fix(drive): strengthen execution proof result validation

[QuantumExplorer]

Summary

• compare identity create and update proof results with the submitted key and revision changes
• reject generic balance/address snapshots where the current proof format cannot establish request-specific completion
• keep the existing history-backed and group-backed token result paths unchanged

Compatibility

This is a verifier-side hardening change and does not alter consensus or require a protocol activation. Proved wait calls for unsupported result shapes now return an explicit proof error rather than a stronger success guarantee than the evidence supports.

Validation

• cargo test -p drive --lib (3,219 passed)
• cargo clippy -p drive --lib -- -D warnings
• cargo fmt --all -- --check
• git diff --check

Summary by CodeRabbit

• New Features
  • Added affected-state proof verification for validating height-pinned state snapshots without asserting transition execution.
  • Added a WebAssembly verification entry point for affected-state proofs.
• Bug Fixes
  • Execution verification now rejects proofs that lack transition-bound execution evidence.
  • Strengthened identity proof checks for public keys, revisions, and disabled-key timestamps.
  • Improved validation of balances and state snapshots across address, token, and identity transitions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: dd6e72a5-f56f-4f7f-8320-091c020d89b0

📥 Commits

Reviewing files that changed from the base of the PR and between c039102 and 828316c.

📒 Files selected for processing (6)

• packages/rs-drive-proof-verifier/src/proof.rs
• packages/rs-drive/src/verify/state_transition/verify_state_transition_was_executed_with_proof/mod.rs
• packages/rs-drive/src/verify/state_transition/verify_state_transition_was_executed_with_proof/v0/mod.rs
• packages/rs-platform-version/src/version/drive_versions/drive_verify_method_versions/mod.rs
• packages/rs-platform-version/src/version/drive_versions/drive_verify_method_versions/v1.rs
• packages/wasm-drive-verify/src/state_transition/verify_state_transition_was_executed_with_proof.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/rs-drive/src/verify/state_transition/verify_state_transition_was_executed_with_proof/v0/mod.rs

---

📝 Walkthrough

Walkthrough

State-transition proof verification now distinguishes execution evidence from affected-state snapshots, strengthens identity proof binding, adds Drive and WASM affected-state APIs, updates platform-version metadata, and revises integration tests for fail-closed execution checks.

Changes

State-transition proof verification

Layer / File(s)	Summary
Verification mode APIs and dispatch packages/rs-drive/src/verify/state_transition/..., packages/rs-platform-version/..., packages/wasm-drive-verify/...	Drive and WASM expose separate execution-evidence and affected-state proof verification paths, with platform-version dispatch metadata.
Execution evidence and snapshot verification packages/rs-drive/src/verify/state_transition/verify_state_transition_was_executed_with_proof/v0/mod.rs	The v0 verifier gates token, identity, address, and shield proofs by semantics and validates identity keys, revisions, balances, and disabled-key timestamps.
Verifier regression coverage packages/rs-drive/src/verify/state_transition/verify_state_transition_was_executed_with_proof/v0/mod.rs	Tests cover affected-state snapshots, identity binding, and fail-closed results for unsupported execution-evidence proofs.
Consumer proof interpretation packages/rs-drive-proof-verifier/src/proof.rs, packages/rs-drive-abci/...	Proof consumers use affected-state semantics for snapshots, while shield and strategy tests separately require transition-bound execution evidence.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant WasmClient
  participant Drive
  participant V0Verifier
  participant ProofResult
  WasmClient->>Drive: request affected-state proof verification
  Drive->>V0Verifier: verify with AllowAffectedState
  V0Verifier->>ProofResult: produce height-pinned affected-state result
  ProofResult-->>Drive: return root hash and state snapshot
  Drive-->>WasmClient: return serialized verification result

Loading

Suggested reviewers: shumkov, lklimek, llbartekll, zocolini

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: stricter Drive execution-proof result validation.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-execution-proof-binding

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

🕓 Ready for review — 27 ahead in queue (commit 828316c)
Queue position: 28/32 · 2 reviews active
ETA: start ~03:34 UTC · complete ~03:58 UTC (median 23m across 30 recent reviews; 2 slots)
Queued 4h 55m ago · Last checked: 2026-07-22 22:20 UTC

[codecov]

Codecov Report

❌ Patch coverage is 82.22543% with 123 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.51%. Comparing base (16a63c8) to head (828316c).
⚠️ Report is 21 commits behind head on v4.1-dev.

