[antuz123]

A contributor can prepare an isolated TESTNET Relay and SigningServer stack from public repositories, without private configuration or release credentials. Mobile native setup and local integration limits are documented.

• Pin public backend commits and checksum every adapter file; reject unexpected files and symlinks before preparation.
• Preserve existing developer checkouts and environment files, handle custom port permutations in one pass, and reserve port 8081 for Metro.
• Use digest-pinned local backend image adapters and an internal network with loopback-only gateway ports.
• Initialize a single-member MongoDB replica set idempotently for transactional backup snapshot/repair. Verify round trips, stale-revision preservation, A → B → A revisions and persistence using disposable synthetic records.
• Require the pinned SigningServer invalid-token response before claiming invalid 2FA passed.
• Request Ben, Utkarsh and Parsh through CODEOWNERS for all changes when a PR is ready. Retain one developer approval and separate product signoff; maintainers assess actual Copilot findings.

Current update at 58208450c88c0aabd4a44df52630c35843c16484 (Electrum test and Relay pin commit ce2972b85ba8cd405b60ada06de00d6bd800bbef, followed by a contributor-install documentation correction): the source lock pins public Relay ee935359f22ff7932ea0a62e9084d4b49801f4aa and SigningServer 3cc7728c27328e7b0358d1f91a32d8d13feba90a. Relay's legacy walletObject/signersObjects alias fix passed exact-head Build and test and Source readiness. In the existing public app checkout, dev prepare fetched and adapted the new Relay pin and was idempotent; 11/11 Python bootstrap fixtures passed. On Node 22 with a pre-existing dependency tree matching the app's yarn.lock, focused Electrum client/wallet/vault Jest passed 53/53 and the full app Jest suite passed 183/183 across 17 suites. The local full-suite command excluded generated ignored backend .sources tests, which are absent in a clean app CI checkout. The fixed test-only Electrum fixture exercises wallet scanning, transaction parsing, coin selection and PSBT signing without public-node availability or a mutable testnet wallet balance. The mobile TypeScript scan now excludes the copied SigningServer adapter; four adapter-only missing-import diagnostics disappeared (1,394 to 1,390), while the app-wide typecheck still has existing diagnostics. A fresh local dependency install was not completed because host disk space was constrained. The inherited sprint package/lock pair lacks two lint-plugin selectors, so the contributor guide now uses the same non-frozen Yarn install as CI and labels the older frozen-install result as historical; package.json and yarn.lock were not changed. Exact-head CI completed success: Tests passed 17/17 suites and 183/183 tests. The Lint job is green because its command is informational (continue-on-error); the lint command itself exited 1 with 5,468 findings (4,555 errors, 913 warnings), so this is not a lint-clean result. CodeQL completed success. Public backend setup completed success: the SigningServer adapter compiled and passed 121/121 tests; bootstrap passed 11/11 Python tests; local API checks passed TESTNET health, Socket.IO, explicit unsupported routes, app create/read, revisioned backup and stale-repair rejection, and V3 signer valid/invalid 2FA. The persistence and boundary check then confirmed database and signing identity survival after container recreation and rejection of mainnet and hosted-database settings. No same-host Docker or native mobile run has been repeated for this pin; the same-host full-stack result below belongs to an earlier Relay pin. The current-head GitHub backend workflow supplies a separate containerized API and persistence check.

At prior head 9c66b3527fa23b8bf20ea7164b06c771b9ba17a6, CodeQL and Public backend setup succeeded, while CI Tests failed 30/183 across Electrum client/wallet/vault suites after connect ECONNREFUSED 136.49.112.63:57010. The same endpoint refusal occurred in sibling Tests job 1 and sibling Tests job 2 within minutes. That is evidence of a shared external-node failure at the time, not proof that a backend pin caused it.

Earlier validation at 2ec20264f5486c7ce4ba657bf8250ce60f458817: 11/11 bootstrap fixtures pass locally. The exact-head CI, CodeQL and Public backend setup workflows all completed successfully. Their jobs include Tests, Lint, Analyze JavaScript/TypeScript, Public SigningServer adapter, and Local backend and bootstrap. The lint job is configured as informational, so workflow success does not mean zero lint findings.

