chore: sync from monorepo @b35fdb0

[WomB0ComB0]

Automated sync from the internal monorepo at b35fdb0.

Review before merging — direct pushes to standalone repos are preserved.

Summary by CodeRabbit

• New Features
  • Added support for initializing airspace permits and submitting drone location attestations. Attestations are checked against the drone’s registered key, signed telemetry, location limits, and timestamp window.
• Documentation
  • Updated development and configuration guidance.
• Maintenance
  • Updated Solana and Anchor dependencies and added the new program to local and development network configurations.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

Next included review available in 47 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 7f3129a9-353a-4dff-bfc0-4c7753aa986d

📥 Commits

Reviewing files that changed from the base of the PR and between 5972ef6 and 33ac981.

📒 Files selected for processing (1)

• resq-airspace/src/instructions/record_crossing.rs

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a212bab7-a1d3-4bee-a191-3fad57654378

📥 Commits

Reviewing files that changed from the base of the PR and between d625d4e and 5972ef6.

⛔ Files ignored due to path filters (2)

• Cargo.lock is excluded by !**/*.lock
• vendor/solana-program-test/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (14)

• Anchor.toml
• Cargo.toml
• README.md
• resq-airspace/src/instructions/initialize_property.rs
• resq-airspace/src/instructions/record_crossing.rs
• resq-airspace/src/lib.rs
• resq-airspace/src/state/airspace_account.rs
• resq-airspace/tests/host_init_regression.rs
• resq-airspace/tests/integration.rs
• resq-delivery/src/lib.rs
• resq-delivery/tests/integration.rs
• resq-gating/Cargo.toml
• resq-gating/src/lib.rs
• resq-gating/tests/integration.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The workspace adds the resq-gating program, which initializes permits and verifies and stores signed telemetry attestations. The change also updates workspace dependencies, existing program serialization and tests, configuration, and README content.

Changes

Gating Program and Workspace Integration

Layer / File(s)	Summary
Workspace registration and package setup Cargo.toml, Anchor.toml, resq-gating/Cargo.toml, README.md	The workspace registers resq-gating, updates dependency versions and lint allowances, and configures its localnet and devnet addresses. The new package manifest defines its features and dependencies. README configuration and development text is updated.
Existing program serialization and SDK updates resq-airspace/src/*, resq-airspace/tests/*, resq-delivery/src/lib.rs, resq-delivery/tests/integration.rs	Airspace adds explicit Borsh serialization by enum discriminant. Existing program lint attributes, comments, and formatting change. Airspace and delivery tests update imports, transmute annotations, and bindings for the newer Solana SDK.
Permit data and initialization resq-gating/src/lib.rs	The new program defines permit and attestation account data, error codes, clock and coordinate helpers, waypoint advancement, and permit initialization.
Attestation verification and state updates resq-gating/src/lib.rs	Attestation submission checks permit status, telemetry values, timestamp freshness, Ed25519 instruction structure, and the signed payload. It stores the attestation and advances or retires the permit.
Gating program validation tests resq-gating/src/lib.rs, resq-gating/tests/integration.rs	Unit tests cover clock drift, waypoint advancement, and coordinate bounds. Integration tests cover successful submission and rejection of spoofed payloads, stale timestamps, and a truncated Ed25519 instruction.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant Ed25519Precompile
  participant resq_gating
  participant InstructionsSysvar
  participant LocationAttestation
  participant AirspacePermit
  Client->>Ed25519Precompile: Include signed telemetry verification instruction
  Ed25519Precompile->>resq_gating: Complete before submit_attestation
  resq_gating->>InstructionsSysvar: Read preceding instruction
  InstructionsSysvar-->>resq_gating: Return Ed25519 instruction data
  resq_gating->>LocationAttestation: Store verified telemetry
  resq_gating->>AirspacePermit: Advance waypoint or retire permit

Loading

Merge Risk: ⚪ Minimal · up to 5972e

This sync adds the new resq-gating permit and attestation program, updates dependencies, and makes lint and test adjustments to the existing programs. No concrete defect was established. Note that gating permits can be registered by whoever claims a permit_id first; confirm this is the intended design. Otherwise the change appears ready to merge.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 78.72% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 47 functions across 10 files. (4 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately identifies the pull request as an automated monorepo sync. It is broad but consistent with the stated objective and changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 78.72% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 47 functions across 10 files. (4 skipped: 4 unsupported.)

