feat(rfq): finalize durable provider settlements

README.md

@@ -42,10 +42,16 @@ concrete final Liquid PSET before the irreversible signing transition: it binds
 the persisted RFQ leg inside a venue-neutral transaction, checks authoritative
 unspent prevouts, finalized taker P2TR `SIGHASH_ALL` signatures, confidential
 disclosures/proofs/balance and provider output recovery, and derives fee and
-weight facts with the missing provider witnesses projected. Its `FirmQuote` is
-still an internal, unauthenticated artifact, not yet a provider-signed network
-quote. A production wallet/RPC/HSM backend, market-data pricing source, signer
-adapter, authenticated remote protocol, and relay remain future work.
+weight facts with the missing provider witnesses projected. After durable
+commitment, the signing coordinator gives only the exact persisted job to the
+provider signer, cryptographically verifies and inserts its signatures, proves
+that no other PSET field changed, rechecks proofs and fee facts, and persists
+one canonical signed PSET before returning it. Exact retries replay that
+durable winner without re-signing; concurrently in-flight valid signature
+encodings may both sign, but every caller returns the same stored winner. Its
+`FirmQuote` is still an internal, unauthenticated artifact, not yet a provider-
+signed network quote. A production wallet/RPC/HSM backend, market-data pricing
+source, authenticated remote protocol, and relay remain future work.
 This initial validator accepts ordinary finalized tree-less P2TR
 `SIGHASH_ALL` inputs outside the current RFQ leg; Simplicity covenant inputs
 and a second interactive RFQ signer need a later authenticated venue/script
@@ -54,10 +60,10 @@ The eventual service must derive market assets from chain-validated canonical
 parameters and add authenticated-owner rate limits plus bounded history
 retention; the library's live-quote quotas only cap concurrent reservations.
 The safety-critical commit is reachable only by consuming the validator's
-opaque one-shot intent; the signed-result transition remains crate-internal
-until the signer adapter lands. The RFQ provider remains separate from
-`deadcat-node`; future AMM and DLOB protocols are not implemented by this
-repository today.
+opaque one-shot intent, and signed-artifact persistence accepts only the
+coordinator's private verified-PSET capability. The RFQ provider remains
+separate from `deadcat-node`; future AMM and DLOB protocols are not implemented
+by this repository today.
 
 The RFQ provider database is still clean-slate preproduction state. Its schema
 and private record-layout versions intentionally remain `1` while the provider

crates/deadcat-rfq-provider/src/lib.rs

@@ -5,7 +5,7 @@
 //! provider's signing point of no return durable and auditable. The required
 //! ordering is:
 //!
-//! `validate -> commit exact payload -> sign -> persist signed bytes -> release`
+//! `validate -> commit exact payload -> sign -> persist signed bytes -> return/relay`
 //!
 //! Only an uncommitted reservation can expire or be cancelled. Once a signing
 //! payload is committed, every reserved outpoint remains retired even across
@@ -17,9 +17,11 @@
 //! the commit transition: it rechecks the durable quote, authoritative
 //! prevouts, complete taker signatures, confidential proofs and openings, and
 //! exact fee/weight facts before it emits a one-shot signing capability.
-//! Concrete wallet/RPC/HSM implementations remain outside this crate. The
-//! signed-result transition remains private until a concrete signer adapter
-//! can be its only producer.
+//! After durable commitment, the signing coordinator invokes only the
+//! committed job, verifies and inserts its provider signatures, revalidates
+//! the completed PSET, and makes a private verified-PSET capability the only
+//! path to signed-artifact persistence. Concrete wallet/RPC/HSM
+//! implementations remain outside this crate.
 
 mod inventory;
 mod model;
@@ -55,10 +57,10 @@ pub use quote::{
 pub use store::{
     AuthoritativePrevout, CommitOutcome, DEFAULT_MAX_SETTLEMENT_INPUTS,
     DEFAULT_MAX_SETTLEMENT_OUTPUTS, MAX_EXPIRATION_BATCH, ProviderError,
-    ProviderSettlementValidator, ReservationBook, SCHEMA_VERSION, SettlementChainSource,
-    SettlementInputPlacement, SettlementLayout, SettlementLayoutError, SettlementLimitsError,
-    SettlementOutputPlacement, SettlementValidationError, SettlementValidationLimits,
-    SignedOutcome, ValidatedSigningIntent,
+    ProviderSettlementValidator, ProviderSigningCoordinator, ReservationBook, SCHEMA_VERSION,
+    SettlementChainSource, SettlementInputPlacement, SettlementLayout, SettlementLayoutError,
+    SettlementLimitsError, SettlementOutputPlacement, SettlementValidationError,
+    SettlementValidationLimits, SignedOutcome, SigningFinalizationError, ValidatedSigningIntent,
 };
 pub use wallet::{
     ConfidentialDestination, DestinationPurpose, DestinationSource, InventorySnapshot,

crates/deadcat-rfq-provider/src/model.rs

@@ -651,7 +651,7 @@ impl InventoryView {
 }
 
 /// Exact durable work item that a signer may consume.
-#[derive(Clone, Debug, PartialEq, Eq)]
+#[derive(Clone, PartialEq, Eq)]
 pub struct SigningJob {
     pub(crate) reservation_id: ReservationId,
     pub(crate) commitment: SigningCommitment,
@@ -660,6 +660,19 @@ pub struct SigningJob {
     pub(crate) targets: Vec<SigningTarget>,
 }
 
+impl fmt::Debug for SigningJob {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("SigningJob")
+            .field("reservation_id", &self.reservation_id)
+            .field("commitment", &self.commitment)
+            .field("pre_sign_payload_bytes", &self.pre_sign_payload.len())
+            .field("fee", &self.fee)
+            .field("target_count", &self.targets.len())
+            .finish()
+    }
+}
+
 impl SigningJob {
     #[must_use]
     pub const fn reservation_id(&self) -> ReservationId {
@@ -724,14 +737,26 @@ impl SigningTarget {
 }
 
 /// Exact signed bytes persisted before any response or relay attempt.
-#[derive(Clone, Debug, PartialEq, Eq)]
+#[derive(Clone, PartialEq, Eq)]
 pub struct SignedArtifact {
     pub(crate) reservation_id: ReservationId,
     pub(crate) commitment: SigningCommitment,
     pub(crate) digest: SignedArtifactDigest,
     pub(crate) bytes: Vec<u8>,
 }
 
+impl fmt::Debug for SignedArtifact {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("SignedArtifact")
+            .field("reservation_id", &self.reservation_id)
+            .field("commitment", &self.commitment)
+            .field("digest", &self.digest)
+            .field("signed_payload_bytes", &self.bytes.len())
+            .finish()
+    }
+}
+
 impl SignedArtifact {
     #[must_use]
     pub const fn reservation_id(&self) -> ReservationId {