Looser spec

[illuzen]

Summary

• Runtime gate: Quantus nodes with a specVersion newer than this CLI’s tested table (currently up to 143) connect with a warning instead of a hard reject. Wrong specName and older/unknown pairs still error. quantus version and the exercise runtime check report the same “newer / may not work” case; ML-DSA-65 is assumed retained on newer unlisted specs.
• Wormhole multiround accounting: Expected round amounts use on-chain VOLUME_FEE_BPS (4), not a stale 10 bps hardcode. Funding must actually debit free balance by the partitioned total (preflight via ensure_balance_covers_call, postflight debit check). Final verification uses on-chain minted exit totals and fails the run on mismatch — a missing ~100 DEV funding debit can no longer hide inside a soft “fee tolerance” warning.

Test plan

• SKIP_CIRCUIT_BUILD=1 cargo test --locked --lib config::
• SKIP_CIRCUIT_BUILD=1 cargo test --locked --lib calculate_round_amount_uses
• SKIP_CIRCUIT_BUILD=1 cargo test --locked --lib verify_final_balance
• SKIP_CIRCUIT_BUILD=1 cargo clippy --lib --locked -- -D warnings
• Connect to a node on a newer-than-table spec → warning, commands still run
• Connect to wrong specName / very old spec → still refused
• quantus wormhole multiround with a wallet funded for the full --amount → balance verification passes
• Underfunded wallet (balance ≪ amount) → fails at funding preflight or debit check, not after a fake “success”

[n13]

Reviewer model: GPT Sol

Verdict: REQUEST_CHANGES

• [P2] Fix the newly added ML-DSA-87 import example — README.md:384

  wallet import intentionally has no --mnemonic option; it reads the phrase from a hidden prompt. I reproduced the documented command and it exits with unexpected argument '--mnemonic' found. Besides being unusable, the example encourages users to place a recovery phrase in shell history and process arguments, contrary to the CLI's enforced secret-handling policy (wallet_import_rejects_mnemonic_cli_argument). Please show quantus wallet import --name recovered_87 --scheme ml-dsa-87 and explain that the mnemonic is prompted securely. The adjacent default-scheme import example has the same stale option and should be corrected while updating this block.

Validation:

• cargo +nightly fmt --all -- --check — passed.
• SKIP_CIRCUIT_BUILD=1 cargo test --locked --lib config:: — 10 passed.
• SKIP_CIRCUIT_BUILD=1 cargo test --locked --lib cli::wormhole::tests:: — 40 passed.
• SKIP_CIRCUIT_BUILD=1 cargo clippy --lib --locked -- -D warnings — passed.
• Broader skipped-circuit library run — 254 passed; the sole failure required generated circuit bins intentionally omitted by SKIP_CIRCUIT_BUILD=1. Both full CI build/test matrix jobs and all other PR checks pass.

No additional blocking findings found in the runtime compatibility or wormhole accounting changes.

[n13]

Reviewer model: GPT Sol

Verdict: APPROVE

The previously blocking wallet-import examples are now corrected: both commands use the CLI's hidden mnemonic prompt, and the ML-DSA-87 example retains the explicit scheme. I re-reviewed the complete diff at e05318b; no blocking findings remain in the runtime compatibility, wormhole accounting, shared ZK proof-fetching, documentation, or workflow changes.

Validation:

• cargo +nightly fmt --all -- --check — passed.
• SKIP_CIRCUIT_BUILD=1 cargo test --locked --lib config:: — 10 passed.
• SKIP_CIRCUIT_BUILD=1 cargo test --locked --lib cli::wormhole::tests:: — 40 passed.
• SKIP_CIRCUIT_BUILD=1 cargo test --locked --lib wallet_import_rejects_mnemonic_cli_argument — 1 passed.
• SKIP_CIRCUIT_BUILD=1 cargo clippy --lib --locked -- -D warnings — passed.
• Current-head GitHub Fast Checks, Analysis/Docs, and Security Audit — passed; build/test matrices and Examples were still running at review time.