[aterga]

Summary

External canisters monitored by the station could inherit the station's global obtain-cycles strategy when they had no obtain options of their own. This PR stops that:

• CycleManager::add_external_canister registers an external canister with explicit obtain options that never obtain cycles. canfund therefore never falls back to the global strategy for it, including when the global strategy changes later.
• canister_monitor_start and canister_monitor_restart (monitors restored after an upgrade) both use the new registration.
• canister_monitor_start now accepts only an empty or Disabled obtain strategy. Previously it rejected only MintFromNativeToken.
• The station and upgrader still use the global strategy, so their own top-ups are unchanged.
• The cycle manager now uses the test-safe crate::core::ic_cdk::api::print, so it can run in unit tests.

Behaviour change: external canisters can only be topped up from the station's own cycles balance. While the station itself is low on cycles, external canisters are not topped up. Any stored monitor with an explicit per-canister obtain strategy has that strategy ignored after the upgrade.

Testing

• New unit tests:
  • canister_monitor_start_rejects_cycle_obtain_strategies
  • monitored_external_canisters_never_obtain_cycles: covers fresh and restored monitors, with the global strategy set before registration and changed after it
• New integration test external_canisters_are_funded_only_from_station_balance:
  • Normal top-ups from the station's balance still happen.
  • A top-up the station can't afford doesn't touch the ICP account.
  • Both hold before and after a station upgrade.
• Both unit tests and the integration test fail on the previous commit.
• cargo test -p station: 411 passed. cargo fmt --check and cargo clippy are clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Rr5M1gYD2ZN6MC7Zs2UFxf

[Copilot]

🟡 Changes recommended

Regression coverage is needed to verify funding isolation while preserving station-balance top-ups across restoration and global-strategy changes.

1 open issue

• Add regression tests for external monitor funding isolation · New

What changed in this PR

This PR isolates external-canister funding from the station’s global cycle-obtaining strategy.

Changes:

• Registers external monitors with explicit no-obtain options.
• Uses this registration for new and restored monitors.
• Rejects external obtain strategies other than empty or Disabled.

File	Description
core/​station/​impl/​src/​services/​external_canister.rs	Updates monitor registration, restoration, and strategy validation.
core/​station/​impl/​src/​services/​cycle_manager.rs	Adds external registration with a no-obtain override.

_{Review effort: Balanced}

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to c519d22.

Security Overview

• 🔎 Scanned files: 3 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/5243341a-e7d7-47de-848a-f52264761c93?scanId=428491ad-6a52-4df0-af93-4d64c5328f17&codeScanTypes=PrScan&tab=issues&detectionTypes=traditional,businessLogic,customRule,IAC,SECRETS,CICD,EOL,uncategorized

Detected Code Changes

Change Type

Relevant files

Enhancement

► core/station/impl/src/services/cycle_manager.rs     Register external canisters with explicit obtain options (no obtain cycles) and add corresponding helper; add NoObtainCycles implementation ► core/station/impl/src/services/external_canister.rs     Switch from add_canister to add_external_canister for monitoring external canisters     Adjust canister_monitor_start flow to disallow certain obtain strategies and use external canister monitoring logic ► tests/integration/src/cycles_monitor_tests.rs     Add utilities and tests for external canisters monitoring and funding behavior