Cardano Updates

Signed-off-by: Chris Gianelloni <[email protected]>

Co-Authored-By: John A. Lotoski <[email protected]>

Drops the `stake > 0` filter from `build_committee`'s EveryoneVotes
arm.  EveryoneVotes is an extreme-test selection mode — the point
is to drive the maximum possible voter set, including relay-only
(zero-stake) nodes, so that a sim configured with this committee
has the full network as its committee.

Without the filter, the everyone committee aligns with linear_leios's
`CommitteeSelectionAlgorithm::Everyone` (every node returns
`vrf_wins = 1`) and with the script-level threshold formula
`ceil(TOTAL_NODES * 0.75)`.  Empirical confirmation at NA,0.350 /
everyone / 750n / -s 500 / con-rs single-shot:

- before filter lift: 26/26 uncertified, 4203 bundles (committee
  was 216 staking pools; threshold 563 unreachable).
- after: 7/26 uncertified, 14434 bundles, mean 627 σ 208 — within
  noise of linear-with-tx-references's 6/26, 14296 bundles, mean
  549 σ 291.

WfaLs and StakeCentile retain stake-weighted semantics; only the
test-only EveryoneVotes mode changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

filip(feat): worklows update

Smallest first slice toward unblocking issue #5285 Story 1: plumb a
mint set through buildLedgerTx and buildLedgerTxRaw, translate the
wallet's (TokenMap, TokenMap) mint/burn pair to a single signed
ledger MultiAsset, and feed the real value from mkTransactionLedger
and constructUnsignedTxLedger. Script witnesses remain out of scope.

Artifacts: spec.md (2 P1 stories, 9 FRs, 5 SCs), plan.md (113 lines,
constitution pass, 6 design decisions), research.md (Phase 0 from
Explore agent: signed/unsigned asymmetry between TokenMap and
MultiAsset is the load-bearing surprise), data-model.md (netting
rule for mint/burn overlap), contracts/ledger-mint-translation.md
(P1-P8 converter properties, B1-B3 builder properties), tasks.md
(15 tasks across 5 phases mapping to three bisect-safe commits),
requirements checklist, quickstart for reviewers.

* feat(ledger): Added changes to track latest opcert sequence per pool

Signed-off-by: Akhil Repala <[email protected]>

* feat(ledger): Moved the test to state_test and modified the added db funciton comments

Signed-off-by: Akhil Repala <[email protected]>

* feat(ledger): Fixed the lint error

Signed-off-by: Akhil Repala <[email protected]>

* feat(ledger): Usd a map with Assign in all metadat stores

Signed-off-by: Akhil Repala <[email protected]>

* fix(ledger):fix(ledger):

Signed-off-by: Akhil Repala <[email protected]>

---------

Signed-off-by: Akhil Repala <[email protected]>

Signed-off-by: Akhil Repala <[email protected]>

* test(ledger): Added missing chainIterator test cases for validating chain iterator ordering, rollback and blocking behavior

Signed-off-by: Akhil Repala <[email protected]>

* test(ledger): made changes to make make blocking iterator test deterministic

Signed-off-by: Akhil Repala <[email protected]>

---------

Signed-off-by: Akhil Repala <[email protected]>

* feat(blockfrost): Added stake account endpoints and history queries

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): fix account endpoint lint violations

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): Fixed most of the bot comments

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): fixed the account hisotry query edge cases for mysql

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): fixed the account hisotry ordering and lint issues

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): wrapped the error with more context arounf resolveReadDB and resoleveDB

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): fix account history 404s and address counts

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): fixed account active epoch lookup errors

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): Fixed all merge conflicts

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): tighten account history queries and controlled amount lookup

Signed-off-by: Akhil Repala <[email protected]>

* feat(blockfrost): Made changes for controlled cmount extarction based on staking key and added batch controlled amount lookup by staking key

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): Made changes to fix account active epoch for inactive and re-registered accounts

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): Made changes to have same alignment in address pagination query as well as with count address by staking key

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): Made changes to push all the delegation history pagination parameters into metadata queries

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): Made changes to push all the egistration history pagination into metadata queries

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): Fixed the lint errors

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): fix cert joins in account history queries

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): fix account history joins and ordering

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): fixed the lint error

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): Fixed the lint error

Signed-off-by: Akhil Repala <[email protected]>

* fix(blockfrost): Fixed the lint error during rebase

Signed-off-by: Akhil Repala <[email protected]>

---------

Signed-off-by: Akhil Repala <[email protected]>

Adds the centrally-rendered alert rules that consume the cardano_cc_*
series published by profile-cardano-committee-monitor, plus a README
section covering enablement, prerequisites, threshold tuning, and the
collector-cadence/staleness coupling.