Files with missing lines	Patch %	Lines
...state_transition_was_executed_with_proof/v0/mod.rs	82.37%	117 Missing ⚠️
...fy_state_transition_was_executed_with_proof/mod.rs	81.48%	5 Missing ⚠️
packages/rs-drive-proof-verifier/src/proof.rs	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           v4.1-dev    #4155    +/-   ##
==========================================
  Coverage     87.51%   87.51%            
==========================================
  Files          2667     2667            
  Lines        336972   337442   +470     
==========================================
+ Hits         294903   295316   +413     
- Misses        42069    42126    +57     

Components	Coverage Δ
dpp	88.47% <ø> (ø)
drive	86.24% <82.34%> (+<0.01%)	⬆️
drive-abci	89.58% <ø> (ø)
sdk	∅ <ø> (∅)
dapi-client	∅ <ø> (∅)
platform-version	∅ <ø> (∅)
platform-value	92.90% <ø> (ø)
platform-wallet	∅ <ø> (∅)
drive-proof-verifier	49.79% <0.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/tests-rs-workspace.yml:
- Around line 241-250: Update the cleanup retry loop around rm -rf
target/llvm-cov-target so it breaks only when the removal command succeeds and
target/llvm-cov-target no longer exists. Keep retrying with the existing warning
and delay when either condition fails, while preserving the final warning if the
directory remains after all attempts.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 540d3956-d3e2-48f0-9b1d-f30624735b42

📥 Commits

Reviewing files that changed from the base of the PR and between 2b3e3fc and c039102.

📒 Files selected for processing (7)

• .github/workflows/kotlin-sdk-build.yml
• .github/workflows/tests-rs-workspace.yml
• packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/shield/tests.rs
• packages/rs-drive-abci/tests/strategy_tests/verify_state_transitions.rs
• packages/rs-drive/src/verify/state_transition/verify_state_transition_was_executed_with_proof/v0/mod.rs
• packages/rs-unified-sdk-jni/src/tx_decode.rs
• packages/swift-sdk/build_ios.sh

[QuantumExplorer]

Addressed the merge blocker in 828316c (plus a v4.1-dev merge in 962c9ce).

The strict verifier keeps this PR's semantics unchanged: verify_state_transition_was_executed_with_proof still fails closed for every transition family whose proof cannot be bound to execution, and the strategy-test assertions stay as they are. What was missing was a consumer story — five rs-sdk broadcast flows (address funds transfer, address credit withdrawal, address top-up, identity withdrawal, no-history token transfer) matched result variants that nothing produced anymore, so every successful broadcast of those types surfaced as a proof error and got retried across nodes.

The fix adds an explicitly-named sibling entry point, verify_state_transition_affected_state_with_proof: identical to the strict verifier for execution-verifiable types, and for the receipt-gated families it returns a verified snapshot of the affected state — keys derived from the transition, values authenticated as of the proof's block, documented as height-pinned snapshots and not execution evidence. That matches how the wallet flows actually consume these results (balance reconciliation pins on the proof height). The SDK wait path now uses the affected-state entry point; wasm-drive-verify exposes a matching verifyStateTransitionAffectedStateWithProof export alongside the strict one.

Also relaxed the identity-update disabled-key check from exact equality with the proof block's timestamp to at-or-before it — a proof generated at a later block than the executing one carries the original disabled_at, which never changes afterwards, so the exact-equality check failed retried/replayed proofs spuriously. Regression test included (verify_identity_update_accepts_key_disabled_before_proof_block), plus affected-state snapshot tests for top-up, withdrawal and credit transfer reusing the same proofs the strict tests reject.

Validation: drive lib 3,236 tests pass; clippy clean on drive, drive-proof-verifier and wasm-drive-verify (wasm32 target); drive --no-default-features --features verify compiles; dash-sdk lib tests pass; drive-abci test targets compile.

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.