A separate fresh public app clone at b39b0a173b9021a31479e8c29fe858d4130beb7b used an empty HOME, disabled system/global Git configuration and interactive credential prompts, and copied no backend checkout or environment file. It fetched the locked public Relay and SigningServer revisions and passed 11 bootstrap fixtures. The clone then fast-forwarded anonymously to 2ec20264f5486c7ce4ba657bf8250ce60f458817; all 11 fixtures passed again, dev prepare preserved both prepared public sources, dev env generated a local-only file with mode 0600, and Compose configuration validation passed. A disposable local branch added a focused bootstrap regression and passed 12/12 tests; that local commit and branch were discarded without opening a throwaway public PR. The contribution guide, PR template, CODEOWNERS, and backend pull-request workflow were checked, but an external fork submission remains untested.

On the same Mac at 2ec20264f5486c7ce4ba657bf8250ce60f458817, an isolated keeper-r4-anon Compose project used loopback ports 33000/34002/33003 and only synthetic records. dev up built the pinned public sources and passed health, Socket.IO, explicit unsupported integration failure, app record create/read, revisioned backup snapshot/repair with stale and A → B → A rejection, and V3 testnet signer authorization with valid/invalid 2FA. verify-local.sh --persistence --boundaries passed after container recreation: the app record, backup revision and signing identity persisted, while mainnet and hosted-database startup were rejected. The gateway published only loopback ports; Mongo was not published and the backend network was internal. Only this project's containers, volumes, networks and uniquely tagged built images were removed after the check.

These results do not include a native mobile build or onboarding on this head, a real wallet signing or recovery flow, hosted provider delivery, a second developer's machine, or production deployment. The current shell lacks the documented iOS Ruby/Bundler setup; no iOS pass is claimed. The latest submitted Copilot review predates this source-pin commit and reports no findings; all seven inline conversations are resolved. No independent developer approval is present.

Source dependencies: public SigningServer #1 at 3cc7728c27328e7b0358d1f91a32d8d13feba90a and public Relay #3 at ee935359f22ff7932ea0a62e9084d4b49801f4aa are the exact app pins. Both upstream PRs remain open; reviewed merges, independent contributor/mobile acceptance, and one developer approval remain gates to final delivery. SigningServer #2 logging review and hosted configuration are separate security handoff work. This PR targets sprint and changes no hosted service.

Product signoff: the owner authorized the public contributor setup and the three-developer reviewer policy in this task. A PR author's product signoff does not satisfy the independent developer review gate.

[Copilot]

Copilot review overview

🟡 Changes recommended

Port substitution can generate incorrect configuration, adapter integrity checks are bypassable, and the Relay base image remains mutable.

Review effort: Balanced
Findings: 1 · 2

Open (3)

• Unlisted adapter files bypass integrity validation · New
• Relay Dockerfile uses a mutable unpinned base image · New
• Sequential placeholder replacement corrupts port mappings · New

What changed in this PR

Packages a reproducible public Relay/SigningServer contributor environment on sprint.

Changes:

• Adds pinned Docker backend setup and verification tooling.
• Documents contributor, security, native-build, and handoff workflows.
• Adds dedicated public-backend CI and a platform-neutral prepare hook.