Alert rules (auto-discovered via parseDir on grafana/alerts):
  - cardano_cc_term_expiring (warning, 30d default)
  - cardano_cc_term_expiring_urgent (page, 7d default)
  - cardano_cc_hot_key_unauthorized / _resigned (page)
  - cardano_cc_member_expired (page)
  - cardano_cc_member_unrecognized (page)
  - cardano_cc_to_be_expired_next_epoch (page, authoritative ledger signal)
  - cardano_cc_no_members (page)
  - cardano_cc_metrics_stale (page, 5400s, paired with hourly cadence)
  - cardano_cc_collector_absent (page)

warnDays / pageDays are constants in the alert file (per-environment
tuning via duplicated rules with environment=~"..." selectors). The
file is part of the project template, so downstream repos own it after
template init.

New profile profile-cardano-committee-monitor publishes per-member
constitutional-committee state to a prometheus textfile-collector .prom
file on an hourly systemd timer. The alloy node-exporter picks the file
up via the textfileCollectorDirectory wiring added in the previous
commit.

Metrics (all carry environment=<env>):
  - cardano_cc_member_epochs_until_expiration  (per cold_credential)
  - cardano_cc_member_seconds_until_expiration (per cold_credential)
  - cardano_cc_member_hot_cred_status          (info-gauge with status label)
  - cardano_cc_member_state                    (info-gauge with state label)
  - cardano_cc_member_next_epoch_change        (info-gauge with change label)
  - cardano_cc_current_epoch
  - cardano_cc_member_count
  - cardano_cc_seconds_per_epoch

The collector script lives in flakeModules/lib/ as a callPackage-able
writeShellApplication so the production unit and the fixture check share
the exact same text; the check swaps cardano-cli for a JSON-fixture shim
and diffs the output against a golden .prom file.

Module asserts on services.alloy.textfileCollectorDirectory != null and
services.cardano-node.shareNodeSocket = true. The cardano-node socket is
read via a SupplementaryGroups=[cardano-node node-textfile] hardened
DynamicUser=true oneshot; output is atomically published via mv on the
same filesystem. Cadence is hourly + RandomizedDelaySec=600s; the
matching staleness threshold lives in the alerts file added in the next
commit.

Wires in via flake-parts auto-discovery (recursiveImports); no
flake.nix or flakeModules/lib.nix changes needed.

Adds two opt-in options consumed by sibling profiles that publish metrics via prometheus textfile collector.

services.alloy.textfileCollectorDirectory (nullOr str, default null):
  - When non-null: enables the node-exporter "textfile" collector,
    emits the textfile { directory = ... } HCL block, creates a
    node-textfile group, and tmpfiles-rules the directory mode 2775
    (setgid so multiple publishers can share it).
  - When null: behaviour is identical to before.

services.alloy.extraPrometheusRelabelNodeKeepRegex (listOf str, default []):
  - Additional alternation arms appended to prometheusRelabelNodeKeepRegex.
    Lets sibling profiles whitelist their textfile metric series without
    a recursive mkForce on the base option.

Also extends the base prometheusRelabelNodeKeepRegex default with
node_textfile_(mtime_seconds|scrape_error) so textfile-collector
self-metrics are scrapeable (un-breaks NodeTextFileCollectorScrapeError
in templates/.../alerts/node-exporter.nix-import and enables a future
metrics-stale alert keyed on node_textfile_mtime_seconds).

- use infaillaible conversion for signed entities sent by the aggregator
- handle Unknown case for input from third parties:
  - `http_server:routes:::signature_routes`: reject the request with a
    400 error
  - `SignatureConsumerDmq`: filter out unknown values

- `mithril-aggregator-discovery`: No functional change (since the one
  contact between messages and entities is a equality, which is already
  supported), only the tests had to be adapted.
- `mithril-client`: Add the messages to the re-exported types + adapt
  message builder for `CardanoImmutableFilesFull`.
- `mithril-protocol-config`: use `into_known_discriminants` to filter
  out unknown values when converting `ProtocolConfigurationMessage` into
  `MithrilNetworkConfigurationForEpoch`.

all except `mithril-aggregator`, changes:
- `mithril-client-cli`: no functional changes, only minor changes to
  tests
- `mithril-signer`: adapt signatures publishes, both http and dmq, using
  an infaillible conversion
- `mithril-end-to-end` (stress test): adapt payload building