Conversation
370bcc8 to
e121f7e
Compare
github-actions
Bot
added
the
severity-critical
🔴 PR Severity: CRITICAL
🔴 Critical (12 files)
🟡 Medium (1 file)
🟢 Low (1 file)
AnalysisThis PR modifies core wallet reservation/commitment logic ( To override, add a |
There was a problem hiding this comment.
🟡 Changes recommended
A goroutine in ChainArbitrator.resolveContracts captures the cp loop variable, which can cause resolving the wrong channel outpoint under concurrency.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR adds opt-in integration points to let external systems manage parts of a channel’s funding and on-chain lifecycle while lnd continues to own channel state machines (HTLCs, commitments, and contract resolution). It introduces an auxiliary channel lifecycle interface, an externally managed wallet-controller mode, a way to inspect negotiated funding outputs for pending reservations, and a synchronous funding-message delivery path.
Changes:
- Add an optional
AuxChannelLifecycleto coordinate chain-watch ownership, commitment-publication gating, and durable terminal cleanup (with resumable force-close support). - Allow embedding runtimes to manage the base
WalletControllerlifecycle and to query the exact negotiated funding output for active reservations. - Add
ProcessFundingMsgAndWaitto synchronously wait for the existing funding-message handler to complete on the coordinator goroutine.
File summaries
| File | Description |
|---|---|
| server.go | Plumbs AuxChannelLifecycle into server configuration. |
| lnwallet/config.go | Adds ExternallyManagedWalletController config flag. |
| lnwallet/wallet.go | Skips wallet-controller start/stop when externally managed; adds thread-safe reservation inspection APIs. |
| lnwallet/reservation.go | Adds fundingOutput() helper to derive the negotiated funding output. |
| lnwallet/wallet_test.go | Adds tests for externally managed wallet lifecycle and pending funding output lookup. |
| funding/manager.go | Refactors funding message handling and adds synchronous ProcessFundingMsgAndWait. |
| funding/manager_test.go | Adds tests for synchronous funding message admission and completion behavior. |
| contractcourt/aux_channel_lifecycle.go | Introduces the AuxChannelLifecycle interface and chain-watch ownership model. |
| contractcourt/channel_arbitrator.go | Adds commitment-publication barrier and resumable force-close behavior. |
| contractcourt/channel_arbitrator_test.go | Adds tests asserting the publication barrier and resume semantics. |
| contractcourt/chain_arbitrator.go | Adds optional chain-watch admission policy and terminal finalization barrier; parallelizes resolution when enabled. |
| contractcourt/chain_arbitrator_test.go | Adds tests for admission filtering, unknown owner rejection, and finalization barrier behavior. |
| config_builder.go | Exposes AuxChannelLifecycle in aux component configuration. |
| docs/release-notes/release-notes-0.22.0.md | Documents the externally managed funding/lifecycle capability for the release notes. |
Review details
- Files reviewed: 14/14 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| c.wg.Add(1) | ||
| go func() { | ||
| defer c.wg.Done() | ||
| c.resolveContract(cp) | ||
| }() |
External funding coordinators need the exact output negotiated by a pending channel reservation. Expose a synchronized lookup by pending channel ID without changing LightningWallet lifecycle ownership.
e121f7e to
05d0ea4
Compare
External transports need an unambiguous delivery boundary before they acknowledge an inbound funding message. Add an opt-in synchronous entry point while preserving the existing asynchronous path and funding protocol error reporting.
05d0ea4 to
26c3220
Compare
|
@sputn1ck, remember to re-request review from reviewers when ready |
c0b4900 to
26a4413
Compare
Externally funded channels need explicit chain-watch ownership and durable barriers around commitment publication and terminal cleanup. Add one cancelable auxiliary interface and make interrupted force closes safely resumable. Keep missing-input sweep failures retryable until a spend notification arrives. An empty immediate lookup cannot prove an input is orphaned; canceling its watch can strand a resolver after its sweep confirms.
Expose the driver-independent SQL backend without native driver build flags. Register PostgreSQL in its backend and preserve walletdb bucket semantics for SQL drivers that decode empty blobs as nil slices. Keep shared connections alive when another namespace fails to open. Cover external driver construction, cursor semantics, and ownership.
26a4413 to
8b853cc
Compare
Change Description
Some custom channel implementations negotiate a normal lnd channel while
another subsystem coordinates how the funding output reaches the chain. They
still need lnd to own channel state, HTLC processing, commitments, and contract
resolution.
This PR exposes the minimal, application-neutral boundaries needed for that
composition:
pending reservation while lnd continues to own its wallet lifecycle;
asynchronous
ChannelReadyprocessing;ownership, funding materialization before commitment publication, and durable
terminal cleanup;
safely.
All behavior is opt-in. Without an auxiliary lifecycle, lnd retains its existing
funding dispatch, chain watching, force-close, and cleanup behavior. The
interfaces contain no application-specific policy or types.
Testing
go test ./lnwallet ./funding ./contractcourt -count=1go test ./funding -run '^TestProcessFundingMsgAndWait' -race -count=1make fmt-checkmake tidy-module-checkcustom-gclagainstlightningnetwork/master