[bennyhodl]

Summary

Item 3 of #225. Both parties' CET adaptor signatures and both refund signatures are already in the offer, accept and sign messages. So anyone holding the three messages can close a contract without a key: either party, a watchtower, or a server. Today sign_cet / sign_refund require the funding secret key, and the adaptor-secret sum in ddk-dlc is private.

Changes

• ddk::contract::settle_cet_from_messages(offer, accept, sign, attestations): decrypts both parties' adaptor signatures with the oracle secret, verifies each against the CET under its party's funding key, and orders the witness by key. It covers enum, numeric and multi-oracle contracts.
• ddk::contract::settle_refund_from_messages(offer, accept, sign): verifies both stored refund signatures, then combines them.
• ddk_dlc::adaptor_secret is public. It is the former private signatures_to_secret; ddk_dlc::sign_cet uses it.
• settle.rs is restructured around one private Settlement. CET selection, attestation validation and signature checks live there once. The key-based and keyless functions differ only in where the settling party's half comes from.
• Module docs (lifecycle diagram, Settlement section) and the ddk-dlc README are updated.

Compatibility

• sign_cet and sign_refund produce the same transactions as before, witness bytes included. On a key tie the witness ordering follows ddk_dlc::util::sign_multi_sig_input.
• Error variants change on two paths that are hard to reach: a bad adaptor secret is now InvalidAttestation, and an adaptor signature that won't decrypt is now InvalidAccept/InvalidSign (naming the message that carried it). Both were ContractError::Dlc before. I kept the more precise variants rather than give the key-based path its own error mapping.

Follow-ups

• The private witness builder in settle.rs should switch to ddk_dlc::util::multisig_witness once the verify-signed-contract PR (item 2) lands. The two PRs are independent.
• sign_refund is now redundant: settle_refund_from_messages returns identical bytes for either party. sign_cet mostly is too. Deprecating them is a separate decision.

Testing

• ddk/tests/stateless.rs:
  • keyless CET for single-oracle enum, numeric, and 2-of-3 enum attested by oracles 0 and 2. Each matches sign_cet's txid for both parties, and the witness signatures are verified as OP_CHECKMULTISIG would.
  • keyless refund equals sign_refund byte for byte.
  • a forged attestation, swapped adaptor signatures (accept and sign) and a swapped refund signature are rejected with the message-specific errors.
  • the pre-rc.4 OwnPayoutOnly fixture settles keylessly.
• ddk/tests/stateless_execution.rs, regtest broadcast and confirm: enum_three_of_five_oracles_closes_from_the_messages, numeric_with_difference_three_of_five_oracles_closes_from_the_messages, refund_closes_the_contract_from_the_messages.
• After the review fix: stateless 50/50, ddk contract lib tests 42/42, ddk-dlc lib 22/22, fmt and clippy -D warnings clean.
• Reviewed by GPT-6 Astra:
  • no settlement-validation bypass found;
  • one witness-ordering tie difference from master, fixed;
  • one error-mapping change, kept as described above.

[bennyhodl]

Note

🤖 Claude Opus 5.5 responding on behalf of bennyhodl

Review against orange-grove's consumers (lygos_utils::dlc, the wallet crate, the server's Fordefi signer) before 2.0.0. Change first.

This deletes about 200 lines of witness construction, decryption and signature checks from lygos-utils/src/dlc/settle.rs. Before freezing:

1. Per-outcome enum nonces. OracleAttestation::validate (dlc-messages/src/oracle_msgs.rs) zips the signatures with oracle_nonces by position. Magnolia announces one nonce per outcome and signs with the outcome's own nonce, so its attestations fail here. Orange-grove matches nonces as a set (lygos-utils/src/oracle_messages.rs). This is issue contract: the primitives the Lygos wallet had to write itself (external-signer split, keyless settle, tracker, verification) #225 item 7, and settlement is where it bites: either support per-outcome nonces in validation and adaptor construction, or reject them explicitly so consumers can plan the oracle migration.
2. Event id. validate checks the key, the signatures and the nonces, but not attestation.event_id against the announcement. The nonce check already binds it in practice, so this is defence in depth, not a hole.
3. Document what settlement verifies. It verifies the signatures it needs to close, not the whole signed contract; for example, refund doesn't check funding witnesses or CET adaptors. Callers that want the full check should run ddk: verify a signed contract from its three messages #231's verifier first.
4. Orange-grove still needs the CET index and outcome alongside the transaction, so returning them (or exposing the lookup) would let us drop our adapter too.