[Amperstrand]

Recreation of #1151 (closed unmerged when its stack base died; content unchanged, rebased directly on main). scripts/bump-gonuts.sh v0.15.0 — manifest + every glob-discovered carrier; fence green incl. --latest (v0.15.0 = newest stable tag, so release-check is unblocked by this). 19 modules green on main. Fork release carries: mint+melt pending-op intents, NUT-09 restore fallback (#866), swap-response binding (#831/#833), unpriceable-proof refusal (#832), spent-input retirement, integration-build fix — all live-verified on the fork side.

[Amperstrand]

Local CI gate — PR #1198: deps(wallet): gonuts-tollgate v0.15.0 — intents, NUT-09 restore, response binding (rebased on main)

Run of scripts/pr-verify.sh (the local CI gate: GitHub Actions is
org-blocked and the ngit lane fires only on maintainer mirror pushes,
so a PR ref gets no CI runs — this comment is the offline verification
evidence, produced on the pinned head SHA).

• Head: deps/gonuts-v0.15.0 @ 906f1e7c51
• Base: main @ ?
• Gate: pr-verify 6f304ed0e72d on ai-legion, started 2026-11-05 03:55 UTC, wall 651s
• Logs: /tmp/tollgate-pr-verify/1198-20261105T034425Z (on the verifying host)

Leg	Result	Detail
hygiene	PASS	no conflict markers in the tracked tree (0s)
contract-fences	FAIL	red: doc-facts contract dependency sync — see contract-fences.log; 13 checks green (6s)
packaging-sequential	FAIL	red (1/17): backend-api-owner-network_test.sh — logs in /tmp/tollgate-pr-verify/1198-20261105T034425Z/packaging-sequential (24s)
shell-suites	PASS	23 suites (uci-defaults + ngit pipeline) (70s)
packaging-concurrent	FAIL	red (1/17): backend-api-owner-network_test.sh — logs in /tmp/tollgate-pr-verify/1198-20261105T034425Z/packaging-concurrent (9s)
go-battery	PASS	19 modules, gofmt/vet/build/-race (542s)

Verdict: 3 leg(s) RED — 3 green.

What this gate does not run (no vacuous green)

• spec-quote drift check (greatspectations tool + pinned nuts fetch)
• reproducibility / conformance lanes (make release-check territory)
• router-visible behaviour (PRTA / bench — unit green ≠ router works)

failing-leg log tails

contract-fences — tail

  DEPENDENCY DRIFT DETECTED
============================================================

🔴 github.com/cashubtc/cdk-go — 2 versions:
   cli: v0.17.3
   merchant: v0.17.3
   root: v0.18.1
   tollwallet: v0.17.3

Fix: update all go.mod files to the same version.
     Run 'go mod tidy' in each sub-module after updating.
== gonuts pin fence (offline identity)
ok   an aligned tree (block + single-line carriers) passes
ok   a block-form carrier on a different version
ok   a single-line carrier left behind (the token-recovery shape)
ok   a go.sum that never recorded the truth version (half-update)
ok   a self-consistent pseudo-version integration pin passes OFFLINE (the --latest leg is the release gate for it)
ok   a manifest without the .gonuts key
ok   a tree whose manifest names a pin no carrier has

7 cases, 0 failed
== gonuts pin carriers
  manifest pin (packaging/build-inputs.json .gonuts.version): v0.15.0
  carriers discovered by glob: 5 module(s)
✅ one pin, everywhere: github.com/OpenTollGate/gonuts-tollgate v0.15.0 across 5 carrier(s).
== mirror/relay sync
ok    BLOSSOM_SERVERS: 13 copies identical (https://blossom.primal.net https://blossom.psbt.me https://blossom2.orangesync.tech)
ok    relay list: 13 copies identical (wss://relay.damus.io wss://nos.lol wss://nostr.mom wss://relay2.orangesync.tech)
== stale import paths
✅ All 376 Go source files use correct import paths.

packaging-sequential — tail

--- backend-api-owner-network_test.sh.log
ok   the fragment guards exactly :2121
ok   packaging/files/etc/nftables.d/30-backend-firewall.nft is an include fragment (no own table declaration)
ok   the chain hooks input at priority -1 (the drop is authoritative)
ok   chain 'backend_input_firewall' is declared once
== the admin-board and LuCI guards are still captive-bridge-scoped
ok   31-admin-board-not-guest-reachable.nft is scoped by $tg_portal_if (the captive bridge's define)
ok   32-luci-not-guest-reachable.nft is scoped by $tg_portal_if (the captive bridge's define)
== the recipe installs the rule
ok   local-build-ipk.sh installs 30-backend-firewall.nft
ok   packaging/Makefile installs the 30-backend-firewall.nft rule via its *.nft glob
ok   packaging/Makefile FILES_ lists /etc/nftables.d/30-backend-firewall.nft
== the fragment parses
FAIL nft -c rejects the fragment — 'nft -f' would fail the whole fw4 reload

passed=17 failed=1

packaging-concurrent — tail

--- backend-api-owner-network_test.sh.log
ok   the fragment guards exactly :2121
ok   packaging/files/etc/nftables.d/30-backend-firewall.nft is an include fragment (no own table declaration)
ok   the chain hooks input at priority -1 (the drop is authoritative)
ok   chain 'backend_input_firewall' is declared once
== the admin-board and LuCI guards are still captive-bridge-scoped
ok   31-admin-board-not-guest-reachable.nft is scoped by $tg_portal_if (the captive bridge's define)
ok   32-luci-not-guest-reachable.nft is scoped by $tg_portal_if (the captive bridge's define)
== the recipe installs the rule
ok   local-build-ipk.sh installs 30-backend-firewall.nft
ok   packaging/Makefile installs the 30-backend-firewall.nft rule via its *.nft glob
ok   packaging/Makefile FILES_ lists /etc/nftables.d/30-backend-firewall.nft
== the fragment parses
FAIL nft -c rejects the fragment — 'nft -f' would fail the whole fw4 reload

passed=17 failed=1

[Amperstrand]

Superseded by #1193 (v0.16.0 > v0.15.0, same script-generated shape, fence-legitimate). Closing this one to keep exactly one bump PR alive — #1193 just needs its binary artifact removed first (finding posted there).