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​tokio@​1.50.0 ⏵ 1.53.1	-1
	cargo/​tokio@​1.50.0 ⏵ 1.48.0	+2
	cargo/​thiserror@​2.0.17
	cargo/​solana-keypair@​3.0.1
	cargo/​test-case@​3.3.1
	cargo/​log@​0.4.28
	cargo/​solana-cluster-type@​3.0.0
	cargo/​solana-commitment-config@​3.0.0
	cargo/​solana-cpi@​3.0.0
	cargo/​solana-instructions-sysvar@​3.0.1
	cargo/​solana-msg@​3.0.0
	cargo/​solana-program-entrypoint@​3.1.0
	cargo/​solana-sdk-ids@​3.0.0
	cargo/​solana-signer@​3.0.1
	cargo/​solana-stable-layout@​3.0.0
	cargo/​solana-sysvar-id@​3.0.0
	cargo/​anchor-lang@​1.0.0-rc.2 ⏵ 1.0.0-rc.4
	cargo/​solana-account@​4.1.0 ⏵ 4.6.0
	cargo/​solana-account@​4.1.0 ⏵ 3.2.0
	cargo/​solana-account-info@​3.1.0 ⏵ 3.1.1
	cargo/​solana-account-info@​3.1.0 ⏵ 3.0.0
	cargo/​solana-address@​2.3.0 ⏵ 2.7.0
	cargo/​solana-clock@​3.0.1 ⏵ 3.0.0
	cargo/​solana-epoch-rewards@​3.0.1 ⏵ 3.0.0
	cargo/​solana-fee-calculator@​3.1.0 ⏵ 3.0.0
	cargo/​solana-instruction@​3.2.0 ⏵ 3.5.0
	cargo/​solana-instruction@​3.2.0 ⏵ 3.0.0
	cargo/​solana-message@​4.0.0 ⏵ 3.0.1
	cargo/​solana-program@​4.0.0 ⏵ 4.1.0
	cargo/​solana-program@​4.0.0 ⏵ 3.0.0
	cargo/​solana-pubkey@​4.1.0 ⏵ 4.3.0
	cargo/​solana-rent@​4.1.0 ⏵ 3.0.0
	cargo/​solana-sdk@​4.0.1 ⏵ 4.1.0
See 6 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo openssl is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: vendor/solana-program-test/Cargo.lock → cargo/solana-runtime@3.1.10 → cargo/openssl@0.10.74 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/openssl@0.10.74. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[github-actions]

Audit Summary

The audit of pull request #79 is complete. The changes primarily focus on synchronizing with the monorepo and introducing the new program for drone telemetry verification.

Key Findings

1. Security & Robustness (resq-gating)

The program implements excellent cryptographic verification for drone telemetry:

• Ed25519 Precompile Verification: The program correctly enforces a canonical layout for the precompile instruction data, preventing offset manipulation and overlapping data exploits. It also includes critical bounds checks to prevent out-of-bounds slicing panics (CWE-125).
• Replay Protection: Permit PDAs are seeded by a globally unique , effectively mitigating shadow permit/replay attacks. The use of a strict 30s freshness window for attestations further bounds the replay window.
• Arithmetic Safety: The use of for clock drift checks and for waypoint increments ensures the program remains stable under extreme input conditions.

2. Data Integrity (resq-airspace)

• Finding: In , the argument (polygon vertices) is not validated against valid geographic ranges (-90/+90 latitude, -180/+180 longitude).
• Recommendation: For consistency with and to ensure data integrity, consider adding coordinate range validation to the handler.

3. General Observations

• The code follows Anchor idiomatic patterns and maintains high standards for documentation and error handling.
• Account space calculations were verified and found to be accurate.

The audit passed with minor recommendations for improved data validation in the airspace initialization logic.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

Generated by ai-auditor for issue #79 · ◷

[github-actions]

Audit Summary (Corrected)

The audit of pull request #79 is complete. The changes primarily focus on synchronizing with the monorepo and introducing the new resq-gating program for drone telemetry verification.

Key Findings

1. Security & Robustness (resq-gating)

The resq-gating program implements excellent cryptographic verification for drone telemetry:

• Ed25519 Precompile Verification: The program correctly enforces a canonical layout for the precompile instruction data, preventing offset manipulation and overlapping data exploits. It also includes critical bounds checks to prevent out-of-bounds slicing panics (CWE-125).
• Replay Protection: Permit PDAs are seeded by a globally unique permit_id, effectively mitigating shadow permit/replay attacks. The use of a strict 30s freshness window for attestations further bounds the replay window.
• Arithmetic Safety: The use of abs_diff for clock drift checks and checked_add for waypoint increments ensures the program remains stable under extreme input conditions.

2. Data Integrity (resq-airspace)

• Finding: In resq-airspace/src/instructions/initialize_property.rs, the poly argument (polygon vertices) is not validated against valid geographic ranges (-90/+90 latitude, -180/+180 longitude).
• Recommendation: For consistency with RecordCrossing and to ensure data integrity, consider adding coordinate range validation to the initialize_property handler.

3. General Observations

• The code follows Anchor idiomatic patterns and maintains high standards for documentation and error handling.
• Account space calculations were verified and found to be accurate.

The audit passed with minor recommendations for improved data validation in the airspace initialization logic.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

Generated by ai-auditor for issue #79 · ◷