File	Description
setup.sh	Makes prepare platform-neutral.
Readme.md	Links contributor and backend guides.
CONTRIBUTING.md	Defines contribution and testing workflow.
.github/​pull_request_template.md	Adds structured PR reporting.
.github/​workflows/​public-backend.yml	Runs backend CI checks.
dev/​local-backend/​.env.example	Defines Compose defaults.
dev/​local-backend/​.gitignore	Ignores generated local state.
dev/​local-backend/​ACCESS.md	Documents optional private access.
dev/​local-backend/​CI.md	Explains CI scope and limitations.
dev/​local-backend/​HANDOFF.md	Provides independent setup checklist.
dev/​local-backend/​README.md	Documents complete local setup.
dev/​local-backend/​VERIFICATION.md	Records verification evidence.
dev/​local-backend/​app.env.local.example	Supplies local app configuration.
dev/​local-backend/​compose.yaml	Defines the disposable backend stack.
dev/​local-backend/​dev	Wraps the setup CLI.
dev/​local-backend/​keeper.py	Implements setup and lifecycle commands.
dev/​local-backend/​nginx.conf	Proxies loopback backend ports.
dev/​local-backend/​sources.lock.json	Pins backend sources and adapters.
dev/​local-backend/​test_keeper.py	Tests bootstrap safety behavior.
dev/​local-backend/​verify-local.sh	Wraps integration verification.
dev/​local-backend/​verify.py	Exercises backend APIs and boundaries.
dev/​local-backend/​adapters/​signing/​local.patch	Adds SigningServer local-mode behavior.
dev/​local-backend/​adapters/​signing/​files/​.dockerignore	Excludes sensitive/build files.
dev/​local-backend/​adapters/​signing/​files/​Dockerfile.local	Builds local SigningServer image.
dev/​local-backend/​adapters/​signing/​files/​scripts/​local-entry.cjs	Generates disposable signing secrets.
dev/​local-backend/​adapters/​signing/​files/​src/​config.ts	Enforces local testnet configuration.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Port validation, verification accuracy, documentation, and reviewer scoping need correction before approval.

Review effort: Balanced
Findings: 1 · 2 · 1

Open (4)

• Reject backend port 8081 to preserve Metro availability · New
• Avoid global CODEOWNERS rule for sprint-only reviewer assignment · New
• Assert the specific invalid-token error, not only HTTP 400 · New
• Align source pins with the revisions cited in verification evidence · New

Resolved since last review (3)

• Unlisted adapter files bypass integrity validation
• Sequential placeholder replacement corrupts port mappings
• Relay Dockerfile uses a mutable unpinned base image

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved findings remain around Metro port collisions, 2FA verification assertions, stale verification claims, and branch-wide CODEOWNERS behavior.

Review effort: Balanced
Findings: 1 · 2 · 1

Open (4)

• Reject backend port 8081 to preserve Metro availability
• Assert the specific invalid-token error, not only HTTP 400
• Avoid global CODEOWNERS rule for sprint-only reviewer assignment
• Align source pins with the revisions cited in verification evidence

[Copilot]

Copilot review overview

🔵 Needs a closer look

The documented validation command references a nonexistent OpenSpec change, setup instructions conflict, and symlink rejection lacks regression coverage.

Review effort: Balanced
Findings: None

Resolved since last review (4)

• Reject backend port 8081 to preserve Metro availability
• Assert the specific invalid-token error, not only HTTP 400
• Avoid global CODEOWNERS rule for sprint-only reviewer assignment
• Align source pins with the revisions cited in verification evidence

Previously missed (3)

In code that hasn't changed since last review

Add regression coverage for adapter symlink rejection

dev/​local-backend/​keeper.py:67

The bootstrap tests exercise checksum mismatches and unlisted regular files, but none covers this explicit symlink rejection branch. Because rejecting adapter symlinks is a stated integrity boundary, add a Linux regression case that creates a listed or unlisted symlink and asserts prepare() fails before any Git command runs.

Getting Started still claims setup.sh installs CocoaPods

Readme.md:66

The newly linked contributor guide correctly makes CocoaPods an explicit iOS step, but the Getting Started text at line 58 still says yarn install automatically installs pods. Since this change removes that behavior from setup.sh, new contributors following the root README can skip a required native setup step. Update the existing sentence to match the explicit platform instructions.

Reproduction command references a missing OpenSpec change

dev/​local-backend/​VERIFICATION.md:279

This reproduction command names package-contributor-development, but no such change exists under openspec/changes or the archive, so it fails with a missing change instead of reproducing the claimed strict validation. Add the referenced OpenSpec artifacts, or remove/update this command and the corresponding PASS claim.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The security-sensitive signing and backup stack depends on two unmerged upstream pull requests and requires independent developer review.

Review effort: Balanced
Findings: None