POC - transaction courier

[saefstroem]

No description provided.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot review overview

🟡 Changes recommended

The signing transition can lose both transaction copies on power failure, and descriptor/path validation has correctness gaps.

Review effort: Balanced
Findings: 2 · 1 · 1

Open (4)

• Tombstones pending record before signed record is durable · New
• Fails to reject oversized Ledger paths · New
• Accepts truncated configuration headers · New
• Dependency policy incorrectly requires zero dependencies · New

[Copilot]

Copilot review overview

🔵 Needs a closer look

A new transaction can inherit the previous transaction’s retry deadline and exponential backoff.

Review effort: Balanced
Findings: None

Resolved since last review (4)

• Fails to reject oversized Ledger paths
• Tombstones pending record before signed record is durable
• Accepts truncated configuration headers
• Dependency policy incorrectly requires zero dependencies

Previously missed (1)

In code that hasn't changed since last review

Reset retry schedule when clearing pending transaction

crates/​firmware/​src/​signing.rs:62

Reset the retry schedule when there is no pending transaction. Otherwise, after a failed signing attempt sets an exponential delay, clearing that transaction and submitting a new one leaves the new transaction blocked until the old next_poll_at (up to 30 seconds), and its first failure inherits the old backoff.