ACP xochi_cross_chain_transfer: stealth / different-recipient delivery (deferred from same-owner launch)

[DROOdotFOO]

Summary

The xochi_cross_chain_transfer ACP offering launches in same-owner, public
mode: it settles a cross-chain transfer to the settler's own configured
wallet_address, with public (non-shielded) settlement. This issue tracks the
deferred capability to deliver to a different recipient and/or via a
shielded / stealth path.

Background

Raxol.ACP.Xochi.Settler builds the QuoteRequest with wallet: wallet_address
(the owner) and delivers there on the destination chain. The Xochi
QuoteRequest schema has no distinct recipient field — :wallet is both funder
and recipient — so plaintext delivery to a third party is not expressible today.
The supported mechanism for different-recipient delivery is ERC-5564 stealth
addresses (settlement_preference: "stealth" + the buyer's compressed
spending/viewing pubkeys), which the wider raxol stealth stack already
implements but which is not wired into this offering.

As of the same-owner launch, the settler now fails closed on anything it
can't honor rather than silently misrouting or downgrading:

• a destination that differs from wallet_address -> {:error, {:different_recipient_not_enabled, dest}}
• settlement_preference other than public, or any stealth pubkey present -> {:error, :stealth_not_enabled} / {:error, {:non_public_not_enabled, pref}}

Scope of this issue (the deferred capability)

• Wire stealth delivery: carry the buyer's stealth meta-address through the
  requirement schema into the QuoteRequest (settlement_preference: "stealth"
  + spending/viewing pubkeys), so funds land at a stealth address the buyer
  controls on the destination chain.
• Remove the ensure_same_owner / ensure_public gates in the settler (or
  widen them) once stealth is validated.
• Decide on the "private" (Xochi dark-pool, same-recipient) path: enable it
  as a same-owner privacy option, separate from stealth.
• End-to-end validation on a Base fork: trace where funds land for a
  different-recipient stealth settlement before enabling on mainnet.
• Update Raxol.ACP.Xochi.Offering schema/metadata to advertise the
  capability once shipped.

Out of scope

Same-owner public settlement (the launch mode) — already shipped and
fork-validated.

References

• Settler: packages/raxol_acp/lib/raxol/acp/xochi/settler.ex
• Offering: packages/raxol_acp/lib/raxol/acp/xochi/offering.ex
• Stealth stack: Raxol.Payments.Xochi.Stealth (ERC-5564/6538) in raxol_payments

[DROOdotFOO]

Update: the pure-relay rewrite already delivered most of this

This issue was filed 2026-07-03 against a settler that built the QuoteRequest itself (wallet: wallet_address) and failed closed via ensure_same_owner / ensure_public. That design was superseded on 2026-07-07 by the pure-storefront relay (1113d721 + the offering rewrite). In the current code:

• Raxol.ACP.Xochi.Settler is a pure relay of the buyer's pre-signed intent bundle. It never builds a QuoteRequest. The ensure_same_owner / ensure_public gates no longer exist anywhere in the source.
• Raxol.Payments.Xochi.Schemas.QuoteRequest already fully supports stealth: settlement_preference: "stealth" + stealth_spending_pub_key / stealth_viewing_pub_key, validated and serialized.
• TransferOffering.validate_requirement/1 gates only on corridor/amount/address/fillability -- there is no gate on settlement_preference, destination, same-owner, or stealth. The offering moduledoc now states this explicitly ("there is no same-owner or public-only gate on raxol's side").

So different-recipient + stealth delivery is already supported end to end: the buyer signs any recipient / settlement_preference: "stealth" + pubkeys into their own Xochi intent, and raxol relays the opaque bundle without gating.

Checklist reconciliation

• Wire stealth delivery through the requirement schema into the QuoteRequest -- obsolete; raxol no longer builds the QuoteRequest, the buyer does, and it already supports stealth.
• Remove the ensure_same_owner / ensure_public gates -- already removed in the pure-relay rewrite (they don't exist).
• Advertise the capability in Offering schema/metadata -- done just now.

What I fixed now

One genuine residual bug: the published requirement_schema restricted settlement_preference to ["public", "private"] with additionalProperties: false, so a buyer who signed a stealth intent could not declare it -- the published schema forbade the very capability the runtime supports.

• offering.ex: settlement_preference enum now includes "stealth"; description explains the ERC-5564 stealth-delivery semantics; offering_metadata advertises different-recipient + stealth delivery.
• offering_test.exs: enum assertion updated.
• transfer_offering_test.exs: added a test proving a stealth + different-destination requirement is accepted, not gated.

All 55 xochi tests + 5 properties pass.

Remaining (funds/infra-gated, not code)

• End-to-end validation on a Base fork: trace where funds land for a different-recipient stealth settlement before enabling on mainnet.

This is the same launch-pending class as the other Xochi settlement items (blocked on a funded solver + Riddler stealth-fill validation), not a raxol-side code gap. Leaving the issue open, re-scoped to just that validation.

[DROOdotFOO]

Superseded by the pure-relay refactor. Closing.

This issue tracked a same-owner Settler that BUILDS a Xochi QuoteRequest and FAILS
CLOSED on a different recipient / non-public preference (different_recipient_not_enabled,
ensure_same_owner, ensure_public, stealth_not_enabled). That model no longer exists
on master:

• packages/raxol_acp/lib/raxol/acp/xochi/settler.ex is a pure relay -- the buyer
  quotes + signs their own Xochi intent (recipient + privacy baked into the signature),
  raxol relays the opaque signed_intent bundle via
  Payments.Protocols.Xochi.execute_signed/2 and polls to settlement. raxol never builds
  a QuoteRequest, never signs, never holds funds.
• Grepping packages/raxol_acp/lib/ for QuoteRequest, different_recipient,
  ensure_same_owner, ensure_public, stealth_not_enabled, non_public_not_enabled
  returns nothing -- the gates this issue describes are gone.
• offering.ex already advertises destination and
  settlement_preference: ["public","private","stealth"] as buyer-signed audit hints,
  and handle_request already accepts (does not gate) a stealth / different-recipient
  requirement.

So the capability -- buyer signs a stealth or different-recipient intent, storefront
relays it verbatim -- is already delivered by the relay. #419 finishes the story:

• surfaces the ERC-5564 stealth announcement (stealth_address / ephemeral_pub_key /
  view_tag) plus settlement_type in the deliverable so the buyer / evaluator can
  verify the delivery on-chain (they were being discarded with the execute response);
• adds settle-path test coverage for stealth and different-recipient relays (the prior
  #368 coverage was at handle_request only);
• documents the stealth / different-recipient buyer flow in the example.

Re-introducing a QuoteRequest-building / same-owner / storefront-signs Settler would
contradict the fund-safety design (raxol never holds funds), so that path is intentionally
not being rebuilt. Closing as superseded; see #419.