.
+
+## Conflict Handling
+
+If an implementation agent finds a contradiction:
+
+1. Do not infer a new protocol rule.
+2. Prefer the highest-priority source listed above.
+3. If the conflict is only in examples or historical rationale, follow the
+   normative source and leave a note for docs cleanup.
+4. Ask for human review if the conflict affects:
+   - fund safety,
+   - RT issuance or destruction,
+   - deterministic blinding,
+   - oracle authorization,
+   - chain-only recovery,
+   - PSET layout,
+   - store atomicity,
+   - public API shape.
+
+## Known Cleanup Items
+
+Resolve these before treating the docs as fully implementation-ready:
+
+- Multi-outcome public params Rust representation for runtime `outcome_count`.
+- Exact LMSR admin/close signature preimages and domain strings.
+- Whether `half_payout_sats` is intentionally independent from the parent
+  market denomination, or should be constrained by it.
+
+## Document Status Labels
+
+Related markdown files should start with one of:
+
+- `Status: Normative`
+- `Status: Normative for <specific topic>`
+- `Status: Decision record, non-normative`
+- `Status: Historical, non-normative`
+- `Status: Future / v2, non-normative for v1`
+
+Implementation agents should not implement from non-normative docs unless a
+normative doc links to a specific section and says it is authoritative for the
+current implementation.

docs/architecture/enforcement-layers.md

@@ -59,7 +59,7 @@ The builder/application layer. Conventions enforced by `deadcat-core` during PSE
 
 **Mechanisms:**
 - OP_RETURN recovery hints (chain-only recovery)
-- Standard denomination conventions (1-2-5 table, 26-value mantissa)
+- Standard denomination conventions (shared 16-value 1-2-5 table for market `base_payout` and pool `max_loss_sats` / `half_payout_sats`)
 - Deterministic key and nonce derivation
 - Output layout conventions for multi-covenant transactions
 - Convention validation in derive functions and PSET builders
@@ -123,11 +123,11 @@ Each row maps a security property to the layer(s) that enforce it and notes any
 
 | Property | Primary enforcement | Cross-layer dependency | What goes wrong without it |
 |---|---|---|---|
-| **Token supply = collateral / collateral_per_pair** | L2: covenant checks collateral on issuance | L2 must also enforce RT burns (see below) and `ensure_no_issuance` on non-issuance paths, because L1 reissuance/issuance mechanisms bypass L2 | Unbacked tokens dilute legitimate holders |
+| **Token supply = collateral / cp** (where `cp = base_payout × N`) | L2: covenant checks collateral on issuance | L2 must also enforce RT burns (see below) and `ensure_no_issuance` on non-issuance paths, because L1 reissuance/issuance mechanisms bypass L2 | Unbacked tokens dilute legitimate holders |
 | **RT destruction on terminal transitions** | L2: `ensure_blinded_reissuance_burn_output` verifies burn script + commitment | Required because L1 reissuance uses RT + ABF (public with deterministic blinding) — if RTs escape to wallet addresses, L1 reissuance bypasses L2 entirely | Attacker mints unbacked tokens via Elements reissuance |
 | **No parasitic issuance** | L2: `ensure_no_issuance` on every covenant input for non-issuance paths | L1 allows issuance fields on any input — without L2 checks, a builder could attach issuance to a resolution/swap/fill spend | Attacker mints tokens alongside a legitimate covenant transition |
 | **Oracle-only resolution** | L2: BIP-340 signature verification against `ORACLE_PUBLIC_KEY` | L1 provides the Schnorr verification primitive (secp256k1 jet) | Anyone can resolve markets, stealing from token holders |
-| **Collateral conservation** | L2: covenant checks `collateral = pairs × collateral_per_pair` | None — purely L2 | Issue tokens without backing |
+| **Collateral conservation** | L2: covenant checks `collateral = pairs × cp` (where `cp = base_payout × N`) | None — purely L2 | Issue tokens without backing |
 | **Correct redemption rates** | L2: covenant enforces half-value (expired) or full-value (resolved) | None — purely L2 | Expired-market holders redeem at full value |
 | **Deterministic RT blinding** | L2: covenant verifies commitments match deterministic ABF + CBF pass-through | L1 Pedersen balance constrains transaction structure (need confidential outputs for confidential inputs). L2 enforcement is the griefing defense — without it, L4 convention alone is insufficient | Malicious issuer locks the market for all participants |
 | **Swap pricing integrity** | L2: Merkle proofs for F(old_s) and F(new_s), conservation equation | None — purely L2 | Extract more tokens than the LMSR curve allows |
@@ -225,9 +225,9 @@ When adding a new security property or modifying an existing one:
 
 ## Key Files
 
-- `src-tauri/crates/deadcat-sdk/contract/prediction_market.simf` — `ensure_blinded_reissuance_burn_output`, `ensure_no_issuance`, `verify_token_commitment`
-- `src-tauri/crates/deadcat-sdk/contract/lmsr_pool.simf` — pool covenant (swap, admin, close paths)
-- `src-tauri/crates/deadcat-sdk/contract/maker_order.simf` — order covenant (fill path only)
+- `crates/deadcat-core/contracts/prediction_market.simf` — `ensure_blinded_reissuance_burn_output`, `ensure_no_issuance`, `verify_token_commitment`
+- `crates/deadcat-core/contracts/lmsr_pool.simf` — pool covenant (swap, admin, close paths)
+- `crates/deadcat-core/contracts/maker_order.simf` — order covenant (fill path only)
 - `docs/protocol/deterministic-rt-blinding.md` — RT blinding scheme and covenant enforcement
 - `docs/contracts/contract-specification.md` — spend paths and covenant constraints
 - `docs/architecture/deadcat-core-design.md` — security model section, covenant-enforced